Power monitoring network security detection method and related device

Abstract

The invention provides an electric power monitoring network security detection method and a related device, and relates to the technical field of electric power monitoring, and the method comprises the steps: obtaining data information in an electric power monitoring network; extracting key data features related to network security based on the data information, and scanning security vulnerabilities based on the key data features; and carrying out abnormal behavior identification and alarm based on the data information. According to the power monitoring network security detection method, the data information in the power monitoring network is acquired, the key data features are extracted based on the data information, and the key data features are related to the network security, so that security vulnerabilities are scanned based on the key data features, and meanwhile, abnormal behavior identification and alarm can be performed based on the data information; according to the method, the network flow of the power monitoring system can be monitored in real time, potential network attacks and abnormal behaviors can be quickly identified and judged, the detection efficiency is high, and the identification accuracy of attack types is improved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of electric power monitoring, and in particular to a method for detecting electric power monitoring network security and related devices. Background Art

[0002] Power monitoring refers to a series of monitoring, analysis and management activities of power systems, equipment and operating status. Its main purpose is to ensure the safe, reliable and economical operation of the power system by timely discovering and handling potential problems through real-time monitoring of the power system. The application of power monitoring system brings many advantages. It improves production efficiency. By real-time monitoring of the operating status of power equipment, faults can be discovered and early-warned in time, thereby reducing downtime caused by faults. Secondly, power monitoring reduces costs. By remotely monitoring and managing power equipment, human resource investment is reduced, thereby reducing maintenance costs and operating costs. The power monitoring system can also collect and analyze the operating data of power equipment, provide data support and decision-making reference for enterprises, and help enterprises optimize production processes and improve production efficiency and quality.

[0003] In the power monitoring system, network security has always been an important concern, but traditional security detection methods often have many shortcomings. Traditional power monitoring network security detection systems often use regular manual inspections and log analysis to perform security detections, which are prone to problems such as low detection efficiency and high false alarm and missed alarm rates. With the increasing complexity of network attack methods and the continuous escalation of network threats, this traditional security detection method can no longer meet the high requirements of power monitoring systems for network security. Summary of the invention

[0004] The purpose of the embodiments of the present disclosure is to provide a power monitoring network security detection method and related devices to solve the problems in the prior art that power monitoring network security detection relies on manual inspection and log analysis, has low detection efficiency, and has a high false alarm and missed alarm rate.

[0005] In order to solve the above technical problems, the first aspect of the present invention provides a power monitoring network security detection method, including: obtaining data information in the power monitoring network; extracting key data features related to network security based on the data information, and scanning security vulnerabilities based on the key data features; based on the data information, identifying and alarming abnormal behaviors.

[0006] Furthermore, the data information includes at least network traffic data, device status data, event log data, user behavior data and security threat feature data.

[0007] Furthermore, the extracting of key data features related to network security based on the data information includes: processing the data information based on a K-means clustering algorithm to form K network security feature clusters, each of the network security feature clusters including multiple data points, each data point consisting of features in the data information; performing behavior pattern analysis based on the data points in the network security feature clusters to extract the key data features.

[0008] Furthermore, the scanning of security vulnerabilities based on the key data features includes: comparing and analyzing the key data features based on a vulnerability database to determine the existing security vulnerabilities; and judging the severity of the security vulnerabilities based on the consequences caused by the security vulnerabilities.

[0009] Furthermore, the K-means clustering algorithm is used to process the data information to form K network security feature clusters, including: presetting the number of clusters K; randomly selecting K data points in the data information as initial cluster centers, denoted as According to the distance between each data point and the cluster center, each data point is assigned to the cluster with the closest distance, the average value of all data points in each cluster is calculated, and the average value is used as the new cluster center for iteration. For each cluster center k, the sum of squared errors within the class is recalculated. In the formula, M represents the total number of data points, x i represents the i-th data point, μ represents the set of cluster centers, represents the cluster center of the class to which the i-th data point belongs, c i Indicates the category to which the i-th data point belongs; when the change in the cluster center decreases to the first threshold, or when the number of iterations reaches the preset maximum number of iterations, K network security feature clusters are formed.

[0010] Furthermore, the identification and alarm of abnormal behavior based on the data information includes: identifying abnormal behavior based on comparative analysis of historical data and real-time data in the data information; classifying the data information into normal data and abnormal data through a support vector machine classifier, and judging whether new network traffic data is a normal connection or a malicious connection based on the normal data and the abnormal data, and issuing an alarm of abnormal behavior when the new network traffic data is a malicious connection.

