Security disposal method, device, equipment, medium and product fusing power network security element knowledge graph

Abstract

The invention discloses a security disposal method, device and equipment fusing a power network security element knowledge graph, a medium and a product. The method comprises the steps of collecting power network data, and converting the power network data into security basic data field data based on a data model; extracting network security knowledge to form network security elements, constructing a knowledge graph, and updating the knowledge graph in real time according to the security situation change condition of the power network; generating an initial security event disposal script according to the knowledge graph; when the knowledge graph is updated, updating the security event handling script according to the influence relationship between the network security element change in the knowledge graph and the generation process of the security event handling script; and disposing the security event according to the security disposal script through the response capability model. The knowledge graph and the security event handling script are constructed, and the knowledge graph and the security event handling script can adapt to the security situation change of the power network, so that the security event is automatically and reliably handled, and the security of the power grid is fully ensured.

Description

Technical Field

[0001] The present application relates to the field of power grid security technology, and in particular to a security disposal method, device, equipment, medium and product that integrates a knowledge graph of power grid security elements. Background Art

[0002] The new power system takes open interaction as one of its construction goals. In the context of adapting to the large-scale access of various new technologies, new equipment and multiple loads, it will inevitably face the problems of increased system hierarchical structure, multiple subsystems, inconsistent security protection strategies for each system, and various typical business scenarios requiring the coordinated handling of multiple protection components. In this scenario, the traditional strategy of relying on manual experience to check and expect single-point prevention and response is no longer applicable. It is necessary to adopt security orchestration automation and response technology to build a comprehensive network security defense response architecture for different interactive scenarios to achieve rapid discovery and timely handling of network attack behaviors.

[0003] As the cybersecurity attack and defense confrontation becomes increasingly fierce, security orchestration automation and response technology has quickly become a hot topic in current cybersecurity technology research. Security orchestration automation refers to the process of combining the security capabilities of different systems or different components in the system according to a certain logical relationship through automated means to complete a specific security operation. Machine learning methods have been used to classify warnings by analyzing historical attack data to improve the efficiency of research and disposal, but manual decision-making based on experience and auxiliary information is still required in the selection of scripts. There are also methods that use supervised active intelligence and automatic responder knowledge algorithms to provide security analysts with dynamic interactive capabilities at all stages of the incident response workflow to quickly handle existing and emerging threats. However, it only provides auxiliary suggestions for security experts and cannot realize automated decision-making of scripts. Some companies have proposed to automate the execution of scripts by setting response rules, but they still need to rely on security experts to manually set response rules. In the field of power grid security protection, how to reliably and automatically orchestrate and dispose of security is an urgent problem to be solved. Summary of the invention

[0004] The present application provides a security handling method, device, equipment, medium and product that integrates the knowledge graph of power network security elements to achieve automatic and reliable handling of security incidents and fully ensure the safety of the power grid.

[0005] In a first aspect, an embodiment of the present application provides a security handling method integrating a knowledge graph of power network security elements, including:

[0006] Collecting power network data, and converting the power network data into safety basic data domain data based on a data model;

[0007] Extracting network security knowledge from the security basic data domain data to form network security elements, and constructing a knowledge graph based on the network security elements, wherein the knowledge graph is updated in real time according to changes in the security situation of the power network;

[0008] Generate an initial security incident handling script based on the knowledge graph;

[0009] When the knowledge graph is updated, the security incident handling script is updated according to the influence relationship between the changes in the network security elements in the knowledge graph and the generation process of the security incident handling script;

[0010] Through the response capability model, security incidents are handled according to the security handling script.

[0011] In a second aspect, the embodiment of the present application further provides a security handling device integrating a knowledge graph of power network security elements, including:

[0012] A collection module, used for collecting power network data and converting the power network data into safety basic data domain data based on a data model;

[0013] A construction module, used to extract network security knowledge from the security basic data domain data to form network security elements, and to construct a knowledge graph based on the network security elements, wherein the knowledge graph is updated in real time according to changes in the security situation of the power network;

[0014] A generation module, used to generate an initial security incident handling script based on the knowledge graph;

[0015] An updating module, configured to update the security incident handling script according to the influence relationship between the changes in the network security elements in the knowledge graph and the generation process of the security incident handling script when the knowledge graph is updated;

[0016] The handling module is used to handle security incidents according to the security handling script through a response capability model.

[0017] In a third aspect, an embodiment of the present application provides an electronic device, including:

[0018] one or more processors;

[0019] A storage device for storing one or more programs;

[0020] When the one or more programs are executed by the one or more processors, the one or more processors implement the security handling method integrating the knowledge graph of power network security elements as described in the first aspect.

[0021] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the security disposal method of integrating the knowledge graph of power network security elements as described in the first aspect.

[0022] In a fifth aspect, an embodiment of the present application further provides a computer program product, including a computer program and / or instructions, which, when executed by a processor, implements a safe handling method for integrating the knowledge graph of power network security elements as described in any of the above embodiments.

