Multi-dimensional comprehensive evaluation method and system for host equipment of power system

Abstract

The invention discloses a multi-dimensional comprehensive assessment method and system for host equipment of a power system. The method comprises the following steps: collecting daily mean values of equipment vulnerabilities, vulnerability levels, equipment types, manufacturers, CPU utilization rates and memory utilization rates; according to the collected equipment vulnerability, vulnerability level, equipment type and manufacturer information, manufacturer quality parameters are calculated; calculating equipment stability parameters according to the acquired CPU utilization rate and memory utilization rate information; calculating equipment health degree parameters according to the collected vulnerability information; and according to the manufacturer quality parameters, the equipment stability parameters and the equipment health degree parameters, equipment safety risk parameters are calculated, and the equipment is evaluated according to the equipment safety risk parameters. According to the multi-dimensional comprehensive security assessment method for the host equipment of the electric power system, the security characteristics of the host equipment can be comprehensively mastered, active defense is made, a powerful decision-making basis is provided for a decision maker, and the occurrence of threat time is effectively prevented.

Description

Technical Field

[0001] The present invention belongs to the field of cyberspace security technology, and more specifically, relates to a multi-dimensional security comprehensive assessment method and system for host equipment in a power system. Background Art

[0002] With the development of ubiquitous Internet of Things and energy Internet, traditional power systems have widely introduced technologies such as sensing, networking and computing and have deepened their application. In this context, host devices have become an important hub connecting the power backbone network with the power primary system and users. As a link node for "multi-network integration", it realizes the "local guidance" of power grid monitoring data and the "functional aggregation" of power grid external control. Its security is directly related to the safe and stable operation of the power grid, and is of great significance to the network security of the power system. Attackers can exploit defects in the software, hardware and security policies of host devices to access or destroy the system without authorization, causing large-scale network attacks. Due to the ubiquitous interconnection and open sharing characteristics of the power system network, there will be risks of threat escalation and transition.

[0003] The work of equipment assessment in the existing technology relies heavily on the experience of experts in various industries, and is fine-tuned on this basis. Although experts have deep professional knowledge, their subjectivity and limitations often become issues that cannot be ignored when conducting security assessments. In addition, this assessment method lacks systematicity and is extremely dependent on the professional level of individuals, which affects the accuracy and reliability of security assessments. In addition, due to the wide variety of network devices on the market and the large number of manufacturers of the same type of equipment, there is a lack of unified evaluation dimensions for host devices. Summary of the invention

[0004] In order to address the deficiencies in the prior art, the present invention provides a multi-dimensional comprehensive evaluation method and system for the host equipment of a power system. The existing evaluation methods are unable to conduct a comprehensive safety evaluation of the product quality, health, and stability of the host equipment from the perspective of the power system, thereby addressing the problem that a single indicator may not be able to fully reflect the true safety risks of the equipment.

[0005] The present invention adopts the following technical solution.

[0006] A first aspect of the present invention provides a multi-dimensional comprehensive evaluation method for a power system host device, comprising:

[0007] Collect the daily average values ​​of device vulnerabilities, vulnerability levels, device types, manufacturers, CPU usage, and memory usage;

[0008] Calculate the manufacturer quality parameters based on the collected device vulnerabilities, vulnerability levels, device types and manufacturer information;

[0009] Calculate the device stability parameters based on the collected CPU usage and memory usage information;

[0010] Calculate the device health parameters based on the collected vulnerability information;

[0011] According to the manufacturer's quality parameters, equipment stability parameters and equipment health parameters, the equipment safety risk parameters are calculated, and the equipment is evaluated based on the equipment safety risk parameters.

[0012] Preferably, the manufacturer's quality parameters are calculated as follows:

[0013] T i Vulnerability parameters of the kth manufacturer corresponding to the device type and T i The lowest value of the vulnerability parameters of all manufacturers under the device type is subtracted to get T i The deviation degree of vulnerability parameters of the kth manufacturer corresponding to the device type;

[0014] T i The difference between the highest and lowest values ​​of the vulnerability parameters of all manufacturers under the device type is T i The maximum difference in vulnerability parameters between manufacturers under device type;

[0015] Calculate T i The deviation degree of vulnerability parameters of the kth manufacturer corresponding to the device type is related to T i The ratio of the maximum difference in vulnerability parameters between manufacturers under the device type is converted to standard points and the ratio is multiplied by 100;

[0016] Subtract the standard score conversion result from 100 to obtain the manufacturer's quality parameters.

