Threat assessment method and system for electric power industrial control system of digital substation

Abstract

The invention discloses a threat assessment method and system for a digital substation electric power industrial control system, and relates to the technical field of electric power industrial control system network security. The method comprises the following steps: obtaining threat characteristic parameters according to the threat type of the digital substation electric power industrial control system, and establishing a threat characteristic model according to the threat characteristic parameters; summarizing all the threat feature models and carrying out matrix processing on the summarized models to obtain a total threat feature model; calculating an overall threat score of all threat feature parameters according to the threat feature general model; and setting an overall threat level, and performing overall threat level evaluation on the digital substation electric power industrial control system according to the overall threat score. According to the method, the problem of deficiencies in the aspects of threat feature data processing and threat risk assessment in the prior art can be solved, so that more accurate threat identification and more effective risk management are realized.

Description

Technical Field

[0001] The present invention relates to the technical field of network security of electric power industrial control systems, and in particular to a threat assessment method and system for an electric power industrial control system of a digital substation. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] In modern power systems, digital substations use advanced digital sensors, digital protection equipment and computer control systems to achieve comprehensive monitoring and control of power systems. The introduction of digital substations marks a major advancement in the management of power facilities. At the same time, the security issues of power industrial control systems have become increasingly prominent. Digital substation power industrial control systems involve many complex equipment, communication networks and software, so there are a large number of threat feature parameters. Existing technologies have significant limitations in processing threat feature parameters of complex power industrial control systems and conducting dynamic threat assessments. These parameters are not only huge in number, but also in diverse formats, which poses great challenges to security analysis. These technologies usually focus on static, single-dimensional data processing and lack the ability to conduct comprehensive and real-time threat analysis of the system. In addition, existing security protection measures and risk assessment methods often fail to adapt to the special needs of power industrial control systems and cannot provide adequate protection. The current threat analysis and assessment have the following problems:

[0004] (1) The digital substation power industrial control system involves many threat feature parameters. These parameters are not only huge in number but also in various formats. Analysts often find it difficult to extract specific threat information from complex data, and thus lack a clear understanding of the nature and extent of potential threats.

[0005] (2) The system can generate a large amount of security data, but in actual operation it is difficult to convert this data into an effective assessment of potential threat risks.

[0006] (3) In the threat analysis and assessment of the power industrial control system of the digital substation, there is a lack of unified standards and models to guide the analysis work. Different analysts may use different methods and standards to assess threats, resulting in inconsistent and difficult to compare assessment results. In addition, the lack of a unified threat assessment model also means that the system cannot automatically and standardizedly generate threat assessment reports, which affects the efficiency and accuracy of the analysis.

[0007] (4) The threat environment of power industrial control systems is dynamically changing, with new threats and attack methods constantly emerging. Existing threat analysis and assessment methods can often only assess known threats and lack the ability to predict and respond to unknown threats. Summary of the invention

[0008] In view of the deficiencies in the prior art, the purpose of the present invention is to provide a threat assessment method and system for a digital substation power industrial control system, which can solve the deficiencies of the prior art in threat feature data processing and threat risk assessment, thereby achieving more accurate threat identification and more effective risk management, thereby enhancing the overall security of the power industrial control system.

[0009] In order to achieve the above object, the present invention is implemented through the following technical solutions:

[0010] A first aspect of the present invention provides a threat assessment method for a digital substation power industrial control system, comprising the following steps:

[0011] Obtain threat feature parameters according to the threat type of the digital substation power industrial control system, and establish a threat feature model based on the threat feature parameters;

[0012] Summarize all threat feature models and perform matrix processing on the summarized models to obtain the overall threat feature model;

[0013] Calculate the overall threat score of all threat signature parameters based on the overall threat signature model;

[0014] Set the overall threat level and evaluate the overall threat level of the digital substation power industrial control system based on the overall threat score.

[0015] Further, threat types include masquerade threat, tampering threat, repudiation threat, disclosure threat, denial of service threat, and privilege escalation threat.

[0016] Furthermore, the specific steps of summarizing all threat feature models and matrixing the summarized models are as follows:

[0017] Summarize all threat feature models to establish a threat matrix for the power industrial control system of digital substations;

[0018] Standardize the threat matrix of digital substation power industrial control system;

[0019] The principal component matrix of the threat matrix of the power industrial control system of the digital substation is constructed to obtain the overall threat feature model.

