Malicious code intelligent searching and killing method and platform based on situation awareness system

Abstract

The invention provides a malicious code intelligent searching and killing method and platform based on a situation awareness system. The method comprises the following steps: remotely monitoring assets of a plant station in a power system to obtain a monitoring result; sending a control request to a situation awareness system under the condition that the monitoring result shows that the assets have malicious code attacks; under the condition that a confirmation signal sent by the situation awareness system is received, remote searching and killing processing on the malicious code is executed, the remote searching and killing processing on the malicious code is achieved through a proxy channel, and the confirmation signal is generated under the condition that the situation awareness system indicates that the control request passes; and the proxy channel is a channel between the intelligent searching and killing platform and a plant station. The method solves the problem of low working efficiency of processing malicious code attacks in the prior art.

Description

Technical Field

[0001] The present application relates to network security technology, and more specifically, to a method and platform for intelligently detecting and killing malicious code based on a situational awareness system. Background Art

[0002] With the widespread application of computer and network communication technology in power monitoring systems, the network security threat situation in the power industry is becoming increasingly severe. In order to strengthen the security management of power monitoring systems, prevent attacks on power monitoring systems such as malicious codes, and ensure the safe and stable operation of power systems, network security products are also widely popularized in the power industry. Existing network security products mainly protect network security from two dimensions: active and passive. Active ones include active vulnerability scanning, and passive ones include firewalls and other protection products.

[0003] In actual applications, when there is a malicious code attack, the existing technology must log in to each host one by one to verify the attack situation. The journey time is long and the efficiency of manual inspection is low. It is impossible to effectively handle the attack incidents suffered by the host of the plant station in time, which leads to low efficiency in handling malicious code attacks. Summary of the invention

[0004] The main purpose of this application is to provide a method and platform for intelligent detection and killing of malicious code based on a situational awareness system, so as to at least solve the problem of low efficiency in handling malicious code attacks in the prior art.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for intelligent detection and killing of malicious code based on a situation awareness system is provided, including: remotely monitoring the assets of a plant in a power system to obtain monitoring results; when the monitoring results show that the assets are under malicious code attack, sending a control request to the situation awareness system; when a confirmation signal sent by the situation awareness system is received, performing remote detection and killing of the malicious code, and the remote detection and killing of the malicious code is implemented through a proxy channel, wherein the confirmation signal is generated when the situation awareness system indicates that the control request has passed, and the proxy channel is a channel between an intelligent detection and killing platform and the plant.

[0006] Optionally, the method further includes: sending the attack event corresponding to the malicious code to a third-party malicious code protection management center for detection and analysis to obtain analysis information corresponding to the attack event; sending the analysis information to at least two inspection systems for inspection to obtain inspection results.

[0007] Optionally, the analysis information is sent to at least two inspection systems for inspection to obtain inspection results, including: assigning weights to each inspection system based on the historical detection accuracy of each inspection system to obtain the weight of each inspection system; obtaining the threat level of the malicious code based on the weight of each inspection system and the inspection results, and displaying the threat level of the malicious code.

[0008] Optionally, the method also includes: counting the distribution of attack events corresponding to the malicious code of each plant within a first preset time to obtain a first statistical result; generating a distribution statistical graph for characterizing the distribution of the attack events based on the first statistical result; counting the number of assets attacked by each malicious code within a second preset time to obtain a second statistical result, wherein the second preset time is longer than the first preset time; and generating a trend statistical graph for characterizing the attack trend of the malicious code based on the second statistical result.

[0009] Optionally, the method also includes: receiving the characteristics of the malicious code transmitted by a third-party malicious code protection management center; sending the characteristics of the malicious code to the malicious code feature library of the plant through the proxy channel to perform a remote upgrade of the malicious code feature library.

[0010] Optionally, the method also includes: performing remote virus scanning on the assets of the plant site through the proxy channel to obtain virus scanning results; performing virus feature comparison detection on the virus scanning results and a local virus feature library to obtain a comparison detection result; when the comparison detection result indicates that the assets of the plant site contain viruses, remotely detecting and killing viruses on the assets of the plant site through the proxy channel.

[0011] Optionally, the method further includes: receiving abnormal access events sent by the plant station, performing abnormal detection analysis on the abnormal access events, and obtaining analysis results; and sending alarm information and monitoring data corresponding to the analysis results to the situation awareness system for monitoring.

[0012] Optionally, the method further includes: configuring an alarm whitelist, and when the alarm information matches the alarm whitelist, ignoring the alarm information within a third preset time; and when the alarm information does not match the alarm whitelist, sending the alarm information to the situational awareness system.

[0013] Optionally, the method also includes: calling the information acquisition interface of each third-party malicious code protection management center to respectively obtain the logs generated by each of the third-party malicious code protection management centers; based on the logs, performing unified management of the logs of each of the third-party malicious code protection management centers; calling the function takeover interface of each of the third-party malicious code protection management centers, and performing unified management of the functions of each of the third-party malicious code protection management centers based on the function takeover interface.

[0014] According to another aspect of the present application, a malicious code intelligent detection and killing platform based on a situation awareness system is provided, including: a remote monitoring module, used to obtain monitoring results of assets of a plant station in a power system to discover malicious code attacks; a control request sending module, used to send a control request to the situation awareness system when the remote monitoring module detects a malicious code attack; a remote detection and killing processing module, used to perform remote detection and killing of the malicious code through a proxy channel of the plant station when the control request is passed, wherein the proxy channel is a channel between the intelligent detection and killing platform and the plant station; wherein the intelligent detection and killing platform is deployed in the cloud, and the intelligent detection and killing platform is interconnected with the situation awareness system and the plant station respectively, and is used to execute any one of the malicious code intelligent detection and killing methods based on the situation awareness system.

[0015] By applying the technical solution of the present application, the assets of the power plant and station in the power system are remotely monitored to obtain monitoring results; when the monitoring results show that the assets are attacked by malicious code, a control request is sent to the situation awareness system; when a confirmation signal sent by the situation awareness system is received, remote detection and killing of the malicious code is performed, and the remote detection and killing of the malicious code is realized through a proxy channel, wherein the confirmation signal is generated when the situation awareness system indicates that the control request has passed, and the proxy channel is a channel between the intelligent detection and killing platform and the power plant and station. This solution solves the problem of low work efficiency in handling malicious code attacks in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings constituting part of the present application are used to provide a further understanding of the present application. The exemplary embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1 A schematic diagram of a process of intelligently detecting and killing malicious code based on a situation awareness system according to an embodiment of the present application is shown;

[0018] Figure 2 A schematic diagram of the structure of a malicious code intelligent detection and killing platform based on a situation awareness system provided according to an embodiment of the present application is shown.