[0017] Preferably, the vulnerability parameter can be expressed by formula (1), as follows:

[0018]

[0019] Where:

[0020] T i The number of vulnerabilities of the kth manufacturer in the device type,

[0021] T i The average number of vulnerabilities across all manufacturers under device type,

[0022] N i,mfrs T i The number of manufacturers corresponding to the device type.

[0023] Preferably, the device stability parameter is calculated as follows:

[0024] With CPU stability parameters and memory stability parameters as input and device stability parameters as output, a data model is constructed through a neural network or deep learning method to obtain a host device stability parameter calculation model, and the device stability parameter S2 is obtained according to the calculation model.

[0025] Preferably, the health parameters of the computing device are specifically:

[0026] T i Type Host Equipment Variation Coefficient vs. T i The lowest value of the coefficient of variation of the type host equipment is subtracted to obtain T i The degree of deviation of the coefficient of variation of the type host equipment;

[0027] T i The difference between the highest and lowest values ​​of the coefficient of variation of the type host equipment is T i The maximum degree of difference in the coefficient of variation of the type of host equipment;

[0028] Calculate T i The deviation degree of the coefficient of variation of the type host equipment and T i The ratio of the maximum difference in the coefficient of variation of the type of host equipment is converted to a standard score and the ratio is multiplied by 100;

[0029] Subtract the standard score conversion result from 100 to obtain the manufacturer's health parameter.

[0030] Preferably, the host device variation parameter can be expressed by formula (5), which is as follows:

[0031]

[0032] Where:

[0033] T i Type Host Equipment Variation Coefficient,

[0034] T i Number of vulnerabilities by type of host device, It is the average number of vulnerabilities across all host device types.

[0035] Preferably, the device is evaluated according to the device security risk parameters as follows:

[0036] The host device security risk parameters are set to three intervals from high to low. The first interval indicates that the host device is running safely and stably, the second interval indicates that the host device needs attention, and the third interval indicates that the host device has security risks and sends an alarm signal.

[0037] Preferably, the host device security risk parameter is calculated by a variable weight method according to the manufacturer quality parameter, the device stability parameter and the device health parameter. The host device security risk parameter can be expressed by formula (8):

[0038] min S=a′*S1+b′*S2+c′*S3 (8)

[0039] sta′+b′+c′=1

[0040] 0.2 <a′<0.3

[0041] 0.3 <b′<0.5

[0042] 0.2 <c′<0.3

[0043] a′ <c′<b′

[0044] S is the host device security risk parameter;

[0045] S1 is the manufacturer's quality parameter, a′ is the variable weight of the manufacturer's quality parameter;

[0046] S2 is the host device stability parameter, b′ is the variable weight of the host device stability parameter;

[0047] S3 is the host device health parameter, and c′ is the variable weight of the host device health parameter.

[0048] Preferably, according to the actual situation of the host device and the weight distribution principle of b′>c′>a′, a simulated annealing algorithm is used to determine the optimal weight distribution.

[0049] A second aspect of the present invention provides a multi-dimensional comprehensive evaluation system for a power system host device, comprising:

[0050] The data collection module is used to collect the daily average values ​​of device vulnerabilities, vulnerability levels, device types, manufacturers, CPU usage, and memory usage;

[0051] Manufacturer quality assessment module, used to calculate manufacturer quality parameters;

[0052] Equipment evaluation module, used to calculate equipment stability parameters and equipment health parameters;

[0053] The risk assessment module is used to assess the security risks of the host device.

[0054] The third aspect of the present invention discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is loaded into the processor, the computer program implements the above-mentioned multi-dimensional comprehensive evaluation method for host equipment of a power system.

[0055] A fourth aspect of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-mentioned multi-dimensional comprehensive evaluation method for a power system host device.

[0056] Compared with the prior art, the beneficial effects of the present invention include at least: the multi-dimensional comprehensive security assessment method for the main equipment of the power system provided by the present invention can comprehensively grasp the security characteristics of the main equipment, make active defense, provide decision makers with a strong decision-making basis, and effectively prevent the occurrence of threat events.

