Method and related device for security posture assessment of power network

Abstract

The one or more embodiments of the application provide a security posture assessment method of a power network and related equipment. The method comprises: acquiring network security posture data of a plurality of nodes in the power network, the network security posture data being extracted according to a preset fixed field; constructing a security posture data knowledge graph according to the network security posture data; inputting the network security posture data set into a posture assessment model to obtain a posture assessment result; wherein the posture assessment model comprises a graph convolutional neural network layer and a transformer layer. Through the application, the security posture assessment effect of the power network can be effectively improved, thereby improving the security performance of the power network.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present application relate to the technical field of computer technology, and in particular to a security posture assessment method of a power network and related equipment. BACKGROUND

[0002] With the acceleration of industrial informatization, network security problems have become one of the problems that must be valued and solved in various industries. As an important part of critical infrastructure, the power system is facing unprecedented network security challenges. Network attacks and data breaches occur frequently, and factors threatening network security are increasingly complex and variable, and the network security situation is becoming increasingly severe. In addition, network attacks are evolving towards trends such as large-scale, complex form, encryption attack normalization, and diversified attack targets, which reduces the effectiveness of conventional defense tools against complex network attacks.

[0003] Most existing security solutions focus on protecting individual components of a system. The close coupling characteristics of modern power network systems make it impossible for such solutions to conduct joint analysis of security components and timely deployment of security strategies. In modern society, how to effectively detect and mitigate network attacks is a highly challenging and difficult task. SUMMARY

[0004] In view of this, the purpose of one or more embodiments of the present application is to propose a security posture assessment method of a power network and related equipment to solve the problems raised in the background art.

[0005] To achieve the above purpose, one or more embodiments of the present application provide a security posture assessment method of a power network, comprising:

[0006] obtaining network security posture data of a plurality of nodes in a power network, the network security posture data being extracted according to a predetermined fixed field;

[0007] constructing a security posture data knowledge graph according to the network security posture data;

[0008] inputting the network security posture data set into a posture assessment model to obtain a posture assessment result; wherein the posture assessment model comprises a graph convolutional neural network layer and a transformer layer.

[0009] Optionally, the step of obtaining a posture assessment result through the posture assessment model comprises:

[0010] extracting a feature matrix and an adjacency relationship matrix of the security posture data knowledge graph, the feature matrix being used to represent the features of the nodes in the security posture data knowledge graph, and the adjacency relationship matrix being used to represent the adjacency relationship of the nodes in the security posture data knowledge graph;

[0011] inputting the feature matrix and the adjacency relation matrix into a graph convolutional neural network model to obtain an intermediate feature vector;

[0012] generating a query vector and a key value vector according to the intermediate feature vector, generating a numerical vector according to the feature matrix, and inputting the query vector, the key value vector and the numerical vector into a transformer layer to obtain the situation assessment result.

[0013] Optionally, before extracting the feature matrix and the adjacency relation matrix of the security situation data knowledge graph, the method comprises:

[0014] adding a super node to the security situation data knowledge graph, wherein all nodes in the security situation data knowledge graph are directly connected to the super node, and the shortest path between the super node and each node is 1.

[0015] Optionally, the situation assessment model is trained according to a training security situation data knowledge graph and a corresponding situation assessment quantitative value label.

[0016] Optionally, the calculation process of the situation assessment quantitative value comprises:

[0017] constructing an evaluation index;

[0018] calculating the score of each evaluation index according to the network security situation data;

[0019] performing weighted summation according to the score of the evaluation index and the weight of each evaluation index to obtain the situation assessment quantitative value.

[0020] Optionally, the constructing of the evaluation index comprises:

[0021] constructing an evaluation dimension;

[0022] constructing a preselected evaluation index according to the evaluation dimension; each evaluation dimension comprises at least one preselected evaluation index;

[0023] constructing a judgment matrix for each preselected evaluation index, and solving the maximum eigenvalue and the eigenvector of each judgment matrix, wherein the position of the maximum value element in the eigenvector indicates the evaluation dimension to which the preselected evaluation index belongs;

[0024] calculating the consistency of all preselected evaluation indexes under each evaluation dimension according to the eigenvector;

[0025] selecting no more than a preset number of preselected evaluation indexes with the minimum consistency in each evaluation dimension as evaluation indexes.