[0023] The embodiment of the present application provides a security handling method, device, equipment, medium and product that integrates the knowledge graph of power network security elements. The security handling method that integrates the knowledge graph of power network security elements includes: collecting power network data, and converting the power network data into security basic data domain data based on the data model; extracting network security knowledge from the security basic data domain data to form network security elements, and constructing a knowledge graph based on the network security elements, and the knowledge graph is updated in real time according to the changes in the security situation of the power network; generating an initial security incident handling script based on the knowledge graph; when the knowledge graph is updated, the security incident handling script is updated according to the influence relationship between the changes in the network security elements in the knowledge graph and the generation process of the security incident handling script; through the response capability model, the security incident is handled according to the security handling script. The above technical solution constructs a knowledge graph and a security incident handling script, and the knowledge graph and the security incident handling script can adapt to the changes in the security situation of the power network, so as to automatically and reliably handle security incidents and fully ensure the safety of the power grid. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0025] Figure 1 A flowchart of a security handling method integrating a knowledge graph of power network security elements provided in an embodiment of the present application;

[0026] Figure 2 A schematic diagram of updating a security incident handling script provided by an embodiment;

[0027] Figure 3 A schematic diagram of an embodiment of continuously optimizing a security incident handling script using a supervised learning model built based on an expert knowledge base;

[0028] Figure 4A schematic diagram of a security handling framework integrating a knowledge graph of power network security elements provided by an embodiment;

[0029] Figure 5 A schematic diagram of an automatic response to malicious behavior of a terminal in a power Internet of Things system provided by an embodiment;

[0030] Figure 6 A schematic diagram of an abnormal identification and handling of third-party cloud-to-cloud interaction in a power system provided by an embodiment;

[0031] Figure 7 A schematic diagram of the structure of a security handling device integrating a knowledge graph of power network security elements provided in an embodiment of the present application;

[0032] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present application, rather than to limit the present application. It should also be noted that, for ease of description, only the parts related to the present application, rather than all structures, are shown in the accompanying drawings.

[0034] It should be mentioned before discussing the exemplary embodiments in more detail that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe the steps as sequential processes, many of the steps therein can be implemented in parallel, concurrently or simultaneously. In addition, the order of the steps can be rearranged. The process can be terminated when its operation is completed, but can also have additional steps not included in the accompanying drawings. The process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0035] It should be noted that the concepts of "first", "second", etc. mentioned in the embodiments of the present application are only used to distinguish different devices, modules, units or other objects, and are not used to limit the order or interdependence of the functions performed by these devices, modules, units or other objects.

[0036] In addition, the embodiments in the present application and the features in the embodiments may be combined with each other if there is no conflict.

[0037] The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0038] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the relevant content of the solution.

[0039] Figure 1 A flowchart of a security handling method that integrates the knowledge graph of power network security elements is provided in an embodiment of the present application. This embodiment can be applied to the situation of secure handling of power networks. Specifically, the security handling method that integrates the knowledge graph of power network security elements can be executed by a security handling device that integrates the knowledge graph of power network security elements. The security handling device that integrates the knowledge graph of power network security elements can be implemented by software and / or hardware and integrated in an electronic device. Electronic devices include but are not limited to computers, smart phones, servers, cloud platforms and other devices with data processing functions.

[0040] like Figure 1 As shown, the method specifically comprises the following steps:

[0041] S110, collecting power network data, and converting the power network data into safety basic data domain data based on a data model;

[0042] In this embodiment, the full-scenario network security situation awareness platform can be used to scan the power system network boundary, host, terminal, and application, etc., to obtain the monitored power network data. The data model is used to process the original power network data to obtain the security basic data domain data as the basis for building the knowledge graph. Exemplarily, the original power network data is cleaned, aligned, and associated with the calculation, etc. using a unified data model to form multi-topic data in the security basic data domain and store it.

[0043] S120, extracting network security knowledge from the security basic data domain data to form network security elements, and constructing a knowledge graph based on the network security elements, wherein the knowledge graph is updated in real time according to changes in the security situation of the power network;

[0044] In this embodiment, network security knowledge is extracted from the security basic data domain to further form network security elements that affect emergency response, such as alarms (or events), inspection capabilities, intelligence, assets, behaviors, and response capability object entities, etc., to complete knowledge extraction and realize knowledge graph construction. In addition, by real-time scanning of changes in the network security situation of the power system, the real-time changing power grid status and attribute dynamics are supplemented to update the knowledge graph.

