Omnibearing power grid network equipment scanning system and method

Abstract

The invention provides an omnibearing power grid network equipment scanning system and method, and the system comprises a plurality of distributed scanning modules, each module communicates with scanned equipment through a network interface, and employs a scanning engine to automatically recognize and connect the network equipment, collect configuration information, operation states and safety parameters, and generate a safety evaluation report. And a scanning result is stored in the storage unit and is transmitted to the central control module through the communication unit. The central control module manages and coordinates the operation of the plurality of distributed scanning modules. And the data processing module is connected with the central control module, collects and analyzes the scanning data from the plurality of distributed scanning modules, detects potential security threats and network performance problems, and generates an overall security and performance evaluation report. The user interface module is connected with the central control module and the data processing module and provides an interface for a user to access scanning results and evaluation reports. According to the system, efficient network security monitoring and evaluation are realized through comprehensive management and analysis.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and in particular to an omnidirectional power grid network equipment scanning system and method. Background Art

[0002] In the prior art, the security and performance of power grid network equipment are usually evaluated through centralized scanning systems. These systems usually include one or more scanning engines to identify and connect to devices in the network, collect configuration information, operating status and security parameters, and generate security assessment reports. These scanning systems rely on a central processing unit to process and analyze all data to detect potential security threats and performance issues. This centralized architecture has a certain effectiveness in small-scale networks, but when dealing with large-scale distributed networks, it often faces data transmission bottlenecks and processing capacity limitations.

[0003] When processing a large number of devices, centralized scanning systems are prone to performance bottlenecks, which greatly reduces scanning speed and efficiency; a single central processing unit becomes a single point of failure for the entire system. Once a problem occurs, the security monitoring and evaluation of the entire network will be seriously affected.

[0004] Therefore, there is an urgent need to develop a new all-round power grid network equipment scanning system and method. Summary of the invention

[0005] The present application provides an omni-directional power grid network equipment scanning system and method to improve the efficiency of network scanning.

[0006] The present application provides an all-round power grid network equipment scanning system, including: A plurality of distributed scanning modules, wherein each distributed scanning module comprises a network interface for establishing communication with the scanned device; a scanning engine configured to automatically identify and connect to the device in the network, collect the configuration information, operation status and security parameters of the device, and generate a security assessment report of the device; a storage unit for storing the scanning results and related data; and a communication unit for transmitting the scanning results to the central control module; A central control module for managing and coordinating multiple distributed scanning modules; A data processing module, connected to the central control module, for aggregating scan data from multiple distributed scan modules; analyzing the scan data to detect potential security threats and network performance issues; and generating an overall security and performance assessment report for network devices; The user interface module is connected to the central control module and the data processing module, and is used to provide an interface for users to access scanning results and evaluation reports; and accept user input to customize scanning parameters and report formats.

[0007] Furthermore, each distributed scanning module automatically adapts to different types of network protocols and device types through the following steps: Step S101: After starting the scanning module, initialize the network interface to enter the protocol detection mode; Step S102: In the protocol detection mode, the scanning module sends a detection packet to a device in the network, wherein the detection packet includes different network protocol identifiers, including SNMP, HTTP, HTTPS, Telnet, SSH and IPP; Step S103: Determine the network protocol type supported by each device by analyzing the received device response, including: Detect SNMP protocol responses and confirm the device type by reading the device's MIB information; Detect HTTP / HTTPS protocol responses and confirm the device type by sending a GET request and analyzing the returned HTML header information; Detect Telnet / SSH protocol responses, confirm the device type by trying to establish a connection and parsing the handshake information; Detect the IPP protocol response and confirm the device type by sending a print service request and parsing the returned information; Step S104: dynamically configuring the scanning engine according to the network protocol type supported by each device determined in step S103 to adapt to the protocol requirements of different devices, including adjusting network interface parameters and communication methods; Step S105: performing a deep scan under supported network protocol types to collect scan data of the device, wherein the scan data includes configuration information, operating status, and security parameters; Step S106: storing the collected scan data in the storage unit, and transmitting the scan data to the central control module through the communication unit.

[0008] Furthermore, the scanning engine of each scanning module is used to execute a multi-level security assessment algorithm, which includes the following steps of the multi-level security assessment algorithm: Step S2001: Perform a preliminary scan on each scanned network device to collect basic configuration information of the scanned network device, wherein the basic configuration information includes device name, IP address and operating system version; calculate the preliminary security score of the scanned device according to the following formula 1 : in, Indicates Security score of basic configuration information; Indicates the total amount of basic configuration information; Indicates The weight of the security score of the basic configuration information; Step S2002: Based on the preliminary security score, perform an in-depth scan of network devices with potential risks, collect advanced configuration information of the scanned network devices, wherein the advanced configuration information includes open ports, running services, and installed software versions; calculate the intermediate security score of the scanned device according to the following formula 2 : in, Indicates Security score of high-level configuration information; Indicates the total number of advanced configuration information; Indicates The risk weight of the high-level configuration information; Step S2003: Perform a comprehensive security vulnerability scan on the high-risk device based on the intermediate security score; calculate the high-level security score of the scanned device according to the following formula 3 based on the security vulnerability scan result : in, Indicates The severity rating of each vulnerability; Indicates the total number of security vulnerabilities scanned; Indicates The difficulty rating of the vulnerability to be fixed; Step S2004: Calculate the scan adjustment factor according to the preliminary safety score, the intermediate safety score and the advanced safety score according to the following formula 4: ; in, , and is the adjustment factor; Step S2005: If the calculated scan adjustment factor If it is greater than the first preset threshold, it indicates a high risk, and the scanning engine will increase the scanning port range, increase the frequency of scanning packages, and extend the scanning time; re-execute steps S2001-S2003 to obtain a preliminary security score, an intermediate security score, and an advanced security score; and directly execute step S2005; Step S2005: Calculate the final security score of the scanned network device according to the following formula 5: : in, , and is the weight coefficient; Step S2006: When the final security score of the scanned device If the final security score of the scanned device is higher than the second preset threshold, the network device is marked as high risk and immediate repair measures are recommended; If the security score of the scanned device is between the third preset threshold and the fourth preset threshold, the network device is marked as medium risk and it is recommended to be repaired within an acceptable time frame. When it is below a third preset threshold, the network device is marked as low risk and regular monitoring and maintenance are recommended.

[0009] Furthermore, the data processing module includes a global risk score calculation algorithm for evaluating the security risk of the entire network in combination with the risk score of each device provided by each distributed scanning module, and dividing the network into high-risk, medium-risk and low-risk areas; the global risk score calculation algorithm includes the following steps: Collect the final security score of each network device from various distributed scanning modules , Indicates In the distributed scanning module The final security score of each network device; Calculate the first In the distributed scanning module Device weight coefficient of each network device : in, Indicates In the distributed scanning module Importance score of each network device; Indicates In the distributed scanning module The location coefficient of each network device in the network topology; Indicates the total number of distributed scanning modules; Indicates The total number of network devices in each distributed scanning module; The network is divided into multiple regions according to the network topology, and the risk score of each region is calculated according to the following formula 7: in, Indicates the network Risk score for each region; Indicates that it belongs to A collection of distributed scanning modules in each region; Indicates The total number of network devices in each distributed scanning module; According to the calculated network The risk scores of each area are divided into high-risk areas, medium-risk areas and high-risk areas; The global risk score of the network is calculated according to the following formula 8: : in, Indicates the total number of regions in the network; Indicates The weight coefficient of the region, Determined based on the importance of the area and the number of devices; Based on the calculated global risk score of the network , determine the overall risk level of the network.

