Power network security risk assessment method based on knowledge graph

Abstract

The invention discloses a power network security risk assessment method based on a knowledge graph, and relates to the field of power network security and artificial intelligence. Comprising the following steps of 1, extracting related information of vulnerabilities from a power network security text in a knowledge extraction mode; and step 2, constructing a power network security knowledge graph. And step 3, searching all network links which may be invaded. According to the method, during work, the knowledge graph technology is introduced, multi-source and multi-type power network data including equipment nodes, security vulnerabilities and the like are integrated, and risks are evaluated more comprehensively and accurately. Besides, the strong reasoning capability of the knowledge graph is utilized to analyze the node relationship in the power network and identify the potential security attack chain, so that the evaluation accuracy is improved.

Description

Technical Field

[0001] The present invention relates to the fields of power network security and artificial intelligence, and in particular to a power network security risk assessment method based on knowledge graph. Background Art

[0002] With the rapid development of the power industry, the scale of power grids is expanding, the complexity is increasing, and the degree of networking is significantly improved. The security of power grids is facing unprecedented challenges, and network attacks, virus transmission, hacker intrusion and other incidents are frequent, threatening the stable operation of power systems.

[0003] Traditional power network risk assessment methods rely on expert experience and manual analysis, which are highly subjective and inefficient, and are difficult to handle large-scale, cross-domain power network attacks. Since network intrusion is an intrusion form that exploits vulnerabilities to attack a node at the boundary of the network system, and then invades other parts of the system through this node, it has a complete attack chain. Therefore, statistical graph models are widely used in network security assessment, and this method can dynamically assess possible risks in the network system.

[0004] Considering that the knowledge graph is a network knowledge base composed of "entity-edge-attribute", which conforms to the form of the attack graph model, how to use the knowledge graph to improve the reliability of evaluation is the current problem. Summary of the invention

[0005] In response to the above problems, the present invention provides a knowledge graph-based power network security risk assessment method that can improve assessment reliability.

[0006] The technical solution of the present invention is: a method for assessing power network security risks based on knowledge graph, comprising the following steps:

[0007] Step 1: Extract relevant information of vulnerabilities from the power network security text through knowledge extraction.

[0008] Step 2: Build a knowledge graph for power network security.

[0009] Step 3: Search all possible intrusion network links.

[0010] Furthermore, step 1 specifically includes:

[0011] 1-1: The BIEOS method is used to annotate entities in power network security texts. B (begin) represents the beginning of the entity; I (inside) represents that the word is inside the entity; O (outside) represents that the word is outside the entity; E (end) represents the end of the entity; S (single) represents a single entity.

[0012] 1-2: It is proposed to construct a Bi-GRU+CRF neural network model to extract knowledge from annotated power network security text. The model consists of three parts: word embedding layer, Bi-GRU layer, and CRF layer. The word embedding layer vectorizes the text knowledge and retains the original semantics; the Bi-GRU layer obtains complete context features; and CRF solves the labeling bias problem in the Bi-GRU network, thereby obtaining the global optimal label of the sentence.

[0013] (1) Word Embedding Layer

[0014] The word embedding layer uses the word vector training tool to vectorize the text knowledge related to power network security vulnerabilities to realize the conversion from text to vector. Text vectorization allows the text knowledge to be parsed into a computer-understandable form for calculation and analysis. The word vector inputs each word as a discrete feature into the word embedding layer. Word embedding is a low-dimensional vectorized expression of a word. The trained word vector can learn the original semantic features from the input text knowledge, and word embedding can solve the problem of dimensionality curse. Word embedding, as a feature expression and direct input, improves the performance of natural language processing related models. The present invention uses the word vector training tool Word2Vec to generate word vectors to realize the feature expression and text representation of power network security text knowledge.

[0015] (2)Bi-GRU layer

[0016] GRU is an advanced variant of LSTM. GRU only has a reset gate and an update gate. GRU merges the input gate and forget gate of LSTM into the update gate, making the network structure simpler.