[0045] S130, generating an initial security incident handling script according to the knowledge graph;

[0046] In this embodiment, the generated security incident handling script mainly involves four steps: classification, detection, research and judgment (or investigation) and generation (or disposal). Exemplarily, various types of security incidents can be classified according to the alarm / event entity attributes in the knowledge graph, mainly including malicious program events, network attack events, data security events, information content security events, equipment and facility failure events, illegal operation events, security risk events, abnormal behavior events, force majeure events and other events; the classified data are detected separately, for example, the intelligence information of the attack source is investigated, and the attachments of the email are statically and dynamically detected; the data output after the research and judgment in the detection stage is then analyzed and judged in the investigation stage for historical behavior, for example, the historical data of the same attack source is analyzed, the impact of similar alarms and the disposal methods, etc.; finally, according to the results of the investigation stage, the initialization generation of the disposal scripts corresponding to various events is completed, and the generated security incident disposal scripts can be used to formulate corresponding disposal methods or response methods for various security incidents.

[0047] S140: When the knowledge graph is updated, the security incident handling script is updated according to the influence relationship between the changes in the network security elements in the knowledge graph and the generation process of the security incident handling script;

[0048] In this embodiment, the knowledge graph will be updated when the network security situation of the power system changes. If the changes in the network security elements in the knowledge graph have an impact on the generation process of the security incident handling script, the affected parts of the security incident handling script will also be updated, thereby ensuring that the security incident handling script can adapt to changes in the network security situation of the power system and can provide the most reasonable and reliable handling method.

[0049] S150. Using the response capability model, handle the security incident according to the security handling script.

[0050] In this embodiment, the response capability mainly refers to the ability to respond to various security incidents, such as blocking or isolating, notifying, and generating work orders. The response capability model may refer to a model that can automatically output corresponding handling methods or response methods according to the security handling script for the security incidents to be handled.

[0051] The above-mentioned security disposal method integrating the knowledge graph of power network security elements is based on the security situation awareness platform, collects the full-factor data of power network risks, and uses the constructed unified data model to process the original data. On this basis, the knowledge graph is constructed in combination with the full-factor data of network security. Based on the knowledge graph, an initialized security disposal script is constructed for various types of security incidents. The security knowledge graph can be updated according to the real-time scanning results of the situation awareness platform, and the security disposal script is automatically updated and optimized based on the update of the security knowledge graph. Finally, the response capability model is used to realize automatic response and linkage disposal, thereby ensuring the flexibility and reliability of security incident disposal.

[0052] In one embodiment, collecting power network data includes:

[0053] S1110. According to the characteristics of each type of asset entity, the power network data is collected by using the corresponding collection method. For example, the security subsystem is collected through the network service (Web Service) and the system log or system record (syslog); the host and terminal are collected by using the agent (Agent), the Simple Network Management Protocol (SNMP), and the Java Database Connectivity (JDBC); the network and security devices are collected through the Secure Shell Protocol (SSH), SNMP, and Windows Management Instrumentation (WMI); the business system is collected through the Web Service; the network traffic is collected through traffic replication, customized distribution, and protocol analysis, and finally the original database is formed.

[0054] In one embodiment, the power network data is converted into safety basic data domain data based on the data model, including:

[0055] S1120, based on the data model, clean, align and correlate the power network data to obtain the following data of the security basic data domain: events, intelligence, network traffic, assets, alarms, status, and behavior;

[0056] S1130, events, intelligence and network flow data are semi-structured data, and semi-structured data is stored in an unstructured platform;

[0057] S1140, assets, alarms, status and behaviors are structured data, and the structured data is stored in an internal database.

[0058] In one embodiment, network security knowledge includes the following types of entities: alerts, inspection capabilities, intelligence, assets, behaviors, and response capabilities.

[0059] In this embodiment, network security knowledge is directly extracted from the security basic data domain to further form network security elements that affect emergency response, including alarm (or event), detection ability, intelligence, asset, behavior, and response capability object entities, which are respectively represented as {event, detect ability, intelligence, asset, behavior, response action}.

[0060] Among them, the attributes of the alarm (or event) entity type include attack source, attack purpose, attack type, alarm name and hazard level, and the basic data or mapping relationship is event and alarm; the attributes of the inspection capability entity type include static inspection, dynamic inspection, blacklist, whitelist and authority, and the basic data or mapping relationship is asset; the attributes of the intelligence entity type include intranet intelligence and extranet intelligence, and the basic data or mapping relationship is intelligence; the attributes of the asset entity type include server, terminal and security equipment, and the basic data or mapping relationship is asset; the attributes of the behavior entity type include similar alarms, similar assets and similar attack sources, and the basic data or mapping relationship is behavior; the attributes of the response action entity type include firewall ban, Web application protection system, also known as website application-level intrusion prevention system (Web Application Firewall, WAF) policy, intrusion prevention system (Intrusion Prevention System, IPS) policy, notification and alarm disposal, and the basic data or mapping relationship is asset.

[0061] In one embodiment, a knowledge graph is constructed based on network security elements, including:

[0062] S1210. For structured data, a template-based approach is used to extract attributes and attribute values ​​related to entities and relationships in the knowledge graph according to mapping relationships.

[0063] S1220. For semi-structured data, a combination of template and element recognition is used to identify the attributes and attribute values ​​related to entities and relationships in the knowledge graph using regular matching rules after completing template data extraction.

