Network security prevention and control method, device and equipment based on power grid master station and medium

Abstract

The embodiment of the invention discloses a network security prevention and control method, device and equipment based on a power grid master station and a medium. The method comprises the following steps: acquiring network flow information of data packet flow to be processed, and processing the network flow information to obtain network flow data; carrying out feature matching on the network traffic data and preset malicious traffic features, and judging whether the traffic of the data packet to be processed is malicious traffic or not according to a matching result; if not, analyzing the network traffic data according to a preset behavior detection strategy to obtain a traffic dimension analysis result; matching a corresponding target abnormal traffic type from preset candidate abnormal traffic types according to a traffic dimension analysis result, and selecting a target traffic interception strategy from preset candidate traffic interception strategies according to the target abnormal traffic type; and according to the target traffic interception strategy, performing security prevention and control on the traffic of the to-be-processed data packet. And the reliability of network security prevention and control of the power grid master station system is improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of network security technology, and in particular to a network security prevention and control method, device, equipment and medium based on a power grid master station. Background Art

[0002] At present, the cybersecurity situation at home and abroad is becoming increasingly severe. The accelerated construction of the new energy system has also brought new challenges. With the access of a large number of new energy sites and third-party market entities, the exposure of network risks has also expanded. The boundaries of network security protection have gradually blurred, and the difficulty of security management has increased. The existing protection system lacks the ability to monitor, comprehensively evaluate and automatically respond to distributed energy access equipment in the new power system scenario, and cannot meet the needs of active defense and risk prevention and control of network security in the new power system scenario. Therefore, it is crucial to improve the reliability of network security prevention and control of the power grid master station system. Summary of the invention

[0003] The present invention provides a network security prevention and control method, device, equipment and medium based on a power grid master station to improve the reliability of network security prevention and control of the power grid master station system.

[0004] According to one aspect of the present invention, a network security prevention and control method based on a power grid master station is provided, comprising:

[0005] Acquire network traffic information of data packet traffic to be processed from each key node device in the master station system of the power grid to be processed, and process the network traffic information to obtain network traffic data;

[0006] Perform feature matching on the network traffic data and preset malicious traffic features, and determine whether the data packet traffic to be processed is malicious traffic based on the matching result;

[0007] If not, the network traffic data is analyzed according to a preset behavior detection strategy to obtain a traffic dimension analysis result; wherein the preset behavior detection strategy includes candidate traffic detection behaviors of different dimensions and behavior detection sub-strategies corresponding to the candidate traffic detection behaviors;

[0008] According to the traffic dimension analysis result, matching the corresponding target abnormal traffic type from the preset candidate abnormal traffic types, and selecting the target traffic interception strategy from the preset candidate traffic interception strategies according to the target abnormal traffic type;

[0009] According to the target traffic interception strategy, security control is performed on the data packet traffic to be processed.

[0010] According to another aspect of the present invention, a network security prevention and control device based on a power grid master station is provided, comprising:

[0011] A flow data determination module is used to obtain network flow information of the data packet flow to be processed from each key node device in the power grid master station system to be processed, and process the network flow information to obtain network flow data;

[0012] A malicious traffic determination module is used to perform feature matching on the network traffic data and preset malicious traffic features, and determine whether the to-be-processed data packet traffic is malicious traffic based on the matching result;

[0013] A dimension result determination module is used to analyze the network traffic data according to a preset behavior detection strategy to obtain a traffic dimension analysis result if no; wherein the preset behavior detection strategy includes candidate traffic detection behaviors of different dimensions and behavior detection sub-strategies corresponding to the candidate traffic detection behaviors;

[0014] An interception strategy determination module is used to match the corresponding target abnormal traffic type from the preset candidate abnormal traffic types according to the traffic dimension analysis result, and select the target traffic interception strategy from the preset candidate traffic interception strategies according to the target abnormal traffic type;

[0015] The security control module is used to perform security control on the data packet traffic to be processed according to the target traffic interception strategy.

[0016] According to another aspect of the present invention, there is provided an electronic device, comprising:

[0017] one or more processors;

[0018] A memory for storing one or more programs;

[0019] When one or more programs are executed by one or more processors, the one or more processors can execute any one of the network security prevention and control methods based on the power grid master station provided by the embodiments of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, which stores computer instructions, and the computer instructions are used to enable a processor to implement any one of the network security prevention and control methods based on the power grid master station provided by the embodiments of the present invention when executed.

[0021] The embodiment of the present invention provides a network security prevention and control solution based on a power grid master station, which obtains network traffic information of the data packet traffic to be processed from each key node device in the power grid master station system to be processed, and processes the network traffic information to obtain network traffic data; performs feature matching on the network traffic data with preset malicious traffic features, and determines whether the data packet traffic to be processed is malicious traffic based on the matching results; if not, analyzes the network traffic data based on a preset behavior detection strategy to obtain a traffic dimension analysis result; wherein the preset behavior detection strategy includes candidate traffic detection behaviors of different dimensions, and behavior detection sub-strategies corresponding to the candidate traffic detection behaviors; based on the traffic dimension analysis result, matches the corresponding target abnormal traffic type from the preset candidate abnormal traffic type, and selects the target traffic interception strategy from the preset candidate traffic interception strategy based on the target abnormal traffic type; and performs security prevention and control on the data packet traffic to be processed based on the target traffic interception strategy. The above scheme, through the collected network traffic information, sequentially determines whether the data packet traffic to be processed is malicious traffic or abnormal traffic. When the data packet traffic to be processed is abnormal traffic, the corresponding target traffic interception strategy is determined to intercept the data packet traffic to be processed, thereby realizing active anomaly detection of network traffic, identifying malicious traffic and abnormal traffic, and executing rapid response measures for malicious traffic and abnormal traffic, thereby effectively and actively defending against invading suspicious traffic and improving the reliability of network security prevention and control of the power grid master station system.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 It is a flow chart of a network security prevention and control method based on a power grid master station provided in Embodiment 1 of the present invention;

