Power sensor and network security analysis method and system

Abstract

The invention discloses a power sensor and network security analysis method and system. The method comprises the following steps: establishing a network security risk index system; establishing a security hierarchical structure of the network according to the network security risk index system; the security hierarchical structure of the network comprises a layer A, a layer B and a layer C; establishing a data set according to the security hierarchy of the network; building a security analysis model based on an EOA-SVM entropy optimization method-support vector machine, and training the model by using the data set; and collecting a C-layer index value, inputting the C-layer index value into the trained security analysis model, and analyzing the network data security in real time. The security analysis method provided by the invention has pertinence to the network, and is high in accuracy and strong in practicability in actual power scene application.

Description

Technical Field

[0001] The present invention relates to the field of application security in information security, and in particular to a power sensor and network security analysis method and system. Background Art

[0002] In recent years, advances in computer technology, integrated circuit technology, short-range wireless communication, digital signal processing, and micro-electromechanical systems have greatly promoted the widespread application of low-energy power sensors and networks. In the power industry, sensors are used to collect physical quantities, environmental conditions, equipment operating status, and operational data related to power production. Power sensors are a bridge between the physical power system and the network system, and are crucial to the digital transformation of the energy industry. With the continuous development and deployment of power sensors and networks, power sensors have become the key infrastructure of the energy Internet, and are widely distributed in various fields of power generation, transmission, and consumption.

[0003] According to SAM Seamless Network data, there were more than 1 billion security attacks in 2021, of which only 5% were aimed at server-side vulnerabilities, while the other 95% were targeted at routers and local devices. As local devices of the Energy Internet, power sensors have functions such as monitoring the operating status of power equipment and power grids, energy metering, and providing basic data sources for energy digitization. Their security is significantly higher than that of traditional sensors. However, the special application scenarios and special requirements of the power industry for sensing data have exacerbated the data security challenges faced by power sensors, such as threats such as electromagnetic and laser tampering. At the same time, existing security analysis methods are generally designed based on ordinary sensor scenarios, and there is a lack of security analysis research for the power industry. Therefore, there is an urgent need for systematic research on security analysis methods for power sensors and networks to build a comprehensive security risk indicator system to characterize the security level of power sensors and networks.

[0004] In the field of power safety risk analysis, some innovative patents have emerged, aiming to enhance the safety protection capabilities of power systems.

[0005] Patent CN115423336A proposes a method and system for assessing network security risks in a power monitoring system. This method acquires business resource data, operation information data, and service function data in the power monitoring system network, and uses the attention mechanism to establish a risk assessment model, thereby achieving an assessment of key elements of the power monitoring system network and a comprehensive risk score. However, the patent does not conduct a specific analysis of the security threats to power sensors and networks, so the proposed security risk assessment method is not targeted at power sensors and networks, and has low accuracy and poor practicality in actual power scenario applications. Summary of the invention

[0006] In order to solve the problems existing in the prior art of low accuracy, low practicality, and low granularity of data attributes and diversity refinement for power sensors and networks in actual power scenario applications, the present invention provides a power sensor and network security analysis method and system.

[0007] The present invention adopts the following technical solution.

[0008] On one hand, the present invention discloses a power sensor and a network security analysis method, comprising:

[0009] Identify the risk categories that affect network security, analyze the risk factors under each risk category, and establish a security hierarchy for power sensors and networks;

[0010] Establish a power sensor and network security risk indicator system, including C-level indicators corresponding to risk factors, B-level indicators corresponding to risk categories, and A-level indicators corresponding to power sensor and network security performance;

[0011] Assign values ​​to the C-layer indicator data to generate labeled data sets;

[0012] A security analysis model is constructed based on entropy optimization method and support vector machine, and the model is trained with a data set;

[0013] Collect C-layer indicator values ​​and input them into the trained security analysis model to analyze the security of power sensors and network data in real time.

[0014] More preferably,

[0015] The risk categories include perception layer risks, network layer risks, edge computing layer risks and other risks;

[0016] The risk factors in the perception layer include electromagnetic tampering, laser tampering, sonic tampering, special means tampering and service life;

[0017] Risk factors in network layer risks include data theft and node impersonation;

[0018] Risk factors in edge computing layer risks include data leakage, storage tampering, and denial of service;

[0019] Risk factors among other risks include environmental threats, natural disasters and management risks.

[0020] More preferably,

[0021] The C-layer index value can be used to calculate the A-layer index value A, and the calculation formula is as follows:

[0022]

[0023] in is the weight of the i-th indicator in layer B relative to the indicator in layer A; i∈[1,4]; is the weight of the jth indicator in layer C relative to the ith indicator in layer B; j∈[1,13]; c j is the jth indicator value of layer C;

[0024] The value range of the C-layer index is 1-5.