[0064] S1230. Construct a knowledge graph based on the attributes and the attribute values.

[0065] Specifically, according to the network security knowledge system, a template-based approach is directly used for structured data to extract attributes and attribute values ​​related to entities and relationships in the graph according to the mapping relationship (table); for semi-structured data, a method combining template-based and element recognition is adopted. After the template data is extracted, regular matching rules are used to identify key elements of related attributes, thereby completing knowledge extraction and realizing the construction of a network security knowledge graph based on power network security elements.

[0066] In one embodiment, the updating of the knowledge graph includes:

[0067] S1310, when the physical topology of the power network changes, updating the corresponding entities and relationships in the knowledge graph;

[0068] S1320, when the attributes of the nodes in the power network change, updating the relationship between the nodes in the knowledge graph;

[0069] S1330, when the power network situation changes, updating the connection relationship or connection strength between entities in the knowledge graph;

[0070] S1340: Perform consistency update on the nodes in the knowledge graph that are connected to the changed nodes.

[0071] In this embodiment, during the network security confrontation process, when the security deployment state of the system changes, the network security elements defined in the network security knowledge graph will change accordingly. The network security situation changes of the power system are scanned in real time, and the real-time changing grid state and attribute dynamic updates are supplemented based on data-driven strategies, thereby completing the network security element knowledge graph update.

[0072] Specifically, determine whether the physical topology of the power system network has changed. If so, update the corresponding entities and relationships in the knowledge graph; determine whether the attributes of a node in the power system network have changed dynamically. If so, update the relationships between nodes in the knowledge graph in real time; determine whether the power system network status has changed, including the emergence of weak nodes, drastic changes in correlation or similarity relationships, and if so, update the connection relationship or connection strength between entities; and update the knowledge graph for consistency with other nodes connected to the changed node.

[0073] In one embodiment, when the knowledge graph is updated, the security incident handling script is updated according to the influence relationship between the changes in the network security elements in the knowledge graph and the generation process of the security incident handling script, including: alarm, inspection capability, intelligence, assets, behavior and response capability

[0074] S1410: When the knowledge graph is updated, classify and enrich the trigger alarm summary information, and update the classification step and data enrichment step according to the change of the alarm type;

[0075] S1420, testing the classified and enriched data, and updating the testing steps according to changes in the inspection capabilities and asset types;

[0076] S1430, update the investigation steps according to the changes of alarm and asset type;

[0077] S1440, determining the response action according to the results of the investigation phase, the type of assets affected, and the system response capability, and updating the response steps according to the change of the response capability type;

[0078] S1450. Construct a supervised learning model based on the handling expert knowledge base to continuously optimize the security incident handling script.

[0079] In this embodiment, the script automatic update and optimization process is achieved through the influence relationship between the changes in the network security factor knowledge graph and the script generation steps.

[0080] Specifically, for the script generation process, at the beginning, the update of the knowledge graph of cybersecurity elements is used as a trigger condition;

[0081] In the classification stage, the trigger alarm summary information is classified in detail and enriched, for example, whether the attack source is an intranet IP or a domestic or foreign IP; whether the asset type of the attack target is a core asset; and the permission information of the employee associated with the recipient of the email security alarm. This step can be triggered based on the change of the alarm / event field. That is, if a new alarm type has a new key field, the classification step needs to add a classification enrichment step for the field.

[0082] Perform tests on the classified data separately, for example, investigate the intelligence information of the attack source; perform static and dynamic tests on the attachments of the emails, etc. This step can trigger updates based on changes in the inspection capability, intelligence, and asset type fields, that is, changes in the acquisition capability and asset type capability. When these capability elements change, the associated classification step analysis is performed and the detection step is added;

[0083] Update the investigation steps according to the changes in the alarm type and asset type fields. That is, when the alarm type and asset type change, there may be new similar alarms and similar asset historical data that need to be investigated, and the corresponding investigation steps need to be added;

[0084] Generate blocking, notification or policy changes and other disposal actions based on the results of the investigation phase and the types of assets affected and the system's response capabilities. This step can trigger updates based on changes in the blocking capability and notification channel fields. That is, when the blocking method or notification channel in the response capability changes, the system will be prompted to add disposal measures or notification methods, and the corresponding response steps need to be added;

[0085] When updating the script, it will prompt whether to add steps. After the security operation personnel judge the prompt update, they will choose whether to accept the step update. If the security operation personnel accept it, the script will be updated, otherwise it will remain unchanged. In this process, the disposal expert knowledge base is generated based on the judgment result data;

[0086] Taking the disposal expert knowledge base and the existing script collection as input, a supervised learning model is constructed to learn the recommended steps of different types of steps, achieve more practical response step recommendations, and continuously optimize the scripts in the script library.

