Power grid terminal network security protection method and device, terminal equipment and storage medium

Abstract

The invention discloses a power grid terminal network security protection method and apparatus, a terminal device and a storage medium. The method comprises the steps of obtaining a security event log of a to-be-protected power grid; the security event log comprises terminal operation state data, a network flow log, a firewall log and historical attack event data; performing feature extraction on the security event log to obtain a terminal security log feature corresponding to the security event log; inputting the terminal security log feature into a preset network threat identification model for different-dimension analysis and identification to obtain a network security threat; determining a corresponding network security protection strategy according to the network security threat, the historical attack event data and a preset threat level table; and executing the network security protection strategy on a to-be-protected power grid according to the network security protection strategy. According to the invention, the accuracy of power grid security threat identification is improved, and the high security requirement of power grid terminal equipment is met.

Description

Technical Field

[0001] The present invention relates to the field of power grid security defense technology, and in particular to a power grid terminal network security protection method, device, terminal equipment and storage medium. Background Art

[0002] With the continuous development and popularization of smart grid systems, power grid terminal devices, as an important part of smart grids, are widely distributed, diverse, and highly networked, making the power grid system face increasingly serious network security threats. These terminal devices are not only directly related to the operating efficiency and stability of the power grid, but also carry a large amount of sensitive information and key data. Once they are attacked by the network, they will have a serious impact on the safe and stable operation of the power system.

[0003] Existing security monitoring systems only rely on single-dimensional data for threat identification, such as identifying power grid terminal security threats based on network traffic or log analysis. This single-dimensional data monitoring method is difficult to capture the full picture of power grid network attacks, resulting in inaccurate identification of security threats and unable to meet the high security requirements of power grid terminal equipment. Summary of the invention

[0004] The embodiments of the present invention provide a power grid terminal network security protection method, device, terminal equipment and storage medium, which can effectively solve the problem that the single-dimensional data monitoring method of the prior art is difficult to capture the full picture of power grid network attacks, resulting in inaccurate identification of security threats and unable to meet the high security requirements of power grid terminal equipment.

[0005] An embodiment of the present invention provides a power grid terminal network security protection method, including:

[0006] Obtaining a security event log of the power grid to be protected; the security event log includes: terminal operation status data, network traffic log, firewall log and historical attack event data;

[0007] Extract features from the security event log to obtain terminal security log features corresponding to the security event log;

[0008] Input the terminal security log features into a preset network threat identification model for analysis and identification in different dimensions to obtain network security threats;

[0009] Determine a corresponding network security protection strategy according to the network security threat, the historical attack event data, and a preset threat level table;

[0010] According to the network security protection strategy, the network security protection strategy is executed on the power grid to be protected.

[0011] Further, feature extraction is performed on the security event log to obtain terminal security log features corresponding to the security event log, including:

[0012] Analyze the communication frequency between each power grid terminal according to the terminal operation status data to obtain terminal operation status data characteristics;

[0013] Calculate the communication volume between each power grid terminal and the total communication volume of each power grid terminal according to the network traffic log and the preset time window;

[0014] According to the communication volume between each power grid terminal and the total communication volume, the network traffic log characteristics are obtained;

[0015] Performing index quantification processing according to the firewall log to obtain firewall log features;

[0016] Analyze historical attack paths and attack tools according to the historical attack event data to obtain historical attack event characteristics;

[0017] According to the terminal operation status data characteristics, the network traffic log characteristics, the firewall log characteristics and the historical attack event characteristics, the terminal security log characteristics corresponding to the security event log are obtained.

[0018] Furthermore, it also includes:

[0019] Obtain historical protection decision variables corresponding to historical attack event data;

[0020] Calculate variances according to the terminal operation status data features, network traffic log features, firewall log features, and historical attack event features to obtain a first variance, a second variance, a third variance, and a fourth variance;

[0021] Compare the first variance, the second variance, the third variance and the fourth variance with a preset first threshold, a preset second threshold, a preset third threshold and a preset fourth threshold respectively;

[0022] The terminal operation status data feature whose first variance is greater than the preset first threshold is used as the target terminal operation status data feature; the network traffic log feature whose second variance is greater than the preset second threshold is used as the target network traffic log feature; the firewall log feature whose third variance is greater than the preset third threshold is used as the target firewall log feature; and the historical attack event feature whose fourth variance is greater than the preset fourth threshold is used as the target historical attack event feature;

[0023] Calculate the correlation between the target terminal operation status data characteristics, the target network traffic log characteristics, the target firewall log characteristics and the target historical attack event characteristics and the historical protection decision variable to obtain a first correlation coefficient, a second correlation coefficient, a third correlation coefficient and a fourth correlation coefficient;

[0024] The target terminal operation status data characteristics, target network traffic log characteristics, target firewall log characteristics and target historical attack event characteristics whose first correlation coefficient, second correlation coefficient, third correlation coefficient and fourth correlation coefficient are greater than the preset correlation threshold are used as the final terminal security log characteristics.

