Security situation assessment method of power network and related equipment

Abstract

One or more embodiments of the invention provide a security situation assessment method of a power network and related equipment. The method comprises the following steps: acquiring network security situation data of a plurality of nodes in a power network, the network security situation data being extracted according to a preset fixed field; constructing a security situation data knowledge graph according to the network security situation data; inputting the network security situation data set into a situation assessment model to obtain a situation assessment result; wherein the situation assessment model comprises a graph convolutional neural network layer and a transformer layer. Through the method, the power network security situation assessment effect can be effectively improved, so that the security performance of the power network is improved.

Description

Technical Field

[0001] One or more embodiments of the present application relate to the field of computer technology, and in particular, to a method for assessing the security situation of a power network and related equipment. Background Art

[0002] With the acceleration of the process of industrial informatization, network security has become one of the issues that all industries must pay attention to and solve. As an important part of critical infrastructure, the power system is facing unprecedented network security challenges. Cyber ​​attacks and data leaks are emerging in an endless stream, and the factors threatening network security are becoming increasingly complex and changeable, and the network security situation is becoming increasingly severe. In addition, network attacks are constantly evolving towards huge scale, complex forms, normalized encrypted attacks, and diversified attack targets, which reduces the effectiveness of conventional defense tools in resisting complex network attacks.

[0003] Most existing security solutions focus on protecting individual components of the system. The tightly coupled nature of modern power grid systems makes it impossible for such solutions to conduct linkage analysis of various security components and timely deployment of security strategies. In modern society, how to effectively detect and mitigate cyber attacks is an extremely challenging and difficult task. Summary of the invention

[0004] In view of this, an object of one or more embodiments of the present application is to propose a security situation assessment method for a power network and related equipment to solve the problems raised by the background technology.

[0005] Based on the above objectives, one or more embodiments of the present application provide a method for assessing the security situation of a power network, including:

[0006] Acquire network security situation data of multiple nodes in the power network, wherein the network security situation data is extracted according to a preset fixed field;

[0007] Constructing a security situation data knowledge graph based on the network security situation data;

[0008] The network security situation data set is input into a situation assessment model to obtain a situation assessment result; wherein the situation assessment model includes a graph convolutional neural network layer and a transformer layer.

[0009] Optionally, the step of obtaining a situation assessment result through the situation assessment model includes:

[0010] Extracting a feature matrix and an adjacency matrix of the security situation data knowledge graph, wherein the feature matrix is ​​used to represent the features of nodes in the security situation data knowledge graph, and the adjacency matrix is ​​used to represent the adjacency relationships of nodes in the security situation data knowledge graph;

[0011] Inputting the feature matrix and the adjacency matrix into a graph convolutional neural network model to obtain an intermediate feature vector;

[0012] A query vector and a key value vector are generated according to the intermediate feature vector, a numerical vector is generated according to the feature matrix, and the query vector, the key value vector and the numerical vector are input into a transformer layer to obtain the situation assessment result.

[0013] Optionally, before extracting the feature matrix and the adjacency relationship matrix of the security situation data knowledge graph, the method includes:

[0014] A super node is added to the security situation data knowledge graph, and all nodes in the security situation data knowledge graph are directly connected to the super node, and the shortest path to each node is 1.

[0015] Optionally, the situation assessment model is trained based on a training security situation data knowledge graph and its corresponding situation assessment quantitative value labels.

[0016] Optionally, the calculation process of the situation assessment quantitative value includes:

[0017] Construct evaluation metrics;

[0018] Calculate the score of each evaluation indicator based on the network security situation data;

[0019] The situation assessment quantification value is obtained by performing a weighted summation based on the score of the assessment indicator and the weight of each assessment indicator.