[0025] More preferably,

[0026] The calculation formula for the weight of the i-th indicator in layer B relative to the indicator in layer A is as follows:

[0027]

[0028] Where P i is the importance scale of the i-th indicator in layer B, P k is the importance scale of the kth indicator in layer B, k is an integer, and k∈[1,K], K is the total number of indicators in layer B;

[0029] The calculation formula for the weight of the j-th indicator in the C layer relative to the i-th indicator in the B layer is as follows:

[0030]

[0031] Where P j is the importance scale of the jth indicator in layer C, P m is the importance scale of the mth indicator in layer C, m is an integer, and m∈[1,M], M is the total number of indicators in layer C;

[0032] The importance scale P of the ath indicator a The calculation formula is as follows:

[0033]

[0034] Where N is the total number of indicators in the layer where indicator a is located;

[0035] t a,b Indicates the difference in importance between indicator a and indicator b, t a,b The value range is 1-5, where a and b are indicators of the same layer.

[0036] More preferably,

[0037] Take the C-layer indicator data randomly assigned by the setting group, and calculate the A-layer indicator value based on the C-layer indicator value. Set the A-layer indicator value to four labels, namely label 1 to label 4, and use the C-layer indicator data and the corresponding labels to establish a labeled data set; among which label 1 corresponds to insecure data, label 2 corresponds to general data security, label 3 corresponds to secure data, and label 4 corresponds to very secure data.

[0038] More preferably,

[0039] During the training process of the security analysis model, the entropy optimization method is used to optimize the penalty parameters and slack variables in the support vector machine.

[0040] On the other hand, the present invention discloses an electric power sensor and network security analysis system based on the electric power sensor and network security analysis method, including a security hierarchy construction module, a security risk indicator system construction module, a data set construction module, a security analysis model construction training module and a safety performance real-time analysis module.

[0041] The security hierarchy building module determines the risk categories that affect network security, analyzes the risk factors under each risk category, and establishes a security hierarchy for power sensors and networks;

[0042] The risk indicator system construction module establishes a power sensor and network security risk indicator system, including C-level indicators corresponding to risk factors, B-level indicators corresponding to risk categories, and A-level indicators corresponding to power sensor and network security performance;

[0043] The data set construction module assigns values ​​to the C-layer indicator data to generate a labeled data set;

[0044] The security analysis model construction training module constructs a security analysis model based on entropy optimization method and support vector machine, and trains the model with a data set;

[0045] The safety performance real-time analysis module collects C-layer indicator values ​​and inputs them into the trained safety analysis model to analyze the safety of power sensors and network data in real time.

[0046] More preferably,

[0047] In the security hierarchy building module, risk categories include perception layer risks, network layer risks, edge computing layer risks, and other risks;

[0048] The risk factors in the perception layer include electromagnetic tampering, laser tampering, sonic tampering, special means tampering and service life;

[0049] Risk factors in network layer risks include data theft and node impersonation;

[0050] Risk factors in edge computing layer risks include data leakage, storage tampering, and denial of service;

[0051] Risk factors among other risks include environmental threats, natural disasters and management risks.

[0052] More preferably,

[0053] In the safety risk indicator system construction module, the C-layer indicator value can be used to calculate the A-layer indicator value A, and the calculation formula is as follows:

[0054]

[0055] in is the weight of the i-th indicator in layer B relative to the indicator in layer A; i∈[1,4]; is the weight of the jth indicator in layer C relative to the ith indicator in layer B; j∈[1,13]; c j is the jth indicator value of layer C;

[0056] The value range of the C-layer index is 1-5.

[0057] More preferably,

[0058] The calculation formula for the weight of the i-th indicator in layer B relative to the indicator in layer A is as follows:

[0059]

[0060] Where P i is the importance scale of the i-th indicator in layer B, P k is the importance scale of the kth indicator in layer B, k is an integer, and k∈[1,K], K is the total number of indicators in layer B;

[0061] The calculation formula for the weight of the j-th indicator in the C layer relative to the i-th indicator in the B layer is as follows:

[0062]

[0063] Where P j is the importance scale of the jth indicator in layer C, P m is the importance scale of the mth indicator in layer C, m is an integer, and m∈[1,M], M is the total number of indicators in layer C;

[0064] The importance scale P of the ath indicator a The calculation formula is as follows:

[0065]

[0066] Where N is the total number of indicators in the layer where indicator a is located;

[0067] t a,b Indicates the difference in importance between indicator a and indicator b, t a,b The value range is 1-5, where a and b are indicators of the same layer.