[0025] Figure 2 It is a flow chart of a network security prevention and control method based on a power grid master station provided in Embodiment 2 of the present invention;

[0026] Figure 3 It is a structural schematic diagram of a network security prevention and control device based on a power grid master station provided in Embodiment 3 of the present invention;

[0027] Figure 4 It is a structural schematic diagram of an electronic device for implementing a network security prevention and control method based on a power grid master station provided in a fourth embodiment of the present invention. DETAILED DESCRIPTION

[0028] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0029] In the existing technology, suspicious traffic can only be blocked by relying on the linkage of products such as firewalls and intrusion detection systems (IDS). The use of firewalls and IDS for intrusion identification can only rely on the detection technology of abnormal detection of signs, which has a high false alarm rate and is difficult to effectively and actively defend against suspicious intrusion traffic.

[0030] The embodiments of the present invention improve the overall security monitoring, defense, response and non-proliferation capabilities of the power grid master station system by constructing an active defense system to cope with the network security risks brought about by the process of the power monitoring system network space moving from closed to open, and realize active network security defense and risk prevention and control in new power system scenarios.

[0031] Embodiment 1

[0032] Figure 1 It is a flow chart of a network security prevention and control method based on a power grid master station provided in Example 1 of the present invention. This embodiment can be applicable to the situation of performing security prevention and control on the network of the power grid master station. The method can be executed by a network security prevention and control device based on the power grid master station. The device can be implemented in software and / or hardware, and can be configured in an electronic device that carries the network security prevention and control function based on the power grid master station.

[0033] See also Figure 1 The network security prevention and control method based on the power grid master station shown is applied to the network security prevention and control system, including:

[0034] S110, acquiring network flow information of the data packet flow to be processed from each key node device in the power grid master station system to be processed, and processing the network flow information to obtain network flow data.

[0035] The power grid master station system to be processed refers to the system of the power grid master station that needs to be network security controlled. Key node equipment refers to important electronic equipment in the power grid master station system to be processed. For example, the key node equipment may include network equipment, security equipment, and servers.

[0036] The data packet flow to be processed refers to the data packet flow that needs to be subject to network security prevention and control. Network flow information refers to network information associated with the data packet flow to be processed. Exemplarily, the network flow information may include bidirectional data flows, data packet numbers, and data packet sizes covering network communications. Bidirectional data flows may include outgoing and incoming flows.

[0037] Among them, network traffic data refers to traffic characteristics and traffic behaviors parsed from network traffic information. Exemplarily, traffic characteristics in network traffic data may include protocol version, packet characteristics (such as packet size, structure, and flags), file type (such as text, image, and audio), and traffic trend characteristics (such as traffic changes within a time period and periodic traffic patterns).

[0038] Among them, the network security prevention and control system can be used to monitor and prevent network traffic on the main station side of the power grid.

[0039] It should be noted that the network security prevention and control system in the embodiment of the present invention can monitor the network traffic of the power grid master station to be processed (i.e., the data packet traffic to be processed) in real time, that is, continuously monitor the network traffic of the power grid master station to be processed to quickly identify anomalies and potential intrusions, including traffic collection, traffic statistics, etc.

[0040] S120: Perform feature matching on the network traffic data and preset malicious traffic features, and determine whether the traffic of the data packet to be processed is malicious traffic based on the matching result.

[0041] The preset malicious traffic characteristics refer to the pre-set malicious traffic related characteristics. Malicious traffic refers to the network traffic that is offensive to the main station system of the power grid to be processed.

[0042] S130: If not, the network traffic data is analyzed according to a preset behavior detection strategy to obtain a traffic dimension analysis result.

[0043] The preset behavior detection strategy refers to a detection strategy for whether the traffic behavior is abnormal. Exemplarily, the preset behavior detection strategy includes candidate traffic detection behaviors of different dimensions and behavior detection sub-strategies corresponding to the candidate traffic detection behaviors. Candidate traffic detection behaviors refer to different types of traffic behaviors. The behavior detection sub-strategy refers to a strategy for performing abnormal detection on a candidate traffic detection behavior.

[0044] The traffic dimension analysis result refers to the detection result obtained by detecting candidate traffic detection behaviors of a certain dimension of network traffic data.

[0045] Specifically, if the data packet traffic to be processed is not malicious traffic, the traffic behavior in the network traffic data is analyzed according to a preset behavior detection strategy to obtain a traffic dimension analysis result.