[0026] Optionally, the evaluation dimension comprises at least one of vulnerability, threat, security and availability.

[0027] The evaluation indexes under the vulnerability evaluation dimension include at least one of the number of vulnerabilities, the severity level of vulnerabilities, and the type of vulnerabilities.

[0028] The evaluation indexes under the threat evaluation dimension include at least one of the type of threats, the number of threat attacks, the type of attacked devices, and the frequency of security events.

[0029] The evaluation indexes under the security evaluation dimension include at least one of the open port situation of devices, the network topology structure, and the number of security devices.

[0030] The evaluation indexes under the availability evaluation dimension include at least one of the network bandwidth usage, the data packet distribution, and the traffic change rate.

[0031] Based on the same inventive concept, one or more embodiments of the present application also provide a security posture assessment device of a power network, comprising:

[0032] a data acquisition module configured to acquire network security posture data of a plurality of nodes in the power network, the network security posture data being extracted according to a preset fixed field;

[0033] a data processing module configured to construct a security posture data knowledge graph according to the network security posture data;

[0034] a posture assessment module configured to input the network security posture data set into a posture assessment model to obtain a posture assessment result; wherein the posture assessment model includes a graph convolutional neural network layer and a transformer layer.

[0035] Based on the same inventive concept, one or more embodiments of the present application also provide an electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor executes the program to implement the security posture assessment method of the power network according to any one of the above embodiments.

[0036] Based on the same inventive concept, one or more embodiments of the present application also provide a non-transitory computer readable storage medium storing computer instructions for causing the computer to execute the security posture assessment method of the power network according to any one of the above embodiments.

[0037] From the above, it can be seen that the security situation assessment of the power network provided by one or more embodiments of the present application, by acquiring network security situation data of a plurality of nodes in the power network, the network security situation data is extracted according to a preset fixed field; constructing a network security situation data set according to the network security situation data; the network security situation data set includes a security situation data knowledge graph constructed according to the network security situation data, and a situation assessment quantitative value corresponding to the network security situation data; inputting the network security situation data set into a situation assessment model to obtain a situation assessment result; wherein the situation assessment model includes a graph convolutional neural network layer and a transformer layer.

[0038] The present application converts the power network security situation assessment task into a graph classification problem for the evaluation data set of the graph property. In order to consider as many node features and spatial features of the graph as possible, the evaluation model introduces a Transformer layer based on the graph convolutional neural network to help consider the relationship between deeper network features through the graph structure, so as to improve the evaluation accuracy.

[0039] The present application can effectively improve the power network security situation assessment effect, thereby improving the security performance of the power network.

[0040] The security situation assessment device of the power network, the electronic equipment and the computer readable storage medium provided by the present application can realize the steps of the above security situation assessment method of the power network, and therefore also have the beneficial effects of the above security situation assessment method of the power network. BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the one or more embodiments of the present application or the prior art, the drawings needed to be used in the embodiment or prior art description will be briefly introduced. Obviously, the drawings in the following description are only one or more embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0042] Figure 1 The flowchart of the security situation assessment method of the power network of the one or more embodiments of the present application;

[0043] Figure 2 The structural schematic diagram of the security situation assessment device of the power network of the one or more embodiments of the present application;

[0044] Figure 3 The hardware structure schematic diagram of the electronic equipment of the one or more embodiments of the present application. DETAILED DESCRIPTION

[0045] In order to make the objects, technical solutions and advantages of the present disclosure clearer, the present disclosure will be described in further detail below with reference to specific embodiments and drawings.