[0068] More preferably,

[0069] In the data set construction module, the C-layer indicator data randomly assigned by the setting group is taken, and the A-layer indicator value is calculated based on the C-layer indicator value, and the A-layer indicator value is set to four labels, namely label 1 to label 4, and a labeled data set is established using the C-layer indicator data and the corresponding labels; wherein label 1 corresponds to insecure data, label 2 corresponds to general data security, label 3 corresponds to secure data, and label 4 corresponds to very secure data.

[0070] More preferably,

[0071] In the safety analysis model construction training module, during the safety analysis model training process, the entropy optimization method is used to optimize the penalty parameters and slack variables in the support vector machine.

[0072] On the other hand, the present application discloses an electronic device, including a processor and a storage medium; the characteristics are:

[0073] The storage medium is used to store instructions;

[0074] The processor is used to operate according to the instructions to execute the power sensor and network security analysis method.

[0075] The present application also discloses a computer-readable storage medium having a computer program stored thereon, wherein the program implements the power sensor and network security analysis method when executed by a processor.

[0076] The beneficial effect of the present invention is that, compared with the prior art,

[0077] 1. The present invention provides a method and system for analyzing the security of power sensors and networks, which has a wide range of applicability and can provide planning guidance for data security detection in future power sensors and networks;

[0078] 2. The invention proposes a power sensor and network security risk indicator system based on the hierarchical analysis method, which can effectively perform hierarchical analysis on the data in the power sensor and network. By building a hierarchical structure, complex analysis problems can be decomposed into multiple sub-problems that are easy to compare and quantify, thus realizing the visualization of security risks;

[0079] 3. The invention constructs a hierarchical structure of power sensor and network security, which can effectively quantify the data security in power sensors and networks and show the influence rules between indicators at different levels;

[0080] 4. The invention proposes to use the EOA algorithm to optimize the penalty parameters and slack variables in the SVM classification model, so that the analysis results are more in line with the actual situation and ensure the objectivity and fairness of the analysis results;

[0081] 5. The power sensor and network security analysis method proposed in the invention achieves a high classification accuracy while ensuring a low training time, realizing a fast and accurate analysis of power sensor and network security risks, and providing a strong guarantee for the stable operation of power sensors and networks.

[0082] In addition, the present invention has outstanding advantages such as high accuracy and strong practicality in actual power scene applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] Figure 1 is a schematic diagram of the method flow chart;

[0084] Figure 2 It is a schematic diagram of the power sensor and network security risk indicator system;

[0085] Figure 3 It is a schematic diagram of classification accuracy comparison;

[0086] Figure 4 This is a schematic diagram of average training time comparison. DETAILED DESCRIPTION

[0087] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only part of the embodiments of the present invention, not all of them. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the scope of protection of the present invention.

[0088] This application discloses a power sensor and a network security analysis method, see the attached Figure 1 ,include:

[0089] Identify the risk categories that affect network security, analyze the risk factors under each risk category, and establish a security hierarchy for power sensors and networks;

[0090] The risk categories include perception layer risks, network layer risks, edge computing layer risks and other risks;

[0091] The risk factors in the perception layer include electromagnetic tampering, laser tampering, sonic tampering, special means tampering and service life;

[0092] Risk factors in network layer risks include data theft and node impersonation;

[0093] Risk factors in edge computing layer risks include data leakage, storage tampering, and denial of service;

[0094] Risk factors among other risks include environmental threats, natural disasters and management risks.

[0095] Establish a power sensor and network security risk indicator system, including C-level indicators corresponding to risk factors, B-level indicators corresponding to risk categories, and A-level indicators corresponding to power sensor and network security performance;

[0096] The C-layer index value can be used to calculate the A-layer index value A, and the calculation formula is as follows:

[0097]

[0098] in is the weight of the i-th indicator in layer B relative to the indicator in layer A; i∈[1,4]; is the weight of the jth indicator in layer C relative to the ith indicator in layer B; j∈[1,13]; c j is the jth indicator value of layer C;

[0099] The calculation formula for the weight of the i-th indicator in layer B relative to the indicator in layer A is as follows:

[0100]

[0101] Where P i is the importance scale of the i-th indicator in layer B, P k is the importance scale of the kth indicator in layer B, k is an integer, and k∈[1,K], K is the total number of indicators in layer B;

[0102] The calculation formula for the weight of the j-th indicator in the C layer relative to the i-th indicator in the B layer is as follows:

[0103]

[0104] Where P j is the importance scale of the jth indicator in layer C, P m is the importance scale of the mth indicator in layer C, m is an integer, and m∈[1,M], M is the total number of indicators in layer C;

[0105] The importance scale P of the ath indicator a The calculation formula is as follows:

[0106]

[0107] Where N is the total number of indicators in the layer where indicator a is located;

[0108] t a,b Indicates the difference in importance between indicator a and indicator b, t a,b The value range is 1-5. When the importance of indicator a and indicator b is incomparable, t a,b =1, when indicator a and indicator b are equally important t a,b =2, when the difference in importance between indicator a and indicator b is small t a,b =3, when the difference in importance between indicator a and indicator b is large t a,b =4, when the difference in importance between indicator a and indicator b is large a,b =5, where a and b are indicators of the same layer.

[0109] The value range of the C-layer index is 1-5.

[0110] Assign values ​​to the C-layer indicator data to generate labeled data sets;

[0111] Take the C-layer indicator data randomly assigned by the setting group, and calculate the A-layer indicator value based on the C-layer indicator value. Set the A-layer indicator value to four labels, namely label 1 to label 4, and use the C-layer indicator data and the corresponding labels to establish a labeled data set; among which label 1 corresponds to insecure data, label 2 corresponds to general data security, label 3 corresponds to secure data, and label 4 corresponds to very secure data.

[0112] A security analysis model is constructed based on entropy optimization method and support vector machine, and the model is trained with a data set;

[0113] During the training process of the security analysis model, the entropy optimization method is used to optimize the penalty parameters and slack variables in the support vector machine.

[0114] Collect C-layer indicator values ​​and input them into the trained security analysis model to analyze the security of power sensors and network data in real time.

[0115] The present application also discloses a power sensor and network security analysis system based on a power sensor and network security analysis method, including a security hierarchy building module, a security risk indicator system building module, a data set building module, a security analysis model building training module and a security performance real-time analysis module:

[0116] The security hierarchy building module determines the risk categories that affect network security, analyzes the risk factors under each risk category, and establishes a security hierarchy for power sensors and networks;

[0117] Risk categories include perception layer risks, network layer risks, edge computing layer risks, and other risks;

[0118] The risk factors in the perception layer include electromagnetic tampering, laser tampering, sonic tampering, special means tampering and service life;

[0119] Risk factors in network layer risks include data theft and node impersonation;

[0120] Risk factors in edge computing layer risks include data leakage, storage tampering, and denial of service;

[0121] Risk factors among other risks include environmental threats, natural disasters and management risks.

[0122] The security risk indicator system construction module establishes a power sensor and network security risk indicator system, including C-level indicators corresponding to risk factors, B-level indicators corresponding to risk categories, and A-level indicators corresponding to power sensor and network security performance;

[0123] The C-layer index value can be used to calculate the A-layer index value A, and the calculation formula is as follows:

[0124]

[0125] in is the weight of the i-th indicator in layer B relative to the indicator in layer A; i∈[1,4]; is the weight of the jth indicator in layer C relative to the ith indicator in layer B; j∈[1,13]; c j is the jth indicator value of layer C;

[0126] The calculation formula for the weight of the i-th indicator in layer B relative to the indicator in layer A is as follows:

[0127]

[0128] Where P i is the importance scale of the i-th indicator in layer B, P k is the importance scale of the kth indicator in layer B, k is an integer, and k∈[1,K], K is the total number of indicators in layer B;

[0129] The calculation formula for the weight of the j-th indicator in the C layer relative to the i-th indicator in the B layer is as follows:

[0130]

[0131] Where P j is the importance scale of the jth indicator in layer C, P m is the importance scale of the mth indicator in layer C, m is an integer, and m∈[1,M], M is the total number of indicators in layer C;

[0132] The importance scale P of the ath indicator a The calculation formula is as follows:

[0133]

[0134] Where N is the total number of indicators in the layer where indicator a is located;

[0135] t a,b Indicates the difference in importance between indicator a and indicator b, t a,b The value range is 1-5, where a and b are indicators of the same layer.

[0136] The value range of the C-layer index is 1-5.

[0137] The data set construction module assigns values ​​to the C-layer indicator data to generate a labeled data set;

[0138] Specifically, the C-layer indicator data randomly assigned by the setting group is taken, and the A-layer indicator value is calculated based on the C-layer indicator value, and the A-layer indicator value is set to four labels, namely label 1 to label 4. A labeled data set is established using the C-layer indicator data and the corresponding labels; among which label 1 corresponds to insecure data, label 2 corresponds to general data security, label 3 corresponds to secure data, and label 4 corresponds to very secure data.