[0010] Furthermore, In the distributed scanning module Importance score of each network device , calculated according to the following formula 9: in, Indicates In the distributed scanning module Device type rating for each device; Indicates In the distributed scanning module The functional score of each device is determined based on the functional importance of the device in the network; Indicates In the distributed scanning module The business importance score of each device is based on the impact of the device on business continuity; , and is the weight coefficient.

[0011] Furthermore, In the distributed scanning module The location coefficient of each network device in the network topology , calculated according to the following formula 10: in, Indicates In the distributed scanning module The number of hops from a device to the core node of the network.

[0012] Furthermore, the user interface module includes an interactive visualization panel, and the interactive visualization panel is used to: Display the topology of the entire network through a graphical interface, including the distribution of network devices, connection relationships and traffic paths; Display the scanning results of each distributed scanning module, including the device configuration information, operating status and security parameters; Provide security assessment reports, including security scores, risk levels and improvement suggestions for each device; Allows users to view detailed information about specific devices, adjust the network view, and add callouts and annotations by clicking and dragging.

[0013] Furthermore, the user interface module also includes a custom report generation function, allowing the user to generate a customized security assessment report according to needs.

[0014] Furthermore, the user interface module includes real-time alarm and notification functions for promptly notifying users when high-risk devices or abnormal network activities are detected.

[0015] The present application provides an all-round power grid network device scanning method, comprising: Multiple distributed scanning modules are deployed in the network, wherein each distributed scanning module includes a network interface for establishing communication with the scanned device; a scanning engine configured to automatically identify and connect to the device in the network, collect the configuration information, operation status and security parameters of the device, and generate a security assessment report of the device; a storage unit for storing the scanning results and related data; and a communication unit for transmitting the scanning results to the central control module; Aggregate scan data from multiple distributed scan modules; Analyze scan data to detect potential security threats and network performance issues; Generates overall security and performance assessment reports for network devices.

[0016] The beneficial effects of the present application mainly include: (1) Through the deployment of multiple distributed scanning modules, the system can efficiently cover and scan devices in large-scale networks, avoiding the performance bottleneck problem of centralized scanning systems when processing a large number of devices, and improving the overall scanning speed and efficiency. (2) The scanning engine equipped with each scanning module can automatically identify and connect to devices in the network and adapt to different network protocols and device types. This automatic identification and dynamic adaptation capability reduces the need for manual configuration and enhances the flexibility and adaptability of the system. (3) The central control module achieves efficient scheduling of scanning tasks and synchronous transmission of results by managing and coordinating multiple distributed scanning modules. This not only avoids the problem of single point failure, but also ensures centralized management and real-time updating of data, improving the reliability and availability of the system. (4) The data processing module can aggregate the scanning data from multiple distributed scanning modules and conduct in-depth analysis to detect potential security threats and network performance issues. By generating a comprehensive network device security and performance evaluation report, it provides a global view of the network status, facilitating timely security protection measures. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of an all-round power grid network equipment scanning system provided in the first embodiment of the present application.

[0018] Figure 2 This is a flow chart of an all-round power grid network equipment scanning method provided in the second embodiment of the present application. DETAILED DESCRIPTION

[0019] Many specific details are described in the following description to facilitate a full understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present application, so the present application is not limited by the specific implementation disclosed below.

[0020] The first embodiment of the present application provides an all-round power grid network equipment scanning system. Figure 1 , which is a schematic diagram of the first embodiment of the present application. Figure 1 A first embodiment of the present application provides an omni-directional power grid network equipment scanning system for detailed description.

[0021] The omni-directional power grid network equipment scanning system includes a plurality of distributed scanning modules 101 , a central control module 102 , a data processing module 103 and a user interface module 104 .

[0022] Multiple distributed scanning modules 101, wherein each distributed scanning module includes a network interface for establishing communication with the scanned device; a scanning engine configured to automatically identify and connect to the device in the network, collect the configuration information, operating status and security parameters of the device, and generate a security assessment report for the device; a storage unit for storing scanning results and related data; and a communication unit for transmitting the scanning results to the central control module.

[0023] In the all-round power grid network equipment scanning system, multiple distributed scanning modules 101 are core components, and each module has multiple functions to ensure comprehensive, accurate and efficient network equipment scanning and data collection.

[0024] First, each distributed scanning module 101 is equipped with a network interface, which is used to establish communication with the scanned device. The network interface can support multiple protocols, such as Ethernet, Wi-Fi, etc., to ensure that it can be connected to various network devices. The configuration of the network interface enables the scanning module to seamlessly connect with different types of network environments and automatically detect and adapt to devices in the network.

[0025] Secondly, the distributed scanning module 101 has a built-in efficient scanning engine. The scanning engine is configured to automatically identify and connect to devices in the network. Specifically, the scanning engine can send detection packets to discover devices in the network, and by analyzing the response data of the device, determine the type of device, operating system, open ports, running services and other detailed information. The scanning engine can handle multiple protocols, including but not limited to SNMP, HTTP, HTTPS, Telnet, SSH and IPP, so as to fully cover the scanning needs of various network devices.

[0026] In terms of data collection, the distributed scanning module 101 can collect the configuration information, operating status and security parameters of the device. The configuration information includes basic information of the device such as name, IP address, operating system version, etc.; the operating status includes real-time operating data of the device such as CPU utilization, memory usage, etc.; and the security parameters involve the security configuration and potential vulnerability information of the device. These data are automatically analyzed and processed by the scanning engine to generate a security assessment report of the device.

[0027] Each distributed scanning module 101 is equipped with a storage unit for storing scanning results and related data. The storage unit can be a built-in flash memory or an externally connected storage device to ensure the security and integrity of the data. The design of the storage unit takes into account the requirements of efficient access and long-term storage of data to support subsequent data analysis and processing.

[0028] The communication unit is another important component of the distributed scanning module 101, which is used to transmit the scanning results to the central control module 102. The communication unit can establish a connection with the central control module through a wired or wireless network to ensure real-time and reliable data transmission. The design of the communication unit ensures the security of data transmission and prevents data from being intercepted or tampered during transmission.

[0029] Through the collaborative work of the above components, multiple distributed scanning modules 101 can effectively cover the entire network and provide detailed device scanning and data collection functions. Each scanning module can not only work independently, but also be uniformly managed and coordinated through the central control module 102. The central control module can assign scanning tasks, synchronize the work progress of each module, and summarize the data collected by all modules.

[0030] In summary, through multiple distributed scanning modules 101, this embodiment provides an efficient, flexible and reliable network device scanning system, which can adapt to various complex network environments and provide comprehensive security assessment functions.