[0020] Optionally, the construction evaluation index includes:

[0021] Constructing evaluation dimensions;

[0022] According to the evaluation dimensions, construct pre-selected evaluation indicators; each of the evaluation dimensions includes at least one pre-selected evaluation indicator;

[0023] Constructing a judgment matrix for each of the pre-selected evaluation indicators, and solving the maximum eigenvalue and eigenvector of each judgment matrix, wherein the position of the maximum value element in the eigenvector indicates the evaluation dimension to which the pre-selected evaluation indicator belongs;

[0024] Calculate the consistency of all pre-selected evaluation indicators under each evaluation dimension according to the feature vector;

[0025] Under each evaluation dimension, no more than a preset number of pre-selected evaluation dimensions with the smallest consistency are selected as evaluation indicators.

[0026] Optionally, the assessment dimension includes: at least one of vulnerability, threat, security and availability;

[0027] The evaluation indicators under the vulnerability assessment dimension include at least one of the number of vulnerabilities, the severity level of vulnerabilities, and the type of vulnerabilities;

[0028] The evaluation indicators under the threat assessment dimension include at least one of the threat type, the number of threat attacks, the type of attacked device, and the frequency of security incidents;

[0029] The evaluation indicators under the security evaluation dimension include at least one of the device open port status, network topology structure and the number of security devices;

[0030] The evaluation indicators under the availability evaluation dimension include at least one of network bandwidth usage, data packet distribution, and traffic change rate.

[0031] Based on the same inventive concept, one or more embodiments of the present application further provide a security situation assessment device for a power network, including:

[0032] A data acquisition module is configured to acquire network security situation data of a plurality of nodes in the power network, wherein the network security situation data is extracted according to a preset fixed field;

[0033] A data processing module is configured to construct a security situation data knowledge graph based on the network security situation data;

[0034] The situation assessment module is configured to input the network security situation data set into a situation assessment model to obtain a situation assessment result; wherein the situation assessment model includes a graph convolutional neural network layer and a transformer layer.

[0035] Based on the same inventive concept, one or more embodiments of the present application also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a method for assessing the security situation of a power network as described in any one of the above items is implemented.

[0036] Based on the same inventive concept, one or more embodiments of the present application also provide a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable the computer to execute any of the above-mentioned methods for assessing the security situation of the power network.

[0037] From the above, it can be seen that the security situation assessment of the power network provided by one or more embodiments of the present application is achieved by obtaining network security situation data of multiple nodes in the power network, and the network security situation data is extracted according to preset fixed fields; a network security situation data set is constructed according to the network security situation data; the network security situation data set includes a security situation data knowledge graph constructed according to the network security situation data, and a situation assessment quantization value corresponding to the network security situation data; the network security situation data set is input into a situation assessment model to obtain a situation assessment result; wherein the situation assessment model includes a graph convolutional neural network layer and a transformer layer.

[0038] This application targets graph-based evaluation datasets and transforms the power network security situation assessment task into a graph classification problem. In order to consider as many node features and spatial features of the graph as possible, the evaluation model introduces the Transformer layer on the basis of the graph convolutional neural network to help consider the relationship between deeper network features through the graph structure, so as to achieve the purpose of improving the evaluation accuracy.

[0039] This application can effectively improve the security situation assessment effect of the power network, thereby improving the security performance of the power network.

[0040] The power network security situation assessment device, electronic device and computer-readable storage medium provided in the present application can all implement the steps of the above-mentioned power network security situation assessment method, and therefore also have the beneficial effects of the above-mentioned power network security situation assessment method. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate one or more embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only one or more embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 A schematic flow chart of a method for assessing the security situation of a power network according to one or more embodiments of the present application;

[0043] Figure 2 A schematic diagram of the structure of a power network security situation assessment device according to one or more embodiments of the present application;

[0044] Figure 3 A schematic diagram of the hardware structure of an electronic device according to one or more embodiments of the present application. DETAILED DESCRIPTION

[0045] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0046] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in one or more embodiments of the present application should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in one or more embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0047] As mentioned in the background technology section, in modern society, how to effectively detect and mitigate network attacks is a very challenging and difficult task. In order to solve the limitations of a single security detection method, network security situation assessment technology came into being.