[0139] The security analysis model construction training module constructs a security analysis model based on entropy optimization method and support vector machine, and trains the model with a data set;

[0140] During the training process of the security analysis model, the entropy optimization method is used to optimize the penalty parameters and slack variables in the support vector machine.

[0141] The safety performance real-time analysis module collects C-layer indicator values ​​and inputs them into the trained safety analysis model to analyze the safety of power sensors and network data in real time.

[0142] Example 1

[0143] A power sensor and network security analysis method, see attached Figure 1 ,include:

[0144] Step 1: Establish a security hierarchy for power sensors and networks;

[0145] The hierarchical analysis method is used to establish the security hierarchy of power sensors and networks. The entire security risk category of power sensors and networks is divided into perception layer risk, network layer risk, edge computing layer risk and other risks.

[0146] The risk factors in the perception layer risk include electromagnetic tampering, laser tampering, acoustic tampering, special means tampering and service life, etc. In addition, in power sensor security, power sensors must actively detect attacks.

[0147] Among them, electromagnetic tampering changes the data sensed by the power sensor by sending electromagnetic waves or adding external magnetic fields;

[0148] Laser tampering uses lasers of a specific frequency to illuminate the power sensor to change the data sensed by the power sensor;

[0149] Acoustic tampering uses ultrasonic and other attack methods to change the data sensed by the power sensor or send control commands;

[0150] Special means of tampering include blinding the camera through specially designed patterns, making it unable to identify specific targets;

[0151] Service life is the life of a power sensor node under long-term working conditions and is one of the main indicators that directly reflects its reliability.

[0152] The risk factors in the network layer risk include data theft and node impersonation.

[0153] Data theft involves obtaining data transmitted over the network through monitoring, thus destroying data confidentiality.

[0154] Node spoofing is when a malicious node impersonates a power sensor to send false information to the network, or a malicious node impersonates a sink node to deceive power sensor data.

[0155] The risk factors in the edge computing layer risks include data leakage, storage tampering and denial of service.

[0156] Data leakage is achieved by obtaining business data stored in edge terminal devices through network attacks, device intrusions, etc.

[0157] Storage tampering is to attack the memory of edge terminal devices through magnetic, laser and other means to change the business and management data stored in the memory;

[0158] Denial of service is achieved by continuously sending data to edge terminal devices, causing the edge terminal devices to stop serving the power sensor.

[0159] The risk factors among the other risks mentioned include environmental threats, natural disasters and management risks, etc.

[0160] Environmental threats are the complexity and variability of the environment in which sensors, cameras, and other devices are located, and their susceptibility to human damage;

[0161] Natural disasters are losses caused by floods, fires, earthquakes, and other natural disasters;

[0162] Management risk is the quality and integrity of management systems, supervisory mechanisms, national policies, laws and regulations.

[0163] Step 2: Establish a power sensor and network security risk indicator system, see Appendix Figure 2 , including C-level indicators corresponding to risk factors, B-level indicators corresponding to risk categories, and A-level indicators corresponding to power sensors and network security performance.

[0164] In the security hierarchy of power sensors and networks, the importance of each indicator at the same layer is analyzed to construct a power sensor and network security risk indicator system.

[0165] According to the power sensor and network security risk indicator system, the single-level weight vector of the B-layer indicator relative to the A-layer indicator is expressed as Among them, when there is no affiliation between the upper and lower layer indicators, the weight vector is 0; the single-level weight vector of the C-layer indicator relative to the B-layer indicator is expressed as The value range of j is [1,4]. and is the single-level weight of each indicator. By multiplying the single-level weight of the B-layer indicator and the single-level weight of the C-layer indicator, we can get the comprehensive weight of the C-layer indicator relative to the A-layer indicator. On this basis, we can get the security hierarchy of power sensors and networks. In this structure, the impact value of C-layer data on A-layer indicators is:

[0166]

[0167] Where C = [c j ] 1×13 Indicates C-level indicator data; c j is the jth indicator of layer C; c j is the jth indicator value of layer C; is the weight of the i-th indicator in layer B relative to the indicator in layer A; i∈[1,4]; is the weight of the jth indicator in layer C relative to the ith indicator in layer B; j∈[1,13];

[0168] The calculation formula for the weight of the i-th indicator in layer B relative to the indicator in layer A is as follows:

[0169]

[0170] Where P i is the importance scale of the i-th indicator in layer B, P kis the importance scale of the kth indicator in layer B, k is an integer, and k∈[1,K], K is the total number of indicators in layer B;

[0171] The calculation formula for the weight of the j-th indicator in the C layer relative to the i-th indicator in the B layer is as follows:

[0172]

[0173] Where P j is the importance scale of the jth indicator in layer C, P m is the importance scale of the mth indicator in layer C, m is an integer, and m∈[1,M], M is the total number of indicators in layer C;

[0174] The importance scale P of the ath indicator a The calculation formula is as follows:

[0175]

[0176] Where N is the total number of indicators in the layer where indicator a is located; t a,b It indicates the difference in importance between indicator a and indicator b, and its value range is 1-5.