[0011] Furthermore, the algorithm used by the support vector machine classifier is:

[0012] f(x)=sign(ω·x+b);

[0013] In the formula, x is a characteristic vector in the data information, ω is a hyperplane normal vector, and b is a hyperplane intercept; the method of judging whether the new network traffic data is a normal connection or a malicious connection based on the normal data and the abnormal data includes: when f(x)>0, judging that the new network traffic data is a normal connection; when f(x)<0, judging that the new network traffic data is a malicious connection.

[0014] The second aspect of the present invention provides a power monitoring network security detection device, including: an input module for acquiring data information in the power monitoring network; an analysis module for extracting key data features related to network security based on the data information, and scanning security vulnerabilities based on the key data features; and also for identifying and alarming abnormal behavior based on the data information.

[0015] A third aspect of the present invention provides a storage medium storing a computer program, which, when executed by a processor, implements the steps of the power monitoring network security detection method.

[0016] A fourth aspect of the present invention provides an electronic device, which includes at least a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the power monitoring network security detection method when executing the computer program in the memory.

[0017] The electric power monitoring network security detection method of the present invention obtains data information in the electric power monitoring network, extracts key data features based on the data information, and these key data features are related to network security, thereby scanning security loopholes based on the key data features. At the same time, abnormal behavior can also be identified and alarmed based on the data information; the network traffic of the electric power monitoring system can be monitored in real time, potential network attacks and abnormal behaviors can be quickly identified and judged, the detection efficiency is high, and the accuracy of identifying attack types is improved.

[0018] The power monitoring network security detection device, storage medium and electronic device in the present invention have all the beneficial effects of the above-mentioned power monitoring network security detection method, which will not be described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0020] Figure 1A schematic diagram of the steps of the power monitoring network security monitoring method provided by the present invention;

[0021] Figure 2 This is a structural block diagram of the power monitoring network security monitoring device provided by the present invention. DETAILED DESCRIPTION

[0022] It should be understood that various modifications may be made to the embodiments of the present application. Therefore, the above description should not be considered as limiting, but only as an example of an embodiment. Other modifications within the scope and spirit of the present disclosure will occur to those skilled in the art.

[0023] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the general description of the present disclosure given above and the detailed description of the embodiments given below, serve to explain the principles of the present disclosure.

[0024] These and other characteristics of the present disclosure will become apparent from the following description of a preferred form of embodiment given as a non-limiting example, with reference to the attached drawings.

[0025] It should also be understood that, although the present disclosure has been described with reference to some specific examples, those skilled in the art will be able to realize many other equivalent forms of the present disclosure that have the features described in the claims and are therefore within the scope of protection defined thereby.

[0026] The above and other aspects, features and advantages of the present disclosure will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings.

[0027] Specific embodiments of the present disclosure are described hereinafter with reference to the accompanying drawings; however, it should be understood that the embodiments claimed are merely examples of the present disclosure, which may be implemented in a variety of ways. Well-known and / or repeated functions and structures are not described in detail to avoid obscuring the present disclosure with unnecessary or redundant details. Therefore, the specific structural and functional details claimed herein are not intended to be limiting, but merely serve as a basis and representative basis for the claims to teach those skilled in the art to use the present disclosure in a variety of ways with substantially any suitable detailed structure.

[0028] This specification may use the phrases "in one embodiment," "in another embodiment," "in a further embodiment," or "in other embodiments," all of which may refer to one or more of the same or different embodiments according to the present disclosure.

[0029] The first aspect of the present invention provides a method for detecting network security of an electric power monitoring system. Figure 1 As shown, including:

[0030] S100, obtaining data information in the power monitoring network;

[0031] S200, extracting key data features related to network security based on the data information, and scanning for security vulnerabilities based on the key data features;

[0032] S300: Based on the data information, identify and alarm abnormal behaviors.

[0033] In step S100, data information in the power monitoring network is obtained. For example, through a preset interface and protocol, data information is collected in real time from each node of the power monitoring system, and the form of data information transmitted in the network is a data packet, which is a subdivision of data information at the network level. Specifically, the data information includes at least network traffic data (such as network traffic size), device status data (such as device startup, stop, parameter and other information), event log data (such as historical and real-time operation records), user behavior data (such as access, browsing and other behaviors) and security threat feature data (such as data tampering, forgery, etc.). In order to ensure the accuracy and integrity of the data, abnormal or invalid data can also be identified and eliminated through data verification and filtering mechanisms. In order to ensure the security of the data, encryption technology can also be used during data transmission to prevent the data from being stolen or tampered with during transmission.

