Network security assessment method and equipment based on power monitoring system

Abstract

The present invention discloses a network security assessment method and device based on an electric power monitoring system, which relates to the technical field of network security, and comprises the following steps: obtaining undisturbed network data of network nodes in a monitoring area; randomly introducing a number of abnormal sensing signals into the network nodes in each monitoring area to obtain a first abnormal network sensing coefficient in each monitoring area; calculating a network abnormal fluctuation deviation coefficient in each monitoring area based on the normal network sensing data and the first abnormal network sensing coefficient; performing secondary division on the monitoring area whose network abnormal fluctuation deviation coefficient is lower than a preset network abnormal threshold to obtain a number of deep monitoring sub-areas; calculating the second abnormal network fluctuation deviation coefficients in the several deep monitoring sub-areas to perform a network security assessment, thereby solving the problem that it is difficult to accurately identify subtle differences between network nodes in normal operation and abnormal state and that the network security in a smaller monitoring area cannot be revealed.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and more specifically, to a network security assessment method and device based on an electric power monitoring system. Background Art

[0002] With the rapid development of the power industry, the network scale of the power monitoring system is expanding, and network security supervision faces greater challenges. The construction of new power systems has gradually introduced more intelligent equipment and digital management methods, further increasing the number and complexity of network nodes. This expansion has not only improved the automation level of the power system, but also brought more complex security risks. At the same time, the means of cyber attacks are constantly evolving, which has put forward higher requirements for the security of the power system.

[0003] For example, the invention patent with announcement number: CN117749534B discloses a network security detection method, system, device and medium based on a distributed system, which obtains any two entities from a network security entity set based on a preset network security knowledge graph; wherein each of the entities in the network security entity set represents a type of network security knowledge; in the network security knowledge graph, path queries are performed on the two entities respectively to determine the query path; and the network security analysis results are determined according to the query path, so that the threats and vulnerabilities existing in the network can be quickly analyzed, evaluated and processed in the massive network security knowledge.

[0004] The above disclosed technical solutions have at least the following technical problems:

[0005] Traditional network security assessment methods often have difficulty accurately identifying subtle differences between network nodes in normal and abnormal states, and are unable to reveal hidden network security in a smaller monitoring area, thereby failing to conduct security assessments on the monitoring area. In view of the above problems, the present invention proposes a solution. Summary of the invention

[0006] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides a network security assessment method and device based on an electric power monitoring system, which solves the problem of difficulty in accurately identifying subtle differences between network nodes in normal operation and abnormal conditions and failure to reveal hidden network security in a smaller monitoring area.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] The network security assessment method based on the power monitoring system includes the following steps: based on the network topology diagram of the power monitoring system, the power monitoring system is divided into several monitoring areas and the undisturbed network data of the network nodes in the monitoring areas are obtained; the network normal sensing data of the network nodes in each monitoring area are calculated based on the preset network sensing assessment model, and several abnormal sensing signals are randomly introduced into the network nodes in each monitoring area to obtain the network first abnormal sensing coefficient in each monitoring area; based on the network normal sensing data and the network first abnormal sensing coefficient, the network abnormal fluctuation deviation coefficient of each monitoring area is calculated; the network abnormal fluctuation deviation coefficient of each monitoring area is sorted, and the monitoring area with the network abnormal fluctuation deviation coefficient lower than the preset network abnormal threshold is secondary divided to obtain several deep monitoring sub-areas; the network second abnormal fluctuation deviation coefficient in the several deep monitoring sub-areas is calculated, and the network security is assessed based on the network second abnormal fluctuation deviation coefficient.

[0009] In a preferred embodiment, several abnormal sensing signals are randomly introduced into the network nodes in each monitoring area to obtain the first abnormal sensing coefficient of the network in each monitoring area, specifically: when there is no interference in the network, the first abnormal sensing signal is first introduced into the network nodes in each monitoring area to obtain initial abnormal sensing data; after the first abnormal sensing signal is introduced, the abnormal sensing signal is randomly increased or decreased to obtain n abnormal sensing data; the initial abnormal sensing data and the n abnormal sensing data are weighted averaged to obtain the first abnormal sensing coefficient of the network in each monitoring area.

