Operating system and method for embedded electric energy terminal equipment with network security probe

Abstract

The present application relates to the field of electric power technology, and in particular to an operating system and method for an embedded electric energy terminal device with a network security probe, the steps of which include: obtaining electric energy terminal device information, network security log information of the electric energy terminal device, and abnormal electric energy information of the electric energy meter associated with the electric energy terminal device; analyzing the first spatiotemporal correlation of different electric energy terminal devices based on the electric energy terminal device information and abnormal electric energy information; analyzing the second spatiotemporal correlation of different electric energy terminal devices based on the electric energy terminal device information and network security log information; ranking the potential intrusion risks of the electric energy terminal devices based on the analysis results of the first spatiotemporal correlation and the second spatiotemporal correlation, and performing equipment safety inspection operations based on the potential intrusion risk ranking results. The present application optimizes the safety inspection operation process of the electric energy terminal devices through a risk ranking mechanism, effectively improving the maintenance efficiency of the electric energy terminal devices.

Description

Technical Field

[0001] The present application relates to the field of electric power technology, and in particular to an operating system and method for an embedded electric energy terminal device with a network security probe. Background Art

[0002] Embedded electric energy terminal equipment is a communication device between the electric energy meter and the power master station system. It is used to collect electric energy meter data and store, convert protocols, classify and time-sharing forward, and monitor the status of the electric energy meter. Embedded electric energy terminal equipment is the communication hub of electric energy. Therefore, the stable and reliable operation of embedded electric energy terminal equipment has become the key to electric energy data collection.

[0003] With the continuous development of digitalization, intelligence and informatization of power grids, embedded electric energy terminal devices with network security probe functions have emerged. They have network security self-perception capabilities, can automatically collect network security incidents occurring in electric energy terminal devices, and report them to the monitoring platform master station, effectively improving the security and stability of the power grid communication network, and providing important support for the reliable operation of the power grid.

[0004] Embedded electric energy terminal equipment with network security probe function integrates electric energy metering function and network security monitoring function. However, the existing technology usually only analyzes single-dimensional information of electric energy terminal equipment in the security monitoring and risk assessment of electric energy terminal equipment. For example, network security events and abnormal electric energy events are handled separately, and the correlation between different network security events and abnormal electric energy events in the time dimension and space dimension is ignored, resulting in low accuracy in the assessment of potential intrusion risks of electric energy terminal equipment. At the same time, it is impossible to reasonably allocate investigation resources through the equipment risk ranking mechanism, resulting in difficulty in the efficient implementation of equipment safety protection measures. Summary of the invention

[0005] In order to overcome the defects and shortcomings of the prior art, the present application provides an operating system and method for an embedded electric energy terminal device with a network security probe. By comprehensively analyzing the spatiotemporal correlation between network security events and abnormal electric energy events of the electric energy terminal device, the potential intrusion risks of the device are effectively identified, and the equipment security inspection operation process is optimized through a scientific risk ranking mechanism, thereby improving the maintenance efficiency of the electric energy terminal device.

[0006] In order to achieve the above objectives, this application adopts the following technical solutions:

[0007] In a first aspect, the present application provides an operating method of an embedded electric energy terminal device with a network security probe, comprising the following steps:

[0008] Obtaining electric energy terminal equipment information, network security log information of electric energy terminal equipment, and electric energy abnormality information of electric energy meters associated with electric energy terminal equipment;

[0009] Analyze the first spatiotemporal correlation of different electric energy terminal devices according to the electric energy terminal device information and the electric energy abnormality information;

[0010] Analyze the second time-space correlation of different electric energy terminal devices according to the electric energy terminal device information and network security log information;

[0011] The potential intrusion risks of electric energy terminal equipment are ranked based on the analysis results of the first spatiotemporal correlation and the second spatiotemporal correlation, and equipment safety inspection operations are performed based on the potential intrusion risk ranking results.

[0012] Optionally, analyzing the first spatiotemporal correlation of different electric energy terminal devices includes:

[0013] Obtaining electric energy terminal equipment information and electric energy abnormality information;

[0014] The electric energy anomaly time correlation index between any two electric energy terminal devices is calculated based on the electric energy anomaly information. The calculation formula of the electric energy anomaly time correlation index is:

[0015] ;

[0016] In the formula Indicates electric energy terminal equipment The abnormal time set of electric energy associated with the electric energy meter, Indicates electric energy terminal equipment The abnormal time set of electric energy associated with the electric energy meter, Represents the terminal equipment for calculating electric energy The number of elements in the energy abnormality time set associated with the energy meter, Represents the terminal equipment for calculating electric energy The number of elements in the energy abnormality time set associated with the energy meter, Indicates electric energy terminal equipment Associate the abnormal time set of electric energy of electric energy meter with electric energy terminal equipment The number of intersection elements of the electric energy anomaly time set of the associated electric energy meter, that is, the number of time points at which electric energy anomalies occur simultaneously, Indicates electric energy terminal equipment Electric energy terminal equipment The abnormal time correlation index of electric energy between

[0017] The sum of the electric energy abnormality time correlation indexes of the electric energy terminal device and all electric energy terminal devices except the electric energy terminal device is used as the first time correlation index of the electric energy terminal device;

[0018] Calculate a first spatial correlation index of the electric energy terminal device based on the electric energy terminal device information and the electric energy abnormality information;

[0019] The sum of the first time correlation index and the first space correlation index of the electric energy terminal device is used as the first time-space correlation index of the electric energy terminal device. The first time-space correlation index is used to evaluate the time-space correlation of the electric energy abnormality information between the electric energy terminal devices.