[0177] Assuming that there are N indicators in the target layer of the indicator system, the expert system scoring method is used to compare the indicators in pairs according to the scoring rule of 1 to 5, and the difference in importance between indicator a and indicator b is obtained. a,b , establish the judgment matrix T = [t a,b ] N×N The scoring rules for the relative importance differences between indicators are shown in Table 1. It should be noted that when there is no subordinate relationship between a lower-level indicator and an upper-level indicator, the importance of the lower-level indicator relative to other indicators at the same level is incomparable. a,b =1.

[0178] Table 1 Scoring rules for relative importance differences among indicators

[0179] <![CDATA[Importance t a,b > meaning 1 There is no comparison between the importance of indicator a and indicator b 2 Indicator a is as important as indicator b 3 The difference in importance between indicator a and indicator b is small 4 The difference in importance between indicator a and indicator b is large 5 The difference in importance between indicator a and indicator b is large

[0180] The C-layer indicator values ​​are obtained through scoring by the second expert system. The value range of the C-layer indicator values ​​is 1-5. The scoring principle is similar to the scoring rule of the relative importance difference between indicators. The importance of the power sensor and network security risk indicator system is scored according to the j-th indicator of the C-layer.

[0181] Step 3: Generate a labeled dataset and divide it into a training dataset and a test dataset.

[0182] Utilize the security hierarchy of power sensors and networks to build 1,000 sets of labeled data As training data and test data for multi-classification models, C represents the C-layer indicator data. is the corresponding A-layer indicator level and The A-layer indicator value A is divided into four labels in equal proportion, namely label 1 to label 4; label 1 corresponds to insecure data, label 2 corresponds to general data security, label 3 corresponds to secure data and label 4 corresponds to very secure data, with a total of four levels.

[0183] In this labeled dataset, the first 70% is used as the training sample dataset The last 30% is used as the test sample data set

[0184] Step 4: Construct a security analysis model based on EOA-SVM.

[0185] The safety analysis model based on EOA-SVM is trained using labeled data. First, the labeled data set is normalized and the Min-Max normalization method is used for data preprocessing.

[0186]

[0187] Among them, X represents the sample data of the C-level indicators to be standardized, X max and X min They represent the maximum and minimum values ​​in the corresponding samples respectively, and X' represents the normalized sample value.

[0188] The support vector machine itself solves the binary classification problem, and uses the bundling method to achieve multi-classification. Bundling two levels together, the four-classification problem becomes a binary classification problem. On this basis, the two bundled classes are binary classified separately, and the four-classification problem is solved through three binary classifications. Specifically, the data corresponding to label 1 and label 2 are bundled, and the new label is recorded as the good class. The data of label 3 and label 4 are bundled, and the new label is recorded as the excellent class. The support vector machine is used for binary classification; on this basis, the support vector machine is constructed to binary classify the data labeled as the good class into class 1 and class 2; the data in class 1 is the original data in label 1, and the data in class 2 is the original data in label 2. The data labeled as the excellent class is binary classified into class 3 and class 4; the data in class 3 is the original data in label 3, and the data in class 4 is the original data in label 4.

[0189] In the process of constructing a binary classification model based on support vector machine, the radial basis function RBF with fewer parameters and higher usage rate is selected as the kernel function of the support vector machine. In the process of simulation through MATLAB, the kernel='rbf' parameter is set to achieve this. In addition, the entropy optimization method EOA, the full name of which is Entropy Optimization Algorithm, is used to optimize the penalty parameters and slack variables in the support vector machine. First, a set of candidate solutions is randomly generated as the initial population, including the initial values ​​of the penalty parameters and slack variables, the search range, the population size, and the number of iterations; then, the F1 score of the support vector machine under different parameter combinations is analyzed by the k-fold cross-validation method; secondly, the selection, crossover, mutation and other operations in the genetic algorithm are used for iterative optimization, and the population is updated; finally, the solution with the highest F1 score is selected as the optimal parameter.