[0031] Furthermore, each distributed scanning module automatically adapts to different types of network protocols and device types through the following steps: Step S101: After starting the scanning module, initialize the network interface to enter the protocol detection mode; Step S102: In the protocol detection mode, the scanning module sends a detection packet to a device in the network, wherein the detection packet includes different network protocol identifiers, including SNMP, HTTP, HTTPS, Telnet, SSH and IPP; Step S103: Determine the network protocol type supported by each device by analyzing the received device response, including: Detect SNMP protocol responses and confirm the device type by reading the device's MIB information; Detect HTTP / HTTPS protocol responses and confirm the device type by sending a GET request and analyzing the returned HTML header information; Detect Telnet / SSH protocol responses, confirm the device type by trying to establish a connection and parsing the handshake information; Detect the IPP protocol response and confirm the device type by sending a print service request and parsing the returned information; Step S104: dynamically configuring the scanning engine according to the network protocol type supported by each device determined in step S103 to adapt to the protocol requirements of different devices, including adjusting network interface parameters and communication methods; Step S105: performing a deep scan under supported network protocol types to collect scan data of the device, wherein the scan data includes configuration information, operating status, and security parameters; Step S106: storing the collected scan data in the storage unit, and transmitting the scan data to the central control module through the communication unit.

[0032] In the comprehensive power grid network device scanning system, each distributed scanning module automatically adapts to different types of network protocols and device types through a series of steps. This process ensures that the scanning module can efficiently and accurately identify and scan various devices in the network, regardless of the protocol or specific type used.

[0033] First, when the scanning module is started, the system will initialize the network interface and enter the protocol detection mode. In this mode, the scanning module sends detection packets to each device in the network through the network interface. These detection packets contain identifiers of multiple network protocols, including but not limited to SNMP, HTTP, HTTPS, Telnet, SSH, and IPP. These identifiers help the scanning module identify the specific protocol types supported by the devices in the network.

[0034] Next, the scanning module analyzes the received device responses to determine the type of network protocols supported by each device. For example, when detecting SNMP protocol responses, the scanning module reads the device's MIB information (Management Information Base) and confirms the device type by analyzing this information; when detecting HTTP / HTTPS protocol responses, the scanning module sends a GET request and confirms the device type by parsing the returned HTML header information; for Telnet / SSH protocols, the scanning module attempts to establish a connection and parses the handshake information to confirm the device type; when detecting IPP protocol responses, the scanning module sends a print service request and confirms the device type by parsing the returned information.

[0035] Based on the network protocol types supported by each device determined in the above steps, the scanning module dynamically configures its scanning engine to adapt to the protocol requirements of different devices. This includes adjusting the parameters and communication methods of the network interface to ensure that the scanning engine can effectively communicate with the device and accurately collect the required data. This dynamic configuration process is automatic and does not require human intervention, thereby improving the efficiency and accuracy of the system.

[0036] After configuration is complete, the scanning module will perform a deep scan for specific network protocol types. This deep scanning process includes collecting various scanning data of the device, such as configuration information, operating status, and security parameters. Configuration information may include device name, IP address, MAC address, operating system version, etc.; operating status may include CPU and memory usage, network traffic statistics, etc.; security parameters include discovered security vulnerabilities, potential threats, and the device's security score.

[0037] All collected scan data will be stored in the storage unit of the scanning module to ensure data security and integrity. Subsequently, the data will be transmitted to the central control module through the communication unit. The central control module is responsible for further data aggregation and analysis, and feeds the results back to the user interface module for generating detailed security assessment reports and providing improvement suggestions.

[0038] Through these steps, the distributed scanning module can automatically adapt to different types of network protocols and device types to perform comprehensive and in-depth device scanning, ensuring that the system can provide efficient and accurate network security assessments.

[0039] Furthermore, the scanning engine of each scanning module is used to execute a multi-level security assessment algorithm, which includes the following steps of the multi-level security assessment algorithm: Step S2001: Perform a preliminary scan on each scanned network device to collect basic configuration information of the scanned network device, wherein the basic configuration information includes device name, IP address and operating system version; calculate the preliminary security score of the scanned device according to the following formula 1 : in, Indicates Security score of basic configuration information; Indicates the total amount of basic configuration information; Indicates The weight of the security score of the basic configuration information; Step S2002: Based on the preliminary security score, perform an in-depth scan of network devices with potential risks, collect advanced configuration information of the scanned network devices, wherein the advanced configuration information includes open ports, running services, and installed software versions; calculate the intermediate security score of the scanned device according to the following formula 2 : in, No. Security score of high-level configuration information; Indicates the total number of advanced configuration information; Indicates The risk weight of the basic configuration information; Step S2003: Perform a comprehensive security vulnerability scan on the high-risk device based on the intermediate security score; calculate the high-level security score of the scanned device according to the following formula 3 based on the security vulnerability scan result : in, Indicates The severity rating of each vulnerability; Indicates the total number of security vulnerabilities scanned; Indicates The difficulty rating of the vulnerability to be fixed; Step S2004: Calculate the scan adjustment factor according to the preliminary safety score, the intermediate safety score and the advanced safety score according to the following formula 4: ; in, , and is the adjustment factor; Step S2005: If the calculated scan adjustment factor If it is greater than the first preset threshold, it indicates a high risk, and the scanning engine will increase the scanning port range, increase the frequency of scanning packages, and extend the scanning time; re-execute steps S2001-S2003 to obtain a preliminary security score, an intermediate security score, and an advanced security score; and directly execute step S2005; Step S2005: Calculate the final security score of the scanned network device according to the following formula 5: : in, , and is the weight coefficient; Step S2006: When the final security score of the scanned device If the final security score of the scanned device is higher than the second preset threshold, the network device is marked as high risk and immediate repair measures are recommended; If the security score of the scanned device is between the third preset threshold and the fourth preset threshold, the network device is marked as medium risk and it is recommended to be repaired within an acceptable time frame. When it is below a third preset threshold, the network device is marked as low risk and regular monitoring and maintenance are recommended.

[0040] In the comprehensive power grid network equipment scanning system, the scanning engine of each scanning module is used to execute a multi-level security assessment algorithm to comprehensively evaluate the security of network equipment. The algorithm includes multiple steps, each of which is designed to collect and analyze different information about the equipment and calculate a security score based on this information to determine the risk level of the equipment. The following is a detailed description of each step and its calculation formula.

[0041] During the initial scan phase, the scanning engine performs a preliminary scan on each scanned network device to collect basic configuration information, including device name, IP address, and operating system version. This information is extracted from the device through standard network protocols (such as SNMP, HTTP, etc.). In order to calculate the initial security score of the device , using the formula: in, Indicates For example, the security score of a device name may be based on whether it complies with the naming convention, the security score of an IP address may be based on whether it is within the safe range, and the security score of an operating system version may be based on whether it is the latest version. Indicates the total number of basic configuration information. The security score of each information are predefined and based on known safety criteria. It means the The importance of each basic configuration information in the overall score is determined in advance, reflecting the impact of each information on the overall security.

[0042] Based on the preliminary security score, the scanning engine will conduct an in-depth scan for network devices with potential risks to collect advanced configuration information, including open ports, running services, and installed software versions. This advanced configuration information is obtained through more detailed detection packages and protocol interactions (such as reading port information through SNMP, checking running services through SSH or Telnet, etc.). Then, the intermediate security score is calculated using the following formula: : in, Indicates For example, the score of an open port may be based on the port's open status and risk level, the score of a running service may be based on the service's importance and known vulnerabilities, and the score of an installed software version may be based on the software's known vulnerabilities and patch status. Indicates the total amount of high-level configuration information. Risk Weight It means the The risk level of each high-level configuration information is based on the specific impact of each information on the device security.