[0046] In an optional embodiment, if the behavior detection sub-strategy includes an anomaly detection threshold, the anomaly detection threshold is determined and updated based on the following method: obtaining historical network traffic characteristics and historical traffic behavior data of each key node device in the master station system of the power grid to be processed when the network is operating normally; building an algorithm based on a preset model, and building a network baseline model based on the historical network traffic characteristics and historical traffic behavior data; determining the anomaly detection threshold based on the network baseline model; and updating the anomaly detection threshold based on the preset threshold update method.

[0047] The anomaly detection threshold refers to a pre-set threshold used to determine whether network traffic data is abnormal in a candidate traffic detection behavior. The embodiment of the present invention does not impose any limitation on the size of the anomaly detection threshold, which can be set by technicians based on experience or repeatedly determined through a large number of experiments.

[0048] The historical network traffic characteristics refer to the network traffic characteristics in the master station system of the power grid to be processed when the network has no abnormal operation in the past. The historical traffic behavior data refer to the traffic behavior data in the master station system of the power grid to be processed when the network has no abnormal operation in the past.

[0049] The embodiments of the present invention do not impose any limitation on the preset model building algorithm, which can be set by a technician according to experience or needs. Exemplarily, the preset model building algorithm may include statistical methods and machine learning methods. The statistical methods may include mean value, median and standard deviation. The machine learning methods may include cluster analysis and PCA (Principal components analysis) method.

[0050] Among them, the network baseline model can be used to define the expected network behavior in the absence of malicious activity based on historical data analysis of network traffic and user activities.

[0051] The embodiment of the present invention does not impose any limitation on the preset threshold updating method, which can be set by a technician according to experience or needs. Exemplarily, the preset threshold updating method may include a sliding window method, an EWMA (Exponentially Weighted Moving Average), and a machine learning method.

[0052] Among them, the sliding window method refers to recalculating the statistical value using the traffic data in the recent period and dynamically updating the anomaly detection threshold. The exponentially weighted moving average (EWMA) refers to giving more weight to the latest data and smoothly adjusting the anomaly detection threshold. Machine learning methods can include support vector machines (SVM), neural networks, and deep learning, which can train models to predict future traffic behavior and adjust anomaly detection thresholds.

[0053] Specifically, based on the network baseline model, an initial anomaly detection threshold is set; according to the dynamic changes of network traffic, an adaptive algorithm is used to adjust the anomaly detection threshold, such as a sliding window method and an exponentially weighted moving average; or, a machine learning method can be used to adjust the anomaly detection threshold.

[0054] It can be understood that by introducing a network baseline model and determining the initial anomaly detection threshold, the accuracy of the determined initial anomaly detection threshold is improved; at the same time, the anomaly detection threshold is updated according to the preset threshold update method so that the anomaly detection threshold can change dynamically with the change of network traffic to adapt to the characteristics of different time periods and network environments, thereby improving the reliability and accuracy of the anomaly detection threshold.

[0055] Exemplarily, traffic behavior analysis is performed on network traffic data, and candidate traffic detection behaviors may include communication ports, connection duration, communication conditions, data upload and download behaviors, abnormal file transfers, business flows and protocol usage, etc.; accordingly, behavior detection sub-strategies may include communication port detection sub-strategies, continuous duration detection sub-strategies, frequent connection detection sub-strategies, data upload and download detection sub-strategies, traffic rate detection sub-strategies, business flow detection sub-strategies and protocol usage detection sub-strategies.

[0056] For example, the communication port detection sub-strategy: The network security prevention and control system can implement communication port analysis, detect the usage of different communication ports, and detect possible non-standard port usage and port scanning behaviors. Specifically, set corresponding usage ranges for different communication ports to identify abnormal port activities.

[0057] For example, the continuous duration detection sub-strategy: the network security prevention and control system implements connection duration analysis to detect abnormal long connections or short connections. Specifically, the minimum duration threshold and the maximum duration threshold of the connection duration are set to detect abnormal short connections or long connections. The embodiment of the present invention does not impose any restrictions on the size of the minimum duration threshold and the maximum duration threshold, which can be set by technicians based on experience or needs, or repeatedly determined through a large number of experiments.

[0058] For example, the frequent connection detection sub-strategy: the network security prevention and control system implements communication situation analysis, including continuous connection, intermittent connection and frequent connection. Specifically, a frequent connection number threshold is set to detect possible scanning or detection behavior. The embodiment of the present invention does not impose any limitation on the size of the frequent connection number threshold, which can be set by technicians based on experience or needs, or repeatedly determined through a large number of experiments.

[0059] For example, the data upload and download detection sub-strategy: the network security prevention and control system implements data upload and download behavior analysis, including the amount and frequency of data uploaded or downloaded and the type of data. Specifically, the data upload frequency threshold, the data download frequency threshold, the data upload quantity threshold and the data download quantity threshold are set to detect abnormal data transmission behavior. The embodiment of the present invention does not impose any restrictions on the size of the data upload frequency threshold, the data download frequency threshold, the data upload quantity threshold and the data download quantity threshold, which can be set by technicians based on experience or needs, or repeatedly determined through a large number of experiments. Specifically, a data packet quantity threshold is defined to detect abnormal data packet frequencies. The embodiment of the present invention does not impose any restrictions on the size of the quantity threshold, which can be set by technicians based on experience or needs, or repeatedly determined through a large number of experiments.