[0010] In a preferred embodiment, after introducing the first abnormal sensing signal, the abnormal sensing signal is randomly increased or decreased to obtain n abnormal sensing data, specifically: after introducing the first abnormal sensing signal, the signal change value and the change amplitude value of the current power monitoring system are calculated according to the random number generation rule; based on the signal change value and the change amplitude value of the current power monitoring system, the abnormal sensing signal is randomly increased or decreased, and the introduction of the abnormal sensing signal is stopped based on the preset maximum signal amount and minimum signal amount to obtain n abnormal sensing data.

[0011] In a preferred embodiment, based on the network normal sensing data and the network first abnormal sensing coefficient, the network abnormal fluctuation deviation coefficient of each monitoring area is calculated, specifically: the inter-group variance and the intra-group variance of the network normal sensing data of the network nodes in each monitoring area are calculated; based on the inter-group variance and the intra-group variance of the network normal sensing data of the network nodes in each monitoring area, the normal sensing coefficient of each monitoring area is calculated; the ratio of the normal sensing coefficient of each monitoring area to the first abnormal sensing coefficient of the network is used as the network abnormal fluctuation deviation coefficient of each monitoring area.

[0012] In a preferred embodiment, the network second abnormal fluctuation deviation coefficients in the several deep monitoring sub-areas are calculated, specifically: the variances of the network abnormal fluctuation deviation coefficients of the several deep monitoring sub-areas and the network abnormal fluctuation deviation coefficients of the remaining monitoring areas are calculated respectively; the variance of the network abnormal fluctuation deviation coefficient of each deep monitoring sub-area is calculated with the variance of the network abnormal fluctuation deviation coefficient of the remaining monitoring areas, respectively, to obtain the network second abnormal fluctuation deviation coefficient of each deep monitoring sub-area.

[0013] In a preferred embodiment, a network security assessment is performed based on the network's second abnormal fluctuation deviation coefficient, specifically: when the network's second abnormal fluctuation deviation coefficient is less than a preset deviation threshold, the network area is a low-risk area; when the network's second abnormal fluctuation deviation coefficient is greater than the preset deviation threshold, the network area is a high-risk area.

[0014] The technical effects and advantages of the network security assessment method and device based on the power monitoring system of the present invention are as follows:

[0015] 1. The present invention divides the system into multiple monitoring areas based on the division of the network topology diagram of the power monitoring system, making the monitoring work more targeted and hierarchical. The network nodes in each monitoring area acquire data under disturbance-free conditions, and calculate the normal network sensing data through a preset network sensing evaluation model, ensuring the accuracy and reliability of the evaluation. On this basis, random abnormal sensing signals are introduced to simulate the potential risks of the network, generate the first abnormal sensing coefficient of the network, and effectively capture possible abnormal network fluctuations. Secondly, by calculating the network abnormal fluctuation deviation coefficient and sorting it, potential abnormal areas can be identified, and the abnormal areas are divided twice according to the set threshold, and further in-depth analysis is performed to improve the accuracy of abnormal detection. Finally, the calculation of the abnormal fluctuation deviation coefficient continues in the deep monitoring sub-area, providing multi-level protection for network security assessment. The whole process is dynamic and flexible, with clear hierarchies, and can accurately identify and respond to network anomalies, which helps to discover potential network security risks in real time and improve the safety and stability of the power monitoring system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a structural schematic diagram of the network security assessment method based on the power monitoring system of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] Embodiment 1, Figure 1 The present invention provides a network security assessment method based on a power monitoring system, comprising the following steps:

[0019] S1, based on the network topology diagram of the power monitoring system, dividing the power monitoring system into several monitoring areas and obtaining the non-disturbance network data of the network nodes in the monitoring areas;

[0020] In this example, the network topology diagram of the power monitoring system is as follows:

[0021] The network topology diagram of the power monitoring system includes power system equipment, monitoring system nodes, and communication network structure.

[0022] It should be noted that obtaining a network topology diagram of a power monitoring system has many advantages. First, it can clearly show the relationship between power equipment, monitoring system nodes, and communication paths, helping engineers understand the layout and operation of the entire system. Through the topology diagram, the connection mode and dependency of each device in the system can be intuitively identified, which is convenient for equipment management, troubleshooting, and maintenance. Secondly, the topology diagram provides a basis for optimizing the performance of the system. By analyzing the load of each node and the efficiency of the communication path, the network layout can be optimized, the data transmission delay can be reduced, and the monitoring response speed can be improved. In addition, the topology diagram also provides support for network security assessment, helping to identify potential weak links, such as bottlenecks in communication links or vulnerable points of nodes, so as to prevent security risks in advance and ensure the efficient and stable operation of the power monitoring system. Overall, the network topology diagram of the power monitoring system is a basic tool for improving system reliability, safety, and efficiency.

