Electric power industrial control system data risk prediction method and device, medium and equipment

Abstract

The invention discloses an electric power industrial control system data risk prediction method and device, a medium and equipment, and relates to the field of electric power industrial control system network security. The method comprises the following steps: obtaining data to be subjected to risk prediction of a preset electric power industrial control system, wherein the data to be subjected to risk prediction comprises data packets of each user accessing the preset electric power industrial control system in different access time periods; carrying out network flow information extraction on each data packet to obtain network flow information of each different access time period corresponding to each user; performing feature extraction based on each piece of network flow information to obtain security feature data of each different access period corresponding to each user; and performing risk prediction based on the security feature data to obtain a data risk prediction result of the electric power industrial control system. According to the method, the network security risk of the digital substation electric power industrial control system can be evaluated more comprehensively and accurately, and a reliable basis is provided for network security operation of the digital substation electric power industrial control system.

Description

Technical Field

[0001] The present invention relates to the field of network security of electric power industrial control systems, and in particular to a method, device, medium and equipment for predicting data risks of electric power industrial control systems. Background Art

[0002] With the deep integration of the power industry and information technology and the rapid development of the global energy Internet, the power industrial control system has achieved unprecedented rapid development. At the same time, the widespread application of smart meters, smart switches, smart distribution equipment, etc. has greatly increased the complexity and operability of the distribution network, which has also brought challenges to the network security of the digital substation power industrial control system. The digital substation power industrial control system is facing increasingly complex network security threats. Network security risk analysis and assessment are becoming more and more important. It is necessary to monitor and control remote access to prevent network attacks and security threats to ensure the safe and stable operation of the digital substation power industrial control system; however, traditional network security defense mainly relies on rules and signatures to identify known threats, but this method is difficult to cope with increasingly complex and changing network security threats. In addition, many threat behaviors themselves do not violate predefined rules or signatures, so they are difficult to be detected by traditional methods. Summary of the invention

[0003] In view of this, the present invention provides a method, device, medium and equipment for predicting data risks in an electric power industrial control system. The main purpose is to solve the problem that the current network security defense of the electric power industrial control system mainly relies on rules and signatures to identify known threats, but cannot adapt to the ever-changing network security threats.

[0004] To solve the above problems, the present application provides a method for predicting data risk of an electric power industrial control system, comprising:

[0005] Acquire risk prediction data for a preset power industrial control system, wherein the risk prediction data includes data packets of each user accessing the preset power industrial control system in different access periods;

[0006] Extracting network traffic information from each of the data packets to obtain network traffic information for each of the different access time periods corresponding to each of the users;

[0007] Perform feature extraction based on each of the network traffic information to obtain security feature data for each of the different access time periods corresponding to each of the users;

[0008] Risk prediction is performed based on each of the safety feature data to obtain a data risk prediction result of the electric power industrial control system.

[0009] Optionally, extracting network traffic information from each of the data packets to obtain network traffic information of each of the different access time periods corresponding to each of the users specifically includes:

[0010] Based on each of the data packets, determining the amount of business access acceptance and the amount of business access rejection of each of the users for accessing different business types of the preset power industrial control system during different access time periods;

[0011] Parsing data packets of the same user in different access periods to obtain data packet information of different data packets of the same user, wherein the data packet information includes a source IP address, a number of access requests, a number of bytes of uploaded data, a number of bytes of downloaded data, and a number of bytes of unauthorized access;

[0012] The total number of data packets in different access time periods of each user is parsed to obtain the number of lost data packets in different access time periods corresponding to each user.

[0013] Optionally, the extracting features based on each of the network traffic information to obtain security feature data for each of the different access time periods corresponding to each of the users specifically includes:

[0014] Extract features based on the source IP addresses of each data packet of the same user in different access periods to obtain IP features of the same user in different access periods;

[0015] Calculate based on the number of access requests of each data packet in different access periods of the same user and a preset normalization factor to obtain the request number characteristics of different access periods of the same user;

[0016] Calculate based on the uploaded data byte count, the downloaded data byte count and the preset normalization factor of each data packet in different access periods of the same user to obtain data features of different access periods of the same user;

[0017] Calculating based on the number of unauthorized access bytes of each data packet in different access periods of the same user and the preset normalization factor, obtaining the permission characteristics of different access periods of the same user;

[0018] Calculate and process the total number of data packets accessed by the same user in different access periods and the number of lost data packets in different access periods corresponding to each user to obtain transmission characteristics of the same user in different access periods;

[0019] Based on the business access acceptance volume of different business types of the preset power industrial control system accessed by the same user in different access time periods and the preset business load corresponding to each different business type, the business access characteristics of the same user in different access time periods are obtained.

[0020] Optionally, extracting features based on the source IP addresses of the data packets in different access periods of the same user to obtain IP features of the same user in different access periods specifically includes:

[0021] Obtaining source IP addresses of different data packets of the same user in different access periods;

[0022] Filter each of the source IP addresses to obtain a first target source IP address and a second target source IP address;

[0023] Performing calculation based on the first target source IP address and the second target source IP address to obtain a difference mask;

[0024] When the difference mask is equal to a predetermined mask value, determining the first feature value as the IP feature;

[0025] When the difference mask is not equal to the predetermined mask value, the second feature value is determined as the IP feature.