[0190] Based on the optimal penalty parameters and slack variables obtained by EOA optimization, as well as the selected RBF kernel function, the training sample set is used Establish and train the EOA-SVM multi-classification model.

[0191] Step 5: Collect C-layer indicator values ​​and input them into the trained security analysis model to analyze the security of power sensors and network data in real time.

[0192] Using the test sample set The security analysis method based on EOA-SVM was tested by MATLAB, and its performance was compared with the ANT-SVM method whose parameters were optimized by ant colony algorithm and the SVM method without parameter optimization. The model training time and classification accuracy were analyzed.

[0193] See attached Figure 3 It can be clearly seen that, first of all, in terms of classification accuracy, although a variety of analysis methods can achieve safety analysis to a certain extent, the EOA-SVM method introduces the parameters or structure of EOA, which enables it to find the classification boundary more accurately when dealing with complex, nonlinear and high-dimensional data. Compared with traditional ANT-SVM and SVM methods, EOA-SVM can more effectively deal with noise and outliers in the data, thereby improving the classification accuracy. Specifically, in multiple experimental comparisons, the EOA-SVM method showed a slightly higher classification accuracy than the ANT-SVM method, which proves its superiority in dealing with complex safety analysis tasks of power sensors and networks. Secondly, see Appendix Figure 4In terms of training time, the EOA-SVM method significantly reduces the training time of the model by optimizing the selection and application of the algorithm. The traditional ANT-SVM method may have a long training time due to the high complexity of the algorithm or improper parameter adjustment, while the EOA-SVM achieves a significant reduction in training time while maintaining high classification accuracy by optimizing the fast convergence and efficiency of the algorithm. This advantage makes the EOA-SVM method more competitive in practical applications, especially in security analysis scenarios that require rapid response and real-time processing. In addition, the EOA-SVM method also has stronger generalization ability and adaptability. Since the EOA algorithm can automatically search for the optimal parameter combination and dynamically adjust it according to the characteristics of the data, the EOA-SVM method can show better adaptability and stability when facing data sets of different fields and sizes.

[0194] In summary, the EOA-SVM method is superior to the traditional ANT-SVM and SVM methods in terms of classification accuracy, training time, generalization ability and adaptability. These advantages make the EOA-SVM method have higher application value and broader application prospects in the field of power sensor and network security analysis.

[0195] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0196] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0197] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0198] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0199] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A power sensor and network security analysis method, characterized in that: include: Identify the risk categories that affect network security, analyze the risk factors under each risk category, and establish a security hierarchy for power sensors and networks; Establish a power sensor and network security risk indicator system, including C-level indicators corresponding to risk factors, B-level indicators corresponding to risk categories, and A-level indicators corresponding to power sensor and network security performance; Assign values ​​to the C-layer indicator data to generate labeled data sets; A security analysis model is constructed based on entropy optimization method and support vector machine, and the model is trained with a data set; Collect C-layer indicator values ​​and input them into the trained security analysis model to analyze the security of power sensors and network data in real time.

2. The power sensor and network security analysis method according to claim 1, characterized in that: The risk categories include perception layer risks, network layer risks, edge computing layer risks and other risks; The risk factors in the perception layer include electromagnetic tampering, laser tampering, sonic tampering, special means tampering and service life; Risk factors in network layer risks include data theft and node impersonation; Risk factors in edge computing layer risks include data leakage, storage tampering, and denial of service; Risk factors among other risks include environmental threats, natural disasters and management risks.

3. The power sensor and network security analysis method according to claim 1, characterized in that: The C-layer index value can be used to calculate the A-layer index value A, and the calculation formula is as follows: in is the weight of the ith indicator in layer B relative to the indicator in layer A; i∈[1,4]; is the weight of the jth indicator in layer C relative to the ith indicator in layer B; j∈[1,13]; c j is the jth indicator value of layer C; The value range of the C-layer index is 1-5.

4. The power sensor and network security analysis method according to claim 3, characterized in that: The calculation formula for the weight of the i-th indicator in layer B relative to the indicator in layer A is as follows: Where P i is the importance scale of the i-th indicator in layer B, P k is the importance scale of the kth indicator in layer B, k is an integer, and k∈[1,K], K is the total number of indicators in layer B; The calculation formula for the weight of the j-th indicator in the C layer relative to the i-th indicator in the B layer is as follows: Where P j is the importance scale of the jth indicator in layer C, P m is the importance scale of the mth indicator in layer C, m is an integer, and m∈[1,M], M is the total number of indicators in layer C; The importance scale P of the ath indicator a The calculation formula is as follows: Where N is the total number of indicators in the layer where indicator a is located; t a,b Indicates the difference in importance between indicator a and indicator b, t a,b The value range is 1-5, where a and b are indicators of the same layer.