[0023] In this example, the undisturbed network data of the network nodes in the monitoring area are as follows:

[0024] The undisturbed network data of network nodes in the monitoring area includes network traffic data, network topology data, power equipment data and time series data.

[0025] It should be noted that obtaining disturbance-free network data of network nodes in the monitoring area is the basis for the safety assessment of the power monitoring system. Disturbance-free data reflects the network performance of the system under normal operating conditions and provides a reliable benchmark for subsequent anomaly detection. By obtaining these data, key indicators such as network traffic, latency, packet loss rate, device status, and connection quality can be accurately understood, thereby evaluating the health level of the network without external interference. These normal state data help identify potential risk areas and facilitate the establishment of a standard model for network anomalies. By comparing with the disturbance data in actual operation, network anomalies and faults can be detected more efficiently. At the same time, disturbance-free data also provides data support for optimizing network layout, adjusting resource allocation, improving system stability, and reducing fault response time, and is an important basis for ensuring the stability and security of the power monitoring system.

[0026] S2, calculating the normal network sensing data of the network nodes in each monitoring area based on the preset network sensing evaluation model using the undisturbed network data, and randomly introducing a number of abnormal sensing signals into the network nodes in each monitoring area to obtain a first abnormal network sensing coefficient in each monitoring area;

[0027] In this example, the undisturbed network data is used to calculate the network normal sensing data of the network nodes in each monitoring area based on a preset network sensing evaluation model. The specific formula is:

[0028]

[0029] in, is the normal network sensing data of the i-th network node, is the jth network asset index value of the ith network node, is the jth network traffic index value of the i-th network node, is the time series data value of the ith network node at time t, , and are the weights of network assets, network traffic and time series data, respectively; m, s and p are the number of indicators of network assets, network traffic and time series, respectively.

[0030] It should be noted that the calculation of the network normal sensing data of the network nodes in each monitoring area based on the preset network sensing evaluation model has significant advantages. First, this method provides an accurate benchmark for subsequent anomaly detection by quantifying the various performance indicators (such as traffic, delay, bandwidth, etc.) of the network nodes during normal operation. The preset evaluation model can effectively eliminate the interference of external factors and ensure the purity and reliability of the data. Secondly, by using these network normal sensing data as the standard, it is possible to monitor and compare the deviations that may occur in actual operation in real time, and timely discover potential security threats or system failures. In addition, this method can improve the automation and accuracy of network management, reduce manual intervention, and improve monitoring efficiency. Finally, based on the calculation of this normal sensing data, it can provide a scientific basis for the optimization, fault location and predictive maintenance of the power system, enhance the stability and emergency response capabilities of the system, and ensure the efficient operation and safety of the power monitoring system.

[0031] In this example, several abnormal induction signals are randomly introduced into the network nodes in each monitoring area to obtain the first abnormal induction coefficient of the network in each monitoring area, which is specifically:

[0032] In the case of no network interference, firstly introduce a first abnormal sensing signal into the network node in each monitoring area to obtain initial abnormal sensing data;

[0033] After the first abnormal sensing signal is introduced, the abnormal sensing signal is randomly increased or decreased to obtain n abnormal sensing data;

[0034] The initial abnormal sensing data and n abnormal sensing data are weighted averaged to obtain a first abnormal sensing coefficient of the network in each monitoring area.

[0035] In this example, when there is no interference in the network, a first abnormal sensing signal is first introduced into the network node in each monitoring area to obtain initial abnormal sensing data, specifically:

[0036] in, is the initial abnormal sensing data, , and are the preset weight coefficients for network delay deviation, network packet loss rate deviation, and network bandwidth deviation, respectively. , and are network delay deviation, network packet loss rate deviation and network bandwidth deviation respectively, and n is the number of network nodes in each monitoring area.