[0026] Optionally, before performing risk prediction based on each of the security feature data to obtain a data risk prediction result of the power industrial control system, the method further includes:

[0027] The network traffic information and the security feature data of each of the different access time periods corresponding to each of the users are stored in a preset security feature database.

[0028] Optionally, performing risk prediction based on each of the security feature data to obtain a data risk prediction result of the power industrial control system specifically includes:

[0029] Based on the security feature data of the same user in different access periods, the scoring rules corresponding to the security feature data, the business access rejection amount of different business types of access to the preset power industrial control system, and the scoring rules corresponding to the business access rejection amount, feature scoring is performed to obtain security risk scores corresponding to each access period of the same user;

[0030] Calculate and process the security risk scores of each user in the same access period to obtain a comprehensive security risk score corresponding to each access period;

[0031] Risk prediction is performed based on the comprehensive scores of each security risk and preset risk level classification rules to obtain the data risk level corresponding to each access time period.

[0032] Optionally, the feature scoring is performed based on the security feature data of different access time periods of the same user, the scoring rules corresponding to the security feature data, the business access rejection amount of different business types of access to the preset power industrial control system, and the scoring rules corresponding to the business access rejection amount to obtain the security risk scores corresponding to each access time period of the same user, specifically including:

[0033] Perform feature scoring based on each of the security feature data of the same user and a scoring rule corresponding to each of the security feature data to obtain a first feature scoring value corresponding to each of the security feature data;

[0034] Perform feature scoring based on the amount of service access rejections of different service types of each user accessing the preset power industrial control system in different access time periods and a scoring rule corresponding to the amount of service access rejections, to obtain a second feature score value of different service types of each user accessing the preset power industrial control system in different access time periods;

[0035] The security risk scores corresponding to the respective access periods of the same user are obtained by performing calculation based on the first feature score value and the second feature score value of the same user in the same access period.

[0036] In order to solve the above problems, the present application provides a data risk prediction device for an electric power industrial control system, comprising:

[0037] An acquisition module, used for acquiring the to-be-risk-predicted data of a preset power industrial control system, wherein the to-be-risk-predicted data includes data packets of each user accessing the preset power industrial control system in different access periods;

[0038] An information extraction module, used to extract network flow information from each of the data packets to obtain network flow information for each of the different access time periods corresponding to each of the users;

[0039] A feature extraction module, used to extract features based on each of the network traffic information to obtain security feature data for each of the different access time periods corresponding to each of the users;

[0040] The risk prediction module is used to perform risk prediction based on each of the security feature data to obtain a data risk prediction result of the power industrial control system.

[0041] In order to solve the above problem, the present application provides a storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned power industrial control system data risk prediction method are implemented.

[0042] To solve the above problems, the present application provides an electronic device, comprising at least a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned method for predicting data risk of an electric power industrial control system when executing the computer program on the memory.

[0043] Beneficial effects of the present application: The present application takes into account multiple network indicators of the digital substation power industrial control system, and can more comprehensively and accurately assess the network security risks of the digital substation power industrial control system, providing a reliable basis for the secure operation of the digital substation power industrial control system network.

[0044] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0046] Figure 1 A schematic diagram of a process flow of a method for predicting data risk in an electric power industrial control system provided in an embodiment of the present application is shown;

[0047] Figure 2 A structural block diagram of a data risk prediction device for an electric power industrial control system provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0048] Various aspects and features of the present application are described herein with reference to the accompanying drawings.

[0049] It should be understood that various modifications may be made to the embodiments of the present application. Therefore, the above description should not be considered as limiting, but only as an example of an embodiment. Other modifications within the scope and spirit of the present application will occur to those skilled in the art.

[0050] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present application and, together with the general description of the present application given above and the detailed description of the embodiments given below, serve to explain the principles of the present application.

[0051] These and other characteristics of the present application will become apparent from the following description of a preferred form of embodiment given as a non-limiting example with reference to the accompanying drawings.

[0052] It should also be understood that although the present application has been described with reference to some specific examples, those skilled in the art will be able to readily implement many other equivalent forms of the present application.

[0053] The above and other aspects, features and advantages of the present application will become more apparent in view of the following detailed description when taken in conjunction with the accompanying drawings.

[0054] Specific embodiments of the present application are described hereinafter with reference to the accompanying drawings; however, it should be understood that the embodiments applied for are merely examples of the present application, which may be implemented in a variety of ways. Well-known and / or repeated functions and structures are not described in detail to avoid unnecessary or redundant details that obscure the present application. Therefore, the specific structural and functional details applied for herein are not intended to be limiting, but merely serve as a basis and representative basis for the claims to teach those skilled in the art to use the present application in a variety of ways with substantially any suitable detailed structure.

[0055] This specification may use the phrases "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," all of which may refer to one or more of the same or different embodiments according to the present application.