[0057] The present invention conducts equipment evaluation from three perspectives, and has the following advantages compared to a single vulnerability evaluation dimension: First, it adds dynamic monitoring of long-term vulnerability data, which can provide a more comprehensive understanding of the security status of the equipment, help to discover potential threats that are easily missed in advance, improve the compliance of the equipment, and optimize the equipment security strategy in a targeted manner; second, it adds real-time data monitoring, which can instantly discover equipment safety hazards, improve the accuracy and response speed of safety protection, optimize equipment management and maintenance, and comprehensively improve the overall safety protection level; third, it adds dimensions of equipment evaluation, and the evaluation is more comprehensive, accurate, and targeted. Through multi-dimensional data information, a systematic and comprehensive analysis of the equipment security status can be carried out, avoiding erroneous judgments caused by single data. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 It is a flow chart of a method for multi-dimensional comprehensive evaluation of host equipment in a power system provided in accordance with an embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The described embodiments are only embodiments of a part of the present invention, not all embodiments. Based on the spirit of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the protection scope of the present invention.

[0060] The present invention is committed to discovering potential security risks in hardware, software, configuration, etc. through a multi-dimensional comprehensive security assessment of the host device. Through comprehensive assessment, threats can be classified and corresponding preventive measures can be taken to reduce the risk of system attacks, discover performance bottlenecks and unreasonable configurations, and optimize them to improve the overall performance of the system. Based on the assessment results, more reasonable and effective security strategies can be formulated to improve the overall security level of the system, which will help organizations better protect their information system assets and improve their overall business operations.

[0061] In order to solve the problem that the evaluation methods in the prior art cannot start from the perspective of the power system, a comprehensive safety evaluation of the product quality, health, and stability of the host equipment is carried out in multiple aspects. Since a single indicator may not be able to fully reflect the technical problem of the real security risk of the equipment, and vulnerabilities are an important factor affecting the security of the host equipment, the present invention evaluates the host by the number and level of host vulnerabilities and the changing trend of the vulnerabilities.

[0062] The present invention provides a method and system for multi-dimensional comprehensive evaluation of host equipment in a power system, which collects information such as equipment vulnerabilities, equipment types, manufacturers, daily average values ​​of CPU usage and memory usage; performs manufacturer quality evaluation based on the collected vulnerability, equipment type, and manufacturer information; performs equipment stability evaluation based on the collected CPU usage and memory usage information; and performs equipment health evaluation based on the collected vulnerability information.

[0063] Specifically, Figure 1 As shown, embodiment 1 of the present invention provides a method for multi-dimensional comprehensive evaluation of a host device of a power system, which is used to evaluate the host device of the power system, and includes the following steps:

[0064] Step 1: Collect information such as device vulnerabilities, vulnerability levels, device types, manufacturers, daily averages of CPU usage and memory usage. Within the scope of the collected data, there are N type types of host devices, each type is represented by T i Indicates that i = 1, 2, ... N type ; For T i Type of host devices, a total of N i,host Host devices, each host device is H i,j Indicates that j = 1, 2, ..., N i,host ; For T i Type of host device, represented by N i,mfrs Manufacturers, each manufacturer M i,k Indicates that k = 1, 2, ..., N i,mfrs .

[0065] Specifically, by obtaining basic information such as device type and manufacturer recorded by the third-party system, vulnerability information and vulnerability level detected during daily inspections, and the daily average CPU usage and memory usage of the device recorded by the third-party monitoring system.

[0066] Step 2: Conduct manufacturer quality assessment based on the collected device vulnerabilities, vulnerability levels, device types, and manufacturer information;

[0067] According to the device type and manufacturer information, the device type T is obtained. i Corresponding manufacturer M i,kThe number of vulnerabilities is calculated to obtain the manufacturer's vulnerability parameters, which are then classified and compared according to different device types to obtain the quality parameters of the device manufacturer corresponding to each device type.

[0068] The quality assessment of the present invention is based on the host device H i,j Manufacturer M i,k In T i The vulnerability performance under the type is measured, rather than being limited to the current host device under test H i,j Vulnerability manifestation of a single host.

[0069] The equipment manufacturer quality assessment includes utilizing the number and level of vulnerabilities in the equipment to analyze and compare excellent equipment and reliable manufacturers.