[0037] It should be noted that, when the network is free of interference, introducing the first abnormal sensing signal and obtaining the initial abnormal sensing data has several advantages. First, this process can simulate potential abnormal situations and identify possible safety hazards in advance even under normal operating conditions. By introducing abnormal sensing signals in an undisturbed environment, baseline data can be effectively established, thereby providing a standard for subsequent abnormal monitoring. Secondly, this method helps to capture potential atypical behaviors of the network, and even small abnormal fluctuations can be detected, which improves the sensitivity and accuracy of the system. In addition, the introduction of initial abnormal sensing data can help compare and analyze the network performance under normal and abnormal conditions, enhance the accuracy of the anomaly detection algorithm, and reduce the risk of false alarms and missed alarms. Finally, this method can be used to conduct risk assessment and early warning before actual abnormalities occur in the network, thereby providing sufficient data support for system optimization, troubleshooting and emergency response, and improving the safety and stability of the power monitoring system.

[0038] In this example, after the first abnormal sensing signal is introduced, the abnormal sensing signal is randomly increased or decreased to obtain n abnormal sensing data, specifically:

[0039] After the first abnormal sensing signal is introduced, the signal change value and the change amplitude value of the current power monitoring system are calculated according to the random number generation rule;

[0040] Based on the signal change value and change amplitude value of the current power monitoring system, the abnormal sensing signal is randomly increased or decreased, and the introduction of the abnormal sensing signal is stopped based on the preset maximum signal amount and minimum signal amount, so as to obtain n abnormal sensing data.

[0041] In this example, after the first abnormal sensing signal is introduced, the signal change value and change amplitude value of the current power monitoring system are calculated according to the random number generation rule, specifically:

[0042] Random number generation rules: define how to simulate random changes through mathematical models to introduce abnormal signals in the power monitoring system. These rules are usually based on probability distributions, such as normal distribution (Gaussian distribution) or uniform distribution, and are used to generate random numbers with certain expected values ​​and standard deviations. The normal distribution random number generation model uses the standard normal distribution function to control the range and amplitude of the signal by setting the expected value and standard deviation; the uniform distribution generates uniform random numbers within a specific interval by setting upper and lower bounds. The abnormal signals introduced by these rules can simulate the deviations of power network nodes during normal operation, helping to evaluate the stability of the system and identify potential security threats;

[0043] Signal change value: refers to the difference between the network node signal and the original normal signal in the power monitoring system after the abnormal sensing signal is introduced. It reflects the impact of the abnormal signal on the normal network state, and is usually obtained by calculating the difference between the new signal value after the abnormal signal is introduced and the normal signal value without disturbance. The signal change value can reveal the performance fluctuations of the network node, help identify potential abnormalities or faults, and provide a basis for subsequent abnormality detection and network security assessment;

[0044] Change amplitude value: refers to the degree of change of the network node signal in the power monitoring system after the introduction of the abnormal sensing signal, which is usually expressed by calculating the absolute value of the abnormal signal. It reflects the impact of the abnormal signal on the normal signal, that is, the fluctuation amplitude of the network node when it is subjected to abnormal interference. The change amplitude value can help evaluate the stability of the system and reveal the specific impact of abnormal conditions on network performance, thereby providing key data for anomaly detection, fault location and safety assessment.

[0045] S3, calculating the network abnormal fluctuation deviation coefficient of each monitoring area based on the network normal sensing data and the network first abnormal sensing coefficient;

[0046] In this example, based on the network normal sensing data and the network first abnormal sensing coefficient, the network abnormal fluctuation deviation coefficient of each monitoring area is calculated, specifically:

[0047] Calculate the inter-group variance and intra-group variance of the network normal sensing data of the network nodes in each monitoring area;

[0048] Calculating a normal sensing coefficient of each monitoring area based on the inter-group variance and intra-group variance of the network normal sensing data of the network nodes in each monitoring area;

[0049] The ratio of the normal induction coefficient of each monitoring area to the first abnormal induction coefficient of the network is used as the network abnormal fluctuation deviation coefficient of each monitoring area.

[0050] In this example, based on the inter-group variance and intra-group variance of the network normal sensing data of the network nodes in each monitoring area, the normal sensing coefficient of each monitoring area is calculated. The specific formula is:

[0051]

[0052]

[0053]

[0054] in, To monitor the inter-group variance of network nodes in the region, is the normal sensing mean of the ith network node in the monitoring area, is the normal sensing mean of all network nodes in the monitoring area, To monitor the intra-group variance of network nodes in the region, is the kth performance indicator of the ith network node, is the normal inductance of the monitored area, is the error factor, m is the number of performance indicators, and r is the number of network nodes in the monitoring area.