[0020] Optionally, the calculating the first spatial correlation index of the electric energy terminal device includes:

[0021] Draw the spatial distribution map of abnormal power events based on the power terminal equipment information and power abnormality information, and identify the high-density areas of abnormal power events through spatial clustering algorithm;

[0022] The electric energy abnormality spatial correlation index between any two electric energy terminal devices is calculated based on the electric energy meter information in the high-density area. The calculation formula of the electric energy abnormality spatial correlation index is:

[0023] ;

[0024] In the formula Indicates the connection with electric energy terminal equipment in high-density areas The number of associated energy meters, Indicates the connection with electric energy terminal equipment in high-density areas The number of associated energy meters, Indicates electric energy terminal equipment The total number of associated energy meters, Indicates electric energy terminal equipment The total number of associated energy meters, Indicates electric energy terminal equipment Electric energy terminal equipment The spatial correlation index of electrical energy anomaly between them;

[0025] The sum of the electric energy abnormal spatial correlation indexes of the electric energy terminal device and all electric energy terminal devices except the electric energy terminal device itself is taken as the first spatial correlation index of the electric energy terminal device.

[0026] Optionally, analyzing the second spatiotemporal correlation of different electric energy terminal devices includes:

[0027] Acquire electric energy terminal equipment information and network security log information and construct a network security event set of the electric energy terminal equipment based on the network security log information;

[0028] When the network security event set of the electric energy terminal device is an empty set, the second spatial correlation index of the electric energy terminal device is 0. When the network security event set of the electric energy terminal device is not an empty set, the second spatial correlation index of the electric energy terminal device is calculated based on the electric energy terminal device information. The calculation formula of the second spatial correlation index is:

[0029] ;

[0030] In the formula Indicates electric energy terminal equipment Electric energy terminal equipment The Euclidean distance of the electric energy terminal device and electric energy terminal equipment The network security event sets of are not empty sets. The mean Euclidean distance of all electric energy terminal devices representing a non-empty set of network security events, Indicates the number of electric energy terminal devices, Indicates electric energy terminal equipment The second spatial correlation index of

[0031] Calculate a second time correlation index of the electric energy terminal device based on the network security event set;

[0032] The sum of the second time correlation index and the second space correlation index of the electric energy terminal device is used as the second time-space correlation index of the electric energy terminal device. The second time-space correlation index is used to evaluate the time-space correlation of network security events between the electric energy terminal devices.

[0033] Optionally, calculating the second time correlation index of the electric energy terminal device includes:

[0034] When the electric energy terminal equipment Cybersecurity event collection and electric energy terminal equipment When the intersection of the network security event sets is an empty set, the electric energy terminal device and electric energy terminal equipment The time correlation index of cybersecurity events between them is 0;

[0035] When the electric energy terminal equipment Cybersecurity event collection and electric energy terminal equipment When the intersection of the network security event sets is not an empty set, the network security event time correlation index is calculated according to the network security event time correlation index calculation formula. The network security event time correlation index calculation formula is:

[0036] ;

[0037] In the formula Indicates electric energy terminal equipment Cybersecurity event collection and electric energy terminal equipment The number of elements in the intersection of the network security event sets, Indicates the intersection Cybersecurity incidents in electric energy terminal equipment The time of occurrence, Indicates the intersection Cybersecurity incidents in electric energy terminal equipment The time of occurrence, Indicates the intersection The event level of a cybersecurity incident, Indicates the network security event monitoring cycle. Indicates electric energy terminal equipment Electric energy terminal equipment Time correlation index of cybersecurity events between them;

[0038] The sum of the network security event time correlation indexes of the electric energy terminal device and all electric energy terminal devices except itself is used as the second time correlation index of the electric energy terminal device.

[0039] Optionally, the step of sorting the electric energy terminal devices by potential intrusion risk and performing a device safety check operation according to the potential intrusion risk sorting result includes:

[0040] Acquire a first spatiotemporal correlation index and a second spatiotemporal correlation index of the electric energy terminal device and calculate the sum of the first spatiotemporal correlation index and the second spatiotemporal correlation index of the electric energy terminal device;

[0041] Sort the electric energy terminal devices in descending order by the sum of the first spatiotemporal correlation index and the second spatiotemporal correlation index to obtain a potential intrusion risk sorting list;

[0042] Perform equipment safety inspection operations on the electric energy terminal devices in sequence according to the sorted list of potential intrusion risks of the electric energy terminal devices.

[0043] In a second aspect, the present application provides an operating system for an embedded electric energy terminal device with a network security probe, including:

[0044] An information acquisition module is used to acquire electric energy terminal equipment information, network security log information of electric energy terminal equipment, and electric energy abnormality information of electric energy meters associated with electric energy terminal equipment;

[0045] A first spatiotemporal correlation analysis module, used for analyzing the first spatiotemporal correlation of different electric energy terminal devices according to the electric energy terminal device information and the electric energy abnormality information;

[0046] A second spatiotemporal correlation analysis module, used for analyzing the second spatiotemporal correlation of different electric energy terminal devices according to the electric energy terminal device information and the network security log information;

[0047] The potential intrusion risk ranking module is used to comprehensively analyze the first spatiotemporal correlation and the second spatiotemporal correlation to rank the potential intrusion risks of electric energy terminal equipment and perform equipment safety inspection operations based on the potential intrusion risk ranking results.

[0048] In a third aspect, the present application provides an electronic device comprising: a processor and a memory, wherein the memory stores a computer program that can be called by the processor, and the processor executes an operating method of an embedded electric energy terminal device with a network security probe by calling the computer program stored in the memory.

[0049] In a fourth aspect, the present application provides a computer-readable storage medium storing instructions, which, when executed on a computer, enable the computer to execute an operating method of an embedded electric energy terminal device with a network security probe.