[0025] Furthermore, the terminal security log features are input into a preset network threat identification model for analysis and identification in different dimensions to obtain network security threats, including:

[0026] Perform sliding prediction based on the terminal security log feature and a preset sliding window to obtain a predicted feature value of each terminal security log feature;

[0027] Calculate the residual according to the predicted feature value and the terminal security log feature to obtain a target residual;

[0028] The target residual and the preset residual threshold are compared, and the terminal security log feature whose target residual is greater than the preset residual threshold is regarded as a time dimension threat;

[0029] According to the communication volume between each power grid terminal, a power grid terminal association graph is constructed with the power grid terminal as a node, the communication relationship corresponding to the power grid terminal as an edge, and the communication frequency as an edge weight;

[0030] Perform cluster analysis based on the power grid terminal association graph to obtain spatial dimension threats;

[0031] Determining the state transition probability of each power grid terminal according to the terminal security log characteristics;

[0032] Predicting the future behavior of the terminal according to the state transition probability and the preset terminal device behavior model to obtain device-related dimension threats;

[0033] A network security threat is obtained according to the time dimension threat, the space dimension threat and the device association dimension threat.

[0034] Furthermore, cluster analysis is performed based on the power grid terminal association graph to obtain spatial dimension threats, including:

[0035] Calculating a terminal association matrix of the power grid to be protected according to the power grid terminal association diagram;

[0036] Constructing a power grid Laplace matrix according to the terminal association matrix and the preset degree matrix;

[0037] According to the power grid Laplace matrix, corresponding eigenvalues ​​and eigenvectors are calculated;

[0038] Clustering is performed according to the eigenvalues ​​and the eigenvectors to divide the power grid terminals into a number of terminal groups;

[0039] Anomalies are identified based on the terminal operation status data corresponding to each terminal group to obtain spatial dimension threats.

[0040] Further, the preset threat level table includes threat scores, threat levels, and network security protection strategies;

[0041] Determine a corresponding network security protection strategy based on the network security threat, the historical attack event data, and a preset threat level table, including:

[0042] Calculate the similarity of each historical attack event data according to the historical attack event data to obtain a similarity value;

[0043] Calculate based on the network security threat, the similarity value and a preset weight coefficient to obtain a comprehensive threat score;

[0044] Determining a corresponding threat level according to the comprehensive threat score and a preset threat level table;

[0045] According to the threat level and the preset threat level table, a corresponding network security protection strategy is determined.

[0046] Further, according to the network security protection strategy, executing the network security protection strategy on the power grid to be protected includes:

[0047] Encapsulating the network security protection strategy to generate a strategy instruction; wherein the strategy instruction includes a target power grid terminal identifier;

[0048] Encrypting according to the policy instruction and a preset symmetric key to obtain an encrypted policy data packet;

[0049] Transmitting the encrypted policy data packet to the target power grid terminal corresponding to the target power grid terminal identifier, so that the target power grid terminal decrypts it according to the preset symmetric key to obtain the decrypted security protection policy;

[0050] According to the decrypted security protection strategy, corresponding protection operations are performed on the protected power grid.

[0051] As an improvement of the above solution, another embodiment of the present invention provides a power grid terminal network security protection device, including:

[0052] A power grid data acquisition module is used to acquire security event logs of the power grid to be protected; the security event logs include: terminal operation status data, network traffic logs, firewall logs, and historical attack event data;

[0053] A feature extraction module is used to extract features from the security event log to obtain terminal security log features corresponding to the security event log;

[0054] A network threat identification module is used to input the terminal security log features into a preset network threat identification model for analysis and identification in different dimensions to obtain network security threats;

[0055] A protection strategy determination module, used to determine a corresponding network security protection strategy according to the network security threat, the historical attack event data and a preset threat level table;

[0056] The protection strategy execution module is used to execute the network security protection strategy on the power grid to be protected according to the network security protection strategy.

[0057] Another embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, a power grid terminal network security protection method as described in the above embodiment is implemented.

[0058] Another embodiment of the present invention provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute a power grid terminal network security protection method described in the above embodiment.

[0059] By implementing the present invention, at least the following beneficial effects are achieved:

[0060] The present invention provides a method, device, terminal equipment and storage medium for protecting the network security of power grid terminals. The method can obtain the security event log of the power grid to be protected; the security event log includes: terminal operation status data, network traffic log, firewall log and historical attack event data; feature extraction is performed on the security event log to obtain the terminal security log feature corresponding to the security event log; the terminal security log feature is input into a preset network threat identification model for different dimensional analysis and identification to obtain network security threats; according to the network security threats, the historical attack event data and the preset threat level table, the corresponding network security protection strategy is determined; according to the network security protection strategy, the network security protection strategy is executed on the power grid to be protected. By collecting the terminal operation status data, network traffic log, firewall log and historical attack event data, it is not only dependent on single dimensional data for threat identification, but also integrates multiple dimensional data for network security identification, comprehensively captures the overall picture of power grid network attacks, and then extracts the corresponding terminal security log feature for network threat identification, improves the accuracy of security threat identification, and implements different security protection strategies according to the identified network security threats, effectively reduces the risk of network attacks on power grid terminals, and meets the high security requirements of power grid terminal equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 It is a flowchart of a method for protecting power grid terminal network security provided by one embodiment of the present invention;

[0062] Figure 2 It is a structural schematic diagram of a power grid terminal network security protection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0063] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] See also Figure 1 , is a flow chart of a method for protecting power grid terminal network security provided by an embodiment of the present invention, including:

[0065] S1. Obtain the security event log of the power grid to be protected; the security event log includes: terminal operation status data, network traffic log, firewall log and historical attack event data;

[0066] Specifically, the security event log includes security logs collected from power grid terminal devices and network traffic monitoring systems of the power grid to be protected. The security event log includes: terminal operation status data, network traffic logs, firewall logs and historical attack event data.