[0046] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in one or more embodiments of the present application should be understood as the general meaning understood by those skilled in the art to which the present disclosure belongs. The terms "first", "second" and the like used in one or more embodiments of the present application do not represent any order, number or importance, but are only used to distinguish different components. The terms "include" or "contain" and the like mean that the elements or objects before the terms cover the elements or objects listed after the terms and their equivalents, and do not exclude other elements or objects. The terms "connect" or "connected" and the like are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The terms "up", "down", "left", "right" and the like are only used to represent relative positional relationships, and when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0047] As described in the background section, in modern society, how to effectively detect and mitigate network attacks is a very challenging and difficult task. To solve the limitations of a single security detection method, network security posture assessment technology has emerged.

[0048] Network security posture assessment refers to determining the current network security state and future trend of change in a complex network operating environment, with various influencing factors such as the operating status of network devices, network behavior and user behavior, which reflect the overall operating status of the network. Compared with solutions such as antivirus software and firewalls, it is an active and effective network defense technology that can ensure system security in the current complex network environment.

[0049] This technology collects and analyzes security element information that causes changes in network security posture, and uses a quantifiable evaluation index system to quantitatively evaluate the overall network security posture, to obtain the overall security status of the network, and to provide visual results for users, helping system administrators to take preventive or remedial measures in a timely manner. The challenge of designing a reasonable network security posture assessment method lies in two aspects: how to develop a reliable posture assessment index system and posture assessment model design.

[0050] Applicant found in the process of realizing the present disclosure that the knowledge graph, as a semantic network organized by entities, relationships, attributes and the like, can express rich semantic relationships, and by integrating scattered and distributed multi-source heterogeneous data, provides support for data analysis and mining. By using the knowledge graph, complex and diverse information features of security situation information collected from different devices can be integrated and correlated, and the feature information of data nodes and the spatial structure information between nodes are considered simultaneously in the evaluation process, the information of the power space is utilized to a greater extent, and accurate evaluation of the network security situation of the power space within a certain time interval is realized.

[0051] Reference Figure 1 The security situation evaluation method of the power network of one or more embodiments of the present application comprises the following steps:

[0052] Step S101: Obtain network security situation data of a plurality of nodes in the power network, wherein the network security situation data is extracted according to a preset fixed field.

[0053] Step S102: Construct a security situation data knowledge graph according to the network security situation data.

[0054] Step S103: Input the network security situation data set into a situation evaluation model to obtain a situation evaluation result; wherein the situation evaluation model comprises a graph convolutional neural network layer and a transformer layer.

[0055] In step S101, the source of the network security situation data can include at least one of network data traffic, device asset data, vulnerability data, device alarm data, and log information of each node in the target power space.

[0056] In the embodiments of the present application, the network security situation data can be subjected to data cleaning, standardization, situation feature screening, etc. Through the above operations, the problems of different formats and information missing of the collected data can be solved.

[0057] In order to ensure the timeliness of the security situation evaluation result, data can be collected according to a preset time interval. If d n represents the data at the nth moment, the data set can be represented as D={d1,d2,…d n}.

[0058] In the embodiments of the present application, the fixed field can include at least one of device IP address, device type, vulnerability type, vulnerability number, danger level, attack type, communication protocol, transmission byte number, packet number and packet loss number.

[0059] The security posture data knowledge graph in step S102 can be constructed according to the above data. It is assumed that G represents a set of security posture data knowledge graphs, G={g1, g2, …g n} and g n represents the security posture data knowledge graph at the nth moment. The security posture data knowledge graph can fully display various elements affecting the network security posture and their correlations. Through the security posture data knowledge graph, the complex information features and the various structures of the security posture information collected from different devices can be integrated and correlated, and the feature information of the data nodes and the spatial structure information between the nodes are considered simultaneously in the evaluation process, the information of the power space is utilized to a greater extent, and accurate evaluation of the network security posture of the power space within a certain time interval is realized.

[0060] In step S103, a posture evaluation result is obtained through a posture evaluation model. The posture evaluation model includes a graph convolutional neural network layer and a transformer layer, which can fully learn the node features and structure features of the network security posture data, and realize the evaluation of the current network security posture.

