Risk information early warning system of power system information communication network

Abstract

The invention discloses a risk information early warning system for an information communication network of an electric power system, belongs to the technical field of information communication security of the electric power system, and aims to solve the problem that an effective technical means for performing security dynamic early warning on confidential information does not exist in the information communication network of the large-scale electric power system. The system comprises a data acquisition module, a safety analysis module and a risk information early warning module. The data acquisition module is used for acquiring real-time data of a security event in a power system communication network; the security analysis module is used for analyzing and extracting attack behavior risks of security events in the communication network; and the risk information early warning module is used for comparing the data of the attack behavior risk with an early warning threshold value in real time, and sending an early warning signal when the data of the attack behavior risk is greater than or equal to the early warning threshold value. The method is used for carrying out security dynamic monitoring on the information communication network of the power system.

Description

Technical Field

[0001] The invention relates to a risk information early warning system for an electric power system information communication network, belonging to the technical field of electric power system information communication safety. Background Art

[0002] With the large-scale development of power systems, the scale of information and communication networks in power systems is also increasing day by day. Large-scale information and communication networks are playing an increasingly important role in power systems, and their network security issues are also arising. Leakage of confidential information and network attacks have become major challenges that need to be addressed urgently.

[0003] In the information and communication network of large-scale power systems, data collection and analysis are the basis of the dynamic early warning system for confidential information security. In the data analysis stage, the system needs to use machine learning and data mining technologies to process the collected data and identify abnormal behaviors and potential threats. Through real-time monitoring and analysis of data, security issues in the network can be discovered in a timely manner, and corresponding measures can be taken to ensure the security of confidential information in the communication network.

[0004] With the continuous development of large-scale communication networks and the increasing security threats they face, dynamic early warning of confidential information security is very important, and the identification and classification of security threats is an important part of the early warning system. Security threat identification and classification refers to the timely discovery and classification of potential threats in the network. These security threats include malware attacks, network intrusions, data leaks, etc., which can be dealt with by monitoring network traffic, analyzing log records, and using intrusion detection systems (IDS) and other technical means.

[0005] In large-scale communication networks, the application of technical means and algorithms can quickly and accurately identify potential security threats, and classify and grade them to effectively deal with network security risks. Therefore, it is necessary to attach importance to and strengthen security threat identification and classification. Real-time monitoring and alarm are important links in the dynamic early warning system for confidential information security in large-scale communication networks.

[0006] However, in the information and communication network of large-scale power systems, there is no effective technical means to provide dynamic and secure early warning for confidential information. Summary of the invention

[0007] The purpose of the present invention is to solve the problem that there is no effective technical means for dynamic security warning of confidential information in the information communication network of a large-scale power system, and to provide a risk information warning system for the information communication network of the power system.

[0008] The risk information early warning system of the power system information communication network described in the present invention comprises: a data acquisition module, a safety analysis module and a risk information early warning module;

[0009] The data acquisition module is used to collect real-time data of security events in the power system communication network;

[0010] The security analysis module is used to analyze and extract the attack behavior risks of security events in the communication network;

[0011] The risk information warning module is used to compare the data of the attack behavior risk with the warning threshold in real time, and send out a warning signal when the data of the attack behavior risk is greater than or equal to the warning threshold.

[0012] Preferably, the real-time data of the security event includes: network traffic, log information and abnormal behavior information.

[0013] Preferably, the data acquisition module is also used to: perform data cleaning and data deduplication on real-time data of security events.

[0014] Preferably, the specific method for the data collection module to collect real-time data of security events includes: network mirroring, log collector and security device log.

[0015] Preferably, the security analysis module analyzes and extracts the attack behavior risk of security events in the communication network, specifically including:

[0016] Establish a security incident information database and attack behavior feature database;

[0017] The security analysis module compares the information data in the security event information database and the attack behavior feature database with the real-time data collected by the data acquisition module, and extracts the similar data.

[0018] Advantages of the present invention: The risk information early warning system of the power system information communication network described in the present invention proposes a dynamic early warning method for confidential information security in a large-scale power system information communication network, which includes data acquisition, security analysis and risk early warning modules. It realizes the analysis of system security and reliability through the system architecture, can comprehensively analyze and process network data, and effectively identify various security threats, providing important support and guarantee for large-scale power system information communication networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a principle block diagram of the risk information early warning system of the power system information communication network described in the present invention. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0022] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments, but they are not intended to limit the present invention.

[0023] Embodiment 1:

[0024] Combine the following Figure 1 This embodiment is described. The risk information early warning system of the power system information communication network described in this embodiment includes: a data acquisition module, a safety analysis module and a risk information early warning module;

[0025] The data acquisition module is used to collect real-time data of security events in the power system communication network;

[0026] The security analysis module is used to analyze and extract the attack behavior risks of security events in the communication network;

[0027] The risk information warning module is used to compare the data of the attack behavior risk with the warning threshold in real time, and send out a warning signal when the data of the attack behavior risk is greater than or equal to the warning threshold.

[0028] Furthermore, the real-time data of the security incident includes: network traffic, log information and abnormal behavior information.

[0029] Furthermore, the data collection module is also used to: perform data cleaning and data deduplication on the real-time data of security events.

[0030] Furthermore, the specific method for the data collection module to collect real-time data of security events includes: network mirroring, log collector and security device log.

[0031] Furthermore, the security analysis module analyzes and extracts the attack behavior risk of security events in the communication network, specifically including:

[0032] Establish a security incident information database and attack behavior feature database;

[0033] The security analysis module compares the information data in the security event information database and the attack behavior feature database with the real-time data collected by the data acquisition module, and extracts the similar data.

[0034] Although the present invention is described herein with reference to specific embodiments, it should be understood that these embodiments are merely examples of the principles and applications of the present invention. It should therefore be understood that many modifications may be made to the exemplary embodiments and that other arrangements may be devised without departing from the spirit and scope of the present invention as defined by the appended claims. It should be understood that the various dependent claims and features described herein may be combined in a manner different from that described in the original claims. It should also be understood that features described in conjunction with individual embodiments may be used in other described embodiments.

Claims

1. A risk information early warning system for an electric power system information communication network, characterized in that: It includes: Data collection module, safety analysis module and risk information early warning module; The data acquisition module is used to collect real-time data of security events in the power system communication network; The security analysis module is used to analyze and extract the attack behavior risks of security events in the communication network; The risk information warning module is used to compare the data of the attack behavior risk with the warning threshold in real time, and send out a warning signal when the data of the attack behavior risk is greater than or equal to the warning threshold.

2. A risk information early warning system for an electric power system information communication network according to claim 1, characterized in that: The real-time data of the security incident includes: network traffic, log information and abnormal behavior information.

3. A risk information early warning system for an electric power system information communication network according to claim 1, characterized in that: The data collection module is also used to clean and deduplicate the real-time data of security events.

4. A risk information early warning system for an electric power system information communication network according to claim 1, characterized in that: The specific method for the data collection module to collect real-time data of security events includes: network mirroring, log collector and security device log.

5. The risk information early warning system of the power system information communication network according to claim 1 is characterized in that: The security analysis module analyzes and extracts the attack behavior risk of security events in the communication network, specifically including: Establish a security incident information database and attack behavior feature database; The security analysis module compares the information data in the security event information database and the attack behavior feature database with the real-time data collected by the data acquisition module, and extracts the similar data.

Images