[0017] 1) Reset gate

[0018] The reset gate is used to control the state h of the last moment t-1 Keep to current state t The degree of h t It consists of two parts, namely h t-1 and the current input information q t The calculation formulas are shown in equations (1) and (2).

[0019] r t =σ(W r q t +U r h t-1 +b r ) (1)

[0020] h t =tanh(W c q t +U c (r t *h t-1 )+bc ) (2)

[0021] In the formula, r t Represents the output of the reset gate, W r , W c , U r , U c Respectively represent the weight matrix in the training process; b r and b c represents the bias; "*" represents element-by-element multiplication; σ represents the sigmoid activation function, with a value between 0 and 1. When σ = 0, it means h t-1 All are discarded, σ=1 means h t-1 Keep all.

[0022] 2) Update Gate

[0023] The update gate is used to determine the output of GRU It consists of two parts, namely the state h at the last moment t-1 and the candidate state h at the current moment t , the calculation formulas are shown in equations (3) and (4).

[0024] z t =σ(W z q t +U z h t-1 +b z ) (3)

[0025]

[0026] In the formula, Z t represents the output of the update gate, W z and U z is the weight matrix during training; b z is the bias; “*” represents element-by-element multiplication; σ represents the sigmoid activation function, which takes a value between 0 and 1. When σ=0, it means h t All are discarded, σ=1 means h t Keep all.

[0027] In the GRU network structure, the state is transmitted unidirectionally from the front to the back. Therefore, GRU only obtains the forward features of the sentence, but cannot obtain the backward features of the sentence. In order to obtain the complete semantic features after text vectorization, a Bi-GRU network is needed. The Bi-GRU network obtains the forward information h of each sentence. t-1 and backward information h t+1 , 2 different feature representations.

[0028] Specifically, the Bi-GRU neural network structure model is divided into two independent GRUs. The input sequence is input into the two GRU neural networks in forward order and reverse order for feature extraction. The word vector formed by concatenating the two output vectors (i.e., the extracted feature vectors) is used as the final feature expression of the word.

[0029] (3) CRF layer

[0030] CRF is used to solve the labeling bias problem generated by the Bi-GRU network, thereby obtaining the global optimal labeling. Adjacent labels are interdependent, and CRF can use the relationship between adjacent labels to optimize the global output label and improve the knowledge extraction performance. The output of the Bi-GRU layer is used as the input of CRF to obtain the global optimal label sequence, thereby realizing the knowledge extraction of power grid control text. n ],y=[y1,y2,…,y n ] are the input and output of the CRF layer, the input X is the output of the Bi-GRU layer, and the output y is the global optimal tag sequence. For a given input X, the probability of the correct prediction result is:

[0031]

[0032] Where: p(x i |y i ) is the emission probability; p(y i |y i-1 ) is the transition probability, and n is the length of the input vector.

[0033] Formula (5) is simplified to logarithmic form:

[0034]

[0035] In the prediction stage, the output label sequence with the largest overall probability is expressed as:

[0036] y * =argmaxyIn(P(y|X)) (7)

[0037] Where: argmax is the function that predicts the output y given the input.

[0038] Furthermore, step 2 specifically includes:

[0039] 2-1: Collect multi-source power network data. First, obtain network node information through cyberspace detection, including: device type, IP address, network segment, etc.; second, collect the topological connection relationship of the target network through cyberspace detection technology, including physical connection and logical connection; then, extract relevant information of vulnerabilities from public network security texts and historical vulnerability records through knowledge extraction in step 1, including historical vulnerabilities and solutions; finally, obtain information such as vulnerabilities, possible attack modes, and vulnerability scoring vectors from public data such as the National Information Security Vulnerability Database and the Vulnerability Scoring System (CVSS) through knowledge extraction. The vulnerability scoring vector in the Vulnerability Scoring System (CVSS) includes basic score, time score, and environment score.