[0020] Furthermore, the specific steps of constructing the main component matrix of the threat matrix of the digital substation power industrial control system are as follows:

[0021] The covariance matrix is ​​calculated according to the standardized threat matrix of the digital substation power industrial control system, and the eigenvalues ​​in the covariance matrix are obtained;

[0022] Set the principal component threshold and filter out the principal component eigenvalues ​​according to the principal component threshold;

[0023] The principal component matrix is ​​calculated based on the eigenvectors of the principal component eigenvalues.

[0024] Furthermore, the specific steps of calculating the overall threat score of all threat feature parameters according to the overall threat feature model are as follows:

[0025] Calculate the comprehensive score of each threat feature parameter of the digital substation power industrial control system based on the overall threat feature model;

[0026] Score the credibility of each threat characteristic parameter of the digital substation power industrial control system based on the comprehensive score;

[0027] The contribution of the overall threat to the power industrial control system of the digital substation is calculated based on the credibility score of each threat feature parameter;

[0028] The overall threat score of the digital substation power industrial control system is calculated based on the contribution.

[0029] Furthermore, the specific steps for calculating the contribution of the overall threat of the power industrial control system of the digital substation according to the credibility score of each threat feature parameter are as follows:

[0030] According to the credibility weight of each threat feature parameter, the credibility score of each threat feature parameter is summarized to obtain the contribution of the overall threat to the power industrial control system of the digital substation.

[0031] Furthermore, the overall threat level includes a low threat level, a medium threat level, and a high threat level.

[0032] A second aspect of the present invention provides a threat assessment system for a digital substation power industrial control system, comprising:

[0033] The data acquisition module is configured to acquire threat characteristic parameters according to the threat type of the power industrial control system of the digital substation, and establish a threat characteristic model according to the threat characteristic parameters;

[0034] The data processing module is configured to aggregate all threat feature models and perform matrix processing on the aggregated models to obtain a total threat feature model;

[0035] a data scoring module configured to calculate an overall threat score for all threat signature parameters based on an overall threat signature model;

[0036] The level assessment module is configured to set an overall threat level and conduct an overall threat level assessment on the digital substation power industrial control system according to the overall threat score.

[0037] Furthermore, in the data acquisition module, threat types include masquerade threat, tampering threat, repudiation threat, disclosure threat, denial of service threat and privilege escalation threat.

[0038] Furthermore, the data processing module includes:

[0039] A parameter summary module is configured to summarize all threat feature models to establish a threat matrix for the power industrial control system of a digital substation;

[0040] A standardization module, configured to standardize a threat matrix of a digital substation power industrial control system;

[0041] The principal component matrix module is configured to construct a principal component matrix of the threat matrix of the power industrial control system of the digital substation to obtain a total threat feature model.

[0042] Furthermore, the principal component matrix module is configured as follows:

[0043] The covariance matrix is ​​calculated according to the standardized threat matrix of the digital substation power industrial control system, and the eigenvalues ​​in the covariance matrix are obtained;

[0044] Set the principal component threshold and filter out the principal component eigenvalues ​​according to the principal component threshold;

[0045] The principal component matrix is ​​calculated based on the eigenvectors of the principal component eigenvalues.

[0046] Furthermore, the data scoring module includes:

[0047] A comprehensive scoring module is configured to calculate a comprehensive score of each threat feature parameter of the power industrial control system of the digital substation according to the overall threat feature model;

[0048] The credibility scoring module is configured to score the credibility of each threat characteristic parameter of the power industrial control system of the digital substation according to the comprehensive score;

[0049] A contribution module is configured to calculate the contribution of the overall threat of the digital substation power industrial control system according to the credibility score of each threat characteristic parameter;

[0050] The overall threat score module is configured to calculate the overall threat score of the digital substation power industrial control system according to the contribution degree.

[0051] Furthermore, the contribution module is configured as follows:

[0052] According to the credibility weight of each threat feature parameter, the credibility score of each threat feature parameter is summarized to obtain the contribution of the overall threat to the power industrial control system of the digital substation.

[0053] Furthermore, in the level assessment module, the overall threat level includes a low threat level, a medium threat level, and a high threat level.

[0054] A third aspect of the present invention provides a medium having a program stored thereon, which, when executed by a processor, implements the steps of the threat assessment method for a digital substation power industrial control system as described in the first aspect of the present invention.