[0043] For devices that are judged to be high risk, the scanning engine will perform a comprehensive security vulnerability scan. This step detects matches in a database of known vulnerabilities and attempts to exploit them to confirm their existence. The security vulnerability scan results are used to calculate the advanced security score. , using the formula: in, Indicates A severity score for a vulnerability, usually based on a CVSS (Common Vulnerability Scoring System) score. Indicates the total number of security vulnerabilities found by the scan. Repair difficulty score It means the The higher the score, the more difficult it is to fix. This formula takes into account the severity and difficulty of the vulnerability to comprehensively assess the impact of the vulnerability on device security.

[0044] To determine whether the scanning strategy needs to be adjusted, the scanning engine calculates a scan adjustment factor based on the preliminary, intermediate, and advanced security scores. , using the formula: in, , and is the adjustment factor that represents the weight of the preliminary, intermediate, and advanced security scores. This formula combines the scores and adjusts them through a logistic function to determine whether the depth and breadth of the scan should be increased. If If it is greater than the preset threshold, it means that the device risk is high. The scanning engine will increase the scanning scope, increase the frequency of scanning packages, extend the scanning time, and re-perform multi-level security assessment.

[0045] Finally, after completing the above steps, the scanning engine calculates the final security score of the device , using the formula: in, , and is the weight coefficient, indicating the importance of each level of scoring. Final score The combination of preliminary, intermediate and advanced scores reflects the overall security status of the device. Based on the final score, the device is marked as high, medium or low risk and provided with corresponding security recommendations, such as high-risk devices need to be repaired immediately, medium-risk devices need to be repaired within an acceptable time frame, and low-risk devices need to be monitored regularly.

[0046] Furthermore, the data processing module includes a global risk score calculation algorithm for evaluating the security risk of the entire network in combination with the risk score of each device provided by each distributed scanning module, and dividing the network into high-risk, medium-risk and low-risk areas; the global risk score calculation algorithm includes the following steps: Collect the final security score of each network device from various distributed scanning modules , Indicates In the distributed scanning module The final security score of each network device; Calculate the first In the distributed scanning module Device weight coefficient of each network device : in, Indicates In the distributed scanning module Importance score of each network device; Indicates In the distributed scanning module The location coefficient of each network device in the network topology; Indicates the total number of distributed scanning modules; Indicates The total number of network devices in each distributed scanning module; The network is divided into multiple regions according to the network topology, and the risk score of each region is calculated according to the following formula 7: in, Indicates the network Risk score for each region; Indicates that it belongs to A collection of distributed scanning modules in each region; Indicates The total number of network devices in each distributed scanning module; According to the calculated network The risk scores of each area are divided into high-risk areas, medium-risk areas and high-risk areas; The global risk score of the network is calculated according to the following formula 8: : in, Indicates the total number of regions in the network; Indicates The weight coefficient of the region, Determined by the importance of the area and the number of devices; Based on the calculated global risk score of the network , determine the overall risk level of the network.

[0047] In the comprehensive power grid network equipment scanning system, the data processing module contains a global risk score calculation algorithm to comprehensively evaluate the security risk of the entire network and divide the network into high-risk, medium-risk and low-risk areas. This algorithm combines the risk scores of each device provided by each distributed scanning module and accurately evaluates and divides network risks through detailed calculation steps.

[0048] First, the data processing module collects the final security score of each network device from each distributed scanning module. .in, Indicates In the distributed scanning module The final security scores of network devices are calculated using the multi-level security assessment algorithm described previously.

[0049] In order to evaluate the importance of each device in the overall network, the device weight coefficient of each device It needs to be calculated by the following formula: In this formula, Indicates In the distributed scanning module Importance score of each network device. Importance score This can be quantified based on the type of equipment, business criticality, and historical risk data. Location Factor It indicates the location of the device in the network topology, which can be obtained by calculating the number of hops from the device to the core node of the network. The fewer the hops, the higher the location coefficient. The higher. represents the total number of distributed scanning modules, and Indicates The total number of network devices in the distributed scanning module. The denominator of the formula ensures that the weight coefficient Normalize the weights of all devices so that the sum of the weights is 1.

[0050] After obtaining the weight coefficient of each device, the data processing module divides the network into multiple areas according to the network topology and calculates the risk score of each area. The formula is as follows: in, Indicates the network The risk score of an area. Indicates that it belongs to The risk score of each device is multiplied by its weight coefficient through this formula, and then these values ​​are accumulated in the same area to obtain the overall risk score of the area. Still indicates that The total number of network devices in each distributed scanning module.

[0051] Based on the calculated risk scores for each area , the network can be divided into high-risk areas, medium-risk areas and low-risk areas. This division is based on the comparison of preset risk thresholds and regional risk scores, helping to identify high-risk areas that need priority attention.

[0052] Finally, the global risk score of the entire network is calculated by the following formula : In this formula, represents the total number of regions in the network, Indicates These weight coefficients The risk score of each area is determined based on the importance and number of devices in each area, reflecting the relative importance of each area in the overall network. The corresponding weight coefficient Multiply and sum, then divide by the sum of all weight coefficients to get the global risk score of the entire network This global risk score is used to determine the overall risk level of the network and provide a basis for the development of network security policies.

[0053] Furthermore, In the distributed scanning module Importance score of each network device , calculated according to the following formula 9: in, Indicates In the distributed scanning module Device type rating for each device; Indicates In the distributed scanning module The functional score of each device is determined based on the functional importance of the device in the network; Indicates In the distributed scanning module The business importance score of each device is based on the impact of the device on business continuity; , and is the weight coefficient.

[0054] In the comprehensive power grid network equipment scanning system, the importance score of the network equipment in each distributed scanning module Calculated based on a number of factors, this score is designed to quantify the importance of each device within the overall network, thus playing a key role in the calculation of the overall risk score.

[0055] No. In the distributed scanning module Importance score of each network device It is calculated by the following formula: In this formula, Indicates the device type score, which reflects the nature of the device itself and its role in the network. The device type score can be preset based on the type of device. For example, core routers and switches may be given a higher score because they are critical to the overall function of the network, while ordinary workstations or printers may be given a lower score. The specific score can be set by the network administrator based on the importance of the device type.

[0056] Indicates the functional score, which is scored based on the functional importance of the device in the network. The functional score of the device considers the specific tasks performed by the device in the network and its impact on network operations. For example, servers that undertake critical tasks (such as database servers, authentication servers, etc.) will be given a high functional score because their operation directly affects business continuity and efficiency; while ordinary file servers or backup devices may have a lower functional score. This score requires network administrators to evaluate based on the actual function of the device and its importance.

[0057] Indicates the business importance score, which reflects the impact of the device on business continuity. The business importance score considers the impact of device downtime or failure on the entire business process. For example, if a server or storage device supporting a customer transaction system fails, it will have a significant impact on the business, so it will have a higher business importance score; while problems with some auxiliary system equipment may not have a direct impact on the core business, so the score is lower. This score also requires network administrators to score according to the role and importance of the device in the business process.

[0058] In the formula, , and are weight coefficients, which are used to adjust the weight of device type, function, and business importance score in the overall importance score. The choice of weight coefficients can be determined based on the specific situation of the network and the focus of the security policy. For example, if the type of network device is particularly important for security assessment, the administrator can set a higher If the functionality of the device is more critical, you can increase If business continuity is the main concern, Can have a greater weight.