[0056] The present application embodiment provides a method for predicting data risk of an electric power industrial control system. Figure 1 As shown, including:

[0057] Step S101: obtaining risk prediction data of a preset power industrial control system, wherein the risk prediction data includes data packets of each user accessing the preset power industrial control system in different access periods;

[0058] During the specific implementation of this step, a predetermined network protocol analyzer can be used to collect the user's network traffic in real time; the predetermined network protocol analyzer can be a Wireshark network traffic capture tool; the traffic data within a preset time range of the preset power industrial control system can be captured, and the preset time range can be one month, two months, three days, five days, 1 hour, 8 hours, etc. This application does not impose any restrictions on the preset time range, and can capture and analyze long-term data, and can also capture and analyze data packets within a short time range.

[0059] Step S102: extracting network traffic information from each of the data packets to obtain network traffic information of each of the different access time periods corresponding to each of the users;

[0060] During the specific implementation of this step, based on each of the data packets, the amount of business access acceptance and the amount of business access rejection of different business types of each of the users accessing the preset power industrial control system during different access periods are determined; each of the business types includes data acquisition and detection business type, equipment control and adjustment business type, data storage and management business type, monitoring and visualization business type, data analysis and processing business type, communication and integration business type, fault diagnosis and alarm business type; the data packets of different access periods of the same user are parsed to obtain data packet information of different data packets of the same user, and the data packet information includes source IP address, number of access requests, number of uploaded data bytes, number of downloaded data bytes, and number of unauthorized access bytes; the total number of data packets of different access periods of each of the users is parsed to obtain the number of lost data packets in different access periods corresponding to each of the users.

[0061] Step S103: extracting features based on each of the network traffic information to obtain security feature data for each of the different access time periods corresponding to each of the users;

[0062] In the specific implementation process of this step, feature extraction is performed based on the source IP address of each data packet in different access time periods of the same user to obtain the IP features of the different access time periods of the same user; the number of access requests of each data packet in different access time periods of the same user and the preset normalization factor are calculated to obtain the request number features of the different access time periods of the same user; the number of uploaded data bytes, the number of downloaded data bytes and the preset normalization factor of each data packet in different access time periods of the same user are calculated to obtain the data features of the different access time periods of the same user; the number of unauthorized access bytes of each data packet in different access time periods of the same user and the preset normalization factor are calculated to obtain the permission features of the different access time periods of the same user; the total number of data packets accessed by the same user in different access time periods and the number of lost data packets corresponding to each user in different access time periods are calculated to obtain the transmission features of the same user in different access time periods; the business access acceptance amount, business access rejection amount and the preset business load degree corresponding to each different business type of the same user accessing the preset power industrial control system in different access time periods are calculated to obtain the business access features of the same user in different access time periods.

[0063] Step S104: performing risk prediction based on each of the security feature data to obtain a data risk prediction result of the power industrial control system.

[0064] During the specific implementation of this step, feature scoring is performed based on the security feature data of different access time periods of the same user, the scoring rules corresponding to the security feature data, the amount of business access rejection of different business types to access the preset power industrial control system, and the scoring rules corresponding to the amount of business access rejection, so as to obtain security risk scores corresponding to each access time period of the same user; calculation and processing are performed based on the security risk scores of each user in the same access time period to obtain comprehensive security risk scores corresponding to each access time period; risk prediction is performed based on each comprehensive security risk score and the preset risk level classification rules to obtain data risk levels corresponding to each access time period.

[0065] This application takes into account multiple indicators of the digital substation power industrial control system network, which can more comprehensively and accurately evaluate the security risks of the digital substation power industrial control system network, and provide a reliable basis for the secure operation of the digital substation power industrial control system network.

[0066] Another embodiment of the present application provides another method for predicting data risk of an electric power industrial control system, including:

[0067] Step S201: obtaining risk prediction data of a preset power industrial control system, wherein the risk prediction data includes data packets of each user accessing the preset power industrial control system in different access periods;

[0068] During the specific implementation of this step, a predetermined network protocol analyzer may be used to collect the user's network traffic in real time; the predetermined network protocol analyzer may be a Wireshark network traffic capture tool; the traffic data within a preset time range of the preset power industrial control system may be captured, and the preset time range may be one month, two months, three days, five days, one hour, eight hours, etc. This application does not impose any restrictions on the preset time range, and may capture and analyze long-term data packets, and may also capture and analyze data packets within a short time range. For example: the total number of days for network traffic collection in the digital substation power industrial control system is D, and the daily traffic collection time period is p, and the traffic collection time period is calculated in hours; p = 1, 2, ..., 24, the digital substation power industrial control system network has a total of N users, and the definition is is the i-th user who accesses the digital substation power industrial control system network in the p-th time period on the d-th day, d = 1, 2, ..., D, i = 1, 2, ..., N; define For users The total number of packets captured by accessing the digital substation power industrial control system network, defined as For users The kth packet captured,

[0069] Step S202: determining, based on each of the data packets, the amount of service access acceptance and the amount of service access rejection of each of the users for accessing different service types of the preset power industrial control system in different access time periods;