[0050] Compared with the prior art, this application has the following advantages and beneficial effects:

[0051] This application effectively identifies the potential intrusion risks of electric energy terminal devices by comprehensively analyzing the spatiotemporal correlation of electric energy abnormal events and network security events of electric energy terminal devices, and optimizes the equipment security inspection operation process through a potential intrusion risk ranking mechanism, thereby effectively improving the maintenance efficiency of electric energy terminal devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0053] Figure 1 It is a schematic diagram of the overall process of the operation method of the embedded electric energy terminal device with a network security probe provided in an embodiment of the present application;

[0054] Figure 2 It is a schematic diagram of the electric energy data collection process provided by the embodiment of the present application;

[0055] Figure 3 It is a structural schematic diagram of an operating system of an embedded electric energy terminal device with a network security probe provided in an embodiment of the present application;

[0056] Figure 4It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] The technical solution of the present application is described in detail below through the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present application and the specific features in the embodiments are detailed descriptions of the technical solution of the present application, rather than limitations on the technical solution of the present application. In the absence of conflict, the embodiments of the present application and the technical features in the embodiments can be combined with each other.

[0058] See also Figure 1 , Figure 1 This is a schematic diagram of the overall process of the operation method of the embedded electric energy terminal device with a network security probe provided in an embodiment of the present application, which specifically includes the following steps:

[0059] S110: Acquire electric energy terminal device information, network security log information of the electric energy terminal device, and electric energy abnormality information of the electric energy meter associated with the electric energy terminal device.

[0060] S120: Analyzing the first spatiotemporal correlation of different electric energy terminal devices according to the electric energy terminal device information and the electric energy abnormality information;

[0061] See also Figure 2 , Figure 2 It is a schematic diagram of the electric energy data collection process provided by the embodiment of the present application. The collection of electric energy data is usually transmitted from the electric energy meter to the electric energy terminal device through the 485 port, and then sent to the dispatching master station by the electric energy terminal device through the dispatching data network. By analyzing the electric energy anomaly (such as overvoltage, loss of pressure, current interruption, power theft, communication anomaly, etc.) occurring in the electric energy meter associated with the electric energy terminal device, it can reflect the abnormal conditions in the communication link or physical environment where the electric energy terminal device is located. The abnormal conditions may be caused by network attacks, equipment failures or human damage. Therefore, by analyzing the electric energy anomaly information of the electric energy meter, the potential intrusion risk of the electric energy terminal device can be effectively evaluated. For example, a large range of electric energy meter anomalies may indicate that the electric energy terminal device has suffered a concentrated attack, while a specific area or single point electric energy anomaly may point to the fault behavior of the electric energy meter itself. The first spatiotemporal correlation of different electric energy terminal devices is analyzed, including:

[0062] Obtaining electric energy terminal equipment information and electric energy abnormality information;

[0063] The electric energy anomaly time correlation index between any two electric energy terminal devices is calculated based on the electric energy anomaly information. The calculation formula of the electric energy anomaly time correlation index is:

[0064] ;

[0065] In the formula Indicates electric energy terminal equipment The abnormal time set of electric energy associated with the electric energy meter, Indicates electric energy terminal equipment The abnormal time set of electric energy associated with the electric energy meter, Represents the terminal equipment for calculating electric energy The number of elements in the energy abnormality time set associated with the energy meter, i.e., the energy terminal device The number of time points at which abnormal electric energy occurs in the associated electric energy meter, Represents the terminal equipment for calculating electric energy The number of elements in the energy abnormality time set associated with the energy meter, i.e., the energy terminal device The number of time points at which abnormal electric energy occurs in the associated electric energy meter, Indicates electric energy terminal equipment Associate the abnormal time set of electric energy of electric energy meter with electric energy terminal equipment The number of intersection elements of the electric energy anomaly time set of the associated electric energy meters, that is, the number of time points at which electric energy anomalies occur simultaneously in the associated electric energy meters of two electric energy terminal devices. express and The geometric mean is used to eliminate the deviation caused by the difference in the total number of abnormal time points of electric energy. Indicates electric energy terminal equipment Electric energy terminal equipment The abnormal time correlation index of electric energy between

[0066] The sum of the electric energy abnormal time correlation indexes of the electric energy terminal device and all electric energy terminal devices except itself is taken as the first time correlation index of the electric energy terminal device. The calculation formula of the first time correlation index is:

[0067] ;

[0068] In the formula Indicates electric energy terminal equipment Electric energy terminal equipment The time correlation index of electric energy anomaly, Indicates the number of electric energy terminal devices, Indicates electric energy terminal equipment The first time correlation index;

[0069] Calculate a first spatial correlation index of the electric energy terminal device based on the electric energy terminal device information and the electric energy abnormality information;

[0070] The sum of the first time correlation index and the first space correlation index of the electric energy terminal device is used as the first time-space correlation index of the electric energy terminal device, and the first time-space correlation index is used to evaluate the time-space correlation of the electric energy abnormality information between the electric energy terminal devices;

[0071] When the abnormality of the electric energy meter shows obvious spatial aggregation, such as concentrated in a specific area or within the communication coverage of a certain electric energy terminal device, it may indicate that the electric energy terminal device in the area has been targeted or has security vulnerabilities. When the abnormality is dispersed or irregularly distributed, it may reflect a random event. By analyzing the spatial correlation of electric energy anomalies, it is possible to more accurately locate the potential intrusion source and determine whether the intrusion is a local behavior or has a diffusion trend. The first spatial correlation index of the electric energy terminal device is calculated, including:

[0072] Based on the information of electric energy terminal equipment and electric energy anomaly information, a spatial distribution map of electric energy anomaly events is drawn and a high-density area of ​​electric energy anomaly events is identified through a spatial clustering algorithm, wherein the spatial clustering algorithm is any one of the DBSCAN algorithm and the K-Means algorithm. Taking the DBSCAN algorithm as an example, the steps of identifying the high-density area of ​​electric energy anomaly events include: (1) determining the neighborhood radius eps and the number of neighbor nodes min_samples required around the data node to be considered as high density through a grid search algorithm; (2) taking each electric energy anomaly event as a data node, traversing the data nodes and checking whether the number of neighbor nodes within the neighborhood radius of each data node reaches min_samples, if it meets the requirement, it is marked as a core point, otherwise it is a boundary point; (3) starting from a core point, marking the points in its neighborhood as the same cluster, and recursively expanding until all core points are covered; (4) after clustering is completed, each cluster represents a high-density area;