[0059] The above formula is calculated The importance score of each device in the network is accurately reflected by comprehensively considering the type, function and impact of the device on the business. This importance score plays a vital role in the overall risk assessment and helps to more accurately manage risks and allocate resources.

[0060] Furthermore, In the distributed scanning module The location coefficient of each network device in the network topology , calculated according to the following formula 10: in, Indicates In the distributed scanning module The number of hops from a device to the core node of the network.

[0061] In the omni-directional power grid network equipment scanning system, the position coefficient of the network equipment in each distributed scanning module in the network topology It is calculated based on the number of hops from the device to the core node of the network. Location coefficient The calculation is intended to quantify the relative position and importance of a device in a network so that the risk weight of the device is more accurately reflected in the overall risk assessment.

[0062] No. In the distributed scanning module The location coefficient of each network device in the network topology Calculated by the following formula: In this formula, Indicates In the distributed scanning module The number of hops from a device to the core node of the network. Hop count refers to the number of intermediate nodes required to reach the core node of the network from the device. The core node usually refers to the central hub of the network, such as a core switch or router, which connects most devices in the network and undertakes the main data transmission tasks.

[0063] Hop Count The acquisition can be achieved through the network topology discovery algorithm. When scanning the network, the distributed scanning module can determine the hop count of the device by sending a probe packet and recording the hop count information in each response packet. These probe packets are usually obtained through ICMP (Internet Control Message Protocol) or using routing protocols such as OSPF, EIGRP, etc. The scanning module records the response path of each device to determine the hop count of each device to the core node.

[0064] The position coefficient in the formula is by adding the hop count The calculation is done by taking the reciprocal after adding 1. The addition of 1 is to avoid division by zero. Even if the device is directly connected to the core node (the number of hops is 0), its location coefficient can be calculated correctly. The reciprocal operation is to make the location coefficient inversely proportional to the number of hops, that is, the fewer the number of hops, the larger the location coefficient, and vice versa. This design reflects that the closer the device is to the core node, the more important its position in the network is, because they usually bear more network traffic and critical tasks.

[0065] For example, if a device is directly connected to a core node, its hop count is is 0, then its position coefficient If a device needs to pass through two intermediate nodes to reach the core node, its hop count is is 2, then its position coefficient is 1 / 3. Thus, through the position coefficient The calculation can quantify the relative positions of all devices in the network with a unified standard, which can be used in the global risk score calculation.

[0066] In summary, the position coefficient By accurately calculating the number of hops from a device to the core node of the network, the importance of the device's location in the network topology is quantified. This location factor plays a key role in the overall risk assessment and helps to more accurately assign the risk weight of the device.

[0067] The central control module 102 is used to manage and coordinate multiple distributed scanning modules.

[0068] In the all-round power grid network equipment scanning system, the central control module 102 plays a vital role. Its main function is to manage and coordinate multiple distributed scanning modules 101 to ensure the efficient operation of the entire system and the unified processing of data.

[0069] The central control module 102 is first responsible for receiving and processing the scanning results from the multiple distributed scanning modules 101. These scanning results are transmitted from each distributed scanning module to the central control module through the communication unit. In order to process a large amount of data, the central control module is equipped with a powerful processing capability, which can efficiently receive and store this data. It uses multi-threading or parallel processing technology to ensure the real-time and integrity of data transmission.

[0070] In terms of data management, the central control module 102 performs unified data aggregation and storage operations. The scan data collected from each distributed scanning module will be integrated into a centralized repository. This centralized repository uses an efficient data structure and index mechanism to ensure fast access and management of data. Through this centralized management, the central control module can ensure the consistency and integrity of the data and avoid data duplication and conflict.

[0071] In addition to data management, the central control module 102 is also responsible for scheduling and coordinating the tasks of multiple distributed scanning modules. It dynamically allocates scanning tasks to each distributed scanning module based on the pre-set scanning strategy and network topology. For example, the central control module can determine which scanning modules are responsible for the scanning tasks of which devices based on the geographical location of the device, the network load, and the importance of the device. This dynamic task allocation mechanism can optimize the utilization of scanning resources and improve the overall scanning efficiency.

[0072] The central control module 102 also has real-time monitoring and feedback functions. It constantly monitors the operating status of each distributed scanning module, including their task execution, resource usage (such as CPU and memory utilization), and network bandwidth usage. When an abnormality is detected in a scanning module (such as resource exhaustion or network connection interruption), the central control module can immediately issue an alarm and take corresponding measures, such as reallocating scanning tasks, adjusting scanning frequency, or notifying the system administrator to intervene.

[0073] In order to improve the flexibility and adaptability of the system, the central control module 102 also implements intelligent adjustment and optimization functions. Based on real-time monitoring data and historical scanning data, the central control module can adjust scanning parameters, such as scanning depth, frequency, and range. For example, when the network traffic is low during a period of time, the central control module can increase the scanning frequency to more comprehensively detect potential threats; and during peak network traffic, the scanning frequency can be reduced to reduce the impact on network performance. In addition, the central control module can also use machine learning algorithms to analyze historical data and predict possible security threats in the future, so as to adjust the scanning strategy in advance.

[0074] The central control module 102 is also responsible for interacting with the data processing module 103 and the user interface module 104. It transmits the aggregated data to the data processing module 103 for in-depth analysis, detects potential security threats and network performance issues, and generates an overall security and performance evaluation report. At the same time, the central control module cooperates with the user interface module 104 to provide a user-friendly interface through which users can access scan results and evaluation reports and customize scan parameters and report formats.

[0075] In summary, the central control module 102 ensures the coordinated work of multiple distributed scanning modules 101 through effective management and coordination functions, and realizes centralized data processing, dynamic task allocation, real-time monitoring and intelligent adjustment and optimization.

[0076] The data processing module 103 is connected to the central control module and is used to aggregate the scan data from multiple distributed scan modules; analyze the scan data to detect potential security threats and network performance issues; and generate an overall security and performance evaluation report for network devices.

[0077] In the all-round power grid network equipment scanning system, the data processing module 103 plays a key role and is responsible for aggregating, analyzing and processing the scanning data from multiple distributed scanning modules 101, thereby detecting potential security threats and network performance issues, and generating a comprehensive network equipment security and performance evaluation report.

[0078] The data processing module 103 first receives the collected scan data from the central control module 102. The central control module is responsible for preliminarily sorting the raw data transmitted by multiple distributed scanning modules and passing it to the data processing module in a unified format. After receiving the data, the data processing module stores it in an internal efficient database. This database is designed to quickly access a large amount of data and support high concurrent access to ensure the real-time and effectiveness of data processing.

[0079] In the data aggregation stage, the data processing module 103 merges the data from different distributed scanning modules. These data include the configuration information, operating status and security parameters of the equipment. Through advanced data fusion technology, the data processing module can effectively remove redundant information and ensure the consistency and accuracy of the data. At the same time, it will also pre-process the data, such as data cleaning and format conversion, so that the subsequent analysis can proceed smoothly.