[0060] For example, the traffic rate detection sub-strategy: the network security prevention and control system implements abnormal file transfer analysis, including file security detection, transmission frequency, and transmission object. Specifically, an incoming traffic rate threshold and an outgoing traffic rate threshold are set to identify abnormal high traffic conditions. The embodiment of the present invention does not impose any restrictions on the size of the incoming traffic rate threshold and the outgoing traffic rate threshold, which can be set by technicians based on experience or needs, or repeatedly determined through a large number of experiments.

[0061] For example, the business flow detection sub-strategy: the network security prevention and control system implements business flow analysis, combines related data packets into business flows according to the business chain, and analyzes the behavior and characteristics of the business flows.

[0062] For example, the protocol usage detection sub-strategy: the network security prevention and control system implements protocol usage analysis, including the protocols and communication methods used; the system monitors whether there is abnormal use of non-standard protocols, or users frequently switch communication methods. Specifically, according to the protocol type, set the scope of protocol compliance use and detect abnormal protocol usage behavior.

[0063] S140. According to the traffic dimension analysis result, a corresponding target abnormal traffic type is matched from preset candidate abnormal traffic types, and according to the target abnormal traffic type, a target traffic interception strategy is selected from preset candidate traffic interception strategies.

[0064] The candidate abnormal traffic type refers to a type of abnormal traffic that is preset, and the target abnormal traffic type refers to a candidate abnormal traffic type that matches the traffic of the data packet to be processed.

[0065] The candidate traffic interception strategy refers to a pre-set strategy for intercepting abnormal traffic. For example, the candidate traffic interception strategy may include DdoS (Distributed Denial of Service Attack) attack interception, port sniffing interception, abnormal protocol interception, file transfer interception, frequent connection interception, and remote command interception. The target traffic interception strategy refers to a candidate traffic interception strategy that can be used to intercept the traffic of the data packet to be processed.

[0066] For example, if the target abnormal traffic type is a sudden increase in traffic or a high-frequency connection request, the network security prevention and control system uses DDoS attack interception to automatically match and intercept malicious DDoS traffic.

[0067] For example, if the target abnormal traffic type is a wide range of port connections with the same source address, the network security prevention and control system uses port sniffing interception to automatically match and intercept port sniffing traffic.

[0068] For example, if the target abnormal traffic type is an unsafe protocol or a non-business protocol, the network security prevention and control system uses abnormal protocol interception to automatically match and intercept abnormal protocol traffic.

[0069] For example, if the target abnormal traffic type is file transfer size, file type or security label, the network security prevention and control system uses file transfer interception to automatically match and intercept file transfer traffic.

[0070] For example, if the target abnormal traffic type is the address connection frequency, the network security prevention and control system uses frequent connection interception to automatically match and intercept frequent connection traffic.

[0071] For example, if the target abnormal traffic type is a high-risk command or an illegal command, the network security prevention and control system uses remote command interception to automatically match and intercept remote command traffic.

[0072] Specifically, if there are abnormal results in the traffic dimension analysis results, the data packet traffic to be processed is determined to be abnormal traffic; according to the abnormal results in the traffic dimension, the corresponding target abnormal traffic type is matched from the preset candidate abnormal traffic types, and according to the target abnormal traffic type, the target traffic interception strategy is selected from the preset candidate traffic interception strategies. Among them, the abnormal results in the traffic dimension refer to the abnormal traffic results obtained when the candidate traffic detection behavior of a certain dimension is detected on the network traffic data. Abnormal traffic refers to network traffic with problems or faults. Compared with malicious traffic, abnormal traffic is not subjectively aggressive.

[0073] S150: Perform security control on the data packet traffic to be processed according to the target traffic interception strategy.

[0074] The embodiment of the present invention provides a network security prevention and control solution based on a power grid master station, which obtains network traffic information of the data packet traffic to be processed from each key node device in the power grid master station system to be processed, and processes the network traffic information to obtain network traffic data; performs feature matching on the network traffic data with preset malicious traffic features, and determines whether the data packet traffic to be processed is malicious traffic based on the matching results; if not, analyzes the network traffic data based on a preset behavior detection strategy to obtain a traffic dimension analysis result; wherein the preset behavior detection strategy includes candidate traffic detection behaviors of different dimensions, and behavior detection sub-strategies corresponding to the candidate traffic detection behaviors; based on the traffic dimension analysis result, matches the corresponding target abnormal traffic type from the preset candidate abnormal traffic type, and selects the target traffic interception strategy from the preset candidate traffic interception strategy based on the target abnormal traffic type; and performs security prevention and control on the data packet traffic to be processed based on the target traffic interception strategy. The above scheme, through the collected network traffic information, sequentially determines whether the data packet traffic to be processed is malicious traffic or abnormal traffic. When the data packet traffic to be processed is abnormal traffic, the corresponding target traffic interception strategy is determined to intercept the data packet traffic to be processed, thereby realizing active anomaly detection of network traffic, identifying malicious traffic and abnormal traffic, and executing rapid response measures for malicious traffic and abnormal traffic, thereby effectively and actively defending against invading suspicious traffic and improving the reliability of network security prevention and control of the power grid master station system.