[0070] Since the manufacturer of the device usually affects the overall quality of the product. Some well-known manufacturers may have higher manufacturing standards and quality control processes, so their products may be more reliable, and the security awareness and practices of the device manufacturer may have a significant impact on the overall security of the device. Some manufacturers may be more proactive in fixing vulnerabilities, providing security updates, or developing more secure products. The number of public vulnerabilities a device has may be an indicator for evaluating the quality of the device. Fewer vulnerabilities generally mean that the device is more robust in design and implementation. Therefore, calculations from the two dimensions of the number of device vulnerabilities and the device manufacturer can help users better understand the reputation of the device supplier and the overall security of the product. This helps purchasers choose more reliable and secure devices, while also prompting manufacturers to pay more attention to security and strengthen vulnerability repair and prevention efforts. First, collect basic data and summarize the number of vulnerabilities for each device.

[0071] By collecting the type, manufacturer, vulnerability information and vulnerability level of each device, since the vulnerability level is more important than the serious and more serious vulnerabilities, in the evaluation of manufacturer quality, only the number of serious and more serious vulnerabilities is obtained for statistical calculation.

[0072] After evaluating the vulnerability information, the emergence of serious and relatively serious vulnerabilities can have a higher impact on the quality of the manufacturer, so in the statistical calculation, the present invention selects the number of serious and relatively serious vulnerabilities. According to the collected device type and manufacturer information, the number of vulnerabilities of each manufacturer corresponding to each device type is obtained, and the vulnerability parameters of each manufacturer corresponding to each device type are calculated by the formula, which are as follows:

[0073]

[0074] Where:

[0075] T iThe number of vulnerabilities of the kth manufacturer in the device type,

[0076] T i The average number of vulnerabilities across all manufacturers under device type,

[0077] N i,mfrs T i The number of manufacturers corresponding to the device type.

[0078] According to the vulnerability parameters, the equipment manufacturer quality parameters are calculated:

[0079] T i Vulnerability parameters of the kth manufacturer corresponding to the device type and T i The lowest value of the vulnerability parameters of all manufacturers under the device type is subtracted to get T i The deviation degree of vulnerability parameters of the kth manufacturer corresponding to the device type;

[0080] T i The difference between the highest and lowest values ​​of the vulnerability parameters of all manufacturers under the device type is T i The maximum difference in vulnerability parameters between manufacturers under device type;

[0081] Calculate T i The deviation degree of vulnerability parameters of the kth manufacturer corresponding to the device type is related to T i The ratio of the maximum difference in vulnerability parameters between manufacturers under the device type is converted to standard points and the ratio is multiplied by 100;

[0082] Subtract the standard score conversion result from 100 to obtain the manufacturer's quality parameters.

[0083] The above steps for calculating the equipment manufacturer's quality parameters for a certain equipment type can be expressed by the following formula:

[0084]

[0085] Where:

[0086] It is T i Vulnerability parameters of the kth manufacturer corresponding to the device type,

[0087] z min It is T i The lowest value of vulnerability parameters of all manufacturers under the device type.

[0088] z max T i The highest value among all manufacturers' vulnerability parameters under the device type.

[0089] As a prominent substantive feature of the present invention and one of the significant advances in the prior art, the present invention evaluates the manufacturer quality of equipment produced by different manufacturers by the number and level of vulnerabilities from the perspective of equipment type. This evaluation is based on vulnerability-related data, which can fully understand the security characteristics of the equipment, provide decision makers with a strong basis for decision-making, and ensure the safe and stable operation of the power system.

[0090] Step 3: Based on the set time interval, collect the H of a single host device i,j CPU usage R cpu and memory usage R mem The average value of CPU utilization and memory utilization is used as the host device stability parameter S2, and the stability of the device is evaluated based on the host device stability parameter.

[0091] High CPU utilization and memory utilization may indicate that the device is under high load, which may affect the performance and stability of the device. By monitoring these indicators, it is possible to promptly detect whether the device has problems when processing the workload. Abnormal CPU and memory utilization may be a precursor to system problems, such as memory leaks, malware or other failures. By monitoring these utilizations in real time, potential system problems can be discovered early and corresponding measures can be taken. Excessive CPU and memory utilization may cause the device to respond more slowly or even cause the system to crash. Monitoring these utilizations helps to evaluate the stability and reliability of the device when it is under workload. Therefore, the present invention evaluates the stability of the device through two dimensions: CPU utilization and memory utilization.