[0034] In step S200, key data features related to network security are extracted based on the data information, and security vulnerabilities are scanned based on the key data features. The data information in the data packet includes the source address, the destination address, the port number, the protocol type, the data packet size, the transmission content, etc. The key data features extracted from these data information include but are not limited to: the source address and the destination address are specific internal address segments, or external suspicious addresses; the port number is a common service port, or an abnormally high-risk port; the protocol type is a standard protocol, or a suspicious custom protocol; the data packet size is within a reasonable size range, or is too large or too small; the transmission content is regular content, or malicious content containing specific keywords and instructions. These key data features are relevant to network security, and security vulnerabilities in the power monitoring network can be scanned through these key data features.

[0035] Furthermore, the extracting of key data features related to network security based on the data information includes:

[0036] S201, processing the data information based on a K-means clustering algorithm to form K network security feature clusters, each of which includes a plurality of data points, and each data point is composed of features in the data information;

[0037] S202: Performing behavior pattern analysis based on the data points in the network security feature cluster to extract the key data features.

[0038] In step S201, the data information is processed based on the K-means clustering algorithm to form K network security feature clusters, each of which includes multiple data points, and each data point is composed of features in the data information. An efficient data mining algorithm, namely the K-means clustering algorithm, is used to analyze the behavior pattern of the data information. The K-means clustering algorithm finally obtains K clusters, and the data points in each cluster are similar data points. The key data features can be extracted by analyzing the characteristics of these clusters.

[0039] In step S202, a behavior pattern analysis is performed based on the data points in the network security feature cluster to extract the key data features. After clustering is completed, the key data features related to network security are extracted by analyzing the distribution patterns and commonalities of the data points in each cluster. In addition to calculating the average flow and average transmission speed, the distribution of the source addresses and destination addresses of the data points in the cluster can also be analyzed, such as whether they are concentrated in certain specific network segments, the frequency of use of port numbers can be analyzed, whether there is a situation where a certain port number accounts for a high proportion in the cluster, and the distribution of protocol types can also be analyzed to see whether there are specific protocols that are more common in the cluster. Through these analyses, the behavior patterns of the data in the cluster can be further understood, thereby extracting more features related to network security.

[0040] Furthermore, the scanning of security vulnerabilities based on the key data features includes:

[0041] S203, comparing and analyzing the key data features based on the vulnerability database to determine the existing security vulnerabilities;

[0042] S204: Determine the severity of the security vulnerability based on the consequences caused by the security vulnerability.

[0043] In step S203, the key data features are compared and analyzed based on the vulnerability database to determine the existing security vulnerabilities. This process can be implemented through a vulnerability scanner, which uses a known vulnerability database (which records vulnerability types, attack modes, consequences, etc.) to compare and analyze the extracted key data features, thereby discovering security vulnerabilities in the power monitoring network. Data vulnerabilities that can be detected using known vulnerability databases and attack modes include: SQL injection vulnerabilities, where attackers obtain sensitive database information by injecting SQL statements into input fields; buffer overflow vulnerabilities, where the data written to the buffer exceeds the buffer capacity, which may cause the program to crash or execute malicious code; weak password vulnerabilities, where if a device or system uses a simple and easy-to-guess password, it is easy for an attacker to brute-force it into the system.

[0044] In step S204, the severity of the security vulnerability is determined based on the consequences caused by the security vulnerability. The severity can be determined based on the possible consequences of the security vulnerability, such as the impact of the security vulnerability on the operation of the power monitoring system, the impact on the stability of the power supply, the impact on the integrity and confidentiality of the data, etc. In one embodiment, the impact that the determined security vulnerability may cause is a power supply interruption, so it can be considered that the severity of the security vulnerability is high, and multiple severity levels can be preset manually during this process.