[0055] The fourth aspect of the present invention provides a device, including a memory, a processor, and a program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps in the threat assessment method for a digital substation power industrial control system as described in the first aspect of the present invention are implemented.

[0056] One or more of the above technical solutions have the following beneficial effects:

[0057] (1) The present invention discloses a threat assessment method and system for a digital substation power industrial control system. The present invention is capable of extracting specific threat information using a principal component matrix, which provides a clear understanding of the nature and extent of potential threats, as the digital substation power industrial control system, which is large in number and has diverse formats, involves numerous threat feature parameters.

[0058] (2) The present invention discloses a threat assessment method and system for a digital substation power industrial control system, which has a complete security level assessment process and can convert a large amount of security data into an effective assessment of potential threat risks.

[0059] (3) The present invention discloses a threat assessment method and system for a digital substation power industrial control system, establishes a set of unified and reasonable assessment standards, has wide applicability and accurate assessment, and analysts can directly compare based on the assessment results and can also intuitively generate threat assessment reports, thus ensuring the efficiency and accuracy of the analysis.

[0060] (4) The present invention discloses a threat assessment method and system for a digital substation power industrial control system, which can predict the trend of threat parameters and provide early warning according to the dynamically changing threat environment of the power industrial control system, and can provide a theoretical basis for timely prediction and response to unknown threats.

[0061] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0063] Figure 1 The present invention is a flowchart of a threat assessment method for a digital substation power industrial control system in the first embodiment of the present invention. DETAILED DESCRIPTION

[0064] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0065] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "include" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or their combinations;

[0066] Embodiment 1:

[0067] Embodiment 1 of the present invention provides a threat assessment method for a digital substation power industrial control system. Figure 1 As shown, the following steps are included:

[0068] Step 1: Obtain threat feature parameters according to the threat type of the digital substation power industrial control system, and establish a threat feature model based on the threat feature parameters. Among them, the threat types include masquerade threat, tampering threat, denial threat, leakage threat, denial of service threat and privilege escalation threat.

[0069] According to the six types of threats in the STRIDE threat model, the threat to the power industrial control system of the digital substation is represented as f = {f1, f2, f3, f4, f5, f6}, where f1 represents masquerade threat, f2 represents tampering threat, f3 represents repudiation threat, f4 represents information leakage threat, f5 represents denial of service threat, and f6 represents privilege escalation threat. The threat feature parameters of the power industrial control system of the digital substation on day d are collected according to the threat type. d=1,2,…,N, where N represents the total number of days for threat collection. is the characteristic parameter of the camouflaged threat on day d, is the tampering threat characteristic parameter on day d, is the characteristic parameter of the denial threat on day d, is the characteristic parameter of information leakage threat on day d, is the characteristic parameter of the denial of service threat on day d, Threat signature parameters for D-day privilege escalation.

[0070] Day d camouflage threat characteristic parameters Contains the number of authentication failures Abnormal login location times It can be expressed as:

[0071]

[0072] Day d Tampering threat characteristic parameters Including the number of packets with discontinuous sequence numbers during transmission Number of packets with out-of-order sequence numbers Number of packet duplications Number of times data in the database has been tampered with It can be expressed as:

[0073]

[0074] Day d deniability threat characteristic parameters Including the number of illegal operations after the user logs into the system There is no log to trace the number of times a user performs illegal operations The number of times the operating system version changed during the user's operation The number of times the user's IP address does not match the specified IP address when using the system It can be expressed as:

[0075]

[0076] Information leakage threat characteristic parameters on day d Includes the number of times users access device configuration parameters Number of times the user accessed the account information The number of times users accessed the key parts of the power system operation data The number of times a user exported data in a manner that did not conform to normal business procedures It can be expressed as:

[0077]

[0078] Day d Denial of Service Threat Signature Parameters Includes the number of service interruption incidents when users are using the system Number of errors returned by the data collection service The number of errors returned by the remote control service The number of requests that the user did not comply with the protocol specifications It can be expressed as:

[0079]

[0080] Day d Privilege Escalation Threat Signature Parameters Includes the number of permission requests that the user did not authorize Number of times the user tried to crack the password Number of times the user tampered with the encryption key It can be expressed as:

[0081]

[0082] Step 2: Summarize all threat feature models and perform matrix processing on the summarized models to obtain the total threat feature model.