[0055] It should be noted that the calculation of the normal induction coefficient based on the inter-group variance and intra-group variance of the network normal induction data of the network nodes in each monitoring area has significant advantages. First, the inter-group variance can reflect the difference in induction data between different monitoring areas, while the intra-group variance reveals the stability between nodes in the same area. Through the combination of the two, the network status of each monitoring area can be comprehensively evaluated to ensure the coordination and consistency of network nodes under normal conditions. Secondly, the calculation of the normal induction coefficient helps to identify possible weak links in the network. If the inter-group variance or intra-group variance of a certain area is large, it may indicate that there is a potential risk of failure or unstable performance in the area. Finally, this method provides reliable benchmark data for subsequent anomaly detection and fault diagnosis. By comparing with actual data, it can efficiently locate anomalies, improve the response speed and reliability of the system, and ensure the stable operation of the power monitoring system.

[0056] In this example, the ratio of the normal induction coefficient of each monitoring area to the first abnormal network induction coefficient is used as the network abnormal fluctuation deviation coefficient of each monitoring area, specifically:

[0057] Taking the ratio of the normal induction coefficient of each monitoring area to the first abnormal induction coefficient of the network as the network abnormal fluctuation deviation coefficient has important advantages. First, this ratio can clearly reveal the fluctuation difference between the normal operation and abnormal state of the monitoring area. When the normal induction coefficient is high and the abnormal induction coefficient is low, it means that the network in this area responds less when encountering abnormal signals, and the system may be more stable; on the contrary, if the ratio is high, it means that the network in this area is easily disturbed and there may be greater safety hazards. Through the calculation of this ratio, the abnormal fluctuation of the monitoring area can be accurately quantified, providing a quantitative basis for subsequent abnormal detection and risk assessment.

[0058] Secondly, the network abnormal fluctuation deviation coefficient can effectively distinguish high-risk areas from low-risk areas. The larger the ratio of the monitored area, the more violent its response to abnormal signals, and the greater the network security risk; while the area with a smaller ratio is relatively stable and has a lower risk. In this way, more accurate resource allocation and risk management can be achieved, with priority given to high-risk areas, and targeted optimization and prevention measures can be taken.

[0059] Finally, this method helps to improve the automation and intelligence level of the power monitoring system. By calculating and dynamically monitoring these deviation coefficients, the system can evaluate the stability and security of the network in real time, reduce manual intervention, and improve fault prediction and response speed, thereby ensuring efficient operation and safe management of the power system.

[0060] S4, sorting the network abnormal fluctuation deviation coefficient of each monitoring area, and performing secondary division on the monitoring area whose network abnormal fluctuation deviation coefficient is lower than a preset network abnormal threshold to obtain a plurality of deep monitoring sub-areas;

[0061] It should be noted that sorting the network abnormal fluctuation deviation coefficient of each monitoring area and dividing the monitoring area below the preset network abnormality threshold into deep monitoring sub-areas has significant advantages. First, by sorting the abnormal fluctuation deviation coefficients of the monitoring areas, higher and lower risk areas can be effectively identified. This sorting method can help operation and maintenance personnel identify which areas have greater network fluctuations and potential safety hazards, and give priority to key monitoring and maintenance of high-risk areas. Accordingly, the monitoring areas below the preset abnormality threshold will receive more detailed management after the secondary division, so that potential problems can be captured more accurately in more stable areas.

[0062] Secondly, after the second division into deep monitoring sub-areas, it is possible to respond more flexibly and meticulously to the network characteristics and risk levels of different areas. For some monitoring areas that originally showed low risks, potential problems may be discovered after subdivision, so that more targeted monitoring and intervention measures can be implemented to improve the safety and stability of the entire power monitoring system.

[0063] In addition, this method is efficient and scalable. As the number of monitoring areas increases, it is possible to dynamically adjust thresholds and secondary partitioning strategies to achieve fine-grained monitoring of large-scale power networks, reduce redundancy and resource waste, optimize system resource allocation, and ensure that each monitoring area receives sufficient attention. Ultimately, this will enhance the system's fault warning, rapid response capabilities, and global optimization, and improve the overall safety and operation and maintenance efficiency of the power monitoring system.

[0064] S5, calculating the network second abnormal fluctuation deviation coefficients in the plurality of depth monitoring sub-areas, and performing a security assessment on the network based on the network second abnormal fluctuation deviation coefficients.