[0040] 2-2: Define the nodes, edges, and attributes of the power network security knowledge graph. The nodes are network devices and vulnerabilities. The attributes of network device nodes are the basic information of the device, including: device type, IP address, network card MAC address, device open ports, operating system type, existing vulnerabilities, and risks. The attributes of vulnerabilities are vulnerability attack methods, vulnerability levels, and vulnerability solutions. The edges between devices are divided into connect and link. Connect means that the two devices are physically connected, but they may not be able to access each other. Link means that the two devices are logically connected and can access each other. The edge between a device and a vulnerability is a vulnerability scoring vector.

[0041] Furthermore, step 3 specifically includes:

[0042] 3-1: Calculate the risk value of the device node. Considering that the risk value f is related to the attack probability p, vulnerability score s, node centrality I and node importance c, the risk value calculation formula is shown in formula (8).

[0043] f=p×s×I×C (8)

[0044] Among them, the attack probability p represents the number of vulnerabilities of the node. The higher the number of vulnerabilities, the larger p is. The vulnerability score s is the basic score of the node in the Common Vulnerability Scoring System (CVSS). The node centrality I represents the connection relationship between the node and other nodes. The higher the centrality, the more central the node is in the graph. The centrality calculation is shown in equations (9) and (10), where N represents the number of nodes in the graph. c represents the importance of the node. For example, the core switch or the node running the service is more important than the ordinary node.

[0045] d i = the number of edges directly connected to node i (9)

[0046]

[0047] 3-2: Define the risk transfer probability of device nodes. Considering that network security intrusion gradually invades from the edge of the network to the inside and outside, the purpose of controlling the entire network is achieved by attacking weak nodes. Therefore, the risk transfer probability between different device nodes is different. The risk transfer probability calculation is shown in formula (11).

[0048]

[0049] Type, f i represents the risk value of the i-th node, f j represents the risk value of the jth node, and P represents the node risk transfer probability.

[0050] 3-3: Determine all possible attack links that the network may be subject to. Start traversing from the device nodes at the edge of the power network security knowledge graph. If the risk transfer probability of a node is greater than the set threshold, it is considered that the point may be invaded, and the node is used as the next attack point, and the connection relationship of the invaded node is retained. If the current device node has no further adjacent device nodes to traverse (that is, the risk transfer probability of all adjacent nodes has not reached the threshold or has been marked as visited), then backtrack to the previous level device node and continue to traverse along other unexplored paths. This process is repeated until all potential attack links in the entire graph are identified and recorded.

[0051] In the work, the present invention integrates multi-source and multi-type power network data, including equipment nodes, security vulnerabilities, etc., by introducing knowledge graph technology to assess risks more comprehensively and accurately. In addition, the powerful reasoning ability of knowledge graph is used to analyze the node relationship in the power network, identify potential security attack chains, and improve the accuracy of assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Attached Figure 1 It is a flow chart of a power network security risk assessment method based on knowledge graph;

[0053] Attached Figure 2 Schematic diagram of the knowledge extraction model based on Bi-GRU+CRF neural network;

[0054] Attached Figure 3 Schematic diagram of Bi-GRU network structure;

[0055] Attached Figure 4 This is a schematic diagram of the knowledge graph for power network security;

[0056] Attached Figure 5 Schematic diagram of the attack link formation of the power network. DETAILED DESCRIPTION

[0057] The technical solution of the present invention is now further described in conjunction with the accompanying drawings and embodiments.

[0058] like Figure 1-5 As shown, a power network security risk assessment method based on knowledge graph includes:

[0059] Step 1: Extract relevant information of vulnerabilities from the power network security text through knowledge extraction.

[0060] Step 2: Build a knowledge graph for power network security.

[0061] Step 3: Search all possible intrusion network links.