[0083] Step 2.1: Summarize all threat feature models to establish a threat matrix for the digital substation power industrial control system.

[0084] The threat characteristic parameters of the power industrial control system of the digital substation on the dth day are summarized to obtain the threat matrix A of the power industrial control system of the digital substation on the dth day. d :

[0085]

[0086] use Represents the threat feature parameter of the ith item on the dth day Threat signature parameters collected in the hth hour period, i = 1, 2, ..., 6, d = 1, 2, ..., N, h = 1, 2, ..., 24; N represents the total number of days.

[0087] Step 2.2: Standardize the threat matrix of the digital substation power industrial control system.

[0088] To ensure that all threat feature parameters are within the same numerical range, the threat matrix A of the power industrial control system of the digital substation on day d is d Perform Z-score standardization, the threat feature parameter of the ith item on the dth day The mean It can be expressed as:

[0089]

[0090] Parameters of the ith threat signature on day d Standard Deviation It can be expressed as:

[0091]

[0092] After Z-score standardization, the threat feature parameter of the ith item on the dth day is Threat signature parameters collected in the hth hour It can be expressed as

[0093]

[0094] Threat Matrix A of Digital Substation Power Industrial Control System d The standardized matrix Bd It can be expressed as:

[0095]

[0096] use Represents the standardized threat characteristic parameter of the ith item on the dth day Normalized threat signature parameters collected in the hth hour period, i = 1, 2, ..., 6, d = 1, 2, ..., N, h = 1, 2, ..., 24.

[0097] Step 2.3: Construct the principal component matrix of the threat matrix of the digital substation power industrial control system and obtain the overall threat feature model.

[0098] Step 2.3.1: Calculate the covariance matrix based on the standardized threat matrix of the digital substation power industrial control system and obtain the eigenvalues ​​in the covariance matrix.

[0099] Standardized threat signature parameter of item i on day d The mean It can be expressed as:

[0100]

[0101] Threat Matrix A of Digital Substation Power Industrial Control System d The standardized matrix B d The covariance matrix C d It can be expressed as:

[0102]

[0103] Definition C d The characteristic value of i=1,2,…,6.

[0104] In this embodiment, the characteristic value It reflects the variance of the corresponding eigenvector. Based on the characteristics of threat features, the larger the eigenvalue, the greater the variation of the threat feature parameter combination contained in the eigenvector in the data, and the more threat information it contains, which is more important for describing the overall characteristics of the threat feature parameters.

[0105] In descending order: Defining Eigenvalues The corresponding eigenvector is i=1,2,…,6, define I as the 6th-order unit matrix, for C d Perform eigenvalue decomposition, the specific calculation process is as follows:

[0106]

[0107] Step 2.3.2: Set the principal component threshold and filter out the principal component eigenvalues ​​according to the principal component threshold.

[0108] In order to reduce the data dimension to simplify calculation and analysis, and retain enough original data information to accurately evaluate the threat of the digital substation power industrial control system, the principal component threshold is defined as α, which can be adjusted according to the actual situation. By default, α is set to 0.8.

[0109] Define k as the number of principal components, k is determined as follows:

[0110]

[0111] The eigenvalues ​​satisfying formula (16) Defined as C d The principal component eigenvalues j=1,2,…,k, which will satisfy the eigenvalue of formula (16) The corresponding eigenvector Defined as C d The principal component j=1,2,…,k,

[0112] Step 2.3.3: Calculate the principal component matrix based on the eigenvectors of the principal component eigenvalues.

[0113] Definition D d Threat matrix A of the power industrial control system of digital substation on day d d The principal component matrix of C d The principal component The ith threat feature parameter in D, j = 1, 2, ..., k, i = 1, 2, ..., 6, d It can be expressed as:

[0114]

[0115] Step 3: Calculate the overall threat score of all threat signature parameters based on the overall threat signature model.

[0116] Step 3.1: Calculate the comprehensive score of each threat feature parameter of the digital substation power industrial control system based on the overall threat feature model.

[0117] Defining λ d′ C d The principal component eigenvalues The sum of d′ It can be expressed as:

[0118]

[0119] definition for The weight coefficient of It can be expressed as:

[0120]

[0121] definition D d The i-th threat feature parameter v d′ The combined value of (i), It can be expressed as:

[0122]

[0123] Step 3.2: Score the credibility of each threat feature parameter of the digital substation power industrial control system based on the comprehensive score.