[0045] Furthermore, the data information is processed based on the K-means clustering algorithm to form K network security feature clusters, including:

[0046] The number of preset clusters K;

[0047] Randomly select K data points in the data information as the initial clustering centers, denoted as

[0048]

[0049] According to the distance between each data point and the cluster center (usually the Euclidean distance), each data point is assigned to the cluster with the closest distance, and the average value (center of mass) of all data points in each cluster is calculated. The average value is used as the new cluster center, and it is iterated (repeated above steps). For each class center k, the sum of squared errors within the class is recalculated. In the formula, M represents the total number of data points, x i represents the i-th data point, μ represents the set of cluster centers, represents the cluster center of the class to which the i-th data point belongs, c i Indicates the category to which the i-th data point belongs;

[0050] When the change in the cluster center is reduced to a first threshold (the first threshold can be set by yourself, which is equivalent to the cluster center no longer changing significantly), or when the number of iterations reaches the preset maximum number of iterations, K network security feature clusters are formed (each network security feature cluster contains a class of similar data points, which can be used as key data features by calculating, for example, the average traffic and average transmission speed of each cluster).

[0051] Furthermore, in step S300, based on the data information, abnormal behavior identification and alarm are performed, including:

[0052] S301, identifying abnormal behavior based on comparison and analysis of historical data and real-time data in the data information;

[0053] S302. Classify the data information into normal data and abnormal data through a support vector machine classifier, and determine whether the new network traffic data is a normal connection or a malicious connection based on the normal data and the abnormal data. When the new network traffic data is a malicious connection, issue an abnormal behavior alarm.

[0054] In step S301, abnormal behavior is identified based on the comparison and analysis of historical data and real-time data in the data information. The event log data in the data information contains a part of historical data and real-time data, and the network traffic data in the data information also contains a part of real-time data. These historical data are compared and analyzed with the real-time data. For example, if a certain IP address sends a large number of data packets in a short period of time, or a certain port receives data of an uncommon protocol type, an alarm for abnormal behavior can be issued.

[0055] In step S302, the data information is classified into normal data and abnormal data by a support vector machine classifier, and based on the normal data and the abnormal data, it is determined whether the new network traffic data is a normal connection or a malicious connection. When the new network traffic data is a malicious connection, an abnormal behavior alarm is issued. The key data features can be classified by a support vector machine (SVM) classifier to distinguish normal data from abnormal data. The support vector machine can find an optimal hyperplane by learning the existing sample data (referring to the known normal data and abnormal data accumulated during the system training process, which contain various characteristics of network traffic and corresponding connection type labels), so that normal data and abnormal data are distributed on both sides of the hyperplane. When new network traffic data enters the system, the support vector machine classifier can determine whether it is a normal connection or a malicious connection based on the feature vectors of these data. The specific algorithm formula is:

[0056] f(x)=sign(ω·x+b);

[0057] In the formula, f(x) represents the predicted value of the sample, x is the feature vector in the data information, ω is the hyperplane normal vector, and b is the hyperplane intercept;

[0058] The determining whether the new network traffic data is a normal connection or a malicious connection based on the normal data and the abnormal data includes:

[0059] When f(x)>0, the new network traffic data is judged to be a normal connection; when f(x)<0, the new network traffic data is judged to be a malicious connection. After judging that the new network traffic data is a malicious connection, the corresponding alarm mechanism can be triggered to serve as a reminder, which is conducive to the recovery of the power monitoring network.

[0060] By using a dynamic update mechanism, the numerical values ​​or settings used to build and train models in machine learning or data mining algorithms are continuously adjusted according to real-time data, including classifier parameters, feature weights or coefficients, threshold parameters, learning rates and other optimization parameters, so as to improve the accuracy and adaptability of intrusion detection. Classifier parameters include ω and b in the formula, feature weights or coefficients refer to the weight coefficients of the influence of different features on the classification results during the feature extraction process, and the learning rate is a parameter used to adjust the model learning speed during the training of the machine learning algorithm. Other optimization parameters include various parameters involved in the dynamic update mechanism for adjusting model performance, such as adjusting the number of clusters in the clustering algorithm and adjusting the decision boundary parameters in the classifier.

[0061] The electric power monitoring network security detection method of the present invention obtains data information in the electric power monitoring network, extracts key data features based on the data information, and these key data features are related to network security, thereby scanning security loopholes based on the key data features. At the same time, abnormal behavior can also be identified and alarmed based on the data information; the network traffic of the electric power monitoring system can be monitored in real time, potential network attacks and abnormal behaviors can be quickly identified and judged, the detection efficiency is high, and the accuracy of identifying attack types is improved.

[0062] The second aspect of the present invention provides a power monitoring network security detection device, combined with Figure 2 As shown, including:

[0063] An input module is used to obtain data information in the power monitoring network;

[0064] The analysis module is used to extract key data features related to network security based on the data information, and scan for security vulnerabilities based on the key data features; it is also used to identify and alarm abnormal behaviors based on the data information.