[0070] In the specific implementation process of this step, the business types of the digital substation power industrial control system include the digital substation power industrial control system data acquisition and detection business type, the digital substation power industrial control system equipment control and adjustment business type, the digital substation power industrial control system data storage and management business type, the digital substation power industrial control system monitoring and visualization business type, the digital substation power industrial control system data analysis and processing business type, the digital substation power industrial control system communication and integration business type, the digital substation power industrial control system fault diagnosis and alarm business type; according to the different load levels of the digital substation power industrial control system business types, the business load level of business type j is θ j The mathematical expression of can be expressed as follows:

[0071]

[0072] user The number of successful accesses to the digital substation power industrial control system service type j in the pth time period on the dth day is defined as the service access acceptance quantity user The number of denied accesses to the digital substation power industrial control system business type during the p-th time period on the d-th day is defined as the business access rejection amount.

[0073] Step S203: parsing data packets of the same user in different access periods to obtain data packet information of different data packets of the same user, wherein the data packet information includes a source IP address, a number of access requests, a number of bytes of uploaded data, a number of bytes of downloaded data, and a number of bytes of unauthorized access;

[0074] In the specific implementation process of this step, the data packets of the same user in different access periods are parsed to obtain the data packet information of different data packets of the same user, and the data packet information includes the source IP address, the number of access requests, the number of bytes of uploaded data, the number of bytes of downloaded data, and the number of bytes of unauthorized access. Specifically, by parsing the data packets of the user in different access periods, the data packet information of the same user is obtained. The kth packet captured Parse the content and obtain the user Source IP address Number of access requests The number of bytes of uploaded data Download data bytes Unauthorized access to bytes

[0075] Step S204: parsing the total number of data packets in different access time periods of each user to obtain the number of lost data packets in different access time periods corresponding to each user;

[0076] In the specific implementation process of this step, The total number of packets captured by accessing the digital substation power industrial control system network Parse and obtain the number of lost packets in the pth time period of d days

[0077] Step S205: extracting features based on the source IP addresses of the data packets of the same user in different access periods, and obtaining IP features of the same user in different access periods;

[0078] In the specific implementation process of this step, the source IP addresses of different data packets of different access time periods of the same user are obtained; each source IP address is screened to obtain a first target source IP address and a second target source IP address; specifically, two source IP addresses corresponding to different time periods can be randomly selected from the source IP addresses corresponding to the different access time periods to be determined as the first target source IP address and the second target source IP address, or the source IP address corresponding to the first access time period of different access time periods of the same user can be selected as the first target source IP address, and the source IP address of the last access time period of the same user can be determined as the second target source IP address. Calculations are performed based on the first target source IP address and the second target source IP address to obtain a difference mask; specifically, the user The difference mask of the user when accessing the digital substation power industrial control system in the pth time period on the dth day The mathematical expression of can be shown as follows:

[0079]

[0080] in, For users The first packet is captured in the pth time period on the dth day The source IP address, For users The first captured in the pth time period on the dth day Packets The source IP address, is an XOR operation. When the difference mask is equal to the predetermined mask value, the first feature value is determined as the IP feature; when the difference mask is not equal to the predetermined mask value, the second feature value is determined as the IP feature. Specifically, the user IP characteristics of accessing the digital substation power industrial control system during the pth time period on the dth day The mathematical expression of can be expressed as follows:

[0081]

[0082] Among them, the predetermined mask value is 0, the first feature value is 0, and the second feature value is 1; when the difference mask is equal to the predetermined mask value 0, the first feature value 0 is determined as the IP feature; when the difference mask is not equal to the predetermined mask value 0, the second feature value 1 is determined as the IP feature.

[0083] Step S206: Calculating based on the access request times of each data packet in different access periods of the same user and a preset normalization factor, to obtain request times characteristics of different access periods of the same user;

[0084] In the specific implementation process of this step, the number of access requests of each data packet in different access periods of the same user is added to obtain the total number of access requests corresponding to the different access periods of the same user; the total number of access requests and the preset normalization factor are divided to obtain the request number characteristics of the different access periods of the same user; specifically, the user The mathematical expression of the total number of access requests to the digital substation power industrial control system in the pth time period on the dth day can be expressed as the following formula (4):

[0085]

[0086] user Characteristics of the number of requests for accessing the digital substation power control system in the pth time period on the dth day The mathematical expression of can be expressed as follows:

[0087]

[0088] Wherein, α is the preset normalization factor for data quantization. The value of the preset normalization factor may be 1000, and the value of the preset normalization factor may be set according to actual needs.