[0061] In the embodiments of the present application, the step of obtaining a posture evaluation result through the above posture evaluation model can include: extracting a feature matrix and an adjacency relationship matrix of the security posture data knowledge graph according to the above network security posture data set, the feature matrix being used to represent the features of the nodes in the security posture data knowledge graph, and the adjacency relationship matrix being used to represent the adjacency relationship of the nodes in the security posture data knowledge graph; inputting the feature matrix and the adjacency relationship matrix into a graph convolutional neural network model to obtain an intermediate feature vector; generating a query vector and a key value vector according to the intermediate feature vector, generating a numerical vector according to the feature matrix, and inputting the query vector, the key value vector and the numerical vector into a transformer layer to obtain the posture evaluation result.

[0062] In the above, the adjacency relationship matrix can be represented by a two-dimensional array. The elements in the two-dimensional array represent the nodes in the security posture data knowledge graph, the element positions correspond to the node positions, and the values of the elements represent whether there is an edge between the vertices.

[0063] The graph convolutional neural network has unique advantages in processing graph structure data. In the embodiments of the present application, the topological properties of the data structure itself are considered, and the node feature matrix and the adjacency matrix are input into the graph convolutional neural network, which can update the current center node feature by aggregating the features of neighboring nodes, capture the position, neighborhood and role of the node in the entire graph structure. The number of layers of the graph convolutional neural network can be determined according to the actual situation, and the present application does not make specific limitations. Appropriately deepening the graph convolutional neural network can help capture the global information of the graph, thereby well representing the node features. However, since the graph convolutional neural network is through layer-by-layer message passing, all nodes need to participate in training to obtain new node feature representation, and a deeper number of layers may cause over-smoothing and gradient explosion problems, resulting in poor training accuracy. In the embodiments of the present application, the graph convolutional neural network is set to two layers.

[0064] In the process of implementing the present application, it is considered that in the process of extracting features by the graph convolutional neural network layer, there may be problems of over-smoothing, over-squashing, and the use of the pooling function may lose some original data information. The Transformer layer can effectively improve the performance of the model on multiple tasks in processing sequence data, so the applicant introduces the Transformer layer, which can capture long-distance dependencies, reduce the phenomenon of over-smoothing and over-squashing, and even combine the graph convolutional neural network and frequency domain information. The model will have stronger performance. At the same time, the use of the [CLS] token can remove / reduce the use of the pooling function. In addition, since the node representation generated by the Transformer layer does not necessarily capture the structural similarity between nodes, the graph convolutional neural network is placed before the Transformer layer to extract features and fuse local structural features of the graph.

[0065] Specifically, the process of obtaining the situation assessment result through the Transformer layer includes: generating a query vector Q and a key value vector K according to the intermediate feature vector, and generating a numerical vector V according to the feature matrix; obtaining a multi-head attention result through a multi-head attention module according to the query vector Q, the key value vector K and the numerical vector V; inputting the result of the multi-head attention layer into a Feed Forward front feeding layer to obtain the situation assessment result.

[0066] Wherein, the query vector Q, the key value vector K and the numerical vector V can be calculated by the following formula: Q = HW Q ,K = HW K ,V = HW V In this way, the calculation formula of the multi-head attention result is: The formula for calculating the situation assessment result is: H (l) =FFN(H′) (l) )+H′ (l) H′ (l) =Attention(Q,K,V)+H (l-1) .

[0067] To further enhance the model's computational power, supernodes can be added to the security situation data knowledge graph before inputting it into the situation assessment model. In this application, a supernode can be viewed as an initialized virtual node, directly connected to all nodes with a shortest path of 1. Virtual nodes can follow all other nodes; therefore, their feature vectors can be considered as aggregating information from the entire graph, representing the feature vectors of the whole graph. Experiments show that adding virtual nodes does not cause smoothing issues and helps to deepen the network layers for graph readout.

[0068] It is understandable that the training of the situation assessment model can be completed based on the security situation data knowledge graph and the corresponding situation assessment quantification value labels.

[0069] The quantification of situation assessment needs to be achieved according to preset situation assessment quantification standards. In cybersecurity situation assessment, the construction of the assessment dataset significantly influences the quality of the assessment results. Therefore, the selection of indicators for constructing the assessment dataset is extremely important. This application does not limit the specific situation assessment standards. For example, situation assessment quantification can be performed from four dimensions. These four dimensions may include: vulnerability, threat, reliability, and availability.