[0067] S2. Extract features from the security event log to obtain terminal security log features corresponding to the security event log;

[0068] Specifically, feature extraction is performed on the security event log to obtain terminal security log features corresponding to the security event log, including:

[0069] Analyze the communication frequency between each power grid terminal according to the terminal operation status data to obtain terminal operation status data characteristics;

[0070] Calculate the communication volume between each power grid terminal and the total communication volume of each power grid terminal according to the network traffic log and the preset time window;

[0071] According to the communication volume between each power grid terminal and the total communication volume, the network traffic log characteristics are obtained;

[0072] Performing index quantification processing according to the firewall log to obtain firewall log features;

[0073] Analyze historical attack paths and attack tools according to the historical attack event data to obtain historical attack event characteristics;

[0074] According to the terminal operation status data characteristics, the network traffic log characteristics, the firewall log characteristics and the historical attack event characteristics, the terminal security log characteristics corresponding to the security event log are obtained.

[0075] Preferably, the terminal operation status data is time series data, and the communication frequency between each power grid terminal is analyzed according to the terminal operation status data to obtain terminal operation status data characteristics, such as the communication frequency between terminal devices. The network traffic log is also time series data, and the communication volume between each power grid terminal and the total communication volume of each power grid terminal are calculated according to the network traffic log and the preset time window, for example, Where X i is the i-th network traffic log data point within the preset time window; F t represents the aggregated features within the time window t; n represents the number of network traffic log data points within the time window; then, the network traffic log features are obtained based on the communication volume between each power grid terminal and the total communication volume. Where C ij Represents the network traffic log characteristics between power grid terminal device i and power grid terminal device j; TXij Represents the communication volume between power grid terminal device i and power grid terminal device j; ZTX i Represents the total amount of communication between the power grid terminal device i and all power grid terminal devices. According to the firewall log, the indicator is quantified to obtain the firewall log characteristics, such as the number of connection attempts, connection success rate, data packet flow, protocol distribution and port usage, etc. According to the historical attack event data, the historical attack path and attack tools are analyzed to obtain the historical attack event characteristics. The historical attack event data is subjected to pattern analysis to extract the typical attack path and the attack tool usage frequency characteristics to obtain the historical attack event characteristics. Finally, according to the terminal operation status data characteristics, the network traffic log characteristics, the firewall log characteristics and the historical attack event characteristics, the terminal security log characteristics corresponding to the security event log are obtained. Based on the comprehensive analysis of multi-dimensional data, more accurate and comprehensive information support can be provided for power grid dispatching and operation to achieve intelligent decision-making.

[0076] S3, inputting the terminal security log features into a preset network threat identification model for analysis and identification in different dimensions to obtain network security threats;

[0077] Preferably, it also includes:

[0078] Obtain historical protection decision variables corresponding to historical attack event data;

[0079] Calculate variances according to the terminal operation status data features, network traffic log features, firewall log features, and historical attack event features to obtain a first variance, a second variance, a third variance, and a fourth variance;

[0080] Compare the first variance, the second variance, the third variance and the fourth variance with a preset first threshold, a preset second threshold, a preset third threshold and a preset fourth threshold respectively;

[0081] The terminal operation status data feature whose first variance is greater than the preset first threshold is used as the target terminal operation status data feature; the network traffic log feature whose second variance is greater than the preset second threshold is used as the target network traffic log feature; the firewall log feature whose third variance is greater than the preset third threshold is used as the target firewall log feature; and the historical attack event feature whose fourth variance is greater than the preset fourth threshold is used as the target historical attack event feature;

[0082] Calculate the correlation between the target terminal operation status data characteristics, the target network traffic log characteristics, the target firewall log characteristics and the target historical attack event characteristics and the historical protection decision variable to obtain a first correlation coefficient, a second correlation coefficient, a third correlation coefficient and a fourth correlation coefficient;

[0083] The target terminal operation status data characteristics, target network traffic log characteristics, target firewall log characteristics and target historical attack event characteristics whose first correlation coefficient, second correlation coefficient, third correlation coefficient and fourth correlation coefficient are greater than the preset correlation threshold are used as the final terminal security log characteristics.

[0084] Specifically, the variances are calculated according to the terminal operation status data characteristics, network traffic log characteristics, firewall log characteristics, and historical attack event characteristics to obtain a first variance, a second variance, a third variance, and a fourth variance Var(X). Where Var(X) represents the variance of feature X; X i represents the i-th data point in the corresponding data or log; μ is the mean of feature X; n represents the total number of samples in the corresponding data or log. Then the first variance, the second variance, the third variance and the fourth variance are compared with the preset first threshold, the preset second threshold, the preset third threshold and the preset fourth threshold respectively; the terminal operation status data feature whose first variance is greater than the preset first threshold is used as the target terminal operation status data feature; the network traffic log feature whose second variance is greater than the preset second threshold is used as the target network traffic log feature; the firewall log feature whose third variance is greater than the preset third threshold is used as the target firewall log feature; and the historical attack event feature whose fourth variance is greater than the preset fourth threshold is used as the target historical attack event feature.