[0048] Network security situation assessment refers to determining the current network security status and future change trends in a complex network operating environment. It includes factors such as the operating status of various network devices, network behavior, and user behavior, which reflects the overall operating status of the network. Compared with antivirus software, firewalls and other solutions, it is an active and effective network defense technology that can ensure system security in the current complex network environment.

[0049] This technology collects and analyzes information about security factors that cause changes in network security situation, and uses a quantifiable evaluation index system to quantitatively evaluate the overall network security situation, obtain the overall security status of the network, and provide users with visual results to help system administrators take preventive or remedial measures in a timely manner. The challenges of designing a reasonable network security situation assessment method lie in two aspects: how to develop a reliable situation assessment index system and situation assessment model design.

[0050] In the process of realizing the present disclosure, the applicant discovered that the knowledge graph, as a semantic network organized by knowledge such as entities, relationships, and attributes, can express rich semantic relationships and provide support for data analysis and mining by integrating scattered multi-source heterogeneous data. Using the knowledge graph, the security situation information with complex information features and diverse structures collected from different devices can be integrated and associated, and the feature information of the data nodes and the spatial structure information between the nodes can be considered at the same time during the evaluation process, and the information of the power space can be used to a greater extent to achieve an accurate assessment of the network security situation of the power space within a certain time interval.

[0051] refer to Figure 1 The method for assessing the security situation of a power network in one or more embodiments of the present application comprises the following steps:

[0052] Step S101: obtaining network security situation data of multiple nodes in the power network, wherein the network security situation data is extracted according to preset fixed fields.

[0053] Step S102: Construct a security situation data knowledge graph based on the above network security situation data.

[0054] Step S103: Input the above network security situation data set into the situation assessment model to obtain a situation assessment result; wherein the above situation assessment model includes a graph convolutional neural network layer and a transformer layer.

[0055] In step S101, the source of network security situation data may include: at least one of network data flow, equipment asset data, vulnerability data, equipment alarm data, and log information of each node in the target power space.

[0056] In the embodiment of the present application, the network security situation data may be cleaned, normalized, and situation feature screened. Through the above operations, the problems of different formats and missing information in the collected data may be solved.

[0057] To ensure the timeliness of security situation assessment results, you can choose to collect data at preset time intervals. n Represents the data at the nth moment. The data set can be expressed as D = {d1, d2, …d n}.

[0058] In an embodiment of the present application, the fixed fields may include: device IP address, device type, vulnerability type, number of vulnerabilities, danger level, attack type, communication protocol, number of transmitted bytes, number of packets, and at least one of the number of lost packets.

[0059] The security situation data knowledge graph in step S102 can be constructed based on the above data. Assume that G represents the security situation data knowledge graph set, G = {g1, g2, ... g n}, g n Represents the security situation data knowledge graph at the nth moment. The security situation data knowledge graph can fully display various factors that affect the network security situation and their associations. Through the security situation data knowledge graph, the security situation information with complex information characteristics and diverse structures collected from different devices can be integrated and associated, and the characteristic information of data nodes and the spatial structure information between nodes can be considered simultaneously during the evaluation process, so as to make greater use of the information of the power space and achieve accurate evaluation of the network security situation of the power space within a certain time interval.

[0060] In step S103, a situation assessment result is obtained through a situation assessment model. The situation assessment model includes a graph convolutional neural network layer and a transformer layer, which can fully learn the node features and structural features of network security situation data to achieve an assessment of the current network security situation.

[0061] In an embodiment of the present application, the step of obtaining a situation assessment result through the above-mentioned situation assessment model may include: extracting a feature matrix and an adjacency relationship matrix of the above-mentioned security situation data knowledge graph according to the above-mentioned network security situation data set, the above-mentioned feature matrix is ​​used to represent the features of the nodes in the above-mentioned security situation data knowledge graph, and the above-mentioned adjacency relationship matrix is ​​used to represent the adjacency relationship of the nodes in the above-mentioned security situation data knowledge graph; inputting the above-mentioned feature matrix and the above-mentioned adjacency relationship matrix into a graph convolutional neural network model to obtain an intermediate feature vector; generating a query vector and a key value vector according to the above-mentioned intermediate feature vector, generating a numerical vector according to the above-mentioned feature matrix, and inputting the above-mentioned query vector, the above-mentioned key value vector and the above-mentioned numerical vector into the transformer layer to obtain the above-mentioned situation assessment result.