[0073] The electric energy abnormality spatial correlation index between any two electric energy terminal devices is calculated based on the electric energy meter information in the high-density area. The calculation formula of the electric energy abnormality spatial correlation index is:

[0074] ;

[0075] In the formula Indicates the connection with electric energy terminal equipment in high-density areas The number of associated energy meters, Indicates the connection with electric energy terminal equipment in high-density areas The number of associated energy meters, Indicates electric energy terminal equipment The total number of associated energy meters, Indicates electric energy terminal equipment The total number of associated energy meters, Indicates electric energy terminal equipment Electric energy terminal equipment The spatial correlation index of electrical energy anomaly between them;

[0076] The sum of the electric energy abnormal spatial correlation indexes of the electric energy terminal device and all electric energy terminal devices except itself is taken as the first spatial correlation index of the electric energy terminal device. The calculation formula of the first spatial correlation index is:

[0077] ;

[0078] In the formula Indicates electric energy terminal equipment Electric energy terminal equipment The electrical energy anomaly spatial correlation index between Indicates the number of electric energy terminal devices, Indicates electric energy terminal equipment The first spatial correlation index of .

[0079] S130: Analyzing the second spatiotemporal correlation of different electric energy terminal devices according to the electric energy terminal device information and the network security log information;

[0080] The network security events that occur in electric energy terminal devices (such as USB device insertion, network external connection, key file changes, device offline, etc.) directly reflect the security status and potential threats of the device in the network environment. By analyzing network security events, it is possible to identify whether there are abnormal access, malicious operations or potential intrusion behaviors. For example, high-frequency external connection events may indicate data leakage risks, and key file changes or permission changes may indicate that intruders are trying to tamper with the system. Network security events provide real-time basis for evaluating the potential intrusion risks of electric energy terminal devices, which can effectively help locate threat sources and determine risk levels, and analyze the second-time and space correlations of different electric energy terminal devices, including:

[0081] Acquire electric energy terminal equipment information and network security log information and construct a network security event set of the electric energy terminal equipment based on the network security log information;

[0082] When the network security event set of the electric energy terminal device is an empty set, the second spatial correlation index of the electric energy terminal device is 0. When the network security event set of the electric energy terminal device is not an empty set, the second spatial correlation index of the electric energy terminal device is calculated based on the electric energy terminal device information. The calculation formula of the second spatial correlation index is:

[0083] ;

[0084] In the formula Indicates electric energy terminal equipment Electric energy terminal equipment The Euclidean distance of the electric energy terminal device and electric energy terminal equipment The network security event sets of are not empty sets, that is, the electric energy terminal equipment and electric energy terminal equipment Cybersecurity incidents occurred. The mean Euclidean distance of all electric energy terminal devices whose network security event set is not an empty set, that is, the mean Euclidean distance of all electric energy terminal devices where network security events occur, Indicates the number of electric energy terminal devices, Indicates electric energy terminal equipment The second spatial correlation index of

[0085] Calculate a second time correlation index of the electric energy terminal device based on the network security event set;

[0086] The sum of the second time correlation index and the second space correlation index of the electric energy terminal device is used as the second time-space correlation index of the electric energy terminal device, and the second time-space correlation index is used to evaluate the time-space correlation of network security events between the electric energy terminal devices;

[0087] The temporal correlation of cybersecurity events in electric energy terminal devices can reveal the concentration of different cybersecurity events in the time dimension, which is of great significance for assessing the potential intrusion risk of electric energy terminal devices. When multiple cybersecurity events occur continuously in a short period of time, it indicates that the device is experiencing targeted attack behaviors or malicious intrusion attempts. At the same time, temporal correlation can also be used to identify key nodes in the attack process, which is conducive to locking potential intrusion sources and calculating the second temporal correlation index of electric energy terminal devices, including:

[0088] When the electric energy terminal equipment Cybersecurity event collection and electric energy terminal equipment When the intersection of the network security event sets is an empty set, the electric energy terminal device and electric energy terminal equipment The time correlation index of cybersecurity events between them is 0;

[0089] When the electric energy terminal equipment Cybersecurity event collection and electric energy terminal equipment When the intersection of the network security event sets is not an empty set, the network security event time correlation index is calculated according to the network security event time correlation index calculation formula. The network security event time correlation index calculation formula is:

[0090] ;

[0091] In the formula Indicates electric energy terminal equipment Cybersecurity event collection and electric energy terminal equipment The number of elements in the intersection of the network security event set, that is, in the electric energy terminal equipment and electric energy terminal equipment The number of cybersecurity incidents that occurred in Indicates the intersection Cybersecurity incidents in electric energy terminal equipment The time of occurrence, Indicates the intersection Cybersecurity incidents in electric energy terminal equipment The occurrence time on the exponential function Used to describe electrical energy terminal equipment and electric energy terminal equipment The closer the time when the same network security events occur, the greater the time correlation of the network security events. and electric energy terminal equipment When the same network security incident occurs at the same time, ,but , Indicates the intersection The event level of a cybersecurity incident, Indicates the network security event monitoring cycle. Indicates electric energy terminal equipment Electric energy terminal equipment The time correlation index of cybersecurity events between , where 1 means urgent, 2 means important, 3 means minor, 4 means general, and 5 means notification. The event level of network security incidents refers to the security event level of network equipment defined in the State Grid Corporation of China's Notice No. 2017-1084 on Accelerating the Construction of the Network Security Management Platform for Power Monitoring Systems issued by the State Grid Corporation of China;

[0092] The sum of the network security event time correlation indexes of the electric energy terminal device and all electric energy terminal devices except itself is taken as the second time correlation index of the electric energy terminal device. The calculation formula of the second time correlation index is:

[0093] ;

[0094] In the formula Indicates electric energy terminal equipment Electric energy terminal equipment The temporal correlation index of cybersecurity events between Indicates the number of electric energy terminal devices, Indicates electric energy terminal equipment The second time correlation index.