[0087] Figure 2 A schematic diagram of updating a security incident handling script provided by an embodiment, such as Figure 2 As shown in the figure, the script generation process includes four step entity objects R1-R4, namely: classification step, detection step, investigation step, and response step; Ri will generate step instance r i,x , and monitor the changes of network security elements in real time according to the corresponding relationship Li between network security elements and script generation steps, add or delete step instances, and realize the automatic update of script steps. Therefore, a complete script contains a set of step instances of 5 steps, which are initially represented as {R0, R1(L1), R2(L2), R3(L3), R4(L4), R5}, where Ri(Li) indicates that the generation of the instance set in each step is affected by the network security element variable.

[0088] As a specific update example: for the scenario {R0,R1,{r 2,1},R3,R4,R5}, considering the impact of intelligence information on the script steps, in the detection stage R2, generate detection instances r 2,1 That is, for the received alarms / events, the intelligence of the associated network security elements is detected to determine whether the attack source of the alarm belongs to the intelligence blacklist. Subsequent blocking can be directly carried out based on the judgment results. When a new type of intelligence data is added to the network security element knowledge graph, a new detection instance r will be generated based on the relationship influence of L2. 2,2 , that is, to detect the newly added intelligence, determine whether the attack source is a threat, and 2,2 Add the detection step of this script, and update the script steps to {R0,R1,{r 2,1 ,r 2,2},R3,R4,R5}.

[0089] The correspondence between the objects in network security elements and the script generation steps is shown in Table 1.

[0090] Table 1 Correspondence between objects in a network security element and script generation steps

[0091] Cybersecurity elements Script steps relation Alert / Event: Attack Purpose Classification trigger Alert / Event: Attack Type Classification trigger Alarm / Event: Alarm name Classification trigger Alarm / Event: Hazard Level Classification trigger Inspection capability: static inspection Detection Call Inspection capability: dynamic detection Detection Call Check capability: Blacklist Detection Call Check capability: Whitelist Detection Call Check capabilities: permissions Detection Call Intelligence: Intranet Intelligence Detection Call Intelligence: External network intelligence Detection Call Assets: Server Detection Call Assets: Terminal Detection Call Assets: Safety equipment Detection Call Behavior: Similar to warning investigation Call Behavior: Asset-like investigation refer to Behavior: Similar to the attack source investigation refer to Responsiveness: Firewall blocking Disposal Call Responsiveness: WAF strategy Disposal Call Responsiveness: IPS Strategy Disposal Call Responsiveness: Notifications Disposal Call Response capability: alarm handling Disposal Call

[0092] Figure 3 A schematic diagram of an embodiment of continuously optimizing a security incident handling scenario using a supervised learning model built based on an expert knowledge base. Figure 3 As shown in the figure, after the script is updated, the security operator will judge the prompt update and choose whether to accept the step update. If the security operator accepts, the script is updated, otherwise it remains unchanged. In this process, the disposal expert knowledge base is generated based on the judgment result data. The generated confirmation acceptance or rejection information is used as historical expert knowledge feedback to build a supervised learning script step recommendation mechanism.

[0093] On the basis of the above, we can use the expert knowledge base and the existing script collection as input to build a supervised learning model, learn the recommended steps of different types of steps, achieve more practical response step recommendations, and continuously optimize the scripts in the script library.

[0094] In one embodiment, handling a security incident according to the security handling script through a response capability model includes:

[0095] S1510, according to the interface information with response capability in the power network, the response capability in the model is constituted by integrating through interface calls, wherein the response capability includes three types: blocking, notification and work order;

[0096] S1520. For security incidents to be handled, call the response capability associated with the corresponding asset area to implement linkage handling of the security incidents.

[0097] In this embodiment, by extracting the interface information of network security equipment, software, system or notification system with response capability, the response capability in the model is constructed through interface call integration, including three types of blocking / isolation, notification and work order. Among them, WAF, IPS, firewall, etc. have the ability to block and isolate, the work order system / module has the ability to transfer and issue work orders, and the SMS system and email system have the ability to notify.

[0098] Different blocking devices control different areas. By associating the blocking devices with the asset areas, it is determined which security device capabilities can be called when a certain type of asset risk needs to be dealt with. Among them, the response capabilities of border security devices such as WAF, IPS, and firewalls have been integrated into the power network security situation awareness platform through interfaces. The platform can be used to uniformly control the blocking and blocking functions of downstream devices and systems to achieve joint disposal.

[0099] Figure 4 A schematic diagram of a security handling framework integrating a knowledge graph of power network security elements provided by an embodiment. Figure 4 As shown in the figure, the framework is based on typical scenarios of power systems and combines the full-factor network security knowledge model generated by the full-scenario network security situation awareness platform to generate security protection strategies in real time and realize flexible and coordinated response and disposal of multi-level security protection components.

[0100] The following takes the automatic response to malicious behavior of terminals in the power Internet of Things system as an example to illustrate the security disposal method that integrates the knowledge graph of power network security elements.