[0019] The reference numerals are as follows:

[0020] 10. Intelligent detection and killing platform; 11. Remote monitoring module; 12. Control request sending module; 13. Remote detection and killing processing module; 20. Situation awareness system; 30. Plant station. DETAILED DESCRIPTION

[0021] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0022] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] As introduced in the background technology, in the prior art, when there is a malicious code attack incident, it is necessary to go downstairs and log in to each host one by one to verify the attack situation. The journey time is long and the efficiency of manual inspection of each host is low. It is impossible to effectively handle the attack incidents suffered by the host of the plant station in time, which leads to low efficiency in handling malicious code attacks. In order to solve the problem of low efficiency in handling malicious code attacks in the prior art, the embodiments of the present application provide a malicious code intelligent detection method and platform based on a situational awareness system.

[0025] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0026] Figure 1 1 is a flow chart of a method for intelligently detecting and killing malicious code based on a situational awareness system according to an embodiment of the present application. Figure 1As shown, the method comprises the following steps:

[0027] Step S101, remotely monitor the assets of power plants in the power system to obtain monitoring results.

[0028] Specifically, in the field of power systems, assets usually refer to the various hardware and software resources that constitute the power grid, including but not limited to hardware assets or terminal assets such as generator equipment, transformer equipment, power transmission and distribution equipment, control systems and automation equipment, auxiliary facilities, and environmental protection equipment. The assets of power plants and stations in the power system also include but are not limited to various information assets. These assets are crucial to the operation of the power system and are often the target of cyber attacks.

[0029] Remote monitoring refers to real-time or regular monitoring of the operating status, security status, network traffic, etc. of assets from a remote location using network technology without physical contact with the assets. Modules with monitoring functions can be used to remotely monitor various assets of a plant or station. Remote monitoring aims to promptly detect abnormal behavior of assets, such as unauthorized access, signs of malicious code activity, abnormal changes in network traffic, etc., to provide data support for subsequent security analysis and response.

[0030] Monitoring results are the output of the remote monitoring process, usually including detailed information about the operating status of assets, such as system logs, network connection records, system behavior analysis reports, virus scanning results, etc. These results can be raw data or information after preliminary analysis, such as a summary of discovered security events, alarms of potential threats, etc. Monitoring results are crucial for assessing the network security status of power systems, identifying potential attack behaviors, and formulating defense strategies.

[0031] Step S102: When the monitoring result shows that the asset is under a malicious code attack, a control request is sent to the situation awareness system.

[0032] Specifically, the remote monitoring system continuously monitors the assets of the power plant and station in the power system. Once potential malicious code activities are detected, such as abnormal network connections, unauthorized system access attempts, abnormal file behaviors or other security events, the monitoring system will generate corresponding monitoring results. These results may include specific malicious code signatures, lists of infected systems or files, timestamps of attacks and other detailed information. The monitoring results can be expressed in words or displayed by marking status. For example, when the monitoring result corresponding to the asset shows the text "malicious code attack", it means that the asset is attacked by malicious code; for example, when the monitoring result corresponding to the asset is marked in red, it means that the asset is attacked by malicious code, and when the monitoring result corresponding to the asset is marked in green, it means that the asset is not attacked by malicious code. When the monitoring results confirm the existence of malicious code attacks, the system will generate a control request. A control request refers to a request made to the situational awareness system when the unified malicious code intelligent detection and killing platform detects malicious activities or potential threats, in order to perform specific security control operations to respond to and mitigate identified threats.

[0033] The control request is sent to the situational awareness system through the network (usually a secure internal network or a dedicated communication channel). The situational awareness system is a platform that integrates multiple security functions and can monitor and analyze the security situation of the entire network in real time, identify potential threats, and coordinate response measures. After receiving the control request, the situational awareness system will process it according to the preset security policy and threat response process, including threat confirmation, isolation of infected assets, and collaboration with third-party security centers to obtain the latest malicious code feature library and killing strategy.

[0034] Step S103, upon receiving the confirmation signal sent by the above-mentioned situation awareness system, remote detection and killing of the above-mentioned malicious code is performed, and the remote detection and killing of the above-mentioned malicious code is implemented through a proxy channel, wherein the above-mentioned confirmation signal is generated when the above-mentioned situation awareness system indicates that the above-mentioned control request is passed, and the above-mentioned proxy channel is the channel between the intelligent detection and killing platform and the above-mentioned plant station.

[0035] Specifically, after the monitoring results show the existence of a malicious code attack, the situational awareness system will evaluate and make decisions on the received control request. If the situational awareness system confirms the validity of the control request (that is, confirms the existence and threat level of the malicious code, and the necessity of the killing operation), it will generate and send a confirmation signal to the intelligent killing platform. The confirmation signal is the response of the situational awareness system to the received control request, indicating that the system recognizes the control request and authorizes the subsequent remote killing operation. After receiving the confirmation signal, the intelligent killing platform will initiate the remote killing process for the malicious code in the report. Without the need to physically access the infected assets, the killing operation is implemented through the network to remove or isolate the malicious code and protect the asset security of the power system plant. Remote killing processing usually includes steps such as identifying malicious code, applying killing strategies, executing removal commands, and verifying the killing effect.

[0036] The proxy channel is a dedicated channel for communication and data exchange between the intelligent detection and killing platform and the power system plant and station. It is called "agent" because it acts as an intermediary between the intelligent detection and killing platform and the plant and station assets, responsible for forwarding the detection and killing commands and receiving responses. The design of the proxy channel takes security and efficiency into consideration, and usually adopts measures such as encrypted communication and identity authentication to ensure the accurate transmission and execution of the detection and killing instructions, while preventing malicious tampering or interception during the transmission process. Through the proxy channel, the intelligent detection and killing platform can directly perform remote detection and killing operations on the assets of the plant and station under the guidance of the confirmation signal without the need for operators to go to the site, which greatly improves the efficiency and response speed of handling malicious code. The generation of confirmation signals and the use of proxy channels are closely related. The confirmation signal provides the necessary authorization and guidance for remote detection and killing processing, and the proxy channel provides a safe and efficient execution path for remote detection and killing. The collaborative work of the two ensures that the intelligent detection and killing platform can quickly and accurately process malicious codes in the power system under the supervision and guidance of the situational awareness system, thereby protecting power assets from damage.