[0095] S140: sorting the potential intrusion risks of the electric energy terminal equipment based on the first spatiotemporal correlation and the second spatiotemporal correlation analysis results, and performing equipment safety inspection operations according to the potential intrusion risk sorting results;

[0096] The intrusion risk ranking list can directly reflect the order of potential intrusion risks of each electric energy terminal device by integrating the first spatiotemporal correlation index and the second spatiotemporal correlation index of the electric energy terminal device, provide a clear priority basis for safe operation and maintenance, help operation and maintenance personnel quickly focus on high-risk equipment, and give priority to checking and handling equipment that may be affected by attacks or abnormal behaviors, thereby improving response efficiency, reducing the possibility of the spread of safety hazards, ensuring the overall stability and security of the power grid communication system, and ranking the potential intrusion risks of electric energy terminal devices and performing equipment safety inspection operations based on the potential intrusion risk ranking results, including:

[0097] Acquire a first spatiotemporal correlation index and a second spatiotemporal correlation index of the electric energy terminal device and calculate the sum of the first spatiotemporal correlation index and the second spatiotemporal correlation index of the electric energy terminal device;

[0098] Sort the electric energy terminal devices in descending order by the sum of the first spatiotemporal correlation index and the second spatiotemporal correlation index to obtain a potential intrusion risk sorting list;

[0099] Perform equipment safety inspection operations on the electric energy terminal devices in sequence according to the sorted list of potential intrusion risks of the electric energy terminal devices.

[0100] See also Figure 3 , Figure 3 This is a schematic diagram of the structure of an operating system of an embedded electric energy terminal device with a network security probe provided in an embodiment of the present application, including:

[0101] The information acquisition module 210 is used to acquire the electric energy terminal device information, the network security log information of the electric energy terminal device, and the electric energy abnormality information of the electric energy meter associated with the electric energy terminal device;

[0102] A first spatiotemporal correlation analysis module 220, configured to analyze first spatiotemporal correlations of different electric energy terminal devices according to electric energy terminal device information and electric energy anomaly information;

[0103] A second spatiotemporal correlation analysis module 230, configured to analyze the second spatiotemporal correlation of different electric energy terminal devices according to the electric energy terminal device information and the network security log information;

[0104] The potential intrusion risk ranking module 240 is used to rank the potential intrusion risks of the electric energy terminal equipment based on the first spatiotemporal correlation analysis results and the second spatiotemporal correlation analysis results and to perform equipment safety inspection based on the potential intrusion risk ranking results.

[0105] In the embodiment of the present application, the first spatiotemporal correlation analysis module 220 is used to analyze the first spatiotemporal correlation of different electric energy terminal devices according to the electric energy terminal device information and the electric energy abnormality information, and the first spatiotemporal correlation of different electric energy terminal devices is analyzed, including:

[0106] Obtaining electric energy terminal equipment information and electric energy abnormality information;

[0107] The electric energy anomaly time correlation index between any two electric energy terminal devices is calculated based on the electric energy anomaly information. The calculation formula of the electric energy anomaly time correlation index is:

[0108] ;

[0109] In the formula Indicates electric energy terminal equipment The abnormal time set of electric energy associated with the electric energy meter, Indicates electric energy terminal equipment The abnormal time set of electric energy associated with the electric energy meter, Represents the terminal equipment for calculating electric energy The number of elements in the energy abnormality time set associated with the energy meter, Represents the terminal equipment for calculating electric energy The number of elements in the energy abnormality time set associated with the energy meter, Indicates electric energy terminal equipment Associate the abnormal time set of electric energy of electric energy meter with electric energy terminal equipment The number of intersection elements of the electric energy anomaly time set of the associated electric energy meter, that is, the number of time points at which electric energy anomalies occur simultaneously, Indicates electric energy terminal equipment Electric energy terminal equipment The time correlation index of electric energy anomaly;

[0110] The sum of the electric energy abnormality time correlation indexes of the electric energy terminal device and all electric energy terminal devices except the electric energy terminal device is used as the first time correlation index of the electric energy terminal device;

[0111] Calculate a first spatial correlation index of the electric energy terminal device based on the electric energy terminal device information and the electric energy abnormality information;

[0112] The sum of the first time correlation index and the first space correlation index of the electric energy terminal device is used as the first time-space correlation index of the electric energy terminal device, and the first time-space correlation index is used to evaluate the time-space correlation of the electric energy abnormality information between the electric energy terminal devices;

[0113] Calculating a first spatial correlation index of the electric energy terminal device includes:

[0114] Draw the spatial distribution map of abnormal power events based on the power terminal equipment information and power abnormality information, and identify the high-density areas of abnormal power events through spatial clustering algorithm;

[0115] The electric energy abnormality spatial correlation index between any two electric energy terminal devices is calculated based on the electric energy meter information in the high-density area. The calculation formula of the electric energy abnormality spatial correlation index is:

[0116] ;

[0117] In the formula Indicates the connection with electric energy terminal equipment in high-density areas The number of associated energy meters, Indicates the connection with electric energy terminal equipment in high-density areas The number of associated energy meters, Indicates electric energy terminal equipment The total number of associated energy meters, Indicates electric energy terminal equipment The total number of associated energy meters, Indicates electric energy terminal equipment Electric energy terminal equipment The spatial correlation index of electrical energy anomaly between them;

[0118] The sum of the electric energy abnormal spatial correlation indexes of the electric energy terminal device and all electric energy terminal devices except itself is taken as the first spatial correlation index of the electric energy terminal device. The calculation formula of the first spatial correlation index is:

[0119] ;

[0120] In the formula Indicates electric energy terminal equipment Electric energy terminal equipment The electrical energy anomaly spatial correlation index between Indicates the number of electric energy terminal devices, Indicates electric energy terminal equipment The first spatial correlation index of .