[0070] Each dimension includes one or more evaluation indicators. The more evaluation indicators there are, the more representative the situation assessment results are. However, too many evaluation factors increase the computational complexity of cybersecurity situation assessment. Therefore, this application optimizes the indicator system, simplifies the calculation of security assessment, and further improves the performance of security situation assessment by calculating the consistency of evaluation factors and selecting representative evaluation factors from numerous factors. The evaluation indicator selection process may include: constructing a judgment matrix for each pre-selected evaluation indicator and solving for the maximum eigenvalue and eigenvector of each judgment matrix, where the position of the maximum value element in the eigenvector indicates the evaluation dimension to which the pre-selected evaluation indicator belongs; calculating the consistency of all pre-selected evaluation indicators under each evaluation dimension based on the eigenvector; and selecting no more than a preset number of pre-selected evaluation dimensions with the lowest consistency under each evaluation dimension as evaluation indicators.

[0071] In the embodiments of the present application, through screening, the evaluation indexes under the vulnerability evaluation dimension can include at least one of the number of vulnerabilities, the vulnerability severity level and the vulnerability type; the evaluation indexes under the threat evaluation dimension can include at least one of the threat type, the threat attack times, the attacked device type and the security event occurrence frequency; the evaluation indexes under the security evaluation dimension can include at least one of the device open port situation, the network topology structure and the number of security devices; and the evaluation indexes under the availability evaluation dimension can include at least one of the network bandwidth usage, the data packet distribution situation and the traffic change rate.

[0072] In the embodiments of the present application, based on the above evaluation system, the situation evaluation quantitative value can be obtained by the analytic hierarchy process. The greater the situation evaluation quantitative value is, the less secure the power network at the moment is.

[0073] The security situation data knowledge graph and the situation evaluation quantitative value at the same moment are associated, and the network security situation data set D' at the moment can be obtained, that is, D' = {g1&p1, g2&p2, … g n &p n}. P = {p1, p2, … p n} represents the situation evaluation quantitative value.

[0074] In summary, to solve the problem that the evaluation performance is limited due to the fact that the spatial structure information of the situation elements is not considered, the situation evaluation model is proposed, the spatial neighbor structure of the situation elements is learned using the graph convolutional neural network, the node feature information is learned using the method of the Transformer, and the super node is introduced to obtain the graph feature vector, which accelerates the model convergence speed and improves the accuracy of the situation evaluation.

[0075] It can be understood that the method can be executed by any device, equipment, platform, device cluster with computing and processing capabilities.

[0076] It should be noted that the method of one or more embodiments of the present application can be executed by a single device, such as a computer or a server, etc. The method of the present embodiment can also be applied to a distributed scenario, and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only execute one or more steps in the method of one or more embodiments of the present application, and the multiple devices will interact with each other to complete the method.

[0077] It is to be understood that the foregoing description is directed to particular embodiments of the application. Various changes can be made to the application claimed without departing from the scope of the application. In some instances, the acts or steps can occur in different orders, and / or at different times than depicted in the example embodiments. Furthermore, not all of the acts or events are required, which have been deemed necessary with respect to the embodiments of the application, and other implementations of the application will be apparent to those of ordinary skill in the art upon reviewing the description.

[0078] Based on the same inventive concept, the present application also provides a security posture assessment device of a power network corresponding to the method of any of the above embodiments. As shown in the figure, the device comprises: Figure 2

[0079] The data acquisition module 11 is configured to acquire network security posture data of a plurality of nodes in the power network, and the network security posture data is extracted according to a preset fixed field.

[0080] The data processing module 12 is configured to construct a security posture data knowledge graph according to the network security posture data.

[0081] The posture assessment module 13 is configured to input the network security posture data set into a posture assessment model to obtain a posture assessment result, wherein the posture assessment model comprises a graph convolutional neural network layer and a transformer layer.

[0082] For the convenience of description, the above device is described as various modules respectively described in function. Of course, the functions of each module can be implemented in the same or more software and / or hardware when implementing one or more embodiments of the present application.