[0037] In the above-mentioned embodiment, first, the assets of the power plant in the power system are remotely monitored to obtain monitoring results; then, when the monitoring results show that the above-mentioned assets are attacked by malicious code, a control request is sent to the situation awareness system; finally, when a confirmation signal sent by the situation awareness system is received, remote detection and killing of the malicious code is performed. The remote detection and killing of the malicious code is implemented through a proxy channel, wherein the confirmation signal is generated when the situation awareness system indicates that the control request has passed, and the proxy channel is the channel between the intelligent detection and killing platform and the power plant, thereby solving the problem of low work efficiency in handling malicious code attacks in the prior art.

[0038] In one embodiment of the present application, the above method also includes: sending the attack event corresponding to the above malicious code to a third-party malicious code protection management center for detection and analysis to obtain analysis information corresponding to the above attack event; sending the above analysis information to at least two inspection systems for inspection to obtain inspection results.

[0039] Specifically, after the intelligent detection and killing platform identifies and processes malicious code, it will send detailed information about the attack event, including the type, characteristics, attack time, and impact range of the malicious code, to the third-party malicious code protection management center. The third-party malicious code protection management center usually has a powerful malicious code database and analysis capabilities, and can provide professional and timely threat intelligence and response strategies. After receiving the attack event information, the third-party malicious code protection management center uses its internal malicious code detection engine and analysis tools to conduct an in-depth analysis of the reported event, involving comparing the malicious code characteristics with known threats in the database, analyzing the attack behavior pattern, and evaluating the impact. The analysis results will help the intelligent detection and killing platform and other security systems better understand the characteristics and attack methods of malicious code, and provide a basis for the formulation of future defense strategies. The intelligent detection and killing platform will further send the analysis information obtained from the third-party malicious code protection management center to at least two verification systems for cross-verification. The verification system can be an independent security analysis platform, cloud security service, or other malicious code inspection tool. They each have their own detection algorithms and databases. Through comparison and verification, the accuracy and credibility of threat identification can be improved. Each inspection system will perform malicious code feature matching and security checks based on the analysis information received, and ultimately generate its own inspection results, which may include threat confirmation, possible false positives, and further descriptions of the malicious code.

[0040] Through the above process, the intelligent detection and killing platform can make full use of external resources to enhance the ability to identify and process malicious code. The participation of multiple third-party centers and inspection systems not only provides more comprehensive threat intelligence, but also improves the accuracy of detection through cross-validation, which helps the intelligent detection and killing platform to establish a more complete security response strategy and protect the power system from malicious code. At the same time, this mechanism also helps the power industry to form a unified threat response system, promote the sharing of security information and collaborative defense, and improve overall network security.

[0041] During the specific implementation process, the above analysis information is sent to at least two inspection systems for inspection to obtain inspection results, including: assigning weights to each of the above inspection systems according to the historical detection accuracy of each of the above inspection systems to obtain the weight of each of the above inspection systems; obtaining the threat level of the above malicious code according to the weight of each of the above inspection systems and the above inspection results, and displaying the threat level of the above malicious code.

[0042] Specifically, the analysis information is sent to at least two inspection systems for inspection, that is, the detailed data on malicious code attack events obtained from the third-party malicious code protection management center or the internal killing operation is sent to at least two independent inspection systems. These inspection systems may include different security software, cloud security services or dedicated malicious code analysis platforms. Each system has its own unique detection algorithm and threat database. Each inspection system has a certain accuracy rate in the historical detection records. The accuracy rate reflects the reliability of the system in identifying and classifying malicious code. The historical detection accuracy rate can be calculated based on the comparison between the detection results in the past period of time and the actual threat situation, such as the number of correct identifications, the number of incorrect identifications (including false positives and missed negatives), etc. The intelligent killing platform assigns weights to each inspection system according to its historical detection accuracy rate. Systems with high accuracy rates will be given higher weights, which means that their detection results will account for a larger proportion in the final threat level assessment. The purpose of weight allocation is to make the final threat level assessment more objective and accurate, avoiding the limitations of a single inspection system and possible false positives or missed negatives. The inspection results received from multiple inspection systems are comprehensively considered, and combined with their respective weights, the intelligent detection and killing platform will conduct a statistical analysis of the threat level, including calculating the average level of the threat, the weighted average level, or through more complex algorithms to determine the specific threat level of malicious code to power system plant assets. The threat level is usually divided into different levels, such as low, medium, and high, to indicate the degree of danger of the malicious code. The final threat level will be displayed to the operator or security manager so that they can take appropriate countermeasures based on the severity of the threat. The display can be presented in the form of a chart, list, or alarm on the user interface of the intelligent detection and killing platform to ensure that the information is clear and easy to understand.

[0043] Through the above process, the intelligent detection and killing platform can not only improve the accuracy of malicious code detection, but also provide more comprehensive and reliable threat intelligence based on the comprehensive evaluation of multiple independent systems, helping the power industry to respond promptly and effectively when facing cyber attacks and protect key assets from damage.

[0044] In one embodiment of the present application, the method further includes: counting the distribution of attack events corresponding to the malicious code of each of the above-mentioned plants within a first preset time to obtain a first statistical result; generating a distribution statistical graph for characterizing the distribution of the above-mentioned attack events based on the first statistical result; counting the number of assets attacked by each of the above-mentioned malicious codes within a second preset time to obtain a second statistical result, wherein the second preset time is longer than the first preset time; generating a trend statistical graph for characterizing the attack trend of the above-mentioned malicious code based on the second statistical result.

[0045] Specifically, the intelligent detection and killing platform will collect and analyze data on malicious code attack incidents suffered by various power system plants and stations within a first preset time (for example, the past day, week or month). Such statistics may include the number of attacks, the number of infected assets, the time of the attack, the type of attack, etc. The first statistical result provides an overview of the distribution of malicious code attack events among different plants and stations, helping to understand the frequent attack areas or time points. Based on the first statistical result, the intelligent detection and killing platform will generate a distribution statistics chart, which can be a bar chart, pie chart or heat map, to intuitively display the distribution of attack events in various plants and stations. The distribution statistics chart can reveal which plants and stations or which types of assets are more likely to become attack targets, thereby guiding the rational allocation of security resources and the determination of key protection areas.

[0046] In a longer second preset time (for example, the past few months or a year), the intelligent anti-virus platform will continue to collect records of malicious code attacks and count the number of assets attacked by each type of malicious code in each period of time (such as daily or weekly). This step aims to analyze the changing trend of malicious code attacks over time, including but not limited to the increase or decrease in attack frequency, the emergence of new attack types, and changes in attack intensity.