[0092] Based on the collected data of a single host device H at a set time interval i,j CPU usage R cpu and memory usage R mem , calculate the expected CPU usage μ cpu and standard deviation σ cpu and expected memory usage μ mem and standard deviation σ mem The time interval is preferably, but not limited to, daily.

[0093] Based on the obtained CPU and memory usage parameters, the CPU and memory stability parameters are calculated and expressed as follows:

[0094]

[0095]

[0096] Where:

[0097] C cpu is the CPU stability parameter, C memRepresents the memory stability parameter,

[0098] C cpu,1 ,C cpu,2 ,C cpu,3 The CPU stability parameter value is, for example, but not limited to, 1, 2, and 3, respectively indicating that the CPU operation stability is good, good, and poor;

[0099] C mem,1 ,C mem,2 ,C mem,3 The memory stability parameter is taken as a value, for example but not limited to 1, 2, and 3, respectively representing good, good, and poor memory operation stability.

[0100] CPU stability parameter C cpu , memory stability parameter C mem And the device stability parameter S2 is used as the characteristic value, a data model is established, and a decision tree machine learning algorithm is used to obtain a host device stability parameter calculation model for a set time interval.

[0101] Specifically, (C cpu ,C mem ,S2) Build data samples for training. The data used for modeling training is the CPU stability parameter C of all types and all devices cpu and memory stability parameter C mem The CPU stability parameter C cpu and memory stability parameter C mem As input and device stability parameter S2 as output. The value of device stability parameter S2 is based on the principle that excellent is 100, good is 90, medium is 80, and poor is 60. cpu and memory usage R mem Get the equipment stability parameters.

[0102] It is worth noting that the decision tree machine learning algorithm is only a preferred but non-limiting modeling method of the present invention. Any neural network or deep learning method can be used to construct a model based on the CPU usage rate R of the host device. cpu and memory usage R mem All methods of obtaining the equipment stability parameter S2 model fall within the scope of the present invention.

[0103] As a prominent substantive feature of the present invention and one of the significant advances brought to the prior art, the present invention introduces device stability assessment, which is completed using real-time CPU occupancy. By real-time monitoring of the device working status, the safety and reliability of the device can be evaluated.

[0104] Step 4: Perform a host device health assessment based on the collected vulnerability information.

[0105] Based on the acquisition of T i Type of host device H i,j The number of vulnerabilities is classified and counted by month. According to the increasing or decreasing trend of the number of vulnerabilities, the health parameters of the host device for that month are calculated. i,j Assess the health of.

[0106] The number of vulnerabilities in host devices each month can reflect the changing trend of the host device security status. If the number of vulnerabilities is stable or gradually decreasing, it may indicate that the security of the host device is improving; if the number of vulnerabilities is on an upward trend, it may mean that the host device is facing more security risks. The number of vulnerabilities in host devices each month is used as an indicator for risk assessment. When the number of vulnerabilities gradually increases, it may be necessary to strengthen the monitoring and maintenance of host devices to prevent potential security risks.

[0107] Based on the number of host device vulnerabilities at a set time frequency, the host device variation coefficient is calculated and expressed as follows:

[0108]

[0109] Where:

[0110] T i Type Host Equipment Variation Coefficient,

[0111] T i Number of vulnerabilities by type of host device, It is the average number of vulnerabilities across all host device types.

[0112] Based on the host device variation coefficient, the host device health parameters are calculated:

[0113] T i Type Host Equipment Variation Coefficient vs. T i The lowest value of the coefficient of variation of the type host equipment is subtracted to obtain T i The degree of deviation of the coefficient of variation of the type host equipment;

[0114] T i The difference between the highest and lowest values ​​of the coefficient of variation of the type host equipment is T i The maximum degree of difference in the coefficient of variation of the type of host equipment;

[0115] Calculate T i The deviation degree of the coefficient of variation of the type host equipment and T i The ratio of the maximum difference in the coefficient of variation of the type of host equipment is converted to a standard score and the ratio is multiplied by 100;

[0116] Subtract the standard score conversion result from 100 to obtain the manufacturer's health parameter.

[0117] The above steps of calculating the host device health parameter can be expressed by the following formula:

[0118]

[0119] Where:

[0120] S3 is the host device health parameter;

[0121] T i Type Host Equipment Variation Coefficient, V min T i The lowest value of the coefficient of variation of the type host device, V max T i Type Host device has the highest value in the coefficient of variation.