[0062] In the work, the present invention constructs a knowledge graph of power network security, which intuitively displays the complex power network relationships in a graphical way, making the results of network security risk assessment easier to understand and analyze. Through the visual interface, security personnel can quickly locate potential security threats and vulnerabilities, improving the efficiency and accuracy of risk assessment.

[0063] At the same time, the risk assessment method based on knowledge graph can comprehensively consider all nodes and edges in the power network, including equipment, systems, users and the interactions between them. This systematic analysis method helps to discover potential risks hidden in complex network structures and avoid information omissions and blind spots that may exist in traditional methods.

[0064] Step 1: Extract relevant information of vulnerabilities from power network security text through knowledge extraction.

[0065] Step 1-1: Use the BIEOS method to annotate entities in the power network security text. B (begin) represents the beginning of the entity; I (inside) represents that the word is inside the entity; O (outside) represents that the word is outside the entity; E (end) represents the end of the entity; S (single) represents a single entity.

[0066] Step 1-2: Propose to construct a Bi-GRU+CRF neural network model to extract knowledge from the annotated power network security text, as shown in the attached Figure 2 As shown in the figure, the model consists of three parts: word embedding layer, Bi-GRU layer, and CRF layer. The word embedding layer vectorizes text knowledge and retains the original semantics; the Bi-GRU layer obtains complete context features; and the CRF solves the labeling bias problem in the Bi-GRU network, thereby obtaining the global optimal label of the sentence.

[0067] (1) Word Embedding Layer

[0068] The word embedding layer uses the word vector training tool to vectorize the text knowledge related to power network security vulnerabilities to realize the conversion from text to vector. Text vectorization allows the text knowledge to be parsed into a computer-understandable form for calculation and analysis, and the word vector inputs each word as a discrete feature into the word embedding layer. Word embedding is a low-dimensional vectorized expression of a word. The trained word vector can learn the original semantic features from the input text knowledge, and word embedding can solve the problem of dimensionality curse. The present invention uses the word vector training tool Word2Vec to generate word vectors to realize the feature expression and text representation of power network security text knowledge.

[0069] (2)Bi-GRU layer

[0070] GRU is an advanced variant of LSTM. GRU only has a reset gate and an update gate. GRU merges the input gate and forget gate of LSTM into the update gate, making the network structure simpler.

[0071] 1) Reset gate

[0072] The reset gate is used to control the state h of the last moment t-1 Keep to current state t The degree of h t It consists of two parts, namely h t-1 and the current input information q t The calculation formulas are shown in equations (12) and (13).

[0073] r t =σ(W r q t +U r h t-1 +b r ) (1)

[0074] h t =tanh(W c q t +U c (r t *h t-1 )+b c ) (2)

[0075] In the formula, r t Represents the output of the reset gate, W r , W c , U r , U c Respectively represent the weight matrix in the training process; b r and b c represents the bias; "*" represents element-by-element multiplication; σ represents the sigmoid activation function, with a value between 0 and 1. When σ = 0, it means h t-1All are discarded, σ=1 means h t-1 Keep all.

[0076] 2) Update Gate

[0077] The update gate is used to determine the output of GRU It consists of two parts, namely the state ht-1 at the previous moment and the candidate state h at the current moment. t , the calculation formulas are shown in equations (3) and (4).

[0078] z t =σ(W z q t +U z h t-1 +b z ) (3)

[0079]

[0080] In the formula, Z t represents the output of the update gate, W z and U z is the weight matrix during training; b z is the bias; “*” represents element-by-element multiplication; σ represents the sigmoid activation function, which takes a value between 0 and 1. When σ=0, it means h t All are discarded, σ=1 means h t Keep all.

[0081] In the GRU network structure, the state is transmitted unidirectionally from the front to the back. Therefore, GRU only obtains the forward features of the sentence, but cannot obtain the backward features of the sentence. In order to obtain the complete semantic features after text vectorization, a Bi-GRU network is needed. The Bi-GRU network obtains the forward information h of each sentence. t-1 and backward information h t+1 , 2 different feature representations.