[0101] The power Internet of Things terminals are widely distributed, numerous, and have incomplete physical security protection. If a terminal is attacked by an attacker, the terminal will be used as a springboard to send abnormal messages, deny services, and other malicious attacks on its upper-level edge devices or main station systems. In response to such malicious behaviors, the terminal security monitoring component captures anomalies in real time and generates terminal abnormal behavior alarms, notifying the power network security situation awareness platform. The situation awareness platform generates and responds to alarms through automated script generation and response, conducts decision-making and judgment, generates linkage strategies, and issues them for execution, realizing automated response and disposal of such attacks.

[0102] Figure 5 The following is a schematic diagram of an automatic response to malicious behavior of a terminal in a power Internet of Things system provided by an embodiment. Figure 5 As shown in the figure, the specific steps of automatic response to malicious behavior of terminals in the power Internet of Things system are as follows:

[0103] First, monitor and obtain abnormal behavior alarms of terminals, start the script and generate the classification stage instance r1,1, and obtain the attack steps and attack source attributes from the network security risk factors;

[0104] Enter the detection phase, monitor the real-time update of the intelligence information blacklist, generate the detection instance r2,1, determine whether the terminal IP is on the blacklist, if so, directly enter the response phase, generate the response instance r4,1, and generate a one-click blocking terminal response strategy; if the terminal IP is not on the blacklist, generate the detection instance r2,2, obtain the asset vulnerability status from the network security knowledge elements, and complete the data enrichment;

[0105] Enter the investigation phase and generate instance r3,1 , according to the enriched information, determine whether it is a vulnerability exploit attack. If the judgment is successful, enter r4,1 to generate a response strategy. Otherwise, generate an investigation instance r 3,2 , further determine the scope of diffusion impact, obtain the associated affected terminals or devices by monitoring the terminal's network access behavior, and if the determination is successful, enter the response phase and generate instance r 4,2 , generate a warning response strategy, otherwise directly generate a survey instance r 3,3 , make asset importance determination, obtain asset importance from network security risk factors, and generate response instance r if the determination is successful 4,3 , generate a firewall access control policy modification policy to limit the access rights of terminal A, otherwise no response is required.

[0106] The generated response strategy is sent to different security protection components in multiple domains through the situation awareness platform for execution, thereby achieving timely and automated response to malicious attacks on terminals. Among them, the one-click blocking strategy is sent to the IoT management platform and implemented through a one-click stop control command; the early warning sheet is directly generated through the situation awareness platform and sent to the corresponding responsible person; the firewall access control strategy modification strategy is sent to the firewall device at the corresponding boundary for modification.

[0107] The following takes the identification and handling of anomalies in third-party cloud-to-cloud interactions in power systems as an example to illustrate the security handling method that integrates the knowledge graph of power network security elements.

[0108] At the third-party cloud-to-cloud boundary of the power system, systems such as third-party aggregation platforms have extensive data interactions with the power grid business system. Attackers use the vulnerabilities of third-party aggregation platforms to penetrate the cloud-to-cloud boundary and launch malicious attacks on the power system. In response to such malicious behaviors, the network security integrated protection gateway at the cloud-to-cloud boundary monitors the boundary traffic in real time, and performs abnormal monitoring and analysis on the access behavior of the third-party aggregation platform. When it is identified that there is a risk of abnormal data inflow and sensitive data leakage in the third-party aggregation platform B, an alarm is generated and the network security situation awareness platform is notified. The power network security situation awareness platform is notified, and the situation awareness platform performs alarm analysis, decision-making judgment, linkage strategy generation and execution through automated script generation and response, realizing automated response and disposal of such attacks.

[0109] Figure 6 A schematic diagram of an abnormal identification and handling of a power system third-party cloud-to-cloud interaction is provided in accordance with an embodiment. Figure 6 As shown in the figure, the specific steps for identifying and handling abnormalities in power system third-party cloud-to-cloud interactions are as follows:

[0110] First, monitor and obtain abnormal alarms from the third-party aggregation platform B, start the script and generate the classification stage instance r1,1, obtain the attack source attributes from the network security risk factors, and determine the attack steps;

[0111] Enter the detection phase, monitor the real-time update of the intelligence information blacklist, and generate detection instances r 2,1 , determine whether the attack source IP is in the blacklist, if so, directly enter the response phase and generate a response instance r 4,4 , generate a response strategy to block system B; if the attack source IP is not in the blacklist, generate a detection instance r 2,3 , obtain the information of the peer system interacting with B from the network security knowledge elements, including the importance of the business, the importance of the business data carried, etc., to complete data enrichment;

[0112] Enter the investigation phase and generate instance r 3,4 , according to the enriched information, determine whether the system interacting with B is an important business system. If the determination is successful, enter r 4,4 Generate a blocking response strategy, otherwise generate a response instance r 4,5 , limit the access rights of system B by modifying the firewall access control policy.