[0075] On the basis of the above technical solution, the process of the network security prevention and control method based on the power grid master station can also be displayed based on a preset display method. Exemplarily, the preset display method may include charts, graphs, and heat maps. Specifically, the data involved in the process of the network security prevention and control method based on the power grid master station is visualized in the form of charts, graphs, or heat maps, and the analysis results and detection result information of modules such as network traffic analysis, traffic behavior analysis, signature detection, and anomaly detection are centrally displayed to determine traffic trends, anomalies, etc.

[0076] Embodiment 2

[0077] Figure 2 This is a flow chart of a network security prevention and control method based on a power grid master station provided in the second embodiment of the present invention. Based on the above embodiments, this embodiment further refines the operation of "matching network traffic data with preset malicious traffic features, and judging whether the data packet traffic to be processed is malicious traffic based on the matching results" into "determining the candidate feature similarity between the network traffic data and each candidate malicious traffic feature; judging whether the data packet traffic to be processed is malicious traffic based on the similarity of each candidate feature and the preset similarity threshold" to improve the judgment mechanism of malicious traffic. It should be noted that for the part not described in detail in the embodiment of the present invention, please refer to the description of other embodiments.

[0078] See also Figure 2 The network security prevention and control method based on the power grid master station shown includes:

[0079] S210, obtaining network flow information of the data packet flow to be processed from each key node device in the power grid master station system to be processed, and processing the network flow information to obtain network flow data.

[0080] S220: Determine the candidate feature similarity between the network traffic data and each candidate malicious traffic feature.

[0081] The candidate malicious traffic feature refers to a pre-set malicious traffic feature. The candidate feature similarity can be used to quantify the similarity between the traffic feature in the network traffic data and the candidate malicious traffic feature.

[0082] Specifically, determine the candidate feature similarities between the traffic features in the network traffic data and each candidate malicious traffic feature.

[0083] S230: Determine whether the data packet flow to be processed is malicious flow based on the similarity of each candidate feature and a preset similarity threshold.

[0084] The embodiment of the present invention does not impose any limitation on the size of the preset similarity threshold, which can be set by a technician based on experience or needs, or determined repeatedly through a large number of experiments.

[0085] In an optional embodiment, whether the data packet traffic to be processed is malicious traffic is determined based on the similarity of each candidate feature and a preset similarity threshold, including: if there is any candidate feature similarity greater than or equal to the preset similarity threshold, the data packet traffic to be processed is determined to be malicious traffic; if the similarities of each candidate feature are less than the preset similarity threshold, it is prohibited to treat the data packet traffic to be processed as malicious traffic.

[0086] It can be understood that by comparing the candidate feature similarity with the preset similarity threshold to determine whether the data packet flow data to be processed is malicious flow, the accuracy of determining whether the data packet flow to be processed is malicious flow is improved.

[0087] In an optional embodiment, the method also includes: if the data packet traffic to be processed is malicious traffic, then taking the candidate feature similarity with the maximum value as the target feature similarity; taking the candidate malicious traffic type corresponding to the target feature similarity as the target malicious traffic type, and according to the target malicious traffic type, determining the corresponding target traffic blocking strategy from the preset candidate traffic blocking strategies.

[0088] The target feature similarity refers to the candidate feature similarity of the maximum value. The candidate malicious traffic type refers to the type of malicious traffic set in advance. The target malicious traffic type refers to the type of malicious traffic for the data packet traffic to be processed.

[0089] The candidate traffic blocking strategy refers to a pre-set strategy for blocking the traffic of data packets to be processed. Exemplarily, the candidate traffic blocking strategy may include a traffic filtering strategy, an IP (Internet Protocol) blocking strategy, and an attacked device isolation strategy.

[0090] For example, traffic filtering strategy refers to filtering malicious traffic according to predefined filtering rules. The content of filtering rules includes protocol, port, IP address and disposal method. Disposal methods include release and discard. Among them, those that do not meet (do not match) the content of the rules need to be filtered.

[0091] For example, IP blocking strategy refers to the dynamic blocking and unblocking of IP addresses, as well as corresponding blocking strategies for different types of attacks. Access control policies and IP blacklists are configured to restrict communications and prevent further malicious behavior.

[0092] For example, the attacked device isolation strategy refers to isolating the affected devices, such as the system itself, network devices, etc., according to predefined isolation rules; isolation methods include disconnecting the attacker and closing the network port of the attacked device to prevent the spread of the attack. The attacked device isolation strategy includes automatic response actions and strategies for intrusion events, as well as the execution and monitoring of isolation measures.

[0093] Furthermore, the data packet traffic to be processed is blocked according to the target traffic blocking strategy.

[0094] In an optional embodiment, the method also includes: determining the to-be-processed file corresponding to the to-be-processed data packet traffic based on network traffic information; determining the candidate file signature corresponding to the to-be-processed file based on a preset signature algorithm; matching the candidate file signature with a reference malicious signature in a malicious signature database; if the match is successful, determining that the to-be-processed data packet traffic is malicious traffic, and blocking the to-be-processed data packet traffic according to the candidate traffic blocking strategy.

[0095] The to-be-processed file refers to a transmission file restored based on the to-be-processed data packet flow. The embodiment of the present invention does not impose any limitation on the preset signature algorithm, which can be set by a technician based on experience or needs. Exemplarily, the preset signature algorithm may include multiple hash algorithms such as MD5 (Message Digest Algorithm 5) and SHA-256.