[0047] Based on the second statistical result, the intelligent anti-virus platform will generate trend statistics charts, such as line graphs or scatter plots, to show the attack trend of malicious code. Trend statistics charts can help security managers predict future attack patterns, evaluate the effectiveness of security measures, and adjust long-term security strategies and resource allocation.

[0048] Through the process of generating these statistics and charts, the intelligent detection and killing platform can provide data-driven decision support for the security protection of the power system. The distribution statistics and trend statistics not only reveal the immediate status and historical trends of the attack, but also provide the security team with a powerful tool to prevent and respond to malicious code attacks. This mechanism reflects the continuous monitoring and intelligent analysis of the network security situation and is an important part of the modern power system network defense system. Through the statistical comparison of the first preset time and the second preset time, the platform can also identify the periodic changes or long-term trends of the attack mode, so as to more comprehensively understand the network security threats facing the power system.

[0049] In one embodiment of the present application, the above method also includes: receiving the characteristics of the above malicious code transmitted by a third-party malicious code protection management center; sending the above characteristics of the above malicious code to the malicious code feature library of the above plant through the above proxy channel to perform remote upgrade of the above malicious code feature library.

[0050] Specifically, the intelligent detection and killing platform will receive the latest malicious code feature data from the third-party malicious code protection management center regularly or under certain conditions. These feature data contain key information such as signatures, behavior patterns, and file hash values ​​of newly discovered malicious codes, which can be used to identify and prevent the spread and infection of these malicious codes. The platform transmits the received malicious code feature data to the local malicious code feature library of the plant station through a secure proxy channel between the plant station and the plant station. The proxy channel is a pre-configured secure communication channel designed to protect the security of the data transmission process and prevent the feature data from being tampered with or leaked during the transmission process. The use of the proxy channel for data transmission ensures the security and integrity of the information. After receiving the feature data, the malicious code feature library of the plant station will be automatically or manually updated to add the newly discovered malicious code features. This process is called remote upgrade. It does not require technicians to visit each plant station in person, but to complete the update of the feature library through the network. Remote upgrade of the malicious code feature library can ensure that the detection and killing systems of all plant stations have the latest defense capabilities and promptly identify and prevent the invasion of new malicious codes.

[0051] In general, receiving malicious code features provided by a third party, transmitting them securely to the plant through a proxy channel, and performing remote upgrades of the malicious code feature library are key steps for the intelligent detection and killing platform to maintain the timeliness and effectiveness of its defense mechanism. This mechanism ensures that the power system can quickly adapt and take corresponding protective measures to protect the safety of power assets in the face of evolving network threats. At the same time, by leveraging the expertise and technology of the third-party malicious code protection management center, the intelligent detection and killing platform can obtain a wider range of threat intelligence and improve the efficiency and accuracy of its malicious code detection and defense.

[0052] In one embodiment of the present application, the method further includes: performing remote virus scanning on the assets of the plant through the proxy channel to obtain virus scanning results; performing virus feature comparison detection on the virus scanning results and the local virus feature library to obtain comparison detection results; when the comparison detection results indicate that the assets of the plant exist viruses, remote virus detection and killing processing is performed on the assets of the plant through the proxy channel.

[0053] Specifically, the intelligent anti-virus platform remotely initiates virus scanning of plant and station assets through the proxy channel between the plant and station. This usually involves sending specific scanning instructions to the plant and station, which are executed by the security software or system on the plant and station side to conduct a comprehensive virus check on all or selected assets. Remote virus scanning can be performed regularly or initiated when the platform detects abnormal behavior or receives threat intelligence to proactively prevent and quickly respond to potential virus threats. After the scan is completed, the intelligent anti-virus platform will receive the virus scan results, which contain information about potential viruses or malware found on plant and station assets. The platform compares these scan results with the locally stored virus feature library. The virus feature library contains the features and signatures of known viruses. Through comparison, it can be identified whether the viruses contained in the scan results are of known types and the degree of danger of the virus. After the comparison process is completed, the platform will obtain the comparison detection results, which will indicate which assets are infected by which types of viruses or malware. If the comparison detection results indicate that there is a virus infection, this will trigger the subsequent remote virus detection and killing process. When the comparison test results confirm that the plant assets are infected with viruses, the intelligent killing platform will send killing instructions to the plant through the proxy channel to perform remote virus killing on the infected assets, including isolating infected files, repairing system vulnerabilities, and removing viruses, depending on the type of virus and the severity of the infection. Remote killing can quickly and efficiently remove viruses without on-site technical intervention, significantly improving the timeliness and efficiency of virus processing.

[0054] Through the above steps, the intelligent virus detection platform can actively monitor the security status of power plant assets in the power system, detect and deal with virus threats in a timely manner, and protect power assets from damage. Especially in critical infrastructure such as power systems, the implementation of remote virus scanning and virus detection is crucial to ensure the continuous operation of the system and data security. In addition, this mechanism also reflects the coordinated operation of the intelligent virus detection platform and local security measures, forming a comprehensive and efficient network security protection system through cloud security resources and local execution capabilities.

[0055] In one embodiment of the present application, the above method also includes: receiving abnormal access events sent by the above plant station, performing abnormality detection analysis on the above abnormal access events, and obtaining analysis results; and sending the alarm information and monitoring data corresponding to the above analysis results to the above situation awareness system for monitoring.

[0056] Specifically, the intelligent detection and killing platform will receive reports of abnormal access events from the plant station. Abnormal access events may include unauthorized devices accessing the network, suspicious network connection attempts, data transmission anomalies, etc., which are all signals that may indicate that the network is threatened or there are security vulnerabilities. After receiving the abnormal access event, the platform will conduct in-depth anomaly detection and analysis on it, mainly to obtain the type of abnormal access event, the associated assets, the time when the abnormal access event occurred, the threat level and other analysis results. Anomaly monitoring and analysis can be achieved by installing an application on the user's computer or device to detect, block and remove malware (such as viruses, worms, Trojans, spyware, adware, etc.). This type of software is usually called anti-virus software, security suite, anti-virus software or more broadly called endpoint security solutions. They protect users' systems from malicious code by monitoring system activities in real time, scanning files and network traffic, updating virus databases and malware signatures, and implementing various protection strategies. Through anomaly detection and analysis, the platform will generate analysis results on abnormal access events, including information such as the nature of the event, possible sources, threat levels, and recommended treatment measures. The analysis results are an important basis for the intelligent detection and killing platform to determine whether to alarm and take action.