[0122] As a prominent substantive feature of the present invention and one of the significant advances in the prior art, the vulnerability change trend is based on the statistics of the number of vulnerabilities within a certain period of time. This data can well measure the change trend of the security protection capability of the equipment, thereby completing the equipment health assessment. Equipment health assessment helps to achieve a dynamic balance of security protection, improve the security protection measures of the plant and station in a targeted manner, and enhance the effectiveness of security strategies to cope with ever-changing security threats.

[0123] Step 5: Taking into account the manufacturer quality parameters obtained in step 2, the host device stability parameters obtained in step 3, and the health parameters obtained in step 4, the host device security risk parameters are calculated and the host device H is evaluated according to the set interval to which the host device security risk parameters belong. i,j Assess the security risks.

[0124] In a preferred but non-limiting embodiment of the present invention, the host device security risk parameter is calculated according to the following formula:

[0125] S=a*S1+b*S2+c*S3 (7)

[0126] Where:

[0127] S is the host device security risk parameter;

[0128] S1 is the manufacturer's quality parameter, and a is the weight of the manufacturer's quality parameter;

[0129] S2 is the stability parameter of the host device, and b is the weight of the stability parameter of the host device;

[0130] S3 is the host device health parameter, and c is the weight of the host device health parameter.

[0131] The host device security risk parameters are set to three intervals from high to low. The first interval indicates that the host device is running safely and stably, the second interval indicates that the host device needs attention, and the third interval indicates that the host device has security risks and sends an alarm signal.

[0132] It is understandable that the host device user can set the interval division nodes and the number of interval divisions according to the safety tolerance margin. Three intervals are only a preferred but non-limiting implementation. Two intervals, or more intervals fall within the core concept scope of the present invention.

[0133] In a further preferred embodiment, the host device security risk parameter is calculated by a fixed weight method. Since there are fewer interference factors of the quality parameters of the equipment manufacturer, preferably, but not limited to, a=0.3, b=0.4, c=0.3.

[0134] As a prominent substantive feature of the present invention and one of the significant advances it brings to the prior art, the scheme of the present invention specifically targets the attribute characteristics of the main equipment of the power system for a more objective security assessment. The vulnerability of the equipment, as a basic feature, can better reflect its basic security level; while operating parameters such as CPU and memory occupancy can intuitively display the operating status of the equipment. Based on these characteristic attributes, a comprehensive assessment of the security of the main equipment of the power system is conducted. In this process, the characteristics of the power system are fully combined, and targeted conditions are set, thereby designing a set of evaluation schemes specifically for the main equipment of the power system. This scheme not only improves the objectivity and accuracy of the security assessment, but also provides a strong guarantee for the stable operation of the power system.

[0135] The present invention is mainly directed to the host device H i,j To evaluate, if the host device H i,j The device type is T i To evaluate, we only need to sum up N i,host The device security risk parameters of the host device are sufficient.

[0136] In a further preferred embodiment, the host device security risk parameter is calculated in a variable weight manner, as shown in the following formula:

[0137] min S=a′*S1+b′*S2+c′*S3 (8)

[0138] sta′+b′+c′=1

[0139] 0.2 <a′<0.3

[0140] 0.3 <b′<0.5

[0141] 0.2 <c′<0.3

[0142] a′ <c′<b′

[0143] In a more optimized implementation strategy, a variable weight method is used to accurately calculate the security risk parameters of the host device. The core of this method is that by dynamically adjusting the weight, the security status of the host device can be more comprehensively reflected. In this method, a', b', and c' represent the variable weights of each evaluation item, which not only help to reveal the minimum threshold of the host device security, but also clearly reflect the priority of each evaluation item.

[0144] In order to more accurately reflect the role of these weights, a rule-based weight adaptive calculation method is introduced. This method dynamically adjusts the weight values ​​of a′, b′, and c′ according to the actual status of the host device and the characteristics of each assessment item through a series of preset rules. This adaptive mechanism ensures that the calculation of security risk parameters can not only capture the overall security level of the host device, but also highlight the importance of key assessment items. Therefore, the rule-based weight adaptive calculation method plays a vital role in calculating the security risk parameters of the host device.