[0121] In the embodiment of the present application, the second spatiotemporal correlation analysis module 230 is used to analyze the second spatiotemporal correlation of different electric energy terminal devices according to the electric energy terminal device information and the network security log information, and the second spatiotemporal correlation of different electric energy terminal devices is analyzed, including:

[0122] Acquire electric energy terminal equipment information and network security log information and construct a network security event set of the electric energy terminal equipment based on the network security log information;

[0123] When the network security event set of the electric energy terminal device is an empty set, the second spatial correlation index of the electric energy terminal device is 0. When the network security event set of the electric energy terminal device is not an empty set, the second spatial correlation index of the electric energy terminal device is calculated based on the electric energy terminal device information. The calculation formula of the second spatial correlation index is:

[0124] ;

[0125] In the formula Indicates electric energy terminal equipment Electric energy terminal equipment The Euclidean distance of the electric energy terminal device and electric energy terminal equipment The network security event sets of are not empty sets. The mean Euclidean distance of all electric energy terminal devices representing a non-empty set of network security events, Indicates the number of electric energy terminal devices, Indicates electric energy terminal equipment The second spatial correlation index of

[0126] Calculate a second time correlation index of the electric energy terminal device based on the network security event set;

[0127] The sum of the second time correlation index and the second space correlation index of the electric energy terminal device is used as the second time-space correlation index of the electric energy terminal device, and the second time-space correlation index is used to evaluate the time-space correlation of network security events between the electric energy terminal devices;

[0128] Calculating a second time-related index of the electric energy terminal device includes:

[0129] When the electric energy terminal equipment Cybersecurity event collection and electric energy terminal equipment When the intersection of the network security event sets is an empty set, the electric energy terminal device and electric energy terminal equipment The time correlation index of cybersecurity events between them is 0;

[0130] When the electric energy terminal equipment Cybersecurity event collection and electric energy terminal equipment When the intersection of the network security event sets is not an empty set, the network security event time correlation index is calculated according to the network security event time correlation index calculation formula. The network security event time correlation index calculation formula is:

[0131] ;

[0132] In the formula Indicates electric energy terminal equipment Cybersecurity event collection and electric energy terminal equipment The number of elements in the intersection of the network security event sets, Indicates the intersection Cybersecurity incidents in electric energy terminal equipment The time of occurrence, Indicates the intersection Cybersecurity incidents in electric energy terminal equipment The time of occurrence, Indicates the intersection The event level of a cybersecurity incident, Indicates the network security event monitoring cycle. Indicates electric energy terminal equipment Electric energy terminal equipment Time correlation index of cybersecurity events between them;

[0133] The sum of the network security event time correlation indexes of the electric energy terminal device and all electric energy terminal devices except itself is used as the second time correlation index of the electric energy terminal device.

[0134] In the embodiment of the present application, the potential intrusion risk ranking module 240 is used to comprehensively analyze the first spatiotemporal correlation and the second spatiotemporal correlation to rank the potential intrusion risks of the electric energy terminal equipment and perform equipment safety inspection according to the potential intrusion risk ranking results, and rank the potential intrusion risks of the electric energy terminal equipment and perform equipment safety inspection operations according to the potential intrusion risk ranking results, including:

[0135] Acquire a first spatiotemporal correlation index and a second spatiotemporal correlation index of the electric energy terminal device and calculate the sum of the first spatiotemporal correlation index and the second spatiotemporal correlation index of the electric energy terminal device;

[0136] Sort the electric energy terminal devices in descending order by the sum of the first spatiotemporal correlation index and the second spatiotemporal correlation index to obtain a potential intrusion risk sorting list;

[0137] Perform equipment safety inspection operations on the electric energy terminal devices in sequence according to the sorted list of potential intrusion risks of the electric energy terminal devices.

[0138] The above-mentioned parameters in the operating system of the embedded electric energy terminal device with a network security probe of the present application and the steps for each unit module to implement the corresponding functions can be referred to the parameters and steps in the embodiment of the operating method of the embedded electric energy terminal device with a network security probe above, and will not be repeated here.

[0139] like Figure 4 As shown, an embodiment of the present invention further provides an electronic device 300, including a memory 310, a processor 320 and a communication bus 330; the memory 310 and the processor 320 are connected via the communication bus 330. The memory 310 stores an operating method of an embedded electric energy terminal device with a network security probe as provided in the above embodiment, which can be loaded and executed by the processor 320.

[0140] The memory 310 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 310 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function, and instructions for implementing the operating method of the embedded electric energy terminal device with a network security probe provided in the above embodiment, etc.; the data storage area may store data involved in the operating method of the embedded electric energy terminal device with a network security probe provided in the above embodiment, etc.

[0141] The processor 320 may include one or more processing cores. The processor 320 executes various functions and processes data of the present application by running or executing instructions, programs, code sets or instruction sets stored in the memory 310, calling the data stored in the memory 310. The processor 320 may be at least one of an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a central processing unit (CPU), a controller, a microcontroller and a microprocessor. It can be understood that for different devices, the electronic device used to implement the above-mentioned processor 320 function can also be other, and the embodiment of the present application is not specifically limited.

[0142] The communication bus 330 may include a path to transmit information between the above components. The communication bus 330 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The communication bus 330 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one double arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0143] An embodiment of the present application provides a computer-readable storage medium storing a computer program that can be loaded by a processor and executes an operating method of an embedded electric energy terminal device with a network security probe as provided in the above embodiment.