[0057] Send the alarm information and related monitoring data in the analysis results to the situational awareness system. The situational awareness system is an advanced security tool that continuously monitors and analyzes network activities. It can receive alarm information from the intelligent detection and killing platform, and combine real-time data such as network traffic and system logs to comprehensively monitor the network status and provide more comprehensive network security situational awareness. After receiving the alarm information and monitoring data, the situational awareness system will integrate them into its own monitoring and analysis process. The system will continuously monitor the development of alarm events and analyze their impact on the network. If necessary, it can notify security managers or automatically trigger corresponding security policies, such as isolating the network, adding firewall rules, etc., to deal with potential threats.

[0058] Through the above process, the intelligent detection and killing platform and the situational awareness system form an effective linkage mechanism, which can not only quickly identify abnormal access events, but also comprehensively analyze their potential impact on the power system network, take timely actions, and strengthen network security protection. This mechanism plays an important role in preventing external intrusions, internal threats and malicious code attacks, and is a key link in the network security management of modern power systems.

[0059] During the specific implementation process, the above method also includes: configuring an alarm whitelist, and when the above alarm information matches the above alarm whitelist, ignoring the above alarm information within a third preset time; when the above alarm information does not match the above alarm whitelist, sending the above alarm information to the above situation awareness system.

[0060] Specifically, the smart killing platform allows administrators to configure an alarm whitelist. The alarm whitelist is a predefined list that contains information such as system activities, devices, IP addresses, network connections, etc. that are known, trusted, or considered safe. The purpose of the whitelist is to reduce false alarms and avoid identifying normal operations as abnormal or threatening. When the smart killing platform receives alarm information about abnormal access events, it will match the information with the alarm whitelist. If the elements in the alarm information (such as device ID, IP address, connection mode, etc.) match any record in the whitelist, this means that the alarm may come from known, safe or regular network activities, rather than real threats. In the case of matching the alarm whitelist, the smart killing platform will temporarily ignore these alarm information and will not send them to the situation awareness system for further monitoring and processing. The duration of the ignore is the third preset time, during which the platform will continue to monitor, but will not generate warnings for the activities in the whitelist. The setting of the third preset time takes into account the duration of normal activities to ensure that false alarms are not generated due to short-term normal fluctuations. If the elements in the alarm information do not match any record in the alarm whitelist, this means that there may be unknown or potential threats. At this point, the intelligent anti-virus platform sends the alarm information to the situation awareness system, which conducts a deeper analysis and response. The situation awareness system will combine the current network status, historical data and threat intelligence to assess the severity and urgency of the alarm and decide on measures to be taken, such as strengthening monitoring, isolating affected systems, and launching emergency response plans.

[0061] Through the above process, the intelligent detection and killing platform can intelligently filter out alarms generated by known, harmless or routine system activities, avoiding the trouble of the security team facing a large number of false alarms and improving the efficiency of handling real security threats. At the same time, by timely transmitting unmatched alarm information to the situational awareness system, it ensures the rapid identification and response to potential threats and enhances the security defense capabilities of the power system network. This rule-based automated alarm processing process helps to accurately identify and prioritize important security events in massive data.

[0062] In one embodiment of the present application, the above method also includes: calling the information acquisition interface of each third-party malicious code protection management center to respectively obtain the logs generated by each of the above-mentioned third-party malicious code protection management centers; based on the above-mentioned logs, performing unified management of the logs of each of the above-mentioned third-party malicious code protection management centers; calling the function takeover interface of each of the above-mentioned third-party malicious code protection management centers, and performing unified management of the functions of each of the above-mentioned third-party malicious code protection management centers based on the above-mentioned function takeover interface.

[0063] Specifically, the intelligent detection and killing platform collects detailed log data generated by each third-party malicious code protection management center by calling the information acquisition interface of each center. These logs usually contain information such as the center's operating status, malicious code detection and killing operations performed, the type and frequency of malicious code detected, and killing results. Interface calling is a network communication method that allows the intelligent detection and killing platform to obtain data from third-party centers in a structured and automated manner without human intervention.

[0064] After receiving the logs from all third-party malicious code protection management centers, the platform will manage them in a unified manner. This includes log storage, classification, analysis, and possible visualization. Unified log management helps the platform form a comprehensive network security situation map, understand the security status of different plants and stations, identify potential malicious code propagation paths and patterns, and evaluate the performance and efficiency of third-party centers. By centrally managing and analyzing logs, the platform can quickly identify abnormal behaviors in the network and respond in a timely manner.

[0065] In addition to obtaining logs, the intelligent detection and killing platform also calls the function takeover interface of the third-party malicious code protection management center to achieve unified management of the functions of these centers. The function takeover interface allows the platform to remotely control certain functions of the third-party center, such as real-time detection and killing of malicious code, updating of feature libraries, and adjustment of security policies. Through unified management, the platform can ensure that all third-party centers operate under the same rules and standards, improving overall collaborative efficiency and response speed. For example, when a new malicious code feature is detected, the platform can immediately send the latest feature library to all third-party centers through the function takeover interface to achieve a rapid upgrade of the entire network's defense.

[0066] The intelligent anti-virus platform can not only collect and analyze security information from multiple sources, but also actively control and coordinate the operation of the third-party malicious code protection management center to form a dynamic, efficient and unified network security protection system. This system can better cope with complex and changing network threats, protect the power monitoring system from malicious code, and ensure the stable operation of the power system.

[0067] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, the implementation process of the malicious code intelligent detection and killing method based on the situation awareness system of the present application will be described in detail below in combination with specific embodiments.

[0068] This embodiment relates to a specific method for intelligently detecting and killing malicious code based on a situation awareness system, including the following steps:

[0069] Step S1: The intelligent detection and killing platform remotely monitors the assets of the power plant in the power system and obtains the monitoring results;

[0070] Step S2: When the monitoring result shows that the assets of the plant station are under attack by malicious code, a control request is sent to the situation awareness system;

[0071] Step S3: The situation awareness system receives the control request and generates a confirmation signal if the control request is approved;

[0072] Step S4: The situation awareness system sends a confirmation signal to the intelligent detection and killing platform;

[0073] Step S5: the intelligent detection and killing platform receives the confirmation signal and performs remote detection and killing of the malicious code. The remote detection and killing of the malicious code is realized through the proxy channel between the intelligent detection and killing platform and the plant station;

[0074] Step S6: After the detection and killing process, the intelligent detection and killing platform sends the malicious code attack event to the third-party malicious code protection management center for detection and analysis to obtain analysis information corresponding to the attack event;

[0075] Step S7: The intelligent anti-virus platform sends the analysis information to at least two inspection systems for inspection, assigns weights according to the accuracy of the inspection results, and calculates the threat level of the malicious code;