[0145] In addition, among all the evaluation items, device stability has the most significant impact on the host device. It is not only directly related to the operational reliability of the host device, but also an important indicator for evaluating its overall security. Therefore, in the weight allocation and adaptive calculation process, device stability is always given priority to ensure the accuracy and effectiveness of the evaluation results. In addition, the manufacturer's quality parameters and host variation coefficient are both evaluated by the number of vulnerabilities and the level of hazard, so the weight adjustment range is consistent.

[0146] During the solution process, the simulated annealing algorithm is used to find the optimal solution, which provides a more accurate and reliable reference for the overall protection of the system, helping us to better evaluate and strengthen the system's security protection capabilities.

[0147] In the process of solving the problem using the simulated annealing algorithm, we set the weight value according to the importance of the evaluation item. Specifically, the basis for weight design is to sort from large to small in the order of b', c', and a'. At the same time, in order to ensure that the impact of each weight coefficient on the host device is within a reasonable range, we have imposed certain constraints on the adjustment range of the weight coefficient.

[0148] The present invention considers the dimensions of equipment evaluation from many aspects: 1. Comprehensiveness: By comprehensively evaluating the quality, stability and health of the equipment, the overall security status of the equipment can be more comprehensively understood. A single indicator may not fully reflect the real security risks of the equipment. 2. Risk identification: The evaluation of equipment quality, stability and health can help discover different types of security risks. For example, low-quality equipment is vulnerable to physical attacks, while unstable equipment is easy to become the target of network attacks. 3. Comprehensive performance: The quality, stability and health of the equipment are usually closely related to its security. A high-quality, stable and healthy device is more likely to have better security performance. 4. It is conducive to formulating measures: After comprehensively evaluating the safety of the equipment from multiple angles, improvement measures can be formulated more specifically to improve the overall safety level of the equipment. In summary, the safety of the equipment is comprehensively evaluated from three aspects: equipment quality, equipment stability and equipment health.

[0149] The entire method for multi-dimensional comprehensive evaluation of power system host equipment in embodiment 1 of the present invention is preferably implemented in the form of system software and used to display the process and results. Therefore, embodiment 2 of the present invention provides a multi-dimensional comprehensive evaluation system for power system host equipment, which runs a method for multi-dimensional comprehensive evaluation of power system host equipment as described in embodiment 1, including:

[0150] The data collection module is used to collect the daily average values ​​of device vulnerabilities, vulnerability levels, device types, manufacturers, CPU usage, and memory usage;

[0151] Manufacturer quality assessment module, used to calculate manufacturer quality parameters;

[0152] Equipment evaluation module, used to calculate equipment stability parameters and equipment health parameters;

[0153] The risk assessment module is used to assess the security risks of the host device.

[0154] Embodiment 3 of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is loaded into the processor, a method for multi-dimensional comprehensive evaluation of a host device of a power system according to embodiment 1 is implemented.

[0155] Embodiment 4 of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and is characterized in that when the computer program is executed by a processor, a method for multi-dimensional comprehensive evaluation of a host device of a power system according to embodiment 1 is implemented.

[0156] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0157] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A multi-dimensional comprehensive evaluation method for host equipment in a power system, characterized in that: The method comprises: Collect the daily average values ​​of device vulnerabilities, vulnerability levels, device types, manufacturers, CPU usage, and memory usage; Calculate the manufacturer quality parameters based on the collected device vulnerabilities, vulnerability levels, device types and manufacturer information; Calculate the device stability parameters based on the collected CPU usage and memory usage information; Calculate the device health parameters based on the collected vulnerability information; According to the manufacturer's quality parameters, equipment stability parameters and equipment health parameters, the equipment safety risk parameters are calculated, and the equipment is evaluated based on the equipment safety risk parameters.

2. A multi-dimensional comprehensive evaluation method for host equipment in a power system according to claim 1, characterized in that: The specific calculation parameters of the manufacturer's quality are: T i Vulnerability parameters of the kth manufacturer corresponding to the device type and T i The lowest value of the vulnerability parameters of all manufacturers under the device type is subtracted to get T i The deviation degree of vulnerability parameters of the kth manufacturer corresponding to the device type; T i The difference between the highest and lowest values ​​of the vulnerability parameters of all manufacturers under the device type is T i The maximum difference in vulnerability parameters between manufacturers under device type; Calculate T i The deviation degree of vulnerability parameters of the kth manufacturer corresponding to the device type is related to T i The ratio of the maximum difference in vulnerability parameters between manufacturers under the device type is converted to standard points and the ratio is multiplied by 100; Subtract the standard score conversion result from 100 to obtain the manufacturer's quality parameters.