[0096] It should be noted that the calculation methods are divided into manual and automatic input. Manual input includes data packets, files to be processed and codes, etc.; automatic input realizes the input of files to be processed restored based on network traffic information.

[0097] The candidate file signature refers to the file signature corresponding to the file to be processed, which can be used to verify the integrity and source of the file.

[0098] The malicious signature database refers to a pre-set database for storing file signatures corresponding to malicious traffic. The embodiment of the present invention does not impose any limitation on the malicious signature database, which can be set by technicians according to experience or needs.

[0099] The reference malicious signature refers to a file signature corresponding to malicious traffic stored in a malicious signature database.

[0100] For example, a malicious signature database is built into the network security prevention and control system to store known malicious files, hash values ​​of malicious codes, and signatures of other malicious features, i.e., reference malicious signatures. Malicious signature database management includes update, deletion, impact overview, and impact details, etc. Unmatched malicious signatures can be updated to the malicious signature database.

[0101] Exemplarily, if the signature matches successfully, the malicious behavior, attack characteristics or capabilities of malicious files present in the data packet traffic to be processed are determined.

[0102] It can be understood that by restoring the file to be processed based on the network traffic information, matching is performed between the candidate file signature of the file to be processed and the reference malicious signature in the malicious signature database. When the match is successful, the candidate traffic blocking strategy is used to block the data packet traffic to be processed, thereby improving the accuracy of malicious traffic judgment on the data packet traffic to be processed.

[0103] It should be noted that in the embodiment of the present invention, whether the data packet traffic to be processed is malicious traffic is determined based on the candidate feature similarity and the candidate file signature. These two methods can be used in parallel, sequentially, or selectively, and the embodiment of the present invention does not make any specific limitation on this.

[0104] S240: If not, the network traffic data is analyzed according to a preset behavior detection strategy to obtain a traffic dimension analysis result.

[0105] The preset behavior detection strategy includes candidate traffic detection behaviors in different dimensions and behavior detection sub-strategies corresponding to the candidate traffic detection behaviors.

[0106] S250. According to the flow dimension analysis result, the corresponding target abnormal flow type is matched from the preset candidate abnormal flow types, and according to the target abnormal flow type, the target flow interception strategy is selected from the preset candidate flow interception strategies.

[0107] S260: Perform security control on the data packet traffic to be processed according to the target traffic interception strategy.

[0108] The embodiment of the present invention provides a network security prevention and control scheme based on the power grid master station, which performs feature matching between the network flow data and the preset malicious flow features, and judges whether the data packet flow to be processed is a malicious flow operation according to the matching results, which is refined into determining the candidate feature similarity between the network flow data and each candidate malicious flow feature; judging whether the data packet flow to be processed is malicious flow according to the similarity of each candidate feature and the preset similarity threshold, thereby improving the judgment mechanism of malicious flow. The above scheme determines whether the data packet flow to be processed is malicious flow by introducing the candidate feature similarity and the preset similarity threshold, thereby improving the accuracy of the determination result; at the same time, the embodiment of the present invention adopts corresponding strategies for different levels of data packet flow to be processed for security prevention and control, that is, adopts a flow blocking strategy to block malicious flow, and adopts a flow interception strategy to intercept abnormal flow, thereby realizing dynamic adjustment of the prevention and control strategy, preventing and controlling the flow on the power grid master station side, and improving the accuracy of network security prevention and control.

[0109] Embodiment 3

[0110] Figure 3 This is a schematic diagram of the structure of a network security prevention and control device based on a power grid master station provided in Embodiment 3 of the present invention. This embodiment is applicable to the situation where security prevention and control is performed on the network of the power grid master station. The method can be executed by a network security prevention and control device based on the power grid master station. The device can be implemented in software and / or hardware, and can be configured in an electronic device that carries the network security prevention and control function based on the power grid master station.

[0111] like Figure 3 As shown, the device includes: a flow data determination module 310, a malicious flow determination module 320, a dimension result determination module 330, an interception strategy determination module 340 and a security control module 350. Among them,

[0112] The flow data determination module 310 is used to obtain network flow information of the data packet flow to be processed from each key node device in the power grid master station system to be processed, and process the network flow information to obtain network flow data;

[0113] The malicious traffic determination module 320 is used to perform feature matching on the network traffic data and preset malicious traffic features, and determine whether the traffic of the data packet to be processed is malicious traffic according to the matching result;

[0114] The dimension result determination module 330 is used to analyze the network traffic data according to a preset behavior detection strategy to obtain a traffic dimension analysis result if no; wherein the preset behavior detection strategy includes candidate traffic detection behaviors of different dimensions and behavior detection sub-strategies corresponding to the candidate traffic detection behaviors;

[0115] The interception strategy determination module 340 is used to match the corresponding target abnormal traffic type from the preset candidate abnormal traffic types according to the traffic dimension analysis result, and select the target traffic interception strategy from the preset candidate traffic interception strategies according to the target abnormal traffic type;

[0116] The security control module 350 is used to perform security control on the data packet traffic to be processed according to the target traffic interception strategy.