[0076] Step S8: The intelligent anti-virus platform displays the threat level of the malicious code;

[0077] Step S9: The intelligent detection and killing platform counts the distribution of attack events corresponding to the malicious code of each factory station within the first preset time, generates a distribution statistical graph for representing the distribution of attack events, and counts the number of assets attacked by each malicious code within the second preset time, and generates a trend statistical graph for representing the attack trend of the malicious code;

[0078] Step S10: the intelligent anti-virus platform receives the malicious code features transmitted by the third-party malicious code protection management center, and remotely upgrades the malicious code feature library of the plant station through the proxy channel;

[0079] Step S11: The intelligent virus detection platform performs remote virus scanning on the plant assets through the proxy channel, compares the scan results with the local virus signature database, and performs remote virus detection and killing through the proxy channel if a virus is found;

[0080] Step S12: The intelligent detection and killing platform receives the abnormal access events reported by the plant station, performs abnormal detection analysis, obtains the analysis results, and sends the alarm information and monitoring data corresponding to the analysis results to the situation awareness system for monitoring.

[0081] Step S13: The intelligent detection and killing platform configures an alarm whitelist to filter the alarm information. If the alarm matches the whitelist, it is ignored within a preset time to reduce false alarms. If the alarm does not match the whitelist, the alarm information is sent to the situation awareness system.

[0082] Step S14: The intelligent detection and killing platform calls the information acquisition interface and function takeover interface of the third-party malicious code protection management center to obtain logs and manage them uniformly, and coordinate the functions of the third-party center to ensure that all centers operate under the same strategy and form a unified defense system.

[0083] The following is a specific example of this application:

[0084] Scenario: A power company operates multiple widely distributed plants and stations, each of which has its own network system and equipment, including servers, monitoring systems, automation control equipment, etc. The power company deploys the intelligent anti-virus platform of this application to protect its plants and stations from attacks by malicious code.

[0085] The intelligent anti-virus platform began to remotely monitor the server of a certain plant station, collecting monitoring results by continuously monitoring network traffic, system logs, abnormal behaviors, etc. For example, it was detected that unknown files on the server were frequently read, which may be potential malicious code activities.

[0086] When the above abnormal activities were discovered, the third-party interconnection management module confirmed that the plant had been attacked by malicious code, and then sent a control request to the situation awareness system, requesting further investigation and processing of the server.

[0087] After the situation awareness system is approved, the detection and disposal module of the intelligent killing platform connects to the infected server through a secure proxy channel to perform remote killing of malicious code. This may include isolating suspicious processes, deleting malicious files, and repairing tampered system settings.

[0088] The intelligent detection and killing platform sends the detailed information of malicious code and attack events to the third-party malicious code protection management center for analysis. After the third-party center analyzes, it feeds back the analysis information to the intelligent detection and killing platform. The intelligent detection and killing platform selects at least two inspection systems for cross-validation, assigns weights based on historical accuracy, calculates the threat level of malicious code, and displays it to the security team.

[0089] The intelligent detection and killing platform also counts the distribution of malicious code attack events, generates distribution statistics charts, and charts of malicious code attack trends to help security teams understand the dynamics of threats.

[0090] After receiving the updated malicious code features from the third-party center, the intelligent detection and killing platform pushes the feature library to all plants and stations through the proxy channel for remote upgrade to ensure that the protection capabilities of all plants and stations are updated synchronously.

[0091] A plant reported that a device attempted unauthorized network access. The intelligent detection and killing platform receives this abnormal access event, analyzes it, and determines its threat. If it is determined to be an abnormal behavior, the intelligent detection and killing platform sends a monitoring request to the situation awareness system and checks whether the alarm information matches the alarm whitelist. For alarm information that does not match, monitoring and possible response are carried out within the preset time.

[0092] The intelligent detection and killing platform calls the information acquisition interfaces of multiple third-party malicious code protection management centers to collect their log data. These logs are managed in a unified manner to help power companies understand the overall security situation.

[0093] By calling the function takeover interface, the intelligent detection and killing platform can unify the management of the functions of the third-party centers. For example, it can require all third-party centers to conduct a comprehensive system scan at a specific time to ensure that no threats are missed.

[0094] In the solution, the intelligent detection and killing platform effectively protects the power system from malicious code through remote monitoring and detection, analysis and processing, feature library update, abnormal event response and other steps. Compared with the traditional manual plant-by-plant response, this solution can significantly improve the response speed and efficiency to malicious code attacks and reduce interference with power system operations. At the same time, because it can centrally manage and analyze the data of the third-party protection center, it also enhances the security situation awareness of the entire network.

[0095] The embodiment of the present application also provides a malicious code intelligent detection and killing platform based on the situation awareness system. The structural diagram of the malicious code intelligent detection and killing platform based on the situation awareness system is as follows: Figure 2 As shown, the intelligent killing platform 10 includes a remote monitoring module 11, a control request sending module 12, and a remote killing processing module 13, which specifically include:

[0096] The remote monitoring module is used to obtain monitoring results of assets of power plants and stations in the power system to detect malicious code attacks.

[0097] Specifically, the remote monitoring module is mainly used to actively monitor the assets of each plant and station in the power system to promptly detect potential malicious code attack events. The main responsibilities of the remote monitoring module are: remotely access and monitor the plant and station assets in the power system through network connections, including servers, workstations, network equipment, automation control equipment, etc., as well as the software, services and network activities they run. Use advanced monitoring technologies and algorithms to conduct continuous and active security checks on the above assets to identify any abnormal behaviors or indicators that may indicate the presence or activity of malicious code. For example, the monitoring module may detect abnormal patterns in network traffic, unauthorized access attempts in system logs, suspicious modifications to files, etc., which are common signs of malicious code attacks. Obtain monitoring results, that is, data and information such as abnormal behaviors, security events, and network activities that are monitored. These results are the basis for subsequent attack detection and response, providing the platform with a real-time security situation view.

[0098] The remote monitoring module can provide comprehensive security monitoring and early warning without directly exposing the internal network and system structure of the power plant, and is the key to the platform's active defense and rapid response. Through the remote monitoring module, the platform can continuously monitor and protect multiple power plants in the power system, greatly improving the efficiency and effectiveness of security management, avoiding the inefficiency and waste of resources of manual inspection of each power plant, and also reducing the risk of malicious code propagation and infection.

[0099] The control request sending module is used to send a control request to the situation awareness system when the remote monitoring module detects a malicious code attack.