[0082] Specifically, the Bi-GRU neural network structure model is divided into two independent GRUs. The input sequence is input into the two GRU neural networks in forward and reverse order for feature extraction. The word vector formed by concatenating the two output vectors (i.e., the extracted feature vectors) is used as the final feature expression of the word, as shown in the attached figure. Figure 3 shown.

[0083] (3) CRF layer

[0084] CRF is used to solve the labeling bias problem caused by the Bi-GRU network, thereby obtaining the global optimal labeling. CRF can use the relationship between adjacent labels to optimize the global output label and improve the knowledge extraction performance.n ],y=[y1,y2,…,y n ] are the input and output of the CRF layer respectively, the input X is the output of the Bi-GRU layer, and the output y is the global optimal label sequence.

[0085] For a given input X, the probability P(y|X) that the prediction result is correct is:

[0086]

[0087] Where: p(x i |y i ) is the emission probability; p(y i |y i-1 ) is the transition probability, and n is the length of the input vector.

[0088] Formula (5) is simplified to logarithmic form:

[0089]

[0090] In the prediction stage, the output label sequence y with the highest overall probability * It is expressed as:

[0091] y*=argmax y In(P(y|X)) (7)

[0092] Where: argmax is the function that predicts the output y given the input.

[0093] Step 2: Construct a knowledge graph for power network security. Based on step 1, knowledge is extracted from historical records or public texts and combined with information about network devices to form a knowledge graph.

[0094] Step 2-1: Collect multi-source power network data. First, obtain network node information through cyberspace detection, including: device type, IP address, network segment, etc.; second, collect the topological connection relationship of the target network through cyberspace detection technology, including physical connection and logical connection; then, extract relevant information of vulnerabilities from public network security texts and historical vulnerability records through knowledge extraction in step 1, including historical vulnerabilities and solutions; finally, obtain possible vulnerability attack modes, vulnerability scoring vectors and other information from public data such as the National Information Security Vulnerability Database and the Vulnerability Scoring System (CVSS) through knowledge extraction. The vulnerability scoring vector in the Vulnerability Scoring System (CVSS) includes basic score, time score and environment score.

[0095] Step 2-2: Define the nodes, edges and attributes of the power network security knowledge graph. The nodes are network devices and vulnerabilities. The attributes of network device nodes are the basic information of the device, including: device type, IP address, network card MAC address, device open ports, operating system type, existing vulnerabilities and risks. The attributes of vulnerabilities are vulnerability attack methods, vulnerability levels and vulnerability solutions. The edges between devices are divided into connect and link. Connect means that the two devices are physically connected, but they may not be able to access each other. Link means that the two devices are logically connected and can access each other. The edge between the device and the vulnerability is the vulnerability score vector. The graph structure is shown in the attached figure. Figure 4 shown.

[0096] Step 3: Search for all possible intrusion network links. Based on the knowledge graph, the power network is evaluated. On the one hand, the risk of each device node is evaluated. On the other hand, all possible network intrusion routes are obtained based on the risk transfer probability of the device node.

[0097] Step 3-1: Calculate the risk value of the device node. Considering that the risk value f is related to the attack probability p, vulnerability score s, node centrality I and node importance c, the calculation formula of the risk value f is shown in formula (8).

[0098] f=p×s×I×c (8)

[0099] Among them, the attack probability p represents the number of vulnerabilities of the node. The higher the number of vulnerabilities, the larger p is. The vulnerability score s is the basic score of the node in the Common Vulnerability Scoring System (CVSS). The node centrality I represents the connection relationship between the node and other nodes. The higher the centrality, the more central the node is in the graph. The centrality calculation is shown in equations (9) and (10), where n represents the number of nodes in the graph. c represents the importance of the node. For example, the core switch or the node running the service is more important than the ordinary node.