[0089] Step S207: Calculating based on the uploaded data byte count, the downloaded data byte count and the preset normalization factor of each data packet in different access periods of the same user, to obtain data features of different access periods of the same user;

[0090] In the specific implementation process of this step, the uploaded data byte count of each data packet in different access periods of the same user is The number of bytes of the downloaded data Perform addition operation to obtain the total number of bytes corresponding to different access periods of the same user; perform division operation based on the total number of bytes and the preset normalization factor to obtain data features of different access periods of the same user; specifically, the user The mathematical expression of the total number of bytes when accessing the digital substation power industrial control system in the pth time period on the dth day can be expressed as the following formula (6):

[0091]

[0092] user Data characteristics when accessing the digital substation power control system during the pth time period on the dth day It can be expressed as the following formula (7):

[0093]

[0094] Step S208: Calculating based on the number of unauthorized access bytes of each data packet in different access periods of the same user and the preset normalization factor, to obtain the permission characteristics of different access periods of the same user;

[0095] In the specific implementation process of this step, the number of unauthorized access bytes of each data packet in different access periods of the same user is added to obtain the total number of unauthorized access bytes corresponding to the different access periods of the same user; the total number of unauthorized access bytes and the preset normalization factor are divided to obtain the permission characteristics of the different access periods of the same user; specifically, the user The mathematical expression of the total number of bytes accessed without authorization when accessing the digital substation power industrial control system in the pth time period on the dth day can be expressed as the following formula (8):

[0096]

[0097] user Permission characteristics for accessing the digital substation power control system during the pth time period on the dth day It can be expressed as the following formula (9):

[0098]

[0099] Step S209: Calculating and processing based on the total number of data packets accessed by the same user in different access periods and the number of lost data packets in different access periods corresponding to each user, to obtain transmission characteristics of the same user in different access periods;

[0100] In the specific implementation process of this step, the user Transmission characteristics when accessing the digital substation power control system in the pth time period on the dth day It can be expressed as the following formula (10):

[0101]

[0102] Step S210: Calculating and processing the service access acceptance volume of different service types of the preset power industrial control system accessed by the same user at different access time periods and the preset service load corresponding to each different service type, to obtain service access characteristics of the same user at different access time periods;

[0103] In the specific implementation process of this step, the business access acceptance volume of different business types accessing the preset power industrial control system by the same user in different access time periods and the preset business load corresponding to each different business type are multiplied to obtain the first business access volume of different business types accessing the preset power industrial control system by the same user in different access time periods; the first business access volume of each different business type is added to obtain the total business access volume; the business access acceptance volume of each different business type is added to obtain the total business access acceptance volume; the business access total volume is divided by the total business access acceptance volume to obtain the business access feature. User Service access characteristics when accessing the digital substation power industrial control system in the pth time period on the dth day It can be expressed as the following formula (11):

[0104]

[0105] Step S211: storing the network traffic information and the security feature data of each of the different access time periods corresponding to each of the users in a preset security feature database;

[0106] In the specific implementation process of this step, the storage structure of the preset security feature database F includes flow information and feature information. For example, a total of V pieces of data are stored in the feature database F, F = {C1, C2, ..., C V}, Article V Data v=1,2,…,V; each data has 15 information fields, where the user storage format is: year-month-day-dpi, represented by 4 digits, 2 digits, 2 digits, 4 digits, 2 digits, 4 digits, source IP address Represented and stored in a 128-bit binary array, access request count The number of bytes of uploaded data Download data bytes Unauthorized access to bytes Number of lost packets Business access acceptance Business access denial Expressed in decimal, IP characteristics Indicated by 0 or 1, request count feature Data characteristics Permission characteristics Transmission characteristics Service access characteristics Express it in decimal and save it to 2 decimal places.

[0107] Step S212: performing feature scoring based on the security feature data of different access periods of the same user, the scoring rules corresponding to the security feature data, the business access rejection amount of different business types of access to the preset power industrial control system, and the scoring rules corresponding to the business access rejection amount, to obtain security risk scores corresponding to each access period of the same user;

[0108] In the specific implementation process of this step, feature scoring is performed based on the security feature data of the same user and the scoring rules corresponding to each security feature data to obtain a first feature score value corresponding to each security feature data; the first feature score includes IP feature score, request number feature score, data feature score, permission feature score, transmission feature score and service access feature score. For example: user IP feature score in the p-th time period on the d-th day The mathematical expression of the corresponding scoring rule can be expressed as follows:

[0109]

[0110] user Feature score of the number of requests in the p-th time period on the d-th day The mathematical expression of the corresponding scoring rule can be expressed as follows:

[0111]

[0112] user Data feature score in the p-th time period on the d-th day The mathematical expression of the corresponding scoring rule can be expressed as follows:

[0113]

[0114] user The authority feature score in the p-th time period on the d-th day The mathematical expression of the corresponding scoring rule can be expressed as follows:

[0115]

[0116] user Transmission characteristic score in the p-th time period on the d-th day The mathematical expression of the corresponding scoring rule can be expressed as follows:

[0117]

[0118] user The service access feature score in the p-th time period on the d-th day The mathematical expression of the corresponding scoring rule can be expressed as follows:

[0119]

[0120] Based on the amount of business access rejections of different business types of each user accessing the preset power industrial control system in different access periods and the scoring rules corresponding to the amount of business access rejections, a second feature score value of different business types of each user accessing the preset power industrial control system in different access periods is obtained; the second feature score value includes the business rejection feature score of different business types of each user accessing the preset power industrial control system in different access periods. User Service rejection feature score in the p-th time period on the d-th day The mathematical expression of the corresponding scoring rule can be expressed as follows:

[0121]

[0122] The first feature score value and the second feature score value of the same user in the same access period are calculated and processed to obtain the security risk score corresponding to each access period of the same user. Security risk score of the digital substation power industrial control system in the pth time period on the dth day The mathematical expression of can be expressed as follows:

[0123]

[0124] Step S213: Calculating and processing the security risk scores of the users in the same access period to obtain the security risk comprehensive scores corresponding to the access periods;

[0125] In the specific implementation process of this step, the mathematical expression of the comprehensive security risk score of the digital substation power industrial control system of N users in the pth time period on the dth day can be expressed as the following formula (20):

[0126]

[0127] Step S214: Perform risk prediction based on the comprehensive security risk scores and preset risk level classification rules to obtain data risk levels corresponding to the access time periods.

[0128] In the specific implementation process of this step, the mathematical expression of the preset risk level classification rule can be expressed as the following formula (21):

[0129]

[0130] Security risk comprehensive score S d,p The value range is [0,60]. d,p According to the value, the cyber security risk level L of the digital substation power industrial control system is divided into no significant impact or dangerous level X 1d,p , low impact or danger level X 2d,p , Medium Impact or Danger Level X 3d,p , high impact or danger level X 4d,p , severe impact or danger level X 5d,p The data risks of the power industrial control system are divided into five levels, and the real-time data can be displayed. Operation and maintenance personnel can intuitively investigate the data risk information of several periods within the target time range of the power industrial control system, and can take risk data processing measures based on the data risk information to improve the data security and network security of the power industrial control system.

[0131] This application takes into account multiple indicators of the digital substation power industrial control system network, which can more comprehensively and accurately evaluate the security risks of the digital substation power industrial control system network, and provide a reliable basis for the secure operation of the digital substation power industrial control system network.

[0132] Another embodiment of the present application provides a data risk prediction device for an electric power industrial control system, such as Figure 2 As shown, including:

[0133] An acquisition module 1 is used to acquire risk prediction data of a preset power industrial control system, wherein the risk prediction data includes data packets of each user accessing the preset power industrial control system in different access periods;

[0134] Information extraction module 2, used for extracting network flow information from each of the data packets to obtain network flow information of each of the different access time periods corresponding to each of the users;

[0135] A feature extraction module 3 is used to extract features based on each of the network traffic information to obtain security feature data for each of the different access time periods corresponding to each of the users;

[0136] The risk prediction module 4 is used to perform risk prediction based on each of the security feature data to obtain a data risk prediction result of the power industrial control system.

[0137] In the specific implementation process, the information extraction module 2 is specifically used to: determine the business access acceptance and business access rejection of different business types of each user accessing the preset power industrial control system in different access time periods based on each of the data packets; parse the data packets of the same user in different access time periods to obtain data packet information of different data packets of the same user, and the data packet information includes the source IP address, the number of access requests, the number of uploaded data bytes, the number of downloaded data bytes, and the number of unauthorized access bytes; parse the total number of data packets of each user in different access time periods to obtain the number of lost data packets corresponding to each user in different access time periods.

[0138] In the specific implementation process, the information extraction module 2 is also used to: extract features based on the source IP addresses of each data packet in different access periods of the same user to obtain IP features of different access periods of the same user; calculate based on the number of access requests of each data packet in different access periods of the same user and the preset normalization factor to obtain the request number features of different access periods of the same user; calculate based on the number of uploaded data bytes, the number of downloaded data bytes and the preset normalization factor of each data packet in different access periods of the same user to obtain data features of different access periods of the same user; calculate based on the number of unauthorized access bytes of each data packet in different access periods of the same user and the preset normalization factor to obtain the permission features of different access periods of the same user; calculate and process based on the total number of data packets accessed by the same user in different access periods and the number of lost data packets corresponding to each user in different access periods to obtain the transmission features of different access periods of the same user; calculate and process based on the business access acceptance volume of different business types of accessing the preset power industrial control system by the same user in different access periods and the preset business load corresponding to each different business type to obtain the business access features of different access periods of the same user.

[0139] During the specific implementation process, the information extraction module 2 is also used to: obtain the source IP addresses of different data packets in different access periods of the same user; filter each source IP address to obtain a first target source IP address and a second target source IP address; perform calculations based on the first target source IP address and the second target source IP address to obtain a difference mask; when the difference mask is equal to a predetermined mask value, determine the first feature value as the IP feature; when the difference mask is not equal to the predetermined mask value, determine the second feature value as the IP feature.

[0140] In the specific implementation process, the power industrial control system data risk prediction device also includes a storage module, which is specifically used to store the network traffic information and the security feature data of each different access time period corresponding to each user in a preset security feature database.