[0065] In this example, the network second abnormal fluctuation deviation coefficients in the plurality of depth monitoring sub-areas are calculated, specifically:

[0066] Calculating the network abnormal fluctuation deviation coefficients of the plurality of depth monitoring sub-areas and the variance of the network abnormal fluctuation deviation coefficients of the remaining monitoring areas respectively;

[0067] The variance ratio of the network abnormal fluctuation deviation coefficient of each deep monitoring sub-area is calculated with the variance of the network abnormal fluctuation deviation coefficient of the remaining monitoring areas to obtain the network second abnormal fluctuation deviation coefficient of each deep monitoring sub-area.

[0068] It should be noted that by calculating the ratio of the variance of the network abnormal fluctuation deviation coefficient of each deep monitoring sub-area to the variance of the remaining monitoring areas, the network second abnormal fluctuation deviation coefficient is obtained, which has significant advantages. First, the variance ratio can quantify the fluctuation difference between the deep monitoring sub-area and other areas, helping to identify which sub-areas have significantly different fluctuation characteristics, thereby more accurately reflecting potential anomalies and risks. Through the calculation of this ratio, the degree of abnormal impact of the deep monitoring sub-area can be effectively evaluated, and compared with the remaining areas to find hot spots and abnormal fluctuation patterns in the network.

[0069] Secondly, this variance ratio calculation method helps to further optimize the allocation of monitoring resources, ensure that key monitoring areas receive sufficient attention and support, and reduce excessive monitoring of low-risk areas. By dynamically evaluating the abnormal fluctuation characteristics of each sub-area, risk points can be accurately identified, thus providing a scientific basis for fault warning, load balancing and network optimization. Finally, this method improves the adaptive ability and response speed of the power monitoring system, helps to achieve more refined and dynamic network management, and ensures the stability and safe operation of the system.

[0070] In this example, the network is security assessed based on the second abnormal fluctuation deviation coefficient of the network, specifically:

[0071] When the network second abnormal fluctuation deviation coefficient is less than the preset deviation threshold, the network area is a low-risk area;

[0072] When the network second abnormal fluctuation deviation coefficient is greater than a preset deviation threshold, the network area is a high-risk area.

[0073] It should be noted that the security assessment method based on the network's second abnormal fluctuation deviation coefficient divides the network area into low-risk and high-risk areas by comparing with the preset deviation threshold, which has important advantages. First, this method can quickly and intuitively evaluate the security status of each area, which helps to accurately identify and mark potential high-risk areas. Secondly, this differentiated risk division enables system operation and maintenance personnel to take targeted measures, give priority to strengthening monitoring and optimizing resource allocation in high-risk areas, and implement routine monitoring in low-risk areas, thereby avoiding redundant consumption of resources. Finally, based on the dynamically calculated second abnormal fluctuation deviation coefficient, this method improves the system's sensitivity and response speed to network anomalies, thereby improving the overall security and stability of the power monitoring system and ensuring the efficient operation of the system.

[0074] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0075] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments may be implemented in whole or in part in the form of a computer program product.

[0076] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0077] In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0078] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0079] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A network security assessment method based on a power monitoring system, characterized in that: The following steps are involved: Based on the network topology diagram of the power monitoring system, the power monitoring system is divided into a plurality of monitoring areas and the non-disturbance network data of the network nodes in the monitoring areas are obtained; Calculating the normal network sensing data of the network nodes in each monitoring area based on the preset network sensing evaluation model using the undisturbed network data, and randomly introducing a number of abnormal sensing signals into the network nodes in each monitoring area to obtain the first abnormal network sensing coefficient in each monitoring area; Calculating the network abnormal fluctuation deviation coefficient of each monitoring area based on the network normal sensing data and the network first abnormal sensing coefficient; Sorting the network abnormal fluctuation deviation coefficient of each monitoring area, and performing secondary division on the monitoring area whose network abnormal fluctuation deviation coefficient is lower than a preset network abnormal threshold to obtain a plurality of deep monitoring sub-areas; The network second abnormal fluctuation deviation coefficients in the plurality of depth monitoring sub-areas are calculated, and a network security assessment is performed based on the network second abnormal fluctuation deviation coefficients.

2. The network security assessment method based on the power monitoring system according to claim 1 is characterized in that: A number of abnormal induction signals are randomly introduced into the network nodes in each monitoring area to obtain the first abnormal induction coefficient of the network in each monitoring area, which is specifically: In the case of no network interference, firstly introduce a first abnormal sensing signal into the network node in each monitoring area to obtain initial abnormal sensing data; After the first abnormal sensing signal is introduced, the abnormal sensing signal is randomly increased or decreased to obtain n abnormal sensing data; The initial abnormal sensing data and n abnormal sensing data are weighted averaged to obtain a first abnormal sensing coefficient of the network in each monitoring area.