[0080] Entering the data analysis phase, the data processing module 103 uses a variety of analysis algorithms to conduct in-depth mining and analysis of the aggregated data. First, it uses statistical analysis methods to detect common security issues and performance bottlenecks in the network. For example, by analyzing the operating status data of the device, it can identify devices with abnormally high CPU and memory usage, which may have potential performance problems. Secondly, the data processing module applies pattern recognition and machine learning algorithms to detect complex security threats. These algorithms can identify abnormal network behavior patterns, such as abnormal traffic surges or connection requests from unknown devices, which may indicate that the network is under attack.

[0081] After detecting potential threats and performance issues, the data processing module 103 will also generate detailed security and performance assessment reports. These reports not only include the detected issues, but also provide specific risk assessments and improvement suggestions. For example, if a known security vulnerability is detected in a device, the report will detail the severity of the vulnerability and repair suggestions; if there is a performance bottleneck in a certain network area, the report will recommend optimizing the network configuration or increasing the bandwidth. Through these detailed reports, users can have a comprehensive understanding of the security status and performance of the network and take appropriate measures to improve it.

[0082] The data processing module 103 is also responsible for generating reports on the overall security and performance evaluation of the network. These reports provide a comprehensive evaluation of the overall security risks and performance status of the network based on the data analysis results of the entire network. For example, by summarizing the risk scores of each device and each area, the data processing module can calculate the overall risk level of the entire network, helping users identify high-risk areas and key protection objects in the network. At the same time, the performance evaluation report will provide key performance indicators such as network traffic distribution, bandwidth utilization and latency, helping users optimize the configuration and use of network resources.

[0083] In addition, the data processing module 103 works closely with the user interface module 104 to ensure that users can easily access and use the analysis results. Users can access various reports generated by the data processing module through the user interface module and customize the report format and content according to actual needs. The user interface module provides an intuitive graphical interface through which users can view network topology maps, device status and security risk details, and even generate customized reports to meet specific management and auditing needs.

[0084] In summary, in the omni-directional power grid network equipment scanning system, the data processing module 103 detects potential security threats and performance issues by receiving, aggregating, analyzing and processing data from multiple distributed scanning modules, and generates a comprehensive security and performance evaluation report.

[0085] The user interface module 104 is connected to the central control module and the data processing module, and is used to provide an interface for users to access scanning results and evaluation reports; and accept user input to customize scanning parameters and report formats.

[0086] In the all-round power grid network equipment scanning system, the user interface module 104 is the interactive bridge between the system and the user. It is finely designed and fully functional, ensuring that the user can easily access the scanning results and evaluation reports, and customize the scanning parameters and report formats according to needs.

[0087] The user interface module 104 first provides an intuitive and user-friendly graphical interface. This interface uses a modern UI / UX design to enable users to easily navigate and operate. The interface includes multiple views and panels to display the network topology map, the status of each device, real-time scan results, and detailed security assessment reports. The network topology map presents the entire network structure in a visual form, and users can view detailed information about specific devices, such as configuration information, operating status, and security parameters, by clicking on a node.

[0088] This module supports the display and update of real-time data, allowing users to view changes in the network in real time. For example, when a new device is connected to the network or the status of an existing device changes, the interface will be updated immediately to ensure that users have the latest information. Real-time data display includes not only basic information about the device, but also security threats and performance issues found during the scan, allowing users to quickly respond and deal with potential risks.

[0089] In order to meet the different needs of users, the user interface module 104 provides a powerful customization function. Users can set scanning parameters through the interface according to their own needs, such as selecting the type of device to be scanned, specifying the time interval and depth of the scan, and selecting specific security indicators and performance parameters to be included in the report. Users can also create and save multiple scanning profiles for quick switching and application in different scenarios.

[0090] In addition, the user interface module 104 has a custom report generation function. Users can select predefined report templates or create custom templates as needed to set the structure, content and format of the report. The generated report can include detailed information such as basic information of the device, security score, detected security threats, performance analysis and improvement suggestions. These reports can be exported in multiple formats, such as PDF, HTML or Excel, which is convenient for users to archive, share or further analyze.

[0091] The user interface module 104 also integrates alarm and notification functions. Users can set alarm conditions through the interface. For example, when the security score of a device exceeds a certain threshold, or when the network traffic increases abnormally, the system will automatically trigger an alarm. The alarm information will be notified to the user through various methods such as pop-up windows on the interface, emails or text messages, ensuring that the user can take timely measures. This function greatly improves the security response capability of the system and prevents potential threats from evolving into actual damage.

[0092] The user interface module 104 is not only a display tool, but also supports user interaction. Users can perform various operations through the interface, such as starting or stopping scanning tasks, adjusting scanning strategies, viewing and processing alarm information, etc. These operations are seamlessly integrated with the central control module 102 and the data processing module 103 through the background, ensuring that the user's operations can be executed quickly and effectively and reflected in the overall operation of the system.

[0093] Finally, the user interface module 104 also provides a wealth of help and support functions. The interface embeds detailed user guides and FAQs to help users quickly get started and solve common problems. At the same time, users can submit technical support requests through the interface, communicate with the technical team, and obtain timely help and services.

[0094] In summary, the user interface module 104 ensures that users can fully and effectively utilize the various functions of the comprehensive power grid network equipment scanning system by providing an intuitive graphical interface, real-time data display and update, powerful customization and report generation functions, alarm and notification functions, and rich interactive operations and support functions.

[0095] Furthermore, the user interface module includes an interactive visualization panel, and the interactive visualization panel is used to: Display the topology of the entire network through a graphical interface, including the distribution of network devices, connection relationships and traffic paths; Display the scanning results of each distributed scanning module, including the device configuration information, operating status and security parameters; Provide security assessment reports, including security scores, risk levels and improvement suggestions for each device; Allows users to view detailed information about specific devices, adjust the network view, and add callouts and annotations by clicking and dragging.

[0096] In the all-round power grid network equipment scanning system, the user interface module is specially designed with an interactive visualization panel to provide comprehensive and intuitive network management and security assessment functions. The interactive visualization panel displays the topology of the entire network through a graphical interface, allowing users to clearly see the distribution, connection relationships and traffic paths of network devices. This visual representation can not only help users intuitively understand the physical and logical structure of the network, but also be updated in real time to reflect dynamic changes in the network.

[0097] The interactive visualization panel displays the scan results of each distributed scanning module, including detailed configuration information, operating status, and security parameters of the device. Configuration information may include the device name, IP address, MAC address, operating system version, etc.; operating status may include CPU and memory usage, network traffic statistics, etc.; security parameters include discovered security vulnerabilities, potential threats, and device security scores. Through this detailed information display, users can fully understand the current status of each network device.

[0098] In addition, the interactive visualization panel also provides a comprehensive security assessment report. The report lists the security score, risk level and improvement suggestions for each device in detail. For example, for a device, if its security score is low, the panel will show that its risk level is high and provide specific improvement suggestions, such as upgrading the operating system, patching known vulnerabilities or changing insecure configurations. This security assessment report not only helps users identify weak links in the network, but also provides specific action guidance to improve overall network security.

[0099] The interactive visual panel design of the user interface module allows users to view detailed information of specific devices, adjust network views, and add annotations and comments by clicking and dragging. By clicking, users can quickly view detailed configuration information and security status of a certain device; by dragging, users can rearrange the positions of network devices and adjust the layout of the network view to make it more in line with actual needs or personal preferences; by adding annotations and comments, users can mark and describe specific devices or connections in the network diagram for later reference or sharing with team members.