[0141] During the specific implementation process, the risk prediction module 4 is specifically used to: perform feature scoring based on the security feature data of different access time periods of the same user, the scoring rules corresponding to the security feature data, the business access rejection volume of different business types accessing the preset power industrial control system, and the scoring rules corresponding to the business access rejection volume, to obtain the security risk scores corresponding to each access time period of the same user; perform calculations based on the security risk scores of each user in the same access time period to obtain the comprehensive security risk scores corresponding to each access time period; perform risk prediction based on each comprehensive security risk score and the preset risk level classification rules to obtain the data risk level corresponding to each access time period.

[0142] During the specific implementation process, the risk prediction module 4 is also used to: perform feature scoring based on the security feature data of the same user and the scoring rules corresponding to each security feature data to obtain a first feature score value corresponding to each security feature data; perform feature scoring based on the business access rejection amount of different business types of each user accessing the preset power industrial control system in different access time periods and the scoring rules corresponding to the business access rejection amount to obtain a second feature score value of different business types of each user accessing the preset power industrial control system in different access time periods; perform calculations based on the first feature score value and the second feature score value of the same access time period of the same user to obtain the security risk scores corresponding to each access time period of the same user.

[0143] This application takes into account multiple indicators of the digital substation power industrial control system network, which can more comprehensively and accurately evaluate the security risks of the digital substation power industrial control system network, and provide a reliable basis for the secure operation of the digital substation power industrial control system network.

[0144] Another embodiment of the present application provides a storage medium, wherein the storage medium stores a computer program, and when the computer program is executed by a processor, the following method steps are implemented:

[0145] Step 1: obtaining risk prediction data of a preset power industrial control system, wherein the risk prediction data includes data packets of each user accessing the preset power industrial control system at different access periods;

[0146] Step 2: extracting network traffic information from each of the data packets to obtain network traffic information for each of the different access time periods corresponding to each of the users;

[0147] Step 3: extracting features based on the network traffic information to obtain security feature data for the different access time periods corresponding to the users;

[0148] Step 4: Perform risk prediction based on each of the security feature data to obtain a data risk prediction result of the power industrial control system.

[0149] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0150] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0151] The specific implementation process of the above method steps can refer to the embodiments of any of the above-mentioned power industrial control system data risk prediction methods, and this embodiment will not be repeated here.

[0152] This application takes into account multiple indicators of the digital substation power industrial control system network, which can more comprehensively and accurately evaluate the security risks of the digital substation power industrial control system network, and provide a reliable basis for the secure operation of the digital substation power industrial control system network.

[0153] Another embodiment of the present application provides an electronic device, which may be a server, and the electronic device includes a processor, a memory, a network interface, and a database connected via a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile and / or volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the electronic device is used to communicate with an external client via a network connection. When the electronic device program is executed by the processor, it implements the functions or steps of a method for predicting data risk in an electric power industrial control system on the server side.

[0154] In one embodiment, an electronic device is provided, which may be a client. The electronic device includes a processor, a memory, a network interface, a display screen, and an input device connected via a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the electronic device is used to communicate with an external server via a network connection. When the electronic device program is executed by the processor, it implements the functions or steps on the client side of a method for predicting data risk in an electric power industrial control system.

[0155] Another embodiment of the present application provides an electronic device, comprising at least a memory and a processor, wherein the memory stores a computer program, and the processor implements the following method steps when executing the computer program in the memory:

[0156] Step 1: obtaining risk prediction data of a preset power industrial control system, wherein the risk prediction data includes data packets of each user accessing the preset power industrial control system at different access periods;

[0157] Step 2: extracting network traffic information from each of the data packets to obtain network traffic information for each of the different access time periods corresponding to each of the users;

[0158] Step 3: extracting features based on the network traffic information to obtain security feature data for the different access time periods corresponding to the users;

[0159] Step 4: Perform risk prediction based on each of the security feature data to obtain a data risk prediction result of the power industrial control system.

[0160] The specific implementation process of the above method steps can refer to the embodiments of any of the above-mentioned power industrial control system data risk prediction methods, and this embodiment will not be repeated here.

[0161] This application takes into account multiple indicators of the digital substation power industrial control system network, which can more comprehensively and accurately evaluate the security risks of the digital substation power industrial control system network, and provide a reliable basis for the secure operation of the digital substation power industrial control system network.

[0162] The above embodiments are only exemplary embodiments of the present application and are not intended to limit the present application. The protection scope of the present application is defined by the claims. Those skilled in the art may make various modifications or equivalent substitutions to the present application within the essence and protection scope of the present application, and such modifications or equivalent substitutions shall also be deemed to fall within the protection scope of the present application.

Claims

1. A method for predicting data risk in an electric power industrial control system, characterized in that: include: Acquire risk prediction data for a preset power industrial control system, wherein the risk prediction data includes data packets of each user accessing the preset power industrial control system in different access periods; Extracting network traffic information from each of the data packets to obtain network traffic information for each of the different access time periods corresponding to each of the users; Perform feature extraction based on each of the network traffic information to obtain security feature data for each of the different access time periods corresponding to each of the users; Risk prediction is performed based on each of the safety feature data to obtain a data risk prediction result of the electric power industrial control system.