[0124] In this embodiment, the credibility is set based on the comprehensive score of the threat feature parameters. A higher comprehensive score of the threat feature parameters indicates that it occupies a relatively important position in the system threat assessment, and to a certain extent, its credibility can be considered to be relatively high. Definition D d The i-th threat feature parameter v d′ (i ) The credibility weight coefficient of It can be expressed as:

[0125]

[0126] Step 3.3: Calculate the contribution of the overall threat to the power industrial control system of the digital substation based on the credibility score of each threat feature parameter.

[0127] According to the credibility weight of each threat feature parameter, the credibility score of each threat feature parameter is summarized to obtain the contribution of the overall threat of the digital substation power industrial control system:

[0128] definition is the threat characteristic parameter x of the power industrial control system of the digital substation on day d d The credibility score of It can be expressed as:

[0129]

[0130] Step 3.4: Calculate the overall threat score of the digital substation power industrial control system based on the contribution.

[0131] The threat score of the i-th threat feature of the power industrial control system of the digital substation on the dth day is defined as It can be expressed as:

[0132]

[0133] Define the overall threat score of the power industrial control system of the digital substation on day d as S d , S d It can be expressed as:

[0134]

[0135] The overall threat score of the digital substation power industrial control system is defined as S, which can be expressed as:

[0136]

[0137] Step 4: Set the overall threat level and evaluate the overall threat level of the digital substation power industrial control system according to the overall threat score. The overall threat level includes low threat level, medium threat level and high threat level.

[0138] The overall threat level of the digital substation power industrial control system is defined as L. According to the overall threat score S of the digital substation power industrial control system, the threat level of the digital substation power industrial control system can be graded. The specific grading method is as follows:

[0139]

[0140] Through the above classification, the threat assessment of the digital substation power industrial control system can be realized, and the threat situation of the digital substation power industrial control system can be obtained more intuitively and accurately.

[0141] The threat analysis and assessment method of a digital substation power industrial control system of the present invention provides an efficient and comprehensive solution, which can not only improve the accuracy of threat detection and provide innovative solutions for security protection, but also effectively guide the formulation of security strategies and provide solid protection for the safe operation of the power system.

[0142] Embodiment 2:

[0143] Embodiment 2 of the present invention provides a threat assessment system for a digital substation power industrial control system, including:

[0144] The data acquisition module is configured to acquire threat characteristic parameters according to the threat type of the power industrial control system of the digital substation, and establish a threat characteristic model according to the threat characteristic parameters;

[0145] Among them, threat types include masquerade threat, tampering threat, repudiation threat, disclosure threat, denial of service threat and privilege escalation threat.

[0146] The data processing module is configured to aggregate all threat feature models and perform matrix processing on the aggregated models to obtain a total threat feature model.

[0147] The data processing module includes:

[0148] A parameter summary module is configured to summarize all threat feature models to establish a threat matrix for the power industrial control system of a digital substation;

[0149] A standardization module, configured to standardize a threat matrix of a digital substation power industrial control system;

[0150] The principal component matrix module is configured to construct a principal component matrix of the threat matrix of the power industrial control system of the digital substation to obtain a total threat feature model.

[0151] The principal component matrix module is also configured to:

[0152] The covariance matrix is ​​calculated according to the standardized threat matrix of the digital substation power industrial control system, and the eigenvalues ​​in the covariance matrix are obtained;

[0153] Set the principal component threshold and filter out the principal component eigenvalues ​​according to the principal component threshold;

[0154] The principal component matrix is ​​calculated based on the eigenvectors of the principal component eigenvalues.

[0155] a data scoring module configured to calculate an overall threat score for all threat signature parameters based on an overall threat signature model;

[0156] The data scoring module includes:

[0157] A comprehensive scoring module is configured to calculate a comprehensive score of each threat feature parameter of the power industrial control system of the digital substation according to the overall threat feature model;

[0158] The credibility scoring module is configured to score the credibility of each threat characteristic parameter of the digital substation power industrial control system according to the comprehensive score;

[0159] A contribution module is configured to calculate the contribution of the overall threat of the digital substation power industrial control system according to the credibility score of each threat characteristic parameter;

[0160] The contribution module is also configured to:

[0161] According to the credibility weight of each threat feature parameter, the credibility score of each threat feature parameter is summarized to obtain the contribution of the overall threat to the power industrial control system of the digital substation.