[0085] The historical protection decision variable represents the decision variable of the network security protection of the corresponding power grid terminal. For example, whether an attack event (such as DDoS attack, intrusion, etc.) has occurred is a binary classification problem, and the target variable can be "attack" or "non-attack". Whether security protection measures have been taken is also a binary variable. According to the target terminal operation status data characteristics, target network traffic log characteristics, target firewall log characteristics, and target historical attack event characteristics, the correlation is calculated with the historical protection decision variable to obtain the first correlation coefficient, the second correlation coefficient, the third correlation coefficient, and the fourth correlation coefficient. Where ρ X,Y represents the correlation coefficient between feature X and historical protection decision variable Y; σ X and σ Yare the standard deviations of X and Y respectively; Cov(X,Y) represents the covariance of X and Y. The variance selection method selects features with variances greater than a preset threshold as target features. This is a preliminary feature screening step, which aims to remove features with too small variances, because features with too small variances usually lack sufficient discrimination and contribute less to the model. The correlation selection method further screens the target features and selects those features that are highly correlated with the historical preservation decision variables. This is to ensure that the features used in the final network threat identification model have a strong correlation with the historical preservation decision variables, thereby improving the model's recognition ability.

[0086] Preferably, the terminal security log features are input into a preset network threat identification model for analysis and identification in different dimensions to obtain network security threats, including:

[0087] Perform sliding prediction based on the terminal security log feature and a preset sliding window to obtain a predicted feature value of each terminal security log feature;

[0088] Calculate the residual according to the predicted feature value and the terminal security log feature to obtain a target residual;

[0089] The target residual and the preset residual threshold are compared, and the terminal security log feature whose target residual is greater than the preset residual threshold is regarded as a time dimension threat;

[0090] According to the communication volume between each power grid terminal, a power grid terminal association graph is constructed with the power grid terminal as a node, the communication relationship corresponding to the power grid terminal as an edge, and the communication frequency as an edge weight;

[0091] Perform cluster analysis based on the power grid terminal association graph to obtain spatial dimension threats;

[0092] Determining the state transition probability of each power grid terminal according to the terminal security log characteristics;

[0093] Predicting the future behavior of the terminal according to the state transition probability and the preset terminal device behavior model to obtain device-related dimension threats;

[0094] A network security threat is obtained according to the time dimension threat, the space dimension threat and the device association dimension threat.

[0095] Specifically, a sliding prediction is performed based on the terminal security log features and a preset sliding window, and a time series analysis method based on the sliding window captures the features in the time dimension to obtain a predicted feature value of each terminal security log feature. In a preferred embodiment of the present invention, Where X tis the predicted characteristic value at time t; α represents the constant term; φ i represents the autoregressive coefficient; θ j represents the sliding mean coefficient; ε t represents the white noise term; p and q are the orders of autoregression and moving average respectively; X t-i represents the actual terminal security log feature value at time ti. Then, the residual is calculated based on the predicted feature value and the terminal security log feature to obtain the target residual Indicates the actual terminal security log feature value. The target residual and the preset residual threshold are compared, and the terminal security log feature whose target residual is greater than the preset residual threshold is regarded as a time dimension threat, indicating that the data at this time point is abnormal.

[0096] In a preferred embodiment of the present invention, according to the communication volume between each power grid terminal, a power grid terminal association graph is constructed with the power grid terminal as a node, the communication relationship corresponding to the power grid terminal as an edge, and the communication frequency as an edge weight. In addition, the communication volume can also be used as the edge weight; then a cluster analysis is performed based on the power grid terminal association graph to obtain spatial dimension threats. According to the terminal security log characteristics, the state transition probability of each power grid terminal is determined; the future behavior of the terminal is predicted based on the state transition probability and the preset terminal device behavior model to obtain the device association dimension threat; the preset terminal device behavior model is a Markov chain model, which predicts the future behavior pattern of the terminal device and identifies the phenomenon that deviates from the normal behavior pattern. P(X t+1 =s j |X t =s i )=p ij , where P(X t+1 =s j |X t =s i ) indicates that the terminal device is in state s i Transfer to state s j The probability of ij Represents an element in the state transition probability matrix; the state transition probability matrix is ​​a matrix that describes the probability of a system transitioning from the current state to another state, and is usually used in Markov chain models. In this embodiment, assuming the maximum allowed number of times or probability threshold for the terminal device to transition from one state to another, if the number of state transitions of the power grid terminal device exceeds the probability threshold or a state transition below the probability threshold occurs, it indicates that there is a device-associated dimension threat. Finally, based on the time dimension threat, the space dimension threat, and the device-associated dimension threat, the network security threat is obtained. The network security threat is obtained using a logistic regression model: Where P(y=1|X) represents the probability of identifying a threat under a given feature X; β0 represents the intercept term; β i Represents feature X i The regression coefficient of i The input threat result includes the time dimension threat, the space dimension threat and the device association dimension threat.