[0100] Specifically, the control request sending module is directly connected to the remote monitoring module, and receives the monitoring results of the plant assets being attacked by malicious code detected by the remote monitoring module. These monitoring results may include abnormal network behavior, suspicious system activities, unknown file modifications or creations, etc. These signs together constitute the preliminary judgment of malicious code attacks. When the remote monitoring module confirms that there is evidence of malicious code attacks on the plant assets, the control request sending module will immediately send a control request to the situation awareness system in the platform. The sending of the control request is a key step in the intelligent detection and killing process of malicious code. It triggers the response mechanism of the situation awareness system. After receiving the control request, the situation awareness system will review and approve it, evaluate the severity and urgency of the attack, and decide whether to approve the execution of remote detection and killing and other protective measures. If approved, the situation awareness system will send instructions to the detection and disposal module of the intelligent detection and killing platform to start the remote detection and killing of malicious code.

[0101] For the intelligent detection and killing platform, the control request sending module is the key bridge connecting monitoring and response. This module ensures that when a malicious code attack is discovered, a request can be sent to the situation awareness system through a standardized process to start the protection mechanism in time. In this way, not only can the infected assets be quickly isolated and processed to prevent the spread of malicious code in the power system, but also the impact on normal business operations can be reduced, and the efficiency and effectiveness of the overall security response can be improved. In addition, through the approval process of the situation awareness system, false alarms or overreactions can also be avoided to ensure the rationality and accuracy of protection measures.

[0102] The remote detection and killing processing module is used to perform remote detection and killing of the above-mentioned malicious code through the proxy channel of the above-mentioned plant station when the above-mentioned control request is passed, wherein the above-mentioned proxy channel is the channel between the intelligent detection and killing platform and the above-mentioned plant station.

[0103] Specifically, the remote detection and killing processing module is responsible for performing remote detection and killing processing on the attacked plant assets through the proxy channel when a malicious code attack is detected and a control request is submitted to the situation awareness system via the control request sending module, and the request is approved. The details are as follows:

[0104] Control request approval: When the remote monitoring module finds that an asset of a plant or station in the power system is attacked by malicious code, it will report to the control request sending module, which then submits a control request to the situation awareness system, requesting approval to detect and kill the attacked asset. After the situation awareness system approves it, the remote detection and killing processing module receives the instruction to execute the detection and killing.

[0105] Establishing a proxy channel: The proxy channel is a secure communication mechanism between the intelligent detection and killing platform and the plant station, which is used to perform remote operations, such as detecting and killing malicious code. The proxy channel is designed to ensure the security and concealment of data transmission, avoid directly exposing the internal network structure of the plant station, and reduce the risk of network attacks.

[0106] Execute remote detection and killing: Once the proxy channel is established, the remote detection and killing module will use this channel to perform remote detection and killing of malicious code on the attacked assets. The killing process may include identifying the characteristics of malicious code, isolating or stopping infected processes, deleting malicious files, repairing tampered system settings, etc. All these operations are completed remotely through the network without the need for on-site human intervention, greatly improving response speed and processing efficiency.

[0107] Result feedback and log recording: After the killing process is completed, the remote killing processing module will feed back the processing results to other components of the intelligent killing platform, such as the monitoring module and the control request sending module, as well as the situation awareness system, for further analysis and follow-up measures. At the same time, the module will record detailed logs during the killing process, including the killing time, killing object, killing results, etc., to provide a basis for subsequent security incident analysis and auditing.

[0108] The implementation of the remote detection and killing processing module is the key to the intelligent detection and killing platform's ability to respond quickly, efficiently and safely when facing malicious code attacks. It can not only reduce the dependence of personnel on the site and improve processing efficiency, but also maintain the confidentiality and security of the network while protecting the safe operation of the power system. By using the proxy channel for remote operation, the platform can achieve accurate detection and killing of malicious codes with minimal system interference, thereby effectively ensuring the safe and stable operation of the power system.

[0109] The above-mentioned intelligent detection and killing platform is deployed in the cloud, such as Figure 2 As shown, the above-mentioned intelligent detection and killing platform 10 is interconnected with the above-mentioned situation awareness system 20 and the above-mentioned plant station 30 respectively, and is used to execute any one of the above-mentioned malicious code intelligent detection and killing methods based on the situation awareness system.

[0110] Specifically, the intelligent detection and killing platform is deployed in the cloud instead of on traditional local servers or devices, mainly based on several significant advantages of cloud computing. First, cloud computing provides powerful computing power and storage resources, which can support large-scale data processing and analysis, which is crucial for monitoring and killing malicious code, because it involves real-time analysis of large amounts of network traffic and system logs; second, cloud deployment has extremely high scalability and flexibility, and can dynamically adjust resources according to actual needs to respond to sudden malicious code attacks and ensure the platform's response speed and processing capabilities; finally, cloud computing environments usually have high availability and disaster recovery mechanisms. Even in the event of partial hardware or network failures, the intelligent detection and killing platform can still maintain stable operation to ensure that the safety protection of the power system is not affected.

[0111] The intelligent detection and killing platform establishes a connection with the situational awareness system through the network. The situational awareness system is a system used to monitor the security status of the network in real time. It can collect and analyze data such as traffic and logs in the network to identify potential malicious code attacks. When the situational awareness system detects signs of attack, it will send a control request to the intelligent detection and killing platform to request further detection and killing of specific assets. After receiving the control request, the intelligent detection and killing platform can respond quickly and perform the corresponding detection and killing operation. This interconnection mechanism ensures the timely transmission and efficient processing of security threats.

[0112] The intelligent detection and killing platform also establishes a connection with each plant and station through the network. This connection is usually achieved through a proxy channel, which provides a secure data transmission channel to ensure that the internal network structure of the plant and station will not be exposed when detecting malicious code, and protect key information from unauthorized access. Through the interconnection with the plant and station, the intelligent detection and killing platform can directly remotely monitor and manage assets in the power system and perform detection and killing operations without the intervention of on-site personnel, greatly improving efficiency and response speed.

[0113] The intelligent detection and killing platform can execute any intelligent detection and killing method of malicious code based on the situational awareness system. These methods cover various links from remote monitoring, control request processing, updating of malicious code feature libraries, remote virus scanning and killing, to abnormal detection and alarm, unified log management, etc., forming a complete malicious code detection and protection process. The intelligent detection and killing platform uses advanced algorithms and strategies to automatically analyze the data provided by the situational awareness system, judge the severity of the threat, determine the priority and specific measures of killing, perform remote detection and killing, and feed back the processing results to the situational awareness system, forming a closed-loop management and improving the security and management efficiency of the entire system.

[0114] An embodiment of the present invention provides a computer-readable storage medium, which includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute the intelligent malicious code detection and killing method based on the situation awareness system.