[0162] The overall threat score module is configured to calculate the overall threat score of the digital substation power industrial control system according to the contribution degree.

[0163] The level assessment module is configured to set an overall threat level and conduct an overall threat level assessment on the digital substation power industrial control system according to the overall threat score.

[0164] Among them, the overall threat level includes low threat level, medium threat level and high threat level.

[0165] Embodiment three:

[0166] Embodiment 3 of the present invention provides a medium on which a program is stored. When the program is executed by a processor, the steps in the threat assessment method of the digital substation power industrial control system as described in Embodiment 1 of the present invention are implemented. The steps are:

[0167] Obtain threat feature parameters according to the threat type of the digital substation power industrial control system, and establish a threat feature model based on the threat feature parameters;

[0168] Summarize all threat feature models and perform matrix processing on the summarized models to obtain the overall threat feature model;

[0169] Calculate the overall threat score of all threat signature parameters based on the overall threat signature model;

[0170] Set the overall threat level and evaluate the overall threat level of the digital substation power industrial control system based on the overall threat score.

[0171] The detailed steps are the same as the threat assessment method for the digital substation power industrial control system provided in Example 1, and will not be repeated here.

[0172] Embodiment 4:

[0173] Embodiment 4 of the present invention provides a device, including a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, the steps of the threat assessment method for the digital substation power industrial control system according to Embodiment 1 of the present invention are implemented, and the steps are:

[0174] Obtain threat feature parameters according to the threat type of the digital substation power industrial control system, and establish a threat feature model based on the threat feature parameters;

[0175] Summarize all threat feature models and perform matrix processing on the summarized models to obtain the overall threat feature model;

[0176] Calculate the overall threat score of all threat signature parameters based on the overall threat signature model;

[0177] Set the overall threat level and evaluate the overall threat level of the digital substation power industrial control system based on the overall threat score.

[0178] The detailed steps are the same as the threat assessment method for the digital substation power industrial control system provided in Example 1, and will not be repeated here.

[0179] The steps involved in the above embodiments 2, 3 and 4 correspond to the method embodiment 1. For the specific implementation methods, please refer to the relevant description part of embodiment 1.

[0180] Those skilled in the art should understand that the modules or steps of the present invention described above can be implemented by a general-purpose computer device, or alternatively, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. The present invention is not limited to any specific combination of hardware and software.

[0181] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

[0182] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0183] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

Claims

1. A threat assessment method for a digital substation power industrial control system, characterized in that: The following steps are involved: Obtain threat feature parameters according to the threat type of the digital substation power industrial control system, and establish a threat feature model based on the threat feature parameters; Summarize all threat feature models and perform matrix processing on the summarized models to obtain the overall threat feature model; Calculate the overall threat score of all threat signature parameters based on the overall threat signature model; Set the overall threat level and evaluate the overall threat level of the digital substation power industrial control system based on the overall threat score.

2. The threat assessment method for a digital substation power industrial control system according to claim 1, characterized in that: Threat types include masquerade threat, tampering threat, repudiation threat, disclosure threat, denial of service threat, and privilege escalation threat.

3. The threat assessment method for a digital substation power industrial control system according to claim 1, characterized in that: The specific steps of summarizing all threat feature models and matrixing the summarized models are: Summarize all threat feature models to establish a threat matrix for the power industrial control system of digital substations; Standardize the threat matrix of digital substation power industrial control system; The principal component matrix of the threat matrix of the power industrial control system of the digital substation is constructed to obtain the overall threat feature model.

4. The threat assessment method for a digital substation power industrial control system according to claim 3, characterized in that: The specific steps of constructing the main component matrix of the threat matrix of the power industrial control system of the digital substation are: The covariance matrix is ​​calculated according to the standardized threat matrix of the digital substation power industrial control system, and the eigenvalues ​​in the covariance matrix are obtained; Set the principal component threshold and filter out the principal component eigenvalues ​​according to the principal component threshold; The principal component matrix is ​​calculated based on the eigenvectors of the principal component eigenvalues.