[0097] In another preferred embodiment of the present invention, cluster analysis is performed according to the power grid terminal association graph to obtain spatial dimension threats, including:

[0098] Calculating a terminal association matrix of the power grid to be protected according to the power grid terminal association diagram;

[0099] Constructing a power grid Laplace matrix according to the terminal association matrix and the preset degree matrix;

[0100] According to the power grid Laplace matrix, corresponding eigenvalues ​​and eigenvectors are calculated;

[0101] Clustering is performed according to the eigenvalues ​​and the eigenvectors to divide the power grid terminals into a number of terminal groups;

[0102] Anomalies are identified based on the terminal operation status data corresponding to each terminal group to obtain spatial dimension threats.

[0103] Specifically, according to the power grid terminal association diagram, the terminal association matrix of the power grid to be protected is calculated. Assuming that there are N devices, the association relationship between the devices is represented by an N*N matrix A, where the matrix element A ij Indicates the strength of association between device i and device j Where: A ij Indicates the association strength between device i and device j; TX ij Indicates the communication volume between device i and device j; ZTX i Represents the total amount of communication between device i and all devices. Then, based on the terminal association matrix and the preset degree matrix, a power grid Laplace matrix is ​​constructed, L = DA; where L represents the power grid Laplace matrix; D is the preset degree matrix, where D ii =∑ j A ij , where D ii represents the degree of device i, represents the sum of the communication volume directly connected to device i; A is the terminal association matrix. Perform eigenvalue decomposition on the Laplace matrix L of the power grid to obtain the corresponding eigenvalue and corresponding eigenvector: Where λ k represents the kth eigenvalue; V kRepresents the corresponding eigenvector; the eigenvectors corresponding to the first K smallest eigenvalues ​​are used to divide the power grid terminals into K terminal groups based on K-means clustering analysis; after clustering, anomaly identification is performed according to the terminal operation status data corresponding to each terminal group, different device groups are identified, and spatial dimensional threats are obtained, that is, device groups with abnormal device communication behaviors.

[0104] S4. Determine a corresponding network security protection strategy according to the network security threat, the historical attack event data, and a preset threat level table;

[0105] Specifically, the preset threat level table includes threat scores, threat levels, and network security protection strategies. According to the network security threats, the historical attack event data, and the preset threat level table, the corresponding network security protection strategies are determined, including:

[0106] Calculate the similarity of each historical attack event data according to the historical attack event data to obtain a similarity value;

[0107] Calculate based on the network security threat, the similarity value and a preset weight coefficient to obtain a comprehensive threat score;

[0108] Determining a corresponding threat level according to the comprehensive threat score and a preset threat level table;

[0109] According to the threat level and the preset threat level table, a corresponding network security protection strategy is determined.

[0110] In a preferred embodiment of the present invention, the similarity of each historical attack event data is calculated according to the historical attack event data to obtain a similarity value, and then a comprehensive threat score S is obtained according to the network security threat, the similarity value and a preset weight coefficient. w =α1S t +α2S s +α3S r +α4S h Where S w represents the comprehensive threat score; S t Represents the threat score in the time dimension, which is determined based on the threat in the time dimension, for example, the frequency of abnormal activities in a certain period of time; S s represents the threat score in the spatial dimension, which is determined based on the spatial dimension threat, for example, the abnormal communication pattern between devices; S r Represents the threat score on the device-related dimension, which is determined based on the threat of the device-related dimension, for example, the degree to which the device behavior deviates from the normal mode; S hrepresents the similarity value of historical attack event data, for example, the similarity value between the current threat and the known attack mode; α1, α2, α3 and α4 represent the corresponding weight coefficients. According to the comprehensive threat score and the preset threat level table, the corresponding threat level is determined, and according to S w The threat is divided into different levels by the value of S. The following is an example: Low-level threat: 0≤S w <25, the threat score is low, usually general abnormal activities, no emergency treatment is required; medium-level threat: 25≤S w <50, medium threat score, there may be potential security risks, need to be monitored and warned; high-level threat: 50≤S w <75, the threat score is high, indicating a greater risk and the need to take immediate defensive measures; Severe threat: 75≤S w ≤100, the threat score is extremely high, indicating that the system may have been attacked and must be blocked and isolated immediately. Then, according to the threat level and the preset threat level table, the corresponding network security protection strategy is determined. For each threat level, the strategy may include the following aspects: Communication blocking: partially or completely blocking the network communication of the affected device; Traffic restriction: reducing the upper limit of the network traffic of suspicious devices to limit the spread of potential threats; Isolation measures: isolating the threatened device from the network to prevent the spread of threats.

[0111] S5. Execute the network security protection strategy on the power grid to be protected according to the network security protection strategy.