[0100] d i = the number of edges directly connected to node i (9)

[0101]

[0102] Step 3-2: Define the risk transfer probability of device nodes. Considering that network security intrusion gradually invades from the edge of the network to the inside and outside, the purpose of controlling the entire network is achieved by attacking weak nodes. Therefore, the risk transfer probability between different device nodes is different. The risk transfer probability calculation is shown in formula (11).

[0103]

[0104] Type, fi represents the risk value of the i-th node, f j represents the risk value of the jth node, and P represents the node risk transfer probability.

[0105] Step 3-3: Determine all possible attack links of the network. Start traversing from the device nodes at the edge of the power network security knowledge graph. If the risk transfer probability of a node is greater than the set threshold, it is considered that the point may be invaded. Then the node is used as the next attack point and the connection relationship of the invaded node is retained, as shown in the attached figure. Figure 5 As shown in the figure. If the current device node has no further adjacent device nodes to traverse (i.e., the risk transfer probability of all adjacent nodes has not reached the threshold or has been marked as visited), it will backtrack to the previous device node and continue to traverse along other unexplored paths. This process is repeated until all potential attack links in the entire graph are identified and recorded.

[0106] Since the knowledge graph has retrieval and reasoning functions, it is helpful for dynamic risk assessment. The present invention applies knowledge graph technology to power network risk assessment, and uses the powerful reasoning ability of knowledge graph to improve the risk assessment ability of complex networks.

[0107] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A power network security risk assessment method based on knowledge graph, characterized in that: The following steps are involved: Step 1: Extract vulnerability-related information from power network security text by knowledge extraction; Step 2: Build a knowledge graph for power network security; Step 3: Search all possible intrusion network links.

2. According to claim 1, a method for assessing power network security risks based on knowledge graph is characterized in that: Step 1 includes: 1-1: Using BIEOS method to annotate entities in power network security text; 1-2: Construct a Bi-GRU+CRF neural network model to extract knowledge from annotated power network security text.

3. A method for assessing power network security risks based on knowledge graph according to claim 2, characterized in that: The Bi-GRU+CRF neural network model includes a word embedding layer, a Bi-GRU layer, and a CRF layer. The word embedding layer is used to vectorize text knowledge and retain the original semantics; the Bi-GRU layer is used to obtain complete context features; The CRF layer is used to obtain the globally optimal label of the sentence.

4. The method for assessing power network security risks based on knowledge graph according to claim 3 is characterized in that: The Bi-GRU+CRF neural network model includes: (1) Word Embedding Layer The word embedding layer uses word vector training tools to vectorize text knowledge related to power network security vulnerabilities to achieve text-to-vector conversion; (2)Bi-GRU layer GRU includes a reset gate and an update gate. 1) Reset gate The reset gate is used to control the state h of the last moment t-1 Keep to current state t The degree, h t It consists of two parts, namely h t-1 and the current input information q t , the calculation formula is shown in formula (1) and (2): r t =σ(W r q t +U r h t-1 +b r ) (1) h t =tanh(W c q t +U c (r t *h t-1 )+b c ) (2) In the formula, r t Represents the output of the reset gate, W r , W c , U r , U c Respectively represent the weight matrix in the training process; b r and b c represents the bias; "*" represents element-by-element multiplication; σ represents the sigmoid activation function, with a value between 0 and 1. When σ=0, it means h t-1 All are discarded. When σ=1, it means h t-1 All are retained; 2) Update Gate The update gate is used to determine the output of GRU It consists of two parts, namely the state h at the last moment t-1 and the candidate state h at the current moment t , the calculation formula is shown in formula (3) and (4): z t =σ(W z q t +U z h t-1 +b z )(3) In the formula, Z t represents the output of the update gate, W z and U z is the weight matrix during training; b z is the bias; "*" represents element-by-element multiplication; σ represents the sigmoid activation function, with a value between 0 and 1. When σ=0, it means h t All are discarded. When σ=1, it means h t All are retained; In order to obtain the complete semantic features after text vectorization, the Bi-GRU network is used to obtain the forward information h of each sentence. t-1 and backward information h t+1 , two different feature representations; (3) CRF layer CRF uses the relationship between adjacent tags to optimize the global output label and improve the knowledge extraction performance. The output of the Bi-GRU layer is used as the input of CRF to obtain the global optimal label sequence, thereby realizing the knowledge extraction of power grid control text. Where X = [x1, x2, ..., x n ],y=[y1,y2,…,y n ] are the input and output of the CRF layer, respectively, the input X is the output of the Bi-GRU layer, and the output y is the global optimal label sequence; For a given input X, the probability P(y|X) that the prediction result is correct is: Where: p(x i |y i ) is the emission probability; p(y i |y i-1 ) is the transition probability, n is the length of the input vector; Formula (5) is simplified to logarithmic form: In the prediction stage, the output label sequence y with the highest overall probability * It is expressed as: y * =argmax y In(P(y|X)) (7) Where: argmax is the function that predicts the output y given the input.