[0065] Furthermore, the power monitoring network security detection device also includes:

[0066] A storage module is used to store the analysis results (including key data features, abnormal behavior recognition results, alarm information, etc.) and data information of the analysis module;

[0067] An output module, used to output the analysis results of the analysis module;

[0068] The control module is used to control the operation of the input module, analysis module, output module and storage module.

[0069] The input module collects data from each node of the power monitoring system in real time through preset interfaces and protocols. This data information includes but is not limited to network traffic data, equipment status data, event log data, user behavior data, and security threat feature data. In order to ensure the accuracy and integrity of the data, the input module also has a data verification and filtering mechanism that can identify and eliminate abnormal or invalid data. After data collection, the data is transmitted to the analysis module through a secure and reliable network channel for further analysis. In order to ensure the security of the data, the input module will use encryption technology during the data transmission process to prevent the data from being stolen or tampered with during the transmission process.

[0070] The output module plays a vital role in the power monitoring network security detection system. It is responsible for presenting the analysis results obtained by the analysis module to the system administrator or security personnel in an appropriate manner, thereby assisting them in making decisions and taking corresponding countermeasures.

[0071] The storage module has efficient and reliable data storage capabilities to ensure long-term storage and fast access to data. The storage module is responsible for long-term storage of data transmitted from the input module. It uses efficient data storage technologies, such as distributed storage and compressed storage, to reduce storage space usage and increase data access speed. At the same time, the storage module also has data management functions, which can classify, index and query data to facilitate subsequent data analysis and query operations. In order to prevent data loss or damage, the storage module also has data backup and recovery functions. It can automatically back up data regularly and quickly restore data when needed. This ensures the reliability and availability of data, and can ensure data security even in the face of hardware failures, natural disasters and unpredictable events. In the process of data storage and management, the storage module pays attention to data security and privacy protection. It uses encryption technology to encrypt and store data to prevent data from being illegally accessed or leaked. At the same time, the storage module also has an access control mechanism, and only authorized users can access relevant data to ensure data confidentiality.

[0072] The control module is the core control center of the power monitoring network security detection system. It is responsible for coordinating and managing the operation of the entire system. When the system starts, the control module is responsible for the initialization and configuration of the system. It initializes the input module, analysis module, output module and storage module according to the preset parameters and rules to ensure that they can work normally. The control module schedules and coordinates each module according to the operation requirements and status of the system. It monitors the working status of each module and adjusts the working parameters and processes of the module as needed to optimize the performance and efficiency of the system. The control module is also responsible for the security management and monitoring of the system. It monitors the security status of the system, including network traffic, user behavior, and abnormal events, and promptly discovers and handles potential security threats. At the same time, the control module also has logging and auditing functions, which can record the system's operation logs and operation records, providing a basis for tracing and investigating security incidents. In order to ensure the stability and sustainability of the system, the control module is also responsible for the maintenance and upgrade of the system. It can regularly maintain and inspect the system to promptly discover and repair potential problems and vulnerabilities. At the same time, the control module also supports online upgrades and expansions of the system to adapt to the ever-changing network security environment and business needs.

[0073] The electric power monitoring network security detection device in the present invention can obtain data information in the electric power monitoring network, extract key data features based on the data information, and these key data features are related to network security, thereby scanning security loopholes based on the key data features. At the same time, abnormal behavior can also be identified and alarmed based on the data information; it can monitor the network traffic of the electric power monitoring system in real time, quickly identify and judge potential network attacks and abnormal behaviors, has high detection efficiency, and improves the accuracy of identifying attack types.

[0074] A third aspect of the present invention provides a storage medium storing a computer program, wherein when the computer program is executed by a processor, the steps of implementing the power monitoring network security detection method include:

[0075] S100, obtaining data information in the power monitoring network;

[0076] S200, extracting key data features related to network security based on the data information, and scanning for security vulnerabilities based on the key data features;

[0077] S300: Based on the data information, identify and alarm abnormal behaviors.

[0078] When the computer program in the storage medium of the present invention is executed by the processor, it can obtain data information in the power monitoring network, extract key data features based on the data information, and these key data features are related to network security, so as to scan security loopholes based on the key data features. At the same time, abnormal behavior can also be identified and alarmed based on the data information; the network traffic of the power monitoring system can be monitored in real time, potential network attacks and abnormal behaviors can be quickly identified and judged, the detection efficiency is high, and the accuracy of identifying attack types is improved.