[0144] In this embodiment, the computer-readable storage medium may be a tangible device that holds and stores instructions used by the instruction execution device. The computer-readable storage medium may be, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any combination thereof. Specifically, the computer-readable storage medium may be a portable computer disk, a hard disk, a USB flash drive, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a podium random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, an optical disk, a magnetic disk, a mechanical encoding device, and any combination thereof.

[0145] The terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not expressly listed, or also includes elements inherent to such process, method, article, or apparatus.

[0146] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of application involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned application concept. For example, the above features are replaced with (but not limited to) technical features with similar functions applied in the present application.

Claims

1. An operating method of an embedded electric energy terminal device with a network security probe, characterized in that: The steps include: Obtaining electric energy terminal equipment information, network security log information of electric energy terminal equipment, and electric energy abnormality information of electric energy meters associated with electric energy terminal equipment; Analyze the first spatiotemporal correlation of different electric energy terminal devices according to the electric energy terminal device information and the electric energy abnormality information; Analyze the second time-space correlation of different electric energy terminal devices according to the electric energy terminal device information and network security log information; According to the analysis results of the first spatiotemporal correlation and the second spatiotemporal correlation, the potential intrusion risks of the electric energy terminal equipment are ranked and the equipment safety inspection operation is performed according to the ranking results of the potential intrusion risks; The analyzing the first spatiotemporal correlation of different electric energy terminal devices includes: Obtaining electric energy terminal equipment information and electric energy abnormality information; The electric energy anomaly time correlation index between any two electric energy terminal devices is calculated based on the electric energy anomaly information. The calculation formula of the electric energy anomaly time correlation index is: ； In the formula Indicates electric energy terminal equipment The abnormal time set of electric energy associated with the electric energy meter, Indicates electric energy terminal equipment The abnormal time set of electric energy associated with the electric energy meter, Represents the terminal equipment for calculating electric energy The number of elements in the energy abnormality time set associated with the energy meter, Represents the terminal equipment for calculating electric energy The number of elements in the energy abnormality time set associated with the energy meter, Indicates electric energy terminal equipment Associate the abnormal time set of electric energy of electric energy meter with electric energy terminal equipment The number of intersection elements of the electric energy anomaly time set of the associated electric energy meter, that is, the number of time points at which electric energy anomalies occur simultaneously, Indicates electric energy terminal equipment Electric energy terminal equipment The abnormal time correlation index of electric energy between The sum of the electric energy abnormality time correlation indexes of the electric energy terminal device and all electric energy terminal devices except the electric energy terminal device is used as the first time correlation index of the electric energy terminal device; Calculate a first spatial correlation index of the electric energy terminal device based on the electric energy terminal device information and the electric energy abnormality information; The sum of the first time correlation index and the first space correlation index of the electric energy terminal device is used as the first time-space correlation index of the electric energy terminal device, and the first time-space correlation index is used to evaluate the time-space correlation of the electric energy abnormality information between the electric energy terminal devices; The analyzing the second spatiotemporal correlation of different electric energy terminal devices includes: Acquire electric energy terminal equipment information and network security log information and construct a network security event set of the electric energy terminal equipment based on the network security log information; When the network security event set of the electric energy terminal device is an empty set, the second spatial correlation index of the electric energy terminal device is 0. When the network security event set of the electric energy terminal device is not an empty set, the second spatial correlation index of the electric energy terminal device is calculated based on the electric energy terminal device information. The calculation formula of the second spatial correlation index is: ； In the formula Indicates electric energy terminal equipment Electric energy terminal equipment The Euclidean distance of the electric energy terminal device and electric energy terminal equipment The network security event sets of are not empty sets. The mean Euclidean distance of all electric energy terminal devices representing a non-empty set of network security events, Indicates the number of electric energy terminal devices, Indicates electric energy terminal equipment The second spatial correlation index of Calculate a second time correlation index of the electric energy terminal device based on the network security event set; The sum of the second time correlation index and the second space correlation index of the electric energy terminal device is used as the second time-space correlation index of the electric energy terminal device. The second time-space correlation index is used to evaluate the time-space correlation of network security events between the electric energy terminal devices.

2. The method for operating an embedded electric energy terminal device with a network security probe according to claim 1, characterized in that: The calculating of the first spatial correlation index of the electric energy terminal device comprises: Draw the spatial distribution map of abnormal power events based on the power terminal equipment information and power abnormality information, and identify the high-density areas of abnormal power events through spatial clustering algorithm; The electric energy abnormality spatial correlation index between any two electric energy terminal devices is calculated based on the electric energy meter information in the high-density area. The calculation formula of the electric energy abnormality spatial correlation index is: ； In the formula Indicates the connection with electric energy terminal equipment in high-density areas The number of associated energy meters, Indicates the connection with electric energy terminal equipment in high-density areas The number of associated energy meters, Indicates electric energy terminal equipment The total number of associated energy meters, Indicates electric energy terminal equipment The total number of associated energy meters, Indicates electric energy terminal equipment Electric energy terminal equipment The spatial correlation index of electrical energy anomaly between them; The sum of the electric energy abnormal spatial correlation indexes of the electric energy terminal device and all electric energy terminal devices except the electric energy terminal device itself is taken as the first spatial correlation index of the electric energy terminal device.