3. A multi-dimensional comprehensive evaluation method for power system host equipment according to claim 2, characterized in that: The vulnerability parameters can be expressed by formula (1), as follows: Where: T i The number of vulnerabilities of the kth manufacturer in the device type, T i The average number of vulnerabilities across all manufacturers under device type, N i,mfrs T i The number of manufacturers corresponding to the device type.

4. A multi-dimensional comprehensive evaluation method for power system host equipment according to claim 1, characterized in that: The equipment stability parameters are calculated as follows: With CPU stability parameters and memory stability parameters as input and device stability parameters as output, a data model is constructed through a neural network or deep learning method to obtain a host device stability parameter calculation model, and the device stability parameter S2 is obtained according to the calculation model.

5. A multi-dimensional comprehensive evaluation method for power system host equipment according to claim 1, characterized in that: The specific health parameters of the computing device are: T i Type Host Equipment Variation Coefficient and T i The lowest value of the coefficient of variation of the type host equipment is subtracted to obtain T i The degree of deviation of the coefficient of variation of the type host equipment; T i The difference between the highest and lowest values ​​of the coefficient of variation of the type host equipment is T i The maximum degree of difference in the coefficient of variation of the type of host equipment; Calculate T i The deviation degree of the coefficient of variation of the type host equipment and T i The ratio of the maximum difference in the coefficient of variation of the type of host equipment is converted to a standard score and the ratio is multiplied by 100; Subtract the standard score conversion result from 100 to obtain the manufacturer's health parameter.

6. A multi-dimensional comprehensive evaluation method for power system host equipment according to claim 5, characterized in that: The host device variation parameter can be expressed by formula (2), as follows: Where: T i Type Host Equipment Variation Coefficient, T i Number of vulnerabilities by type of host device, It is the average number of vulnerabilities across all host device types.

7. A method for multi-dimensional comprehensive evaluation of power system host equipment according to claim 1, characterized in that: The equipment is evaluated based on the equipment security risk parameters as follows: The host device security risk parameters are set to three intervals from high to low. The first interval indicates that the host device is running safely and stably, the second interval indicates that the host device needs attention, and the third interval indicates that the host device has security risks and sends an alarm signal.

8. A multi-dimensional comprehensive evaluation method for host equipment in a power system according to claim 7, characterized in that: According to the manufacturer's quality parameters, equipment stability parameters and equipment health parameters, the host equipment safety risk parameters are calculated by using a variable weight method. The host equipment safety risk parameters can be expressed by formula (3): min S=a′*S1+b′*S2+c′*S3 (3) st a′+b′+c′=1 0.2<a′<0.3 0.3<b′<0.5 0.2<c′<0.3 a′ <c′<b′ S is the host device security risk parameter; S1 is the manufacturer's quality parameter, a ′ is the variable weight of the manufacturer’s quality parameter; S2 is the stability parameter of the host device, b ′ is the variable weight of the stability parameter of the host device; S3 is the host device health parameter, c ′ is the variable weight of the host device health parameter.

9. A multi-dimensional comprehensive evaluation method for host equipment in a power system according to claim 8, characterized in that: According to the actual status of the host device, follow b ′ >c ′ >a ′ The weight distribution principle is adopted and the simulated annealing algorithm is used to determine the optimal weight distribution.

10. A multi-dimensional comprehensive evaluation system for a power system host device, running a multi-dimensional comprehensive evaluation method for a power system host device according to any one of claims 1 to 9, characterized in that: The data collection module is used to collect the daily average values ​​of device vulnerabilities, vulnerability levels, device types, manufacturers, CPU usage, and memory usage; Manufacturer quality assessment module, used to calculate manufacturer quality parameters; Equipment evaluation module, used to calculate equipment stability parameters and equipment health parameters; The risk assessment module is used to assess the security risks of the host device.

11. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the computer program is loaded into a processor, a multi-dimensional comprehensive evaluation method for a power system host device according to any one of claims 1 to 9 is implemented.

12. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, a multi-dimensional comprehensive evaluation method for a power system host device is implemented according to any one of claims 1 to 9.

Images