5. The power sensor and network security analysis method according to claim 1 or 3, characterized in that: Take the C-layer indicator data randomly assigned by the setting group, and calculate the A-layer indicator value based on the C-layer indicator value. Set the A-layer indicator value to four labels, namely label 1 to label 4, and use the C-layer indicator data and the corresponding labels to establish a labeled data set; among which label 1 corresponds to insecure data, label 2 corresponds to general data security, label 3 corresponds to secure data, and label 4 corresponds to very secure data.

6. The power sensor and network security analysis method according to claim 1, characterized in that: During the training process of the security analysis model, the entropy optimization method is used to optimize the penalty parameters and slack variables in the support vector machine.

7. A power sensor and network security analysis system using the power sensor and network security analysis method according to any one of claims 1 to 6, characterized in that: It includes security hierarchy building module, security risk indicator system building module, data set building module, security analysis model building training module and security performance real-time analysis module: The security hierarchy building module determines the risk categories that affect network security, analyzes the risk factors under each risk category, and establishes a security hierarchy for power sensors and networks; The security risk indicator system construction module establishes a power sensor and network security risk indicator system, including C-level indicators corresponding to risk factors, B-level indicators corresponding to risk categories, and A-level indicators corresponding to power sensor and network security performance; The data set construction module assigns values ​​to the C-layer indicator data to generate a labeled data set; The security analysis model construction training module constructs a security analysis model based on entropy optimization method and support vector machine, and trains the model with a data set; The safety performance real-time analysis module collects C-layer indicator values ​​and inputs them into the trained safety analysis model to analyze the safety of power sensors and network data in real time.

8. The power sensor and network security analysis system according to claim 7, characterized in that: In the security hierarchy building module, risk categories include perception layer risks, network layer risks, edge computing layer risks, and other risks; The risk factors in the perception layer include electromagnetic tampering, laser tampering, sonic tampering, special means tampering and service life; Risk factors in network layer risks include data theft and node impersonation; Risk factors in edge computing layer risks include data leakage, storage tampering, and denial of service; Risk factors among other risks include environmental threats, natural disasters and management risks.

9. The power sensor and network security analysis system according to claim 7, characterized in that: In the safety risk indicator system construction module, the C-layer indicator value can be used to calculate the A-layer indicator value A, and the calculation formula is as follows: in is the weight of the ith indicator in layer B relative to the indicator in layer A; i∈[1,4]; is the weight of the jth indicator in layer C relative to the ith indicator in layer B; j∈[1,13]; c j is the jth indicator value of layer C; The value range of the C-layer index is 1-5.

10. The power sensor and network security analysis system according to claim 9, characterized in that: The calculation formula for the weight of the i-th indicator in layer B relative to the indicator in layer A is as follows: Where P i is the importance scale of the i-th indicator in layer B, P k is the importance scale of the kth indicator in layer B, k is an integer, and k∈[1,K], K is the total number of indicators in layer B; The calculation formula for the weight of the j-th indicator in the C layer relative to the i-th indicator in the B layer is as follows: Where P j is the importance scale of the jth indicator in layer C, P m is the importance scale of the mth indicator in layer C, m is an integer, and m∈[1,M], M is the total number of indicators in layer C; The importance scale P of the ath indicator a The calculation formula is as follows: Where N is the total number of indicators in the layer where indicator a is located; t a,b Indicates the difference in importance between indicator a and indicator b, t a,b The value range is 1-5, where a and b are indicators of the same layer.

11. The power sensor and network security analysis system according to claim 7 or 9, characterized in that: In the data set construction module, the C-layer indicator data randomly assigned by the setting group is taken, and the A-layer indicator value is calculated based on the C-layer indicator value, and the A-layer indicator value is set to four labels, namely label 1 to label 4, and a labeled data set is established using the C-layer indicator data and the corresponding labels; wherein label 1 corresponds to insecure data, label 2 corresponds to general data security, label 3 corresponds to secure data, and label 4 corresponds to very secure data.

12. The power sensor and network security analysis system according to claim 7, characterized in that: In the safety analysis model construction training module, during the safety analysis model training process, the entropy optimization method is used to optimize the penalty parameters and slack variables in the support vector machine.

13. An electronic device, comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instructions to execute the power sensor and network security analysis method according to claims 1-6.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the power sensor and network security analysis method described in claims 1-6 are implemented.

Images