[0113] Further monitor the network access behavior in network security elements and generate investigation instances 3,5 , determine whether the interactive content data between system B and the power grid system involves sensitive data, and if the determination is successful, generate a response instance r 4,6 , generate and enable the dynamic desensitization policy for interface data, otherwise no response is required.

[0114] The generated response strategy is sent to different security protection components in the domain through the situation awareness platform for execution, thereby achieving timely and automated response to malicious attacks on system B. Among them, the blocking strategy and firewall access control strategy modification strategy are sent to the firewall at the cloud-to-cloud interaction boundary for execution, and the interface data dynamic desensitization strategy is sent to the business security integrated protection gateway at the cloud-to-cloud boundary for execution.

[0115] Figure 7 A schematic diagram of the structure of a security processing device integrating the knowledge graph of power network security elements provided in an embodiment of the present application. The security processing device integrating the knowledge graph of power network security elements provided in this embodiment includes:

[0116] The acquisition module 210 is used to acquire power network data and convert the power network data into safety basic data domain data based on the data model;

[0117] A construction module 220 is used to extract network security knowledge from the security basic data domain data to form network security elements, and to construct a knowledge graph based on the network security elements, wherein the knowledge graph is updated in real time according to changes in the security situation of the power network;

[0118] A generation module 230, configured to generate an initial security incident handling script based on the knowledge graph;

[0119] An updating module 240, configured to update the security incident handling script according to the influence relationship between the changes in the network security elements in the knowledge graph and the generation process of the security incident handling script when the knowledge graph is updated;

[0120] The handling module 250 is used to handle the security incident according to the security handling script through the response capability model.

[0121] Optionally, converting the power network data into safety basic data domain data based on a data model includes:

[0122] Cleaning, aligning and associating the power network data based on the data model to obtain the following data of the security basic data domain: events, intelligence, network traffic, assets, alarms, status, and behavior;

[0123] Among them, events, intelligence, and network flow data are semi-structured data and are stored in unstructured platforms;

[0124] Assets, alarms, status, and behaviors are structured data and stored in an internal database.

[0125] Optionally, the cybersecurity knowledge includes the following types of entities: alerts, inspection capabilities, intelligence, assets, behaviors, and response capabilities;

[0126] A knowledge graph is constructed based on the network security elements, including:

[0127] For structured data, a template-based approach is used to extract the attributes and attribute values ​​related to entities and relationships in the knowledge graph based on the mapping relationship;

[0128] For semi-structured data, a combination of template and feature recognition is used. After the template data is extracted, regular matching rules are used to identify the attributes and attribute values ​​related to entities and relationships in the knowledge graph.

[0129] A knowledge graph is constructed according to the attributes and the attribute values.

[0130] Optionally, the updating of the knowledge graph includes:

[0131] When the physical topology of the power network changes, the corresponding entities and relationships in the knowledge graph are updated;

[0132] When the attributes of nodes in the power network change, updating the relationship between nodes in the knowledge graph;

[0133] When the power network situation changes, the connection relationship or connection strength between entities in the knowledge graph is updated;

[0134] A consistency update is performed on the nodes in the knowledge graph that are connected to the changed nodes.

[0135] Optionally, when the knowledge graph is updated, the security incident handling script is updated according to the influence relationship between the changes of network security elements in the knowledge graph and the generation process of the security incident handling script, including:

[0136] When the knowledge graph is updated, the trigger alarm summary information is classified and data enriched, and the classification step and data enrichment step are updated according to the change of the alarm type;

[0137] Test the classified and enriched data and update the test steps according to the changes in inspection capabilities and asset types;

[0138] Update investigation steps based on changes in alerts and asset types;

[0139] Determine the response actions based on the results of the investigation phase, the type of affected assets, and the system response capabilities, and update the response steps based on changes in the response capability type;

[0140] A supervised learning model is constructed based on the handling expert knowledge base to continuously optimize the security incident handling script.

[0141] Optionally, the security incident is handled according to the security handling script through the response capability model, including:

[0142] According to the interface information with response capability in the power network, the response capability in the model is constituted through interface call integration, and the response capability includes three types: blocking, notification and work order;

[0143] For security incidents to be handled, the response capabilities associated with the corresponding asset areas are called to achieve linked handling of the security incidents.

[0144] The security disposal device integrating the knowledge graph of electric power network security elements provided in the embodiment of the present application can be used to execute the security disposal method integrating the knowledge graph of electric power network security elements provided in any of the above embodiments, and has corresponding functions and beneficial effects.

[0145] Figure 8A schematic diagram of an electronic device 10 that can be used to implement an embodiment of the present application is shown. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device 10 can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, user equipment, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or required herein.

[0146] like Figure 8 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0147] Multiple components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, wireless networks.

[0148] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above.

[0149] In some embodiments, the method of the above embodiment may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform any of the above embodiment methods in any other appropriate manner (e.g., by means of firmware).