3. The network security assessment method based on the power monitoring system according to claim 2 is characterized in that: After the first abnormal sensing signal is introduced, the abnormal sensing signal is randomly increased or decreased to obtain n abnormal sensing data, specifically: After the first abnormal sensing signal is introduced, the signal change value and the change amplitude value of the current power monitoring system are calculated according to the random number generation rule; Based on the signal change value and change amplitude value of the current power monitoring system, the abnormal sensing signal is randomly increased or decreased, and the introduction of the abnormal sensing signal is stopped based on the preset maximum signal amount and minimum signal amount, so as to obtain n abnormal sensing data.

4. The network security assessment method based on the power monitoring system according to claim 3 is characterized in that: Based on the network normal sensing data and the network first abnormal sensing coefficient, the network abnormal fluctuation deviation coefficient of each monitoring area is calculated, specifically: Calculate the inter-group variance and intra-group variance of the network normal sensing data of the network nodes in each monitoring area; Calculating a normal sensing coefficient of each monitoring area based on the inter-group variance and intra-group variance of the network normal sensing data of the network nodes in each monitoring area; The ratio of the normal induction coefficient of each monitoring area to the first abnormal induction coefficient of the network is used as the network abnormal fluctuation deviation coefficient of each monitoring area.

5. The network security assessment method based on the power monitoring system according to claim 4 is characterized in that: Calculate the network second abnormal fluctuation deviation coefficient in the plurality of deep monitoring sub-areas, specifically: Calculating the network abnormal fluctuation deviation coefficients of the plurality of depth monitoring sub-areas and the variance of the network abnormal fluctuation deviation coefficients of the remaining monitoring areas respectively; The variance ratio of the network abnormal fluctuation deviation coefficient of each deep monitoring sub-area is calculated with the variance of the network abnormal fluctuation deviation coefficient of the remaining monitoring areas to obtain the network second abnormal fluctuation deviation coefficient of each deep monitoring sub-area.

6. The network security assessment method based on the power monitoring system according to claim 5 is characterized in that: The network security is evaluated based on the second abnormal fluctuation deviation coefficient of the network, specifically: When the network second abnormal fluctuation deviation coefficient is less than the preset deviation threshold, the network area is a low-risk area; When the network second abnormal fluctuation deviation coefficient is greater than a preset deviation threshold, the network area is a high-risk area.

7. The network security assessment method based on the power monitoring system according to claim 6 is characterized in that: The undisturbed network data is used to calculate the normal network sensing data of the network nodes in each monitoring area based on a preset network sensing evaluation model. The specific formula is: in, is the normal network sensing data of the i-th network node, is the jth network asset index value of the ith network node, is the jth network traffic index value of the i-th network node, is the time series data value of the ith network node at time t, , and are the weights of network assets, network traffic and time series data, respectively; m, s and p are the number of indicators of network assets, network traffic and time series, respectively.

8. The network security assessment method based on the power monitoring system according to claim 7 is characterized in that: In the case of no network interference, the first abnormal sensing signal is first introduced into the network node in each monitoring area to obtain initial abnormal sensing data, specifically: in, is the initial abnormal sensing data, , and are the preset weight coefficients for network delay deviation, network packet loss rate deviation, and network bandwidth deviation, respectively. , and are network delay deviation, network packet loss rate deviation and network bandwidth deviation respectively, and n is the number of network nodes in each monitoring area.

9. The network security assessment method based on the power monitoring system according to claim 8 is characterized in that: Based on the inter-group variance and intra-group variance of the network normal sensing data of the network nodes in each monitoring area, the normal sensing coefficient of each monitoring area is calculated. The specific formula is: in, To monitor the inter-group variance of network nodes in the region, is the normal sensing mean of the ith network node in the monitoring area, is the normal sensing mean of all network nodes in the monitoring area, To monitor the intra-group variance of network nodes in the region, is the kth performance indicator of the ith network node, is the normal inductance of the monitored area, is the error factor, m is the number of performance indicators, and r is the number of network nodes in the monitoring area.

10. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network security assessment method based on the power monitoring system as described in any one of claims 1 to 9.

Images