[0112] Specifically, according to the network security protection strategy, executing the network security protection strategy on the power grid to be protected includes:

[0113] Encapsulating the network security protection strategy to generate a strategy instruction; wherein the strategy instruction includes a target power grid terminal identifier;

[0114] Encrypting according to the policy instruction and a preset symmetric key to obtain an encrypted policy data packet;

[0115] Transmitting the encrypted policy data packet to the target power grid terminal corresponding to the target power grid terminal identifier, so that the target power grid terminal decrypts it according to the preset symmetric key to obtain the decrypted security protection policy;

[0116] According to the decrypted security protection strategy, corresponding protection operations are performed on the protected power grid.

[0117] In a preferred embodiment of the present invention, the network security protection strategy is encapsulated to generate a policy instruction; wherein the policy instruction includes the target power grid terminal identifier; and also includes the blocking type (such as port blocking, IP blocking, protocol blocking, etc.) and the blocking condition. Then, encryption is performed according to the policy instruction and a preset symmetric key to obtain an encrypted policy data packet, for example, the policy instruction is encrypted using a symmetric encryption algorithm (such as AES). The encrypted policy data packet is represented as follows: Enc(S) = E K (S); where S represents the network security protection strategy; K is the symmetric key, E K (S) represents the encrypted policy data packet. The encrypted policy data packet is transmitted to the target power grid terminal corresponding to the target power grid terminal identifier, so that the target power grid terminal decrypts it according to the preset symmetric key to obtain the decrypted security protection policy. The encrypted policy data packet is transmitted to the target power grid terminal using a secure transmission protocol (such as TLS). It can be transmitted through an intrusion detection system (IDS), a firewall (Firewall) and a power grid management system. After the encrypted policy data packet arrives at the target power grid terminal, it is decrypted according to the preset symmetric key to obtain the decrypted security protection policy. Dec(S′)=D K (S′); where S′ is the encrypted policy data packet; D K (S′) is the decrypted security protection strategy. According to the decrypted security protection strategy, the corresponding protection operation is performed on the protected power grid. After decryption, the target power grid terminal device performs the corresponding protection operation according to the instruction, such as closing a specific port, discarding a specific IP data packet, or restricting the use of the protocol. The execution model of the protection operation can be expressed as:

[0118]

[0119] Among them, E is the target power grid terminal equipment; P is the protection condition; B(E,P) represents the execution status of the protection operation.

[0120] Schematically, after the protection operation is executed, the power grid network status and terminal device status need to be continuously monitored to evaluate the protection effect and make necessary adjustments. Use network traffic analysis tools and device log monitoring systems to collect network traffic and device activity data in real time. Monitoring indicators include but are not limited to: Network traffic changes: monitor traffic fluctuations within a unit time and calculate the traffic change rate: Where, T [`t_r Indicates the total flow after the protection operation; T \_`or_Indicates the total amount of traffic before the protection operation. Terminal device log analysis: By analyzing the terminal device log, detect whether there are new security events and record the triggering frequency of the protection strategy. Monitor the CPU, memory usage, and operating status of the terminal device to evaluate the impact of the protection operation on the performance of the terminal device. If the terminal device is detected to be abnormal or the performance is degraded, timely feedback and adjustment of the blocking strategy are required. Evaluate the effectiveness of the protection strategy based on real-time monitoring data and optimize it.

[0121] Schematically, the effectiveness of the protection strategy is calculated using the effect evaluation model. The protection effect can be calculated by the following formula: In the formula, E \lo]k Indicates protection effectiveness; N \lo]k_^ Indicates the number of threats that the terminal device has been successfully protected from; N tot[l is the total number of threats. Based on the effect evaluation results, if the protection effect does not meet the expected standards, the protection strategy needs to be optimized. Strategy optimization can be achieved by adjusting model parameters, updating protection conditions, or adding new detection rules. Protection condition update: Dynamically update blocking conditions based on new threat intelligence or monitoring data to adapt to new threat patterns. Or introduce new detection rules or strengthen existing rules to improve the comprehensiveness and accuracy of the strategy. After the blocking strategy is executed, the system will continuously monitor and feedback to form a closed-loop system to ensure continuous optimization of the protection strategy and improve the security protection capabilities of power grid terminal equipment.

[0122] The relevant data of the power grid terminal equipment is collected from multiple sources, and the extracted features are comprehensively analyzed using the preset network threat identification model; the network threat identification model covers the time dimension, space dimension and device association dimension, and can more accurately identify potential network threats by cross-validating and analyzing the data from multiple angles; after identifying the potential network threats, this embodiment classifies the threats and generates corresponding protection strategies according to the severity of the threats; the generated protection strategies are transmitted to the relevant security network equipment or power grid management system in real time for execution; in the process of executing the protection strategy, the network status and equipment status are continuously monitored, and the blocking effect is evaluated in real time. Through feedback analysis of the blocking effect, this embodiment can dynamically adjust and optimize the blocking strategy so that it can maintain high efficiency and effectiveness in the face of ever-changing network threats. Therefore, this embodiment successfully solves the problem that traditional network security methods are difficult to identify and protect complex network attacks across devices and regions in real time, which not only improves the accuracy of network threat identification, but also enhances the execution effect of protection strategies, providing more comprehensive and reliable network security protection for power grid terminal equipment.