[0150] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0151] The computer programs for implementing the methods of the present application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer programs are executed by the processor, the functions / operations specified in the flow charts and / or block diagrams are implemented. The computer programs may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0152] In the context of the present application, a computer readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device or equipment. A computer readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium may be a machine readable signal medium. A more specific example of a machine readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0153] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device 10 having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device 10. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0154] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0155] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0156] An embodiment of the present application also provides a computer program product, including a computer program and / or instructions, which, when executed by a processor, implements the security disposal method of integrating the knowledge graph of power network security elements as described in any of the above embodiments.

[0157] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this application can be executed in parallel, sequentially or in different orders, as long as the expected results of the technical solution of this application can be achieved, and this document is not limited here.

[0158] The above specific implementations do not constitute a limitation on the protection scope of this application. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of this application should be included in the protection scope of this application.

Claims

1. A security disposal method integrating knowledge graph of power network security elements, characterized in that: include: Collecting power network data, and converting the power network data into safety basic data domain data based on a data model; Extracting network security knowledge from the security basic data domain data to form network security elements, and constructing a knowledge graph based on the network security elements, wherein the knowledge graph is updated in real time according to changes in the security situation of the power network; Generate an initial security incident handling script based on the knowledge graph; When the knowledge graph is updated, the security incident handling script is updated according to the influence relationship between the changes in the network security elements in the knowledge graph and the generation process of the security incident handling script; Through the response capability model, security incidents are handled according to the security handling script.

2. The method according to claim 1, characterized in that The power network data is converted into safety basic data domain data based on the data model, including: Cleaning, aligning and associating the power network data based on the data model to obtain the following data of the security basic data domain: events, intelligence, network traffic, assets, alarms, status, and behavior; Among them, events, intelligence, and network flow data are semi-structured data and are stored in unstructured platforms; Assets, alarms, status, and behaviors are structured data and stored in an internal database.

3. The method according to claim 2, characterized in that The cybersecurity knowledge includes the following types of entities: alerts, inspection capabilities, intelligence, assets, behaviors, and response capabilities; A knowledge graph is constructed based on the network security elements, including: For structured data, a template-based approach is used to extract the attributes and attribute values ​​related to entities and relationships in the knowledge graph based on the mapping relationship; For semi-structured data, a combination of template and feature recognition is used. After the template data is extracted, regular matching rules are used to identify the attributes and attribute values ​​related to entities and relationships in the knowledge graph. A knowledge graph is constructed according to the attributes and the attribute values.

4. The method according to claim 1, characterized in that The updating of the knowledge graph includes: When the physical topology of the power network changes, the corresponding entities and relationships in the knowledge graph are updated; When the attributes of nodes in the power network change, updating the relationship between nodes in the knowledge graph; When the power network situation changes, the connection relationship or connection strength between entities in the knowledge graph is updated; A consistency update is performed on the nodes in the knowledge graph that are connected to the changed nodes.

5. The method according to claim 1, characterized in that When the knowledge graph is updated, the security incident handling script is updated according to the influence relationship between the changes of the network security elements in the knowledge graph and the generation process of the security incident handling script, including: When the knowledge graph is updated, the trigger alarm summary information is classified and data enriched, and the classification step and data enrichment step are updated according to the change of the alarm type; Test the classified and enriched data and update the test steps according to the changes in inspection capabilities and asset types; Update investigation steps based on changes in alerts and asset types; Determine the response actions based on the results of the investigation phase, the type of affected assets, and the system response capabilities, and update the response steps based on changes in the response capability type; A supervised learning model is constructed based on the handling expert knowledge base to continuously optimize the security incident handling script.

6. The method according to claim 1, characterized in that Through the response capability model, security incidents are handled according to the security handling script, including: According to the interface information with response capability in the power network, the response capability in the model is constituted through interface call integration, and the response capability includes three types: blocking, notification and work order; For security incidents to be handled, the response capabilities associated with the corresponding asset areas are called to achieve linked handling of the security incidents.

7. A security handling device integrating knowledge graph of power network security elements, characterized in that: include: A collection module, used for collecting power network data and converting the power network data into safety basic data domain data based on a data model; A construction module, used to extract network security knowledge from the security basic data domain data to form network security elements, and to construct a knowledge graph based on the network security elements, wherein the knowledge graph is updated in real time according to changes in the security situation of the power network; A generation module, used to generate an initial security incident handling script based on the knowledge graph; An updating module, configured to update the security incident handling script according to the influence relationship between the changes in the network security elements in the knowledge graph and the generation process of the security incident handling script when the knowledge graph is updated; The handling module is used to handle security incidents according to the security handling script through a response capability model.

8. An electronic device, characterized in that: include: at least one processor; a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the security handling method of the integrated power network security element knowledge graph as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, it implements the security handling method of integrating the knowledge graph of power network security elements as described in any one of claims 1-6.

10. A computer program product comprising a computer program and / or instructions, characterized in that: When the computer program and / or instructions are executed by the processor, the security handling method of the integrated power network security element knowledge graph as described in any one of claims 1 to 6 is implemented.

Images