3. The method for operating an embedded electric energy terminal device with a network security probe according to claim 1, characterized in that: The calculating the second time correlation index of the electric energy terminal device comprises: When the electric energy terminal equipment Cybersecurity event collection and electric energy terminal equipment When the intersection of the network security event sets is an empty set, the electric energy terminal device and electric energy terminal equipment The time correlation index of cybersecurity events between them is 0; When the electric energy terminal equipment Cybersecurity event collection and electric energy terminal equipment When the intersection of the network security event sets is not an empty set, the network security event time correlation index is calculated according to the network security event time correlation index calculation formula. The network security event time correlation index calculation formula is: ； In the formula Indicates electric energy terminal equipment Cybersecurity event collection and electric energy terminal equipment The number of elements in the intersection of the network security event sets, Indicates the intersection Cybersecurity incidents in electric energy terminal equipment The time of occurrence, Indicates the intersection Cybersecurity incidents in electric energy terminal equipment The time of occurrence, Indicates the intersection The event level of a cybersecurity incident, Indicates the network security event monitoring cycle. Indicates electric energy terminal equipment Electric energy terminal equipment Time correlation index of cybersecurity events between them; The sum of the network security event time correlation indexes of the electric energy terminal device and all electric energy terminal devices except itself is used as the second time correlation index of the electric energy terminal device.

4. The method for operating an embedded electric energy terminal device with a network security probe according to claim 1, characterized in that: The step of ranking the potential intrusion risks of the electric energy terminal equipment and performing equipment safety inspection operations according to the potential intrusion risk ranking results includes: Acquire a first spatiotemporal correlation index and a second spatiotemporal correlation index of the electric energy terminal device and calculate the sum of the first spatiotemporal correlation index and the second spatiotemporal correlation index of the electric energy terminal device; Sort the electric energy terminal devices in descending order by the sum of the first spatiotemporal correlation index and the second spatiotemporal correlation index to obtain a potential intrusion risk sorting list; Perform equipment safety inspection operations on the electric energy terminal devices in sequence according to the sorted list of potential intrusion risks of the electric energy terminal devices.

5. An operating system for an embedded electric energy terminal device with a network security probe, applied to an operating method for an embedded electric energy terminal device with a network security probe according to any one of claims 1 to 4, characterized in that: The system comprises: An information acquisition module is used to acquire electric energy terminal equipment information, network security log information of electric energy terminal equipment, and electric energy abnormality information of electric energy meters associated with electric energy terminal equipment; A first spatiotemporal correlation analysis module, used for analyzing the first spatiotemporal correlation of different electric energy terminal devices according to the electric energy terminal device information and the electric energy abnormality information; A second spatiotemporal correlation analysis module, used for analyzing the second spatiotemporal correlation of different electric energy terminal devices according to the electric energy terminal device information and the network security log information; A potential intrusion risk ranking module is used to comprehensively analyze the first spatiotemporal correlation and the second spatiotemporal correlation to rank the potential intrusion risks of the electric energy terminal equipment and perform equipment safety inspection operations according to the potential intrusion risk ranking results; The analyzing the first spatiotemporal correlation of different electric energy terminal devices includes: Obtaining electric energy terminal equipment information and electric energy abnormality information; The electric energy anomaly time correlation index between any two electric energy terminal devices is calculated based on the electric energy anomaly information. The calculation formula of the electric energy anomaly time correlation index is: ； In the formula Indicates electric energy terminal equipment The abnormal time set of electric energy associated with the electric energy meter, Indicates electric energy terminal equipment The abnormal time set of electric energy associated with the electric energy meter, Represents the terminal equipment for calculating electric energy The number of elements in the energy abnormality time set associated with the energy meter, Represents the terminal equipment for calculating electric energy The number of elements in the energy abnormality time set associated with the energy meter, Indicates electric energy terminal equipment Associate the abnormal time set of electric energy of electric energy meter with electric energy terminal equipment The number of intersection elements of the electric energy anomaly time set of the associated electric energy meter, that is, the number of time points at which electric energy anomalies occur simultaneously, Indicates electric energy terminal equipment Electric energy terminal equipment The abnormal time correlation index of electric energy between The sum of the electric energy abnormality time correlation indexes of the electric energy terminal device and all electric energy terminal devices except the electric energy terminal device is used as the first time correlation index of the electric energy terminal device; Calculate a first spatial correlation index of the electric energy terminal device based on the electric energy terminal device information and the electric energy abnormality information; The sum of the first time correlation index and the first space correlation index of the electric energy terminal device is used as the first time-space correlation index of the electric energy terminal device, and the first time-space correlation index is used to evaluate the time-space correlation of the electric energy abnormality information between the electric energy terminal devices; The analyzing the second spatiotemporal correlation of different electric energy terminal devices includes: Acquire electric energy terminal equipment information and network security log information and construct a network security event set of the electric energy terminal equipment based on the network security log information; When the network security event set of the electric energy terminal device is an empty set, the second spatial correlation index of the electric energy terminal device is 0. When the network security event set of the electric energy terminal device is not an empty set, the second spatial correlation index of the electric energy terminal device is calculated based on the electric energy terminal device information. The calculation formula of the second spatial correlation index is: ； In the formula Indicates electric energy terminal equipment Electric energy terminal equipment The Euclidean distance of the electric energy terminal device and electric energy terminal equipment The network security event sets of are not empty sets. The mean Euclidean distance of all electric energy terminal devices representing a non-empty set of network security events, Indicates the number of electric energy terminal devices, Indicates electric energy terminal equipment The second spatial correlation index of Calculate a second time correlation index of the electric energy terminal device based on the network security event set; The sum of the second time correlation index and the second space correlation index of the electric energy terminal device is used as the second time-space correlation index of the electric energy terminal device. The second time-space correlation index is used to evaluate the time-space correlation of network security events between the electric energy terminal devices.

6. An electronic device comprising: A processor and a memory, wherein the memory stores a computer program that can be called by the processor; characterized in that the processor executes the operating method of the embedded electric energy terminal device with a network security probe as described in any one of claims 1 to 4 by calling the computer program stored in the memory.

7. A computer-readable storage medium, characterized in that: Instructions are stored, and when the instructions are executed on a computer, the computer executes the operating method of the embedded electric energy terminal device with a network security probe as described in any one of claims 1-4.

Images