[0100] This interactive design greatly improves the convenience and efficiency of network management and security monitoring. Users can easily monitor the network, diagnose problems, and manage security through these interactive operations without having to delve into the underlying technical details. At the same time, the system will update and save the network configuration in real time based on the user's operations, ensuring the consistency and synchronization of the user interface and background management.

[0101] In summary, this embodiment provides an intuitive, detailed and interactive network management and security assessment tool through an interactive visualization panel in the user interface module. The panel displays the network topology and detailed device information, generates a comprehensive security assessment report, and supports interactive management by users through click and drag operations.

[0102] Furthermore, the user interface module also includes a custom report generation function, allowing the user to generate a customized security assessment report according to needs.

[0103] In the comprehensive power grid network equipment scanning system, the user interface module is specially designed with a custom report generation function to meet the user's personalized needs for security assessment reports. This function enables users to generate detailed, security assessment reports based on specific needs and preferences, so as to better understand and manage the security status of network devices.

[0104] The custom report generation function of the user interface module first provides a friendly and intuitive user interface, allowing users to easily select report content and format. Users can use the interface to select the scan parameters and evaluation indicators that need to be included, such as basic device configuration information, security scores, risk levels, discovered vulnerabilities, operating status, and network performance data. In this way, users can decide which information is necessary and exclude irrelevant content based on specific needs, thereby generating concise and targeted reports.

[0105] To further enhance the customization of reports, the user interface module also allows users to select different report templates. These templates can be pre-designed or created and saved by the user. Users can set the report title, chapter structure, chart type and layout to ensure that the generated report is not only detailed but also formatted to meet the standards of the user or organization. Users can adjust the position and order of the report sections by dragging and dropping to make the report more in line with reading habits and review requirements.

[0106] In the process of generating reports, the user interface module will automatically extract the latest scanning data and analysis results from the central control module and the data processing module. The system will sort and summarize the data according to the user's selection and generate a report in a predetermined format. The whole process is highly automated, and users only need to make simple selections and settings to generate high-quality security assessment reports.

[0107] The generated reports are not limited to screen display, but can also be exported to a variety of common formats, such as PDF, Word and Excel files, for easy printing, archiving and sharing. Users can choose to send reports to a specific email address or upload them to the organization's internal sharing platform. This flexible export and sharing function ensures that the reports can be widely reviewed and discussed, promoting the timely discovery and resolution of security issues.

[0108] The custom report generation function also includes the option to generate and update reports regularly. Users can set the time interval for automatic report generation, such as daily, weekly or monthly, and the system will automatically generate and send reports at the scheduled time. This regular reporting function ensures that users always have the latest network security status and take necessary protective measures in a timely manner.

[0109] In summary, the custom report generation function in the user interface module enables users to generate detailed and customized security assessment reports according to their needs by providing a flexible selection and setting interface.

[0110] Furthermore, the user interface module includes real-time alarm and notification functions for promptly notifying users when high-risk devices or abnormal network activities are detected.

[0111] In the comprehensive power grid network equipment scanning system, the user interface module is designed with real-time alarm and notification functions to ensure that users can be notified in time when high-risk equipment or abnormal network activities are detected. This function is designed to provide a rapid response mechanism to help users discover and deal with potential security threats in the shortest time, thereby maintaining the overall security of the network.

[0112] The real-time alarm and notification functions of the user interface module are based on the system's continuous monitoring of network devices. The distributed scanning module regularly collects the operating status and security parameters of the device, and the data processing module analyzes this data in real time. Once it is detected that the security score of a device is lower than the preset security threshold, or abnormal network activities are found (such as traffic surges, unknown device access, etc.), the system will immediately trigger the alarm mechanism.

[0113] After the alarm mechanism is activated, the user interface module will notify the user through various channels. The first is the interface pop-up notification. When the user is using the system interface, the pop-up window will be highlighted on the screen to alert the user to abnormal conditions. The pop-up window usually contains detailed alarm information, including the name of the affected device, IP address, specific security issues or abnormal behavior descriptions, and recommended initial response measures.

[0114] To ensure that users can receive alarm information without using the interface, the user interface module also supports email and SMS notifications. The system automatically sends alarm information to pre-set email addresses and mobile phone numbers. The email and SMS content is concise and contains key alarm information, and is accompanied by a link to the system detailed report. Users can directly view the detailed information and perform subsequent processing by clicking the link.

[0115] In addition, the user interface module also supports mobile application push notifications. If the user has installed the mobile application that comes with the system, the system can send alarm information directly to the user's mobile device through push notifications. In this way, even if the user is not in the office, he or she can obtain real-time network security dynamics and make timely responses.

[0116] The real-time alarm and notification function of the user interface module also provides a detailed alarm record and management interface. Each alarm will be recorded by the system, and users can view historical alarm records through the interface to understand past security events, handling situations, and current security status. Alarm records are arranged in chronological order and support multiple filtering and sorting methods. Users can quickly find specific alarm records based on time period, alarm type, device name, and other conditions.

[0117] In addition, the user interface module allows users to customize alarm rules and notification methods. Users can set different alarm thresholds and conditions according to specific security policies. For example, for critical servers, lower security score thresholds and stricter monitoring conditions can be set. Users can also choose different notification methods and recipient groups to ensure that alarm information can be delivered to the right people, improving the efficiency and accuracy of alarm processing.

[0118] Through the above design, the real-time alarm and notification function of the user interface module can quickly and accurately notify users when high-risk devices or abnormal network activities are detected, ensuring that users can take necessary security measures in a timely manner.

[0119] In the above-mentioned embodiment, a comprehensive power grid network device scanning system is provided. Correspondingly, the present application also provides a comprehensive power grid network device scanning method. Figure 2 , which is a flow chart of an embodiment of an all-round power grid network device scanning method of the present application. Since this embodiment, namely the second embodiment, is basically similar to the first embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the first embodiment. The method embodiment described below is only illustrative.

[0120] A second embodiment of the present application provides an omnidirectional power grid network device scanning method, comprising: Step S201: deploy multiple distributed scanning modules in the network, wherein each distributed scanning module includes a network interface for establishing communication with the scanned device; a scanning engine configured to automatically identify and connect to the device in the network, collect the configuration information, operating status and security parameters of the device, and generate a security assessment report of the device; a storage unit for storing the scanning results and related data; and a communication unit for transmitting the scanning results to the central control module; Step S202: Summarize the scan data from multiple distributed scan modules; Step S203: Analyze the scan data to detect potential security threats and network performance issues; Step S204: Generate an overall security and performance evaluation report of the network device.

[0121] Although the present application is disclosed as above in the form of a preferred embodiment, it is not intended to limit the present application. Any technical personnel in this field may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

Claims

1. A comprehensive power grid network equipment scanning system, characterized in that: include: A plurality of distributed scanning modules, wherein each distributed scanning module comprises a network interface for establishing communication with the scanned device; a scanning engine configured to automatically identify and connect to the device in the network, collect the configuration information, operation status and security parameters of the device, and generate a security assessment report of the device; a storage unit for storing the scanning results and related data; and a communication unit for transmitting the scanning results to the central control module; A central control module for managing and coordinating multiple distributed scanning modules; A data processing module, connected to the central control module, for aggregating scan data from multiple distributed scan modules; analyzing the scan data to detect potential security threats and network performance issues; and generating an overall security and performance assessment report for network devices; The user interface module is connected to the central control module and the data processing module, and is used to provide an interface for users to access scanning results and evaluation reports; and accept user input to customize scanning parameters and report formats.