[0083] The device of the above embodiment is used to implement the corresponding method in the foregoing embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be described here.

[0084] Figure 3 A more specific electronic device hardware structure schematic diagram provided by the present embodiment is shown, which can include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040 and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030 and the communication interface 1040 are connected to each other through the bus 1050 for communication within the device.

[0085] ​The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, etc., for executing relevant programs to implement the technical solutions provided by the embodiments of the present application.

[0086] The memory 1020 can be implemented by a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 1020 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present application are implemented by software or firmware, relevant program codes are stored in the memory 1020 and called and executed by the processor 1010.

[0087] The input / output interface 1030 is configured to connect input / output modules to implement information input and output. The input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. The input devices can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output devices can include a display, a speaker, a vibrator, an indicator light, etc.

[0088] The communication interface 1040 is configured to connect a communication module (not shown in the figure) to implement communication interaction between the device and other devices. The communication module can realize communication through a wired manner (such as a USB, a network cable, etc.) or through a wireless manner (such as a mobile network, WIFI, Bluetooth, etc.).

[0089] The bus 1050 includes a path for transmitting information between various components (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040) of the device.

[0090] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only include components necessary for implementing the technical solutions of the embodiments of the present application, and does not necessarily include all the components shown in the figure.

[0091] The electronic device of the above embodiments is used to implement the corresponding methods in the foregoing embodiments and has the beneficial effects of the corresponding method embodiments, which are not described here again.

[0092] The computer readable media of the present embodiments includes permanent and non-permanent, removable and non-removable media can be implemented by any method or technology to store information. The information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device.

[0093] Those skilled in the art should understand that the discussion of the above any embodiment is only exemplary, and is not intended to imply that the scope of the present disclosure (including claims) is limited to these examples; under the idea of the present disclosure, the above embodiments or technical features between different embodiments can also be combined, the steps can be implemented in any order, and there are many other changes of different aspects of the present application as described above. In order to be brief, they are not provided in detail.

[0094] In addition, in order to simplify the description and discussion, and so as not to make the one or more embodiments of the present application difficult to understand, the well-known power / ground connections of integrated circuit (IC) chips and other components can or can not be shown in the provided drawings. In addition, the devices can be shown in the form of block diagrams in order to avoid making the one or more embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented the one or more embodiments of the present application (i.e. these details should be fully within the understanding of those skilled in the art). Where specific details (e.g. circuits) are set forth in order to describe an exemplary embodiment of the present disclosure, it will be apparent to those skilled in the art that the one or more embodiments of the present application can be implemented without these specific details or with variations on these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0095] Although the present disclosure has been described in conjunction with specific embodiments thereof, many alternatives, modifications and variations will be apparent to those skilled in the art in light of the foregoing description. For example, other memory architectures (e.g. dynamic RAM (DRAM)) can use the embodiments discussed.

[0096] One or more embodiments of the present application are intended to cover all such alternatives, modifications, and variations as come within the scope of the appended claims. Accordingly, any and all such alternatives, modifications, equivalents, improvements and the like are intended to be encompassed by the present disclosure.

Claims

1. A method of security posture assessment of an electric power network, characterized in that, The method comprises the following steps: acquiring network security posture data of a plurality of nodes in a power network, the network security posture data being extracted according to a preset fixed field; constructing a security posture data knowledge graph according to the network security posture data; inputting the network security posture data set into a posture assessment model to obtain a posture assessment result; wherein the posture assessment model comprises a graph convolutional neural network layer and a transformer layer, and the posture assessment model is trained according to a training security posture data knowledge graph and a corresponding posture assessment quantitative value label; wherein the calculation process of the posture assessment quantitative value comprises: constructing an evaluation index; calculating the score of each evaluation index according to the network security posture data; performing weighted summation according to the score of the evaluation index and the weight of each evaluation index to obtain the posture assessment quantitative value; the construction of the evaluation index comprises: constructing an evaluation dimension; constructing a preselected evaluation index according to the evaluation dimension; each evaluation dimension comprises at least one preselected evaluation index; constructing a judgment matrix for each preselected evaluation index, and solving the maximum eigenvalue and eigenvector of each judgment matrix, wherein the position of the maximum value element in the eigenvector indicates the evaluation dimension to which the preselected evaluation index belongs; calculating the consistency of all preselected evaluation indexes under each evaluation dimension according to the eigenvector; selecting no more than a preset number of preselected evaluation indexes with the smallest consistency in each evaluation dimension as evaluation indexes.