2. The method according to claim 1, characterized in that The extracting of network traffic information from each of the data packets to obtain network traffic information of each of the different access time periods corresponding to each of the users specifically includes: Based on each of the data packets, determining the amount of business access acceptance and the amount of business access rejection of each of the users for accessing different business types of the preset power industrial control system during different access time periods; Parsing data packets of the same user in different access periods to obtain data packet information of different data packets of the same user, wherein the data packet information includes a source IP address, a number of access requests, a number of bytes of uploaded data, a number of bytes of downloaded data, and a number of bytes of unauthorized access; The total number of data packets in different access time periods of each user is parsed to obtain the number of lost data packets in different access time periods corresponding to each user.

3. The method according to claim 2, characterized in that The feature extraction based on each of the network traffic information to obtain security feature data of each of the different access time periods corresponding to each of the users specifically includes: Extract features based on the source IP addresses of each data packet of the same user in different access periods to obtain IP features of the same user in different access periods; Calculate based on the number of access requests of each data packet in different access periods of the same user and a preset normalization factor to obtain the request number characteristics of different access periods of the same user; Calculate based on the uploaded data byte count, the downloaded data byte count and the preset normalization factor of each data packet in different access periods of the same user to obtain data features of different access periods of the same user; Calculating based on the number of unauthorized access bytes of each data packet in different access periods of the same user and the preset normalization factor, obtaining the permission characteristics of the different access periods of the same user; Calculate and process the total number of data packets accessed by the same user in different access periods and the number of lost data packets in different access periods corresponding to each user to obtain transmission characteristics of the same user in different access periods; Based on the business access acceptance volume of different business types of the preset power industrial control system accessed by the same user in different access time periods and the preset business load corresponding to each different business type, the business access characteristics of the same user in different access time periods are obtained.

4. The method according to claim 3, characterized in that The feature extraction based on the source IP address of each data packet in different access time periods of the same user to obtain the IP features of the same user in different access time periods specifically includes: Obtaining source IP addresses of different data packets of the same user in different access periods; Filter each of the source IP addresses to obtain a first target source IP address and a second target source IP address; Performing calculation based on the first target source IP address and the second target source IP address to obtain a difference mask; When the difference mask is equal to a predetermined mask value, determining the first feature value as the IP feature; When the difference mask is not equal to the predetermined mask value, the second feature value is determined as the IP feature.

5. The method according to claim 1, characterized in that Before performing risk prediction based on each of the security feature data to obtain a data risk prediction result of the power industrial control system, the method further includes: The network traffic information and the security feature data of each of the different access time periods corresponding to each of the users are stored in a preset security feature database.

6. The method according to claim 1, characterized in that The risk prediction based on each of the security feature data is performed to obtain the data risk prediction result of the power industrial control system, specifically including: Based on the security feature data of the same user in different access periods, the scoring rules corresponding to the security feature data, the business access rejection amount of different business types of access to the preset power industrial control system, and the scoring rules corresponding to the business access rejection amount, feature scoring is performed to obtain security risk scores corresponding to each access period of the same user; Calculate and process the security risk scores of each user in the same access period to obtain a comprehensive security risk score corresponding to each access period; Risk prediction is performed based on the comprehensive scores of each security risk and preset risk level classification rules to obtain the data risk level corresponding to each access time period.

7. The method according to claim 6, characterized in that The feature scoring is performed based on the security feature data of different access periods of the same user, the scoring rules corresponding to the security feature data, the business access rejection amount of different business types of access to the preset power industrial control system, and the scoring rules corresponding to the business access rejection amount, to obtain the security risk scores corresponding to each access period of the same user, specifically including: Perform feature scoring based on each of the security feature data of the same user and a scoring rule corresponding to each of the security feature data to obtain a first feature scoring value corresponding to each of the security feature data; Perform feature scoring based on the amount of service access rejections of different service types of each user accessing the preset power industrial control system in different access time periods and a scoring rule corresponding to the amount of service access rejections, to obtain a second feature score value of different service types of each user accessing the preset power industrial control system in different access time periods; The security risk scores corresponding to the respective access time periods of the same user are obtained by performing calculation based on the first feature score value and the second feature score value of the same user in the same access time period.

8. A data risk prediction device for an electric power industrial control system, characterized in that: include: An acquisition module, used for acquiring the to-be-risk-predicted data of a preset power industrial control system, wherein the to-be-risk-predicted data includes data packets of each user accessing the preset power industrial control system in different access periods; An information extraction module, used to extract network flow information from each of the data packets to obtain network flow information for each of the different access time periods corresponding to each of the users; A feature extraction module, used for performing feature extraction based on each of the network traffic information to obtain security feature data of each of the different access time periods corresponding to each of the users; The risk prediction module is used to perform risk prediction based on each of the security feature data to obtain a data risk prediction result of the power industrial control system.

9. A storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method for predicting data risk of an electric power industrial control system described in any one of claims 1 to 7 are implemented.

10. An electronic device, characterized in that: The method at least comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method for predicting data risk of an electric power industrial control system as described in any one of claims 1 to 7 when executing the computer program on the memory.

Images