[0062] In the above content, the adjacency matrix can be represented by a two-dimensional array. The elements in the two-dimensional array represent the nodes in the security situation data knowledge graph, the element position corresponds to the node position, and the element value indicates whether there is an edge connecting the vertices.

[0063] Graph convolutional neural networks have unique advantages in processing graph structure data. In the embodiments of the present application, the topological properties of the data structure itself are taken into account, and the node feature matrix and the adjacency matrix are input into the graph convolutional neural network. It can update the current central node features by aggregating the features of neighboring nodes, and capture the position, neighborhood and role of the node in the entire graph structure. The setting of the number of graph convolutional neural network layers can be determined according to actual conditions, and this application does not make specific restrictions. Appropriate deepening of the graph convolutional neural network can help capture the global information of the graph, thereby well representing the node features. However, since the graph convolutional neural network passes messages layer by layer, all nodes need to participate in training to obtain new node feature representations. Deeper layers may bring problems of over-smoothing and gradient explosion, resulting in poor training accuracy. In the embodiments of the present application, the graph convolutional neural network is set to two layers.

[0064] In the process of implementing this application, considering that the graph convolutional neural network layer may have problems such as over-smoothing, over-squashing, and the use of pooling function may lose some original data information in the process of extracting features, and the Transformer layer can effectively improve the performance of the model in various tasks in processing sequence data, the applicant introduced the Transformer layer, which can capture long-distance dependencies, reduce the occurrence of over-smoothing and over-squashing, and even combine the graph convolutional neural network and frequency domain information, so that the model will have stronger performance. At the same time, making good use of the [CLS] token can remove / reduce the use of the pooling function. In addition, since the node representation generated by the Transformer layer does not necessarily capture the structural similarity between nodes, the graph convolutional neural network is placed before the Transformer layer to extract features and fuse the local structural features of the graph.

[0065] Specifically, the process of obtaining the situation assessment result through the Transformer layer includes: generating a query vector Q and a key value vector K according to the intermediate feature vector, and generating a numerical vector V according to the feature matrix; obtaining a multi-head attention result through a multi-head attention module according to the query vector Q, the key value vector K and the numerical vector V; and inputting the result of the multi-head attention layer into the Feed Forward layer to obtain the situation assessment result.

[0066] The query vector Q, key value vector K and value vector V can be calculated by the following formula: Q = HW Q ,K=HW K ,V=HW V In this way, the calculation formula for the multi-head attention result is: The calculation formula for the situation assessment result is: H (l) =FFN(H′ (l) )+H′ (l) , H′ (l) =Attention(Q,K,V)+H (l-1) .

[0067] In order to further improve the computing power of the model, a supernode can be added to the security situation data knowledge graph before inputting it into the situation assessment model. In this application, the supernode can be regarded as an initialized virtual node, which is directly connected to all nodes, and the shortest path is 1. Virtual nodes can follow all other nodes, so it can be considered that the node feature vector of the virtual node aggregates the entire graph information and is regarded as a feature vector representation of the entire graph. Through experiments, it was found that adding virtual nodes did not cause smoothing problems, which helped to deepen the number of network layers for graph reading.

[0068] It can be understood that the training of the situation assessment model can be completed based on the security situation data knowledge graph and the corresponding situation assessment quantitative value labels.

[0069] The situation assessment quantification value needs to be realized according to the preset situation assessment quantification standard. In the network security situation assessment, the construction of the evaluation data set affects the quality of the evaluation results to a certain extent. Therefore, the selection of indicators for constructing the evaluation data set is extremely important. This application does not limit the specific situation assessment standards. For example, you can choose to quantify the situation assessment from four dimensions. The four dimensions may include: vulnerability, threat, reliability and availability.