2. The omnidirectional power grid network equipment scanning system according to claim 1, characterized in that: Each distributed scanning module automatically adapts to different types of network protocols and device types through the following steps: Step S101: After starting the scanning module, initialize the network interface to enter the protocol detection mode; Step S102: In the protocol detection mode, the scanning module sends a detection packet to a device in the network, wherein the detection packet includes different network protocol identifiers, including SNMP, HTTP, HTTPS, Telnet, SSH and IPP; Step S103: Determine the network protocol type supported by each device by analyzing the received device response, including: Detect SNMP protocol responses and confirm the device type by reading the device's MIB information; Detect HTTP / HTTPS protocol responses and confirm the device type by sending a GET request and analyzing the returned HTML header information; Detect Telnet / SSH protocol responses, confirm the device type by trying to establish a connection and parsing the handshake information; Detect the IPP protocol response, confirm the device type by sending a print service request and parsing the returned information; Step S104: dynamically configuring the scanning engine according to the network protocol type supported by each device determined in step S103 to adapt to the protocol requirements of different devices, including adjusting network interface parameters and communication methods; Step S105: performing a deep scan under supported network protocol types to collect scan data of the device, wherein the scan data includes configuration information, operating status, and security parameters; Step S106: storing the collected scan data in the storage unit, and transmitting the scan data to the central control module through the communication unit.

3. The omnidirectional power grid network equipment scanning system according to claim 1, characterized in that: The scanning engine of each scanning module is used to execute a multi-level security assessment algorithm, which includes the following steps: Step S2001: Perform a preliminary scan on each scanned network device to collect basic configuration information of the scanned network device, wherein the basic configuration information includes device name, IP address and operating system version; calculate the preliminary security score of the scanned device according to the following formula 1 : in, Indicates Security score of basic configuration information; Indicates the total amount of basic configuration information; Indicates The weight of the security score of the basic configuration information; Step S2002: Based on the preliminary security score, perform an in-depth scan of network devices with potential risks, collect advanced configuration information of the scanned network devices, wherein the advanced configuration information includes open ports, running services, and installed software versions; calculate the intermediate security score of the scanned device according to the following formula 2 : in, Indicates Security score of high-level configuration information; Indicates the total number of advanced configuration information; Indicates The risk weight of the high-level configuration information; Step S2003: Perform a comprehensive security vulnerability scan on the high-risk device based on the intermediate security score; calculate the high-level security score of the scanned device according to the following formula 3 based on the security vulnerability scan result : in, Indicates The severity rating of each vulnerability; Indicates the total number of security vulnerabilities scanned; Indicates The difficulty rating of the vulnerability to be fixed; Step S2004: Calculate the scan adjustment factor according to the preliminary safety score, the intermediate safety score and the advanced safety score according to the following formula 4: ; in, , and is the adjustment factor; Step S2005: If the calculated scan adjustment factor If it is greater than the first preset threshold, it indicates a high risk, and the scanning engine will increase the scanning port range, increase the frequency of scanning packages, and extend the scanning time; re-execute steps S2001-S2003 to obtain a preliminary security score, an intermediate security score, and an advanced security score; and directly execute step S2005; Step S2005: Calculate the final security score of the scanned network device according to the following formula 5: : in, , and is the weight coefficient; Step S2006: When the final security score of the scanned device If the final security score of the scanned device is higher than the second preset threshold, the network device is marked as high risk and immediate repair measures are recommended; If the security score of the scanned device is between the third preset threshold and the fourth preset threshold, the network device is marked as medium risk and it is recommended to be repaired within an acceptable time frame. When it falls below a third preset threshold, the network device is marked as low risk and regular monitoring and maintenance are recommended.

4. The omnidirectional power grid network equipment scanning system according to claim 3, characterized in that: The data processing module includes a global risk score calculation algorithm for evaluating the security risk of the entire network in combination with the risk score of each device provided by each distributed scanning module, and dividing the network into high-risk, medium-risk and low-risk areas; The global risk score calculation algorithm comprises the following steps: Collect the final security score of each network device from various distributed scanning modules , Indicates In the distributed scanning module The final security score of each network device; Calculate the first In the distributed scanning module Device weight coefficient of each network device : in, Indicates In the distributed scanning module Importance score of each network device; Indicates In the distributed scanning module The location coefficient of each network device in the network topology; Indicates the total number of distributed scanning modules; Indicates The total number of network devices in each distributed scanning module; The network is divided into multiple regions according to the network topology, and the risk score of each region is calculated according to the following formula 7: in, Indicates the network Risk score for each region; Indicates that it belongs to A collection of distributed scanning modules in each region; Indicates The total number of network devices in each distributed scanning module; According to the calculated network The risk scores of each area are divided into high-risk areas, medium-risk areas and high-risk areas; The global risk score of the network is calculated according to the following formula 8: : in, Indicates the total number of regions in the network; Indicates The weight coefficient of the region, Determined by the importance of the area and the number of devices; Based on the calculated global risk score of the network , determine the overall risk level of the network.

5. The omnidirectional power grid network equipment scanning system according to claim 4, characterized in that: No. In the distributed scanning module Importance score of each network device , calculated according to the following formula 9: in, Indicates In the distributed scanning module Device type rating for each device; Indicates In the distributed scanning module The functional score of each device is determined based on the functional importance of the device in the network; Indicates In the distributed scanning module The business importance score of each device is based on the impact of the device on business continuity; , and is the weight coefficient.

6. The omnidirectional power grid network equipment scanning system according to claim 4, characterized in that: No. In the distributed scanning module The location coefficient of each network device in the network topology , calculated according to the following formula 10: in, Indicates In the distributed scanning module The number of hops from a device to the core node of the network.

7. The omnidirectional power grid network equipment scanning system according to claim 1, characterized in that: The user interface module includes an interactive visualization panel, wherein the interactive visualization panel is used to: Display the topology of the entire network through a graphical interface, including the distribution of network devices, connection relationships and traffic paths; Display the scanning results of each distributed scanning module, including the device configuration information, operating status and security parameters; Provide security assessment reports, including security scores, risk levels and improvement suggestions for each device; Allows users to view detailed information about specific devices, adjust the network view, and add callouts and annotations by clicking and dragging.

8. The omnidirectional power grid network equipment scanning system according to claim 1, characterized in that: The user interface module also includes a custom report generation function, allowing the user to generate a customized security assessment report according to needs.

9. The omnidirectional power grid network equipment scanning system according to claim 1, characterized in that: The user interface module includes real-time alarm and notification functions for promptly notifying users when high-risk devices or abnormal network activities are detected.

10. A method for scanning all-round power grid network equipment, characterized in that: include: Multiple distributed scanning modules are deployed in the network, wherein each distributed scanning module includes a network interface for establishing communication with the scanned device; a scanning engine configured to automatically identify and connect to the device in the network, collect the configuration information, operation status and security parameters of the device, and generate a security assessment report of the device; a storage unit for storing the scanning results and related data; and a communication unit for transmitting the scanning results to the central control module; Aggregate scan data from multiple distributed scan modules; Analyze scan data to detect potential security threats and network performance issues; Generates overall security and performance assessment reports for network devices.

Images