[0115] Specifically, the intelligent detection and killing method of malicious code based on the situation awareness system includes:

[0116] Step S101, remotely monitor the assets of the power plant in the power system to obtain monitoring results;

[0117] Step S102, when the monitoring result shows that the asset is under a malicious code attack, sending a control request to the situation awareness system;

[0118] Step S103, upon receiving the confirmation signal sent by the above-mentioned situation awareness system, remote detection and killing of the above-mentioned malicious code is performed, and the remote detection and killing of the above-mentioned malicious code is implemented through a proxy channel, wherein the above-mentioned confirmation signal is generated when the above-mentioned situation awareness system indicates that the above-mentioned control request is passed, and the above-mentioned proxy channel is the channel between the intelligent detection and killing platform and the above-mentioned plant station.

[0119] An embodiment of the present invention provides a device, the device including a processor, a memory, and a program stored in the memory and executable on the processor, and when the processor executes the program, at least the following steps are implemented:

[0120] Step S101, remotely monitor the assets of the power plant in the power system to obtain monitoring results;

[0121] Step S102, when the monitoring result shows that the asset is under a malicious code attack, sending a control request to the situation awareness system;

[0122] Step S103, upon receiving the confirmation signal sent by the above-mentioned situation awareness system, remote detection and killing of the above-mentioned malicious code is performed, and the remote detection and killing of the above-mentioned malicious code is implemented through a proxy channel, wherein the above-mentioned confirmation signal is generated when the above-mentioned situation awareness system indicates that the above-mentioned control request is passed, and the above-mentioned proxy channel is the channel between the intelligent detection and killing platform and the above-mentioned plant station.

[0123] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program for initializing at least the following method steps:

[0124] Step S101, remotely monitor the assets of the power plant in the power system to obtain monitoring results;

[0125] Step S102, when the monitoring result shows that the asset is under a malicious code attack, sending a control request to the situation awareness system;

[0126] Step S103, upon receiving the confirmation signal sent by the above-mentioned situation awareness system, remote detection and killing of the above-mentioned malicious code is performed, and the remote detection and killing of the above-mentioned malicious code is implemented through a proxy channel, wherein the above-mentioned confirmation signal is generated when the above-mentioned situation awareness system indicates that the above-mentioned control request is passed, and the above-mentioned proxy channel is the channel between the intelligent detection and killing platform and the above-mentioned plant station.

[0127] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0128] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0129] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0130] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0131] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0132] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0133] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0134] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0135] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0136] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for intelligent detection and killing of malicious code based on a situational awareness system, characterized in that: include: Remotely monitor the assets of power plants and stations in the power system and obtain monitoring results; When the monitoring result shows that the asset is under a malicious code attack, sending a control request to the situation awareness system; When a confirmation signal sent by the situation awareness system is received, remote detection and killing of the malicious code is performed, and the remote detection and killing of the malicious code is implemented through a proxy channel, wherein the confirmation signal is generated when the situation awareness system indicates that the control request has passed, and the proxy channel is the channel between the intelligent detection and killing platform and the plant station.

2. The method according to claim 1, characterized in that The method further comprises: Sending the attack event corresponding to the malicious code to a third-party malicious code protection management center for detection and analysis to obtain analysis information corresponding to the attack event; The analysis information is sent to at least two inspection systems for inspection to obtain inspection results.

3. The method according to claim 2, characterized in that The analysis information is sent to at least two inspection systems for inspection to obtain inspection results, including: According to the historical detection accuracy of each inspection system, weights are assigned to each inspection system to obtain the weights of each inspection system; The threat level of the malicious code is obtained according to the weight of each of the inspection systems and the inspection result, and the threat level of the malicious code is displayed.

4. The method according to claim 1, characterized in that: The method further comprises: Counting the distribution of attack events corresponding to the malicious code in each of the plants within a first preset time to obtain a first statistical result; Generating a distribution statistics graph for characterizing the distribution of the attack events according to the first statistical result; Counting the number of assets attacked by each malicious code within a second preset time to obtain a second statistical result, wherein the second preset time is longer than the first preset time; A trend statistical graph for characterizing the attack trend of the malicious code is generated according to the second statistical result.

5. The method according to claim 1, characterized in that The method further comprises: Receiving characteristics of the malicious code transmitted by a third-party malicious code protection management center; The features of the malicious code are sent to the malicious code feature library of the plant station through the proxy channel to perform remote upgrade of the malicious code feature library.

6. The method according to claim 1, characterized in that The method further comprises: Performing a remote virus scan on the assets of the plant station through the proxy channel to obtain a virus scan result; Perform virus feature comparison detection on the virus scanning result and the local virus feature library to obtain a comparison detection result; When the comparison detection result indicates that the assets of the plant site have viruses, the assets of the plant site are remotely checked for viruses and killed through the proxy channel.

7. The method according to claim 1, characterized in that The method further comprises: receiving the abnormal access event sent by the plant station, performing abnormal detection analysis on the abnormal access event, and obtaining an analysis result; The warning information and monitoring data corresponding to the analysis results are sent to the situation awareness system for monitoring.

8. The method according to claim 7, characterized in that The method further comprises: configuring an alarm whitelist, and ignoring the alarm information within a third preset time when the alarm information matches the alarm whitelist; In the case where the alarm information does not match the alarm whitelist, the alarm information is sent to the situation awareness system.

9. The method according to claim 1, characterized in that: The method further comprises: Calling the information acquisition interface of each third-party malicious code protection management center to respectively obtain the logs generated by each of the third-party malicious code protection management centers; Based on the logs, unified management of the logs of each of the third-party malicious code protection management centers is performed; The function takeover interface of each of the third-party malicious code protection management centers is called, and unified management of the functions of each of the third-party malicious code protection management centers is performed based on the function takeover interface.

10. A malicious code intelligent killing platform based on situational awareness system, characterized in that: include: Remote monitoring module, used to obtain monitoring results of assets of power plants in the power system to detect malicious code attacks; A control request sending module, used for sending a control request to the situation awareness system when the remote monitoring module detects a malicious code attack; A remote detection and killing processing module, used for executing remote detection and killing processing of the malicious code through the proxy channel of the plant station when the control request is passed, wherein the proxy channel is a channel between the intelligent detection and killing platform and the plant station; Among them, the intelligent detection and killing platform is deployed in the cloud, and the intelligent detection and killing platform is interconnected with the situation awareness system and the plant station respectively, and is used to execute the malicious code intelligent detection and killing method based on the situation awareness system as described in any one of claims 1 to 9.

Images