[0117] The embodiment of the present invention provides a network security prevention and control solution based on a power grid master station, which obtains network traffic information of the data packet traffic to be processed from each key node device in the power grid master station system to be processed, and processes the network traffic information to obtain network traffic data; performs feature matching on the network traffic data with preset malicious traffic features, and determines whether the data packet traffic to be processed is malicious traffic based on the matching results; if not, analyzes the network traffic data based on a preset behavior detection strategy to obtain a traffic dimension analysis result; wherein the preset behavior detection strategy includes candidate traffic detection behaviors of different dimensions, and behavior detection sub-strategies corresponding to the candidate traffic detection behaviors; based on the traffic dimension analysis result, matches the corresponding target abnormal traffic type from the preset candidate abnormal traffic type, and selects the target traffic interception strategy from the preset candidate traffic interception strategy based on the target abnormal traffic type; and performs security prevention and control on the data packet traffic to be processed based on the target traffic interception strategy. The above scheme, through the collected network traffic information, sequentially determines whether the data packet traffic to be processed is malicious traffic or abnormal traffic. When the data packet traffic to be processed is abnormal traffic, the corresponding target traffic interception strategy is determined to intercept the data packet traffic to be processed, thereby realizing active anomaly detection of network traffic, identifying malicious traffic and abnormal traffic, and executing rapid response measures for malicious traffic and abnormal traffic, thereby effectively and actively defending against invading suspicious traffic and improving the reliability of network security prevention and control of the power grid master station system.

[0118] Optionally, if the preset malicious traffic feature includes candidate malicious traffic features corresponding to a plurality of different candidate malicious traffic types, the malicious traffic determination module 320 includes:

[0119] A feature similarity determination unit, used to determine the candidate feature similarities between the network traffic data and each of the candidate malicious traffic features;

[0120] The malicious traffic determination unit is used to determine whether the data packet traffic to be processed is malicious traffic based on the similarity of each candidate feature and a preset similarity threshold.

[0121] Optionally, a malicious traffic determination unit is specifically configured to:

[0122] If there is any candidate feature whose similarity is greater than or equal to the preset similarity threshold, the data packet traffic to be processed is determined to be malicious traffic;

[0123] If the similarities of the candidate features are all less than the preset similarity threshold, it is prohibited to regard the data packet traffic to be processed as malicious traffic.

[0124] Optionally, the device further comprises:

[0125] A target feature similarity determination module, configured to use the maximum candidate feature similarity as the target feature similarity if the to-be-processed data packet traffic is malicious traffic;

[0126] The target traffic blocking strategy determination module is used to take the candidate malicious traffic type corresponding to the target feature similarity as the target malicious traffic type, and determine the corresponding target traffic blocking strategy from the preset candidate traffic blocking strategies according to the target malicious traffic type.

[0127] Optionally, the device further comprises:

[0128] A to-be-processed file determining unit, configured to determine, according to the network flow information, a to-be-processed file corresponding to the to-be-processed data packet flow;

[0129] A candidate file signature determining unit, used to determine the candidate file signature corresponding to the to-be-processed file based on a preset signature algorithm;

[0130] A signature matching unit, configured to match the candidate file signature with a reference malicious signature in a malicious signature database;

[0131] The traffic blocking unit is used to determine that the data packet traffic to be processed is malicious traffic if the match is successful, and to block the data packet traffic to be processed according to the candidate traffic blocking strategy.

[0132] Optionally, if the behavior detection sub-strategy includes an anomaly detection threshold, the anomaly detection threshold is determined and updated based on the following means:

[0133] A data acquisition module is used to obtain historical network traffic characteristics and historical traffic behavior data of each key node device in the master station system of the power grid to be processed when the network is operating normally;

[0134] A baseline model building module, used to build a network baseline model based on a preset model building algorithm and according to the historical network traffic characteristics and the historical traffic behavior data;

[0135] A threshold determination module, used to determine an anomaly detection threshold according to the network baseline model;

[0136] The threshold updating module is used to update the anomaly detection threshold based on a preset threshold updating method.

[0137] The network security prevention and control device based on the power grid master station provided in the embodiment of the present invention can execute the network security prevention and control method based on the power grid master station provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing each network security prevention and control method based on the power grid master station.

[0138] In the technical solution of the present invention, the collection, storage, use, processing, transmission, provision and disclosure of the network traffic information, preset malicious traffic characteristics and preset behavior detection strategies involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0139] Embodiment 4

[0140] Figure 4 It is a structural diagram of an electronic device for implementing a network security prevention and control method based on a power grid master station provided by Embodiment 4 of the present invention. Electronic device 410 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0141] like Figure 4 As shown, the electronic device 410 includes at least one processor 411, and a memory connected to the at least one processor 411 in communication, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 411 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 412 or the computer program loaded from the storage unit 418 to the random access memory (RAM) 413. In the RAM 413, various programs and data required for the operation of the electronic device 410 can also be stored. The processor 411, the ROM 412, and the RAM 413 are connected to each other via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0142] Multiple components in the electronic device 410 are connected to the I / O interface 415, including: an input unit 416, such as a keyboard, a mouse, etc.; an output unit 417, such as various types of displays, speakers, etc.; a storage unit 418, such as a disk, an optical disk, etc.; and a communication unit 419, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 419 allows the electronic device 410 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0143] The processor 411 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 411 executes the various methods and processes described above, such as a network security prevention and control method based on a power grid master station.