2. The method of claim 1, wherein, The step of obtaining a posture assessment result through the posture assessment model comprises: extracting a feature matrix and an adjacency relationship matrix of the security posture data knowledge graph, wherein the feature matrix is used to represent the features of the nodes in the security posture data knowledge graph, and the adjacency relationship matrix is used to represent the adjacency relationship between the nodes in the security posture data knowledge graph, and the adjacency relationship matrix is represented by a two-dimensional array, wherein the elements in the two-dimensional array represent the nodes in the security posture data knowledge graph, the element positions correspond to the node positions, and the values of the elements represent whether there is an edge between the nodes; inputting the feature matrix and the adjacency relationship matrix into a graph convolutional neural network model to obtain an intermediate feature vector; generating a query vector and a key value vector according to the intermediate feature vector, generating a numerical vector according to the feature matrix, and inputting the query vector, the key value vector and the numerical vector into a transformer layer to obtain the posture assessment result.

3. The method of claim 2, wherein, Before extracting the feature matrix and the adjacency relationship matrix of the security posture data knowledge graph, the following step is included: adding a super node to the security posture data knowledge graph, wherein all nodes in the security posture data knowledge graph are directly connected to the super node, and the shortest path between the super node and each node is 1.

4. The method of claim 1, wherein, The evaluation dimension comprises at least one of vulnerability, threat, security and availability; the evaluation index under the vulnerability evaluation dimension comprises at least one of the number of vulnerabilities, the severity level of vulnerabilities and the type of vulnerabilities; the evaluation index under the threat evaluation dimension comprises at least one of the type of threats, the number of threat attacks, the type of attacked devices and the frequency of security events; The evaluation indexes under the security evaluation dimension include at least one of the following: open port condition of the device, network topology structure, and number of security devices. The evaluation indexes under the availability evaluation dimension include at least one of the following: network bandwidth usage, data packet distribution, and traffic change rate.

5. A security posture assessment apparatus of an electric power network, characterized by, The method comprises the following steps: The data acquisition module is configured to acquire network security posture data of a plurality of nodes in a power network, wherein the network security posture data is extracted according to a preset fixed field; The data processing module is configured to construct a security posture data knowledge graph according to the network security posture data; The posture evaluation module is configured to input the network security posture data set into a posture evaluation model to obtain a posture evaluation result; wherein the posture evaluation model comprises a graph convolutional neural network layer and a transformer layer, and the posture evaluation model is trained according to training security posture data knowledge graphs and corresponding posture evaluation quantitative value labels; The calculation process of the posture evaluation quantitative value comprises the following steps: Constructing evaluation indexes; According to the network security posture data, the score of each evaluation index is calculated; According to the score of the evaluation index and the weight of each evaluation index, weighted summation is performed to obtain the posture evaluation quantitative value; The construction of the evaluation indexes comprises the following steps: Constructing evaluation dimensions; According to the evaluation dimensions, preselected evaluation indexes are constructed; each evaluation dimension comprises at least one preselected evaluation index; For each preselected evaluation index, a judgment matrix is constructed, and the maximum eigenvalue and eigenvector of each judgment matrix are solved; the position of the maximum value element in the eigenvector indicates the evaluation dimension to which the preselected evaluation index belongs; According to the eigenvector, the consistency of all preselected evaluation indexes under each evaluation dimension is calculated; Select not more than a preset number of preselected evaluation indexes with the smallest consistency in each evaluation dimension as evaluation indexes.

6. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to realize the method of any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium, comprising: The non-transitory computer readable storage medium stores computer instructions for causing the computer to execute the method of any one of claims 1 to 4.

Images