[0070] Each dimension includes one or more evaluation indicators. The more evaluation indicators there are, the more representative the situation assessment results are. But at the same time, too many evaluation factors will increase the computational complexity of the network security situation. Therefore, this application screens out representative evaluation factors from many factors by calculating the consistency of the evaluation factors, optimizes the indicator system, simplifies the calculation of security assessment, and further improves the performance of security situation assessment. The evaluation indicator selection process may include: constructing a judgment matrix for each pre-selected evaluation indicator, and solving the maximum eigenvalue and eigenvector of each judgment matrix, the position of the maximum value element in the eigenvector indicating the evaluation dimension to which the pre-selected evaluation indicator belongs; calculating the consistency of all pre-selected evaluation indicators under each evaluation dimension according to the eigenvector; selecting no more than a preset number of pre-selected evaluation dimensions with the smallest consistency under each evaluation dimension as the evaluation indicator.

[0071] In an embodiment of the present application, after screening, the evaluation indicators under the vulnerability assessment dimension may include at least one of the number of vulnerabilities, vulnerability severity levels and vulnerability types; the evaluation indicators under the threat assessment dimension may include at least one of the threat type, the number of threat attacks, the type of attacked device and the frequency of security incidents; the evaluation indicators under the security assessment dimension may include at least one of the device open ports, the network topology and the number of security devices; the evaluation indicators under the availability assessment dimension may include at least one of the network bandwidth usage, the data packet distribution and the traffic change rate.

[0072] In the embodiment of the present application, based on the above evaluation system, a situation assessment quantitative value can be obtained through the hierarchical analysis method. The larger the situation assessment quantitative value is, the more unsafe the power network is at that moment.

[0073] By associating the security situation data knowledge graph and situation assessment quantification value at the same time, we can obtain the network security situation data set D′={g1&p1,g2&p2,…g n &p n}. P={p1,p2,…p n} represents the quantitative value of situation assessment.

[0074] In summary, in order to solve the problem that the evaluation performance is limited due to not considering the spatial structure information of situation elements, a situation assessment model is proposed. The graph convolutional neural network is used to learn the spatial neighbor structure of situation elements, the Transformer method is used to learn the node feature information, and the super node is introduced to obtain the feature vector of the whole graph, which accelerates the convergence of the model and improves the accuracy of situation assessment.

[0075] It can be understood that the method can be executed by any device, equipment, platform, or device cluster having computing and processing capabilities.

[0076] It should be noted that the method of one or more embodiments of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of one or more embodiments of the present application, and the multiple devices will interact with each other to complete the described method.

[0077] It should be noted that the above describes specific embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0078] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present application also provides a power network security situation assessment device. Figure 2 As shown, the device comprises:

[0079] A data acquisition module 11 is configured to acquire network security situation data of multiple nodes in the power network, wherein the network security situation data is extracted according to a preset fixed field;

[0080] The data processing module 12 is configured to construct a security situation data knowledge graph based on the above network security situation data;

[0081] The situation assessment module 13 is configured to input the above-mentioned network security situation data set into the situation assessment model to obtain a situation assessment result; wherein the above-mentioned situation assessment model includes a graph convolutional neural network layer and a transformer layer.

[0082] For the convenience of description, the above devices are described in terms of functions and modules. Of course, when implementing one or more embodiments of the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0083] The apparatus of the above-mentioned embodiment is used to implement the corresponding method in the above-mentioned embodiment, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0084] Figure 3 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0085] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0086] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solution provided in the embodiment of the present application is implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0087] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0088] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0089] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0090] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiment of the present application, and does not necessarily include all the components shown in the figure.

[0091] The electronic device of the above embodiment is used to implement the corresponding method in the above embodiment, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0092] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0093] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Based on the concept of the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of different aspects of one or more embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0094] In addition, to simplify the description and discussion, and in order not to make one or more embodiments of the present application difficult to understand, the known power / ground connections to the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making one or more embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which one or more embodiments of the present application will be implemented (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuits) to describe exemplary embodiments of the present disclosure, it is obvious to those skilled in the art that one or more embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0095] Although the present disclosure has been described in conjunction with specific embodiments of the present disclosure, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0096] One or more embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of one or more embodiments of the present application should be included in the scope of protection of this disclosure.