[0123] By implementing this embodiment, the security event log of the power grid to be protected is obtained; the security event log includes: terminal operation status data, network traffic log, firewall log and historical attack event data; the security event log is feature extracted to obtain the terminal security log feature corresponding to the security event log; the terminal security log feature is input into the preset network threat identification model for different dimensional analysis and identification to obtain network security threats; according to the network security threats, the historical attack event data and the preset threat level table, the corresponding network security protection strategy is determined; according to the network security protection strategy, the network security protection strategy is executed on the power grid to be protected. By collecting terminal operation status data, network traffic log, firewall log and historical attack event data, it is not only dependent on single dimensional data for threat identification, but also integrates multiple dimensional data for network security identification, comprehensively captures the overall picture of network attacks on the power grid, and then extracts the corresponding terminal security log features for network threat identification, improves the accuracy of security threat identification, and implements different security protection strategies according to the identified network security threats, effectively reduces the risk of network attacks on power grid terminals, and meets the high security requirements of power grid terminal equipment.

[0124] See also Figure 2 , is a schematic diagram of a structure of a power grid terminal network security protection device provided by an embodiment of the present invention, comprising:

[0125] A power grid data acquisition module is used to acquire security event logs of the power grid to be protected; the security event logs include: terminal operation status data, network traffic logs, firewall logs, and historical attack event data;

[0126] A feature extraction module is used to extract features from the security event log to obtain terminal security log features corresponding to the security event log;

[0127] A network threat identification module is used to input the terminal security log features into a preset network threat identification model for analysis and identification in different dimensions to obtain network security threats;

[0128] A protection strategy determination module, used to determine a corresponding network security protection strategy according to the network security threat, the historical attack event data and a preset threat level table;

[0129] The protection strategy execution module is used to execute the network security protection strategy on the power grid to be protected according to the network security protection strategy.

[0130] The present invention provides a network security protection device for power grid terminals. According to a power grid data acquisition module, a security event log of a power grid to be protected is obtained; the security event log includes: terminal operation status data, network traffic log, firewall log and historical attack event data; through a feature extraction module, the security event log is feature extracted to obtain terminal security log features corresponding to the security event log; through a network threat identification module, the terminal security log features are input into a preset network threat identification model for different dimensional analysis and identification to obtain network security threats; in a protection strategy determination module, the corresponding network security protection strategy is determined according to the network security threat, the historical attack event data and a preset threat level table; finally, in a protection strategy execution module, the network security protection strategy is executed on the power grid to be protected according to the network security protection strategy. By collecting terminal operation status data, network traffic log, firewall log and historical attack event data, it is not only dependent on single dimensional data for threat identification, but also integrates multiple dimensional data for network security identification, comprehensively captures the overall picture of power grid network attacks, and then extracts the corresponding terminal security log features for network threat identification, improves the accuracy of security threat identification, and implements different security protection strategies according to the identified network security threats, effectively reduces the risk of power grid terminals being attacked by networks, and meets the high security requirements of power grid terminal equipment.

[0131] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0132] Those skilled in the art can clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0133] Another embodiment of the present invention further provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements a power grid terminal network security protection method as described in the above embodiment when executing the computer program. The terminal device may be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The terminal device may include, but is not limited to, a processor and a memory.

[0134] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the terminal device, and uses various interfaces and lines to connect various parts of the entire terminal device.

[0135] The memory can be used to store the computer program, and the processor realizes various functions of the terminal device by running or executing the computer program stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Med ia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device or other volatile solid-state storage device.

[0136] Another embodiment of the present invention provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute a power grid terminal network security protection method described in the above embodiment.

[0137] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When the computer program is executed by the processor, the steps of each of the above-mentioned method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium.

[0138] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for protecting power grid terminal network security, characterized in that: include: Obtain security event logs of the power grid to be protected; The security event log includes: terminal operation status data, network traffic log, firewall log and historical attack event data; Extract features from the security event log to obtain terminal security log features corresponding to the security event log; Input the terminal security log features into a preset network threat identification model for analysis and identification in different dimensions to obtain network security threats; Determine a corresponding network security protection strategy according to the network security threat, the historical attack event data, and a preset threat level table; According to the network security protection strategy, the network security protection strategy is executed on the power grid to be protected.

2. A method for protecting power grid terminal network security as claimed in claim 1, characterized in that: Extracting features from the security event log to obtain terminal security log features corresponding to the security event log includes: Analyze the communication frequency between each power grid terminal according to the terminal operation status data to obtain terminal operation status data characteristics; Calculate the communication volume between each power grid terminal and the total communication volume of each power grid terminal according to the network traffic log and the preset time window; According to the communication volume between each power grid terminal and the total communication volume, the network traffic log characteristics are obtained; Performing index quantification processing according to the firewall log to obtain firewall log features; Analyze historical attack paths and attack tools according to the historical attack event data to obtain historical attack event characteristics; According to the terminal operation status data characteristics, the network traffic log characteristics, the firewall log characteristics and the historical attack event characteristics, the terminal security log characteristics corresponding to the security event log are obtained.