5. The threat assessment method for a digital substation power industrial control system according to claim 1, characterized in that: The specific steps for calculating the overall threat score of all threat signature parameters based on the overall threat signature model are: Calculate the comprehensive score of each threat feature parameter of the digital substation power industrial control system based on the overall threat feature model; Score the credibility of each threat characteristic parameter of the digital substation power industrial control system based on the comprehensive score; The contribution of the overall threat to the power industrial control system of the digital substation is calculated based on the credibility score of each threat feature parameter; The overall threat score of the digital substation power industrial control system is calculated based on the contribution.

6. The threat assessment method for a digital substation power industrial control system according to claim 5, characterized in that: The specific steps for calculating the contribution of the overall threat of the power industrial control system of the digital substation according to the credibility score of each threat feature parameter are as follows: According to the credibility weight of each threat feature parameter, the credibility score of each threat feature parameter is summarized to obtain the contribution of the overall threat to the power industrial control system of the digital substation.

7. The threat assessment method for a digital substation power industrial control system according to claim 1, characterized in that: The overall threat level includes low threat level, medium threat level and high threat level.

8. A threat assessment system for a digital substation power industrial control system, characterized in that: include: The data acquisition module is configured to acquire threat characteristic parameters according to the threat type of the power industrial control system of the digital substation, and establish a threat characteristic model according to the threat characteristic parameters; The data processing module is configured to aggregate all threat feature models and perform matrix processing on the aggregated models to obtain a total threat feature model; a data scoring module configured to calculate an overall threat score for all threat signature parameters based on an overall threat signature model; The level assessment module is configured to set an overall threat level and conduct an overall threat level assessment on the digital substation power industrial control system according to the overall threat score.

9. The threat assessment system for the digital substation power industrial control system according to claim 8, characterized in that: In the data acquisition module, threat types include masquerade threat, tampering threat, repudiation threat, disclosure threat, denial of service threat and privilege escalation threat.

10. The threat assessment system for the digital substation power industrial control system according to claim 8, characterized in that: The data processing module includes: A parameter summary module is configured to summarize all threat feature models to establish a threat matrix for the power industrial control system of a digital substation; A standardization module, configured to standardize a threat matrix of a digital substation power industrial control system; The principal component matrix module is configured to construct a principal component matrix of the threat matrix of the power industrial control system of the digital substation to obtain a total threat feature model.

11. The threat assessment system for the digital substation power industrial control system according to claim 10, characterized in that: The principal component matrix module is also configured to: The covariance matrix is ​​calculated according to the standardized threat matrix of the digital substation power industrial control system, and the eigenvalues ​​in the covariance matrix are obtained; Set the principal component threshold and filter out the principal component eigenvalues ​​according to the principal component threshold; The principal component matrix is ​​calculated based on the eigenvectors of the principal component eigenvalues.

12. The threat assessment system for the digital substation power industrial control system according to claim 8, characterized in that: The data scoring module includes: A comprehensive scoring module is configured to calculate a comprehensive score of each threat feature parameter of the power industrial control system of the digital substation according to the overall threat feature model; The credibility scoring module is configured to score the credibility of each threat characteristic parameter of the digital substation power industrial control system according to the comprehensive score; A contribution module is configured to calculate the contribution of the overall threat of the digital substation power industrial control system according to the credibility score of each threat characteristic parameter; The overall threat score module is configured to calculate the overall threat score of the digital substation power industrial control system according to the contribution degree.

13. The threat assessment system for the digital substation power industrial control system according to claim 12, characterized in that: The contribution module is also configured to: According to the credibility weight of each threat feature parameter, the credibility score of each threat feature parameter is summarized to obtain the contribution of the overall threat to the power industrial control system of the digital substation.

14. The threat assessment system for the digital substation power industrial control system according to claim 8, characterized in that: In the level assessment module, the overall threat level includes low threat level, medium threat level and high threat level.

15. A computer-readable storage medium, characterized in that: A plurality of instructions are stored therein, and the instructions are suitable for being loaded by a processor of a terminal device and executing the threat assessment method for a digital substation power industrial control system according to any one of claims 1-7.

16. A terminal device, characterized in that: It includes a processor and a computer-readable storage medium, the processor is used to implement each instruction; the computer-readable storage medium is used to store multiple instructions, and the instructions are suitable for being loaded by the processor and executing the threat assessment method of the digital substation power industrial control system described in any one of claims 1-7.

Images