[0144] In some embodiments, the network security prevention and control method based on the power grid master station can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 418. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 410 via the ROM 412 and / or the communication unit 419. When the computer program is loaded into the RAM 413 and executed by the processor 411, one or more steps of the network security prevention and control method based on the power grid master station described above can be performed. Alternatively, in other embodiments, the processor 411 can be configured to execute the network security prevention and control method based on the power grid master station in any other appropriate manner (for example, by means of firmware).

[0145] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0146] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0147] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0148] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0149] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0150] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0151] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0152] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A network security prevention and control method based on a power grid master station, characterized in that: include: Acquire network traffic information of data packet traffic to be processed from each key node device in the master station system of the power grid to be processed, and process the network traffic information to obtain network traffic data; Perform feature matching on the network traffic data and preset malicious traffic features, and determine whether the data packet traffic to be processed is malicious traffic based on the matching result; If not, the network traffic data is analyzed according to a preset behavior detection strategy to obtain a traffic dimension analysis result; wherein the preset behavior detection strategy includes candidate traffic detection behaviors of different dimensions and behavior detection sub-strategies corresponding to the candidate traffic detection behaviors; According to the traffic dimension analysis result, matching the corresponding target abnormal traffic type from the preset candidate abnormal traffic types, and selecting the target traffic interception strategy from the preset candidate traffic interception strategies according to the target abnormal traffic type; According to the target traffic interception strategy, security control is performed on the data packet traffic to be processed.

2. The method according to claim 1, characterized in that If the preset malicious traffic feature includes candidate malicious traffic features corresponding to a plurality of different candidate malicious traffic types, the network traffic data is feature matched with the preset malicious traffic feature, and according to the matching result, whether the to-be-processed data packet traffic is malicious traffic includes: Determine the candidate feature similarity between the network traffic data and each of the candidate malicious traffic features; According to the similarity of each of the candidate features and a preset similarity threshold, it is determined whether the data packet flow to be processed is malicious flow.

3. The method according to claim 2, characterized in that The step of judging whether the data packet flow to be processed is malicious flow according to the similarity of each candidate feature and a preset similarity threshold comprises: If there is any candidate feature whose similarity is greater than or equal to the preset similarity threshold, the data packet traffic to be processed is determined to be malicious traffic; If the similarities of the candidate features are all less than the preset similarity threshold, it is prohibited to regard the data packet traffic to be processed as malicious traffic.

4. The method according to claim 3, characterized in that The method further comprises: If the data packet traffic to be processed is malicious traffic, the candidate feature similarity of the maximum value is used as the target feature similarity; The candidate malicious traffic type corresponding to the target feature similarity is used as the target malicious traffic type, and according to the target malicious traffic type, a corresponding target traffic blocking strategy is determined from preset candidate traffic blocking strategies.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: Determine, according to the network traffic information, the file to be processed corresponding to the traffic of the data packet to be processed; Based on a preset signature algorithm, determine a candidate file signature corresponding to the file to be processed; Matching the candidate file signature with a reference malicious signature in a malicious signature database; If the match is successful, the data packet traffic to be processed is determined to be malicious traffic, and the data packet traffic to be processed is blocked according to the candidate traffic blocking strategy.

6. The method according to any one of claims 1 to 4, characterized in that If the behavior detection sub-strategy includes an anomaly detection threshold, the anomaly detection threshold is determined and updated based on the following method: Obtaining historical network traffic characteristics and historical traffic behavior data of each key node device in the master station system of the power grid to be processed when the network is operating normally; Based on a preset model building algorithm, a network baseline model is built according to the historical network traffic characteristics and the historical traffic behavior data; Determining an anomaly detection threshold based on the network baseline model; Based on a preset threshold updating method, the anomaly detection threshold is updated.

7. A network security prevention and control device based on a power grid master station, characterized in that: include: A flow data determination module is used to obtain network flow information of the data packet flow to be processed from each key node device in the power grid master station system to be processed, and process the network flow information to obtain network flow data; A malicious traffic determination module is used to perform feature matching on the network traffic data and preset malicious traffic features, and determine whether the to-be-processed data packet traffic is malicious traffic based on the matching result; A dimension result determination module is used to analyze the network traffic data according to a preset behavior detection strategy to obtain a traffic dimension analysis result if no; wherein the preset behavior detection strategy includes candidate traffic detection behaviors of different dimensions and behavior detection sub-strategies corresponding to the candidate traffic detection behaviors; An interception strategy determination module is used to match the corresponding target abnormal traffic type from the preset candidate abnormal traffic types according to the traffic dimension analysis result, and select the target traffic interception strategy from the preset candidate traffic interception strategies according to the target abnormal traffic type; The security control module is used to perform security control on the data packet traffic to be processed according to the target traffic interception strategy.

8. The device according to claim 7, characterized in that If the preset malicious traffic feature includes candidate malicious traffic features corresponding to a plurality of different candidate malicious traffic types, the malicious traffic determination module includes: A feature similarity determination unit, used to determine the candidate feature similarities between the network traffic data and each of the candidate malicious traffic features; The malicious traffic determination unit is used to determine whether the data packet traffic to be processed is malicious traffic based on the similarity of each candidate feature and a preset similarity threshold.

9. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement a network security prevention and control method based on a power grid master station as described in any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, a network security prevention and control method based on a power grid master station as described in any one of claims 1 to 6 is implemented.

Images