Claims

1. A method for assessing the security situation of a power network, characterized in that: include: Acquire network security situation data of multiple nodes in the power network, wherein the network security situation data is extracted according to a preset fixed field; Constructing a security situation data knowledge graph based on the network security situation data; The network security situation data set is input into a situation assessment model to obtain a situation assessment result; wherein the situation assessment model includes a graph convolutional neural network layer and a transformer layer.

2. The method according to claim 1, characterized in that The step of obtaining the situation assessment result through the situation assessment model comprises: Extracting a feature matrix and an adjacency matrix of the security situation data knowledge graph, wherein the feature matrix is ​​used to represent the features of nodes in the security situation data knowledge graph, and the adjacency matrix is ​​used to represent the adjacency relationships of nodes in the security situation data knowledge graph; Inputting the feature matrix and the adjacency matrix into a graph convolutional neural network model to obtain an intermediate feature vector; A query vector and a key value vector are generated according to the intermediate feature vector, a numerical vector is generated according to the feature matrix, and the query vector, the key value vector and the numerical vector are input into a transformer layer to obtain the situation assessment result.

3. The method according to claim 2, characterized in that Before extracting the feature matrix and adjacency matrix of the security situation data knowledge graph, it includes: A super node is added to the security situation data knowledge graph, and all nodes in the security situation data knowledge graph are directly connected to the super node, and the shortest path to each node is 1.

4. The method according to any one of claims 1 to 3, characterized in that: The situation assessment model is trained based on a training security situation data knowledge graph and its corresponding situation assessment quantized value labels.

5. The method according to claim 4, characterized in that The calculation process of the situation assessment quantitative value includes: Construct evaluation metrics; Calculate the score of each evaluation indicator based on the network security situation data; The situation assessment quantification value is obtained by performing a weighted summation based on the score of the assessment indicator and the weight of each assessment indicator.

6. The method according to claim 5, characterized in that The construction evaluation indicators include: Constructing evaluation dimensions; According to the evaluation dimensions, construct pre-selected evaluation indicators; each of the evaluation dimensions includes at least one pre-selected evaluation indicator; Constructing a judgment matrix for each of the pre-selected evaluation indicators, and solving the maximum eigenvalue and eigenvector of each judgment matrix, wherein the position of the maximum value element in the eigenvector indicates the evaluation dimension to which the pre-selected evaluation indicator belongs; Calculate the consistency of all pre-selected evaluation indicators under each evaluation dimension according to the feature vector; Under each evaluation dimension, no more than a preset number of pre-selected evaluation dimensions with the smallest consistency are selected as evaluation indicators.

7. The method according to claim 6, characterized in that The assessment dimensions include: at least one of vulnerability, threat, security and availability; The evaluation indicators under the vulnerability assessment dimension include at least one of the number of vulnerabilities, the severity level of vulnerabilities, and the type of vulnerabilities; The evaluation indicators under the threat assessment dimension include at least one of the threat type, the number of threat attacks, the type of attacked device, and the frequency of security incidents; The evaluation indicators under the security evaluation dimension include at least one of the device open port status, network topology structure and the number of security devices; The evaluation indicators under the availability evaluation dimension include at least one of network bandwidth usage, data packet distribution, and traffic change rate.

8. A security situation assessment device for a power network, characterized in that: include: A data acquisition module is configured to acquire network security situation data of a plurality of nodes in the power network, wherein the network security situation data is extracted according to a preset fixed field; A data processing module is configured to construct a security situation data knowledge graph based on the network security situation data; The situation assessment module is configured to input the network security situation data set into a situation assessment model to obtain a situation assessment result; wherein the situation assessment model includes a graph convolutional neural network layer and a transformer layer.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause the computer to execute any one of claims 1 to 7.

Images