[0079] A fourth aspect of the present invention provides an electronic device, the electronic device comprising at least a memory and a processor, the memory storing a computer program, the processor implementing the steps of the power monitoring network security detection method when executing the computer program on the memory, including:

[0080] S100, obtaining data information in the power monitoring network;

[0081] S200, extracting key data features related to network security based on the data information, and scanning for security vulnerabilities based on the key data features;

[0082] S300: Based on the data information, identify and alarm abnormal behaviors.

[0083] The electronic device in the present invention, when the computer program in its memory is executed by the processor, can obtain data information in the power monitoring network, extract key data features based on the data information, and these key data features are related to network security, so as to scan security loopholes based on the key data features. At the same time, abnormal behavior can also be identified and alarmed based on the data information; the network traffic of the power monitoring system can be monitored in real time, potential network attacks and abnormal behaviors can be quickly identified and judged, the detection efficiency is high, and the accuracy of identifying the attack type is improved.

[0084] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0085] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0086] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0087] In the embodiments provided in the present application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are only schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0088] If the integrated module is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned motor torque control method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0089] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A power monitoring network security detection method, characterized in that: include: Obtain data information from the power monitoring network; Extracting key data features related to network security based on the data information, and scanning for security vulnerabilities based on the key data features; Based on the data information, abnormal behavior is identified and an alarm is issued.

2. The power monitoring network security detection method according to claim 1 is characterized in that: The data information includes at least network traffic data, device status data, event log data, user behavior data and security threat feature data.

3. The power monitoring network security detection method according to claim 2 is characterized in that: The extracting of key data features related to network security based on the data information includes: Processing the data information based on a K-means clustering algorithm to form K network security feature clusters, each of which includes a plurality of data points, each of which is composed of features in the data information; Behavior pattern analysis is performed based on the data points in the network security feature cluster to extract the key data features.

4. The power monitoring network security detection method according to claim 1 is characterized in that: The scanning of security vulnerabilities based on the key data features includes: Compare and analyze the key data features based on the vulnerability database to determine the existing security vulnerabilities; Based on the consequences caused by the security vulnerability, the severity of the security vulnerability is determined.

5. The power monitoring network security detection method according to claim 3 is characterized in that: The K-means clustering algorithm is used to process the data information to form K network security feature clusters, including: The number of preset clusters K; Randomly select K data points in the data information as the initial clustering centers, denoted as According to the distance between each data point and the cluster center, each data point is assigned to the cluster with the closest distance, the average value of all data points in each cluster is calculated, and the average value is used as the new cluster center for iteration. For each cluster center k, the sum of squared errors within the class is recalculated. In the formula, M represents the total number of data points, x i represents the i-th data point, μ represents the set of cluster centers, represents the cluster center of the class to which the i-th data point belongs, c i Indicates the category to which the i-th data point belongs; When the variation of the cluster center decreases to a first threshold, or when the number of iterations reaches a preset maximum number of iterations, K network security feature clusters are formed.

6. The power monitoring network security detection method according to claim 1 is characterized in that: The identification and alarm of abnormal behavior based on the data information includes: Identify abnormal behavior based on comparison and analysis of historical data and real-time data in the data information; The data information is classified into normal data and abnormal data through a support vector machine classifier, and based on the normal data and the abnormal data, it is determined whether the new network traffic data is a normal connection or a malicious connection. When the new network traffic data is a malicious connection, an abnormal behavior alarm is issued.

7. The power monitoring network security detection method according to claim 6 is characterized in that: The algorithm used by the support vector machine classifier is: f(x)=sign(ω·x+b); In the formula, x is the eigenvector in the data information, ω is the hyperplane normal vector, and b is the hyperplane intercept; The determining whether the new network traffic data is a normal connection or a malicious connection based on the normal data and the abnormal data includes: When f(x)>0, the new network traffic data is judged to be a normal connection; When f(x) < 0, the new network traffic data is determined to be a malicious connection.

8. A power monitoring network security detection device, characterized in that: include: An input module is used to obtain data information in the power monitoring network; The analysis module is used to extract key data features related to network security based on the data information, and scan security vulnerabilities based on the key data features; it is also used to identify and alarm abnormal behaviors based on the data information.

9. A storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the power monitoring network security detection method according to any one of claims 1 to 7 are implemented.

10. An electronic device, comprising at least a memory and a processor, wherein a computer program is stored in the memory, wherein: The processor implements the steps of the power monitoring network security detection method according to any one of claims 1 to 7 when executing the computer program on the memory.

Images