3. A method for protecting power grid terminal network security as claimed in claim 2, characterized in that: Also includes: Obtain historical protection decision variables corresponding to historical attack event data; Calculate variances according to the terminal operation status data features, network traffic log features, firewall log features, and historical attack event features to obtain a first variance, a second variance, a third variance, and a fourth variance; Compare the first variance, the second variance, the third variance and the fourth variance with a preset first threshold, a preset second threshold, a preset third threshold and a preset fourth threshold respectively; Taking the terminal operation status data feature whose first variance is greater than the preset first threshold as the target terminal operation status data feature; Taking the network traffic log feature whose second variance is greater than a preset second threshold as the target network traffic log feature; Taking the firewall log feature whose third difference is greater than the preset third threshold as the target firewall log feature; and taking the historical attack event feature whose fourth variance is greater than a preset fourth threshold as the target historical attack event feature; Calculate the correlation between the target terminal operation status data characteristics, the target network traffic log characteristics, the target firewall log characteristics and the target historical attack event characteristics and the historical protection decision variable to obtain a first correlation coefficient, a second correlation coefficient, a third correlation coefficient and a fourth correlation coefficient; The target terminal operation status data characteristics, target network traffic log characteristics, target firewall log characteristics and target historical attack event characteristics whose first correlation coefficient, second correlation coefficient, third correlation coefficient and fourth correlation coefficient are greater than the preset correlation threshold are used as the final terminal security log characteristics.

4. A method for protecting power grid terminal network security as claimed in claim 3, characterized in that: The terminal security log features are input into a preset network threat identification model for analysis and identification in different dimensions to obtain network security threats, including: Perform sliding prediction based on the terminal security log feature and a preset sliding window to obtain a predicted feature value of each terminal security log feature; Calculate the residual according to the predicted feature value and the terminal security log feature to obtain a target residual; The target residual and the preset residual threshold are compared, and the terminal security log feature whose target residual is greater than the preset residual threshold is regarded as a time dimension threat; According to the communication volume between each power grid terminal, a power grid terminal association graph is constructed with the power grid terminal as a node, the communication relationship corresponding to the power grid terminal as an edge, and the communication frequency as an edge weight; Perform cluster analysis based on the power grid terminal association graph to obtain spatial dimension threats; Determining the state transition probability of each power grid terminal according to the terminal security log characteristics; Predicting the future behavior of the terminal according to the state transition probability and the preset terminal device behavior model to obtain device-related dimension threats; A network security threat is obtained according to the time dimension threat, the space dimension threat and the device association dimension threat.

5. A method for protecting power grid terminal network security as claimed in claim 4, characterized in that: Cluster analysis is performed based on the power grid terminal association graph to obtain spatial dimension threats, including: Calculating a terminal association matrix of the power grid to be protected according to the power grid terminal association diagram; Constructing a power grid Laplace matrix according to the terminal association matrix and the preset degree matrix; According to the power grid Laplace matrix, corresponding eigenvalues ​​and eigenvectors are calculated; Clustering is performed according to the eigenvalues ​​and the eigenvectors to divide the power grid terminals into a number of terminal groups; Anomalies are identified based on the terminal operation status data corresponding to each terminal group to obtain spatial dimension threats.

6. A method for protecting power grid terminal network security as claimed in claim 5, characterized in that: The preset threat level table includes threat scores, threat levels, and network security protection strategies; Determine a corresponding network security protection strategy based on the network security threat, the historical attack event data, and a preset threat level table, including: Calculate the similarity of each historical attack event data according to the historical attack event data to obtain a similarity value; Calculate based on the network security threat, the similarity value and a preset weight coefficient to obtain a comprehensive threat score; Determining a corresponding threat level according to the comprehensive threat score and a preset threat level table; According to the threat level and the preset threat level table, a corresponding network security protection strategy is determined.

7. A method for protecting power grid terminal network security as claimed in claim 6, characterized in that: According to the network security protection strategy, the network security protection strategy is executed on the power grid to be protected, including: Encapsulating the network security protection strategy to generate a strategy instruction; wherein the strategy instruction includes a target power grid terminal identifier; Encrypting according to the policy instruction and a preset symmetric key to obtain an encrypted policy data packet; Transmitting the encrypted policy data packet to the target power grid terminal corresponding to the target power grid terminal identifier, so that the target power grid terminal decrypts it according to the preset symmetric key to obtain the decrypted security protection policy; According to the decrypted security protection strategy, corresponding protection operations are performed on the protected power grid.

8. A power grid terminal network security protection device, characterized in that: include: A power grid data acquisition module, used to obtain security event logs of the power grid to be protected; The security event log includes: terminal operation status data, network traffic log, firewall log and historical attack event data; A feature extraction module is used to extract features from the security event log to obtain terminal security log features corresponding to the security event log; A network threat identification module is used to input the terminal security log features into a preset network threat identification model for analysis and identification in different dimensions to obtain network security threats; A protection strategy determination module, used to determine a corresponding network security protection strategy according to the network security threat, the historical attack event data and a preset threat level table; The protection strategy execution module is used to execute the network security protection strategy on the power grid to be protected according to the network security protection strategy.

9. A terminal device, characterized in that: The invention comprises a processor, a memory and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, a power grid terminal network security protection method as claimed in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located is controlled to execute a power grid terminal network security protection method as described in any one of claims 1 to 7.

Images