5. The method for assessing power network security risks based on knowledge graph according to claim 3 is characterized in that: Step 2 includes: 2-1: Collect multi-source power network data; First, through cyberspace detection, network node information is obtained, including: device type, IP address, and network segment; Secondly, the topological connection relationship of the target network is collected through cyberspace detection technology, including physical connections and logical connections; Then, through the knowledge extraction method in step 1, relevant information about the vulnerability is extracted from public network security texts and historical vulnerability records, including historical vulnerabilities and solutions; Finally, vulnerabilities, possible attack modes, and vulnerability scoring vectors are obtained from the national information security vulnerability database and vulnerability scoring system through knowledge extraction. The vulnerability scoring vector in the vulnerability scoring system includes basic scores, time scores, and environmental scores. 2-2: Define the nodes, edges and attributes of the power network security knowledge graph, where nodes are network devices and vulnerabilities, and the attributes of network device nodes are basic information about the device, including: device type, IP address, network card MAC address, device open ports, operating system type, existing vulnerabilities and risks; The attributes of a vulnerability are the vulnerability attack method, vulnerability level, and vulnerability solution; The edges between devices are divided into connect and link. Connect means that two devices are physically connected, and link means that two devices are logically connected. The edge between a device and a vulnerability is a vulnerability score vector.

6. The method for assessing power network security risks based on knowledge graph according to claim 3 is characterized in that: Step 3 includes: 3-1: Calculate the risk value of the device node; 3-2: Define the risk transfer probability of device nodes; 3-3: Identify all possible attack links on the network.

7. The method for assessing power network security risks based on knowledge graph according to claim 3 is characterized in that: In step 3-1, The risk value f calculation formula is shown in formula (8): f=p×s×I×c (8) Among them, the attack probability p represents the number of vulnerabilities of the node, the vulnerability score s is the basic score of the node in the general vulnerability scoring system, the node centrality I represents the connection relationship between the node and other nodes, and c represents the importance of the node.

8. The method for assessing power network security risks based on knowledge graph according to claim 3 is characterized in that: In step 3-2, the risk transfer probability is calculated as shown in formula (11): Type, f i represents the risk value of the i-th node, f j represents the risk value of the jth node, and P represents the node risk transfer probability.

9. The method for assessing power network security risks based on knowledge graph according to claim 3 is characterized in that: In step 3-3, the traversal starts from the device nodes at the edge of the power network security knowledge graph. If the risk transfer probability of a node is greater than the set threshold, it is considered that the point may be invaded, and the node is used as the next attack point, and the connection relationship of the invaded node is retained; If the current device node has no further adjacent device nodes to traverse, then backtrack to the previous device node and continue traversing along other unexplored paths; The above process is repeated until all potential attack links in the entire graph are identified and recorded.

Images