Risk behavior identification method and device for power grid asset data

Abstract

The invention discloses a risk behavior identification method and device for power grid asset data, relates to the technical field of communication, and mainly aims to solve the problem that risk behavior identification cannot be performed on the power grid asset data in the prior art. Comprising the following steps: acquiring alarm information obtained by alarming power grid asset data by a digital substation industrial control system, and constructing a topological network of the digital substation industrial control system; determining an asset influence score based on the asset association degree of each power grid asset data in the topology network, and determining risk asset data according to the asset influence score, the asset influence score being used for representing a condition of generating a risk influence on power grid assets; and identifying the alarm information and the risk asset data, and determining the risk behavior of the power grid asset data.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method and device for identifying risk behaviors of power grid asset data. Background Art

[0002] With the continuous development of computer technology, information technology, big data, artificial intelligence and industrial automation, information technology has been widely used in the field of industrial control, making traditional industrial control systems more and more open, which has brought new challenges to the relatively closed substation industrial control system in traditional industries. At present, the digital substation industrial control system is an important energy operating system. Once the asset data in the system, such as IP addresses, system files, power operation data, etc., are damaged, it will cause vulnerabilities and security configuration anomalies in the digital substation industrial control system. Therefore, in order to ensure the safe operation of the digital substation industrial control system, a risk behavior identification method for power grid asset data is urgently needed to solve the above problems. Summary of the invention

[0003] In view of this, the present invention provides a method and device for identifying risk behaviors of power grid asset data, the main purpose of which is to solve the problem that risk behaviors of power grid asset data cannot be identified in the prior art.

[0004] According to one aspect of the present invention, a method for identifying risk behaviors of power grid asset data is provided, comprising:

[0005] Acquire alarm information obtained by the digital substation industrial control system for power grid asset data, and construct a topological network of the digital substation industrial control system;

[0006] Determine an asset influence score based on the asset correlation of each of the power grid asset data in the topological network, and determine risk asset data according to the asset influence score, wherein the asset influence score is used to characterize the situation of risk impact on power grid assets;

[0007] The warning information and the risky asset data are identified, and risky behavior of the power grid asset data is determined.

[0008] Further, the determining of the asset influence score based on the asset correlation of each of the power grid asset data in the topological network includes:

[0009] Querying adjacent asset nodes based on the network structure in the topological network, and calculating the asset relevance of each of the power grid asset data based on the asset nodes and the alarm information feature vector of the alarm information;

[0010] The asset threat coefficient and the probability of dangerousness transfer pre-configured in the digital substation industrial control system are obtained, and an iterative solution is performed based on the asset threat coefficient, the probability of dangerousness transfer, and the asset correlation to obtain an asset influence score.

[0011] Furthermore, determining risk asset data according to the asset influence score includes:

[0012] If the difference between the current asset influence score and the previous asset influence score is less than the preset influence threshold in the iterative solution process, all the asset influence scores are sorted;

[0013] The influence scores of the sorted target assets are determined based on a preset number threshold, and the risky asset data are screened out from the power grid asset data based on the target asset influence scores.

[0014] Furthermore, the method further comprises:

[0015] Determine the number of adjacent nodes in the topological network, and obtain the alarm frequency and alarm quantity of each of the power grid asset data;

[0016] The alarm information is converted based on the number of adjacent nodes, the alarm frequency, and the alarm number to obtain an alarm information feature vector.

[0017] Furthermore, the construction of the topological network of the digital substation industrial control system includes:

[0018] A weighted undirected network is defined, and the power grid asset data is configured in the weighted undirected network to obtain a topological network, wherein each asset node in the topological network has a communicable edge, and one asset node corresponds to one power grid asset data.

[0019] Furthermore, before constructing the topological network of the digital substation industrial control system, the method further includes:

[0020] The alarm information is de-redundanted based on the alarm time threshold, alarm classification and alarm identification of the digital substation industrial control system to obtain the alarm information to be converted.

[0021] Further, the identifying the alarm information and the risky asset data and determining the risk behavior of the power grid asset data includes:

[0022] An alarm object matching the risk asset data is searched from the alarm information, and the risk behavior of the power grid asset data is matched based on the alarm object.

[0023] According to another aspect of the present invention, a risk behavior identification device for power grid asset data is provided, comprising:

[0024] An acquisition module is used to acquire alarm information obtained by the digital substation industrial control system for alarming power grid asset data, and to construct a topological network of the digital substation industrial control system;

[0025] A determination module, configured to determine an asset influence score based on the asset correlation of each of the power grid asset data in the topological network, and determine risk asset data according to the asset influence score, wherein the asset influence score is used to characterize the situation of risk impact on power grid assets;

[0026] An identification module is used to identify the alarm information and the risky asset data, and determine the risk behavior of the power grid asset data.

[0027] Furthermore, the determination module is specifically used to query adjacent asset nodes based on the network structure in the topological network, and calculate the asset correlation of each power grid asset data based on the asset node and the alarm information feature vector of the alarm information; obtain the asset threat coefficient and the danger transfer probability pre-configured in the digital substation industrial control system, and iteratively solve based on the asset threat coefficient, the danger transfer probability, and the asset correlation to obtain the asset influence score.

[0028] Furthermore, the determination module is specifically used to sort all the asset influence scores if the difference between the current asset influence score and the previous asset influence score is less than a preset influence threshold during the iterative solution process; determine the sorted target asset influence score based on a preset number threshold, and filter out risky asset data from the power grid asset data based on the target asset influence score.

[0029] Furthermore, the device further comprises: a conversion module,

[0030] The determination module is further used to determine the number of adjacent nodes in the topological network, and obtain the alarm frequency and alarm quantity of each of the power grid asset data;

[0031] The conversion module is used to convert the alarm information based on the number of adjacent nodes, the alarm frequency, and the alarm number to obtain an alarm information feature vector.

[0032] Furthermore, the acquisition module is specifically used to define a weighted undirected network, and configure the power grid asset data in the weighted undirected network to obtain a topological network, wherein each asset node in the topological network has a communicative edge, and one asset node corresponds to one power grid asset data.

[0033] Furthermore, the device also includes:

[0034] The processing module is used to perform redundancy removal processing on the alarm information based on the alarm time threshold, alarm classification and alarm identification of the digital substation industrial control system to obtain the alarm information to be converted.

[0035] Furthermore, the identification module is specifically used to search for an alarm object matching the risk asset data from the alarm information, and match the risk behavior of the power grid asset data based on the alarm object.

[0036] According to another aspect of the present invention, a storage medium is provided, wherein at least one executable instruction is stored in the storage medium, and the executable instruction enables a processor to execute operations corresponding to the above-mentioned risk behavior identification method for power grid asset data.

[0037] According to another aspect of the present invention, there is provided a terminal, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0038] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute operations corresponding to the above-mentioned risk behavior identification method for power grid asset data.

[0039] By means of the above technical solution, the technical solution provided by the embodiment of the present invention has at least the following advantages:

[0040] The present invention provides a method and device for identifying risk behaviors of power grid asset data. Compared with the prior art, the embodiment of the present invention obtains alarm information obtained by a digital substation industrial control system for alarming power grid asset data, and constructs a topological network of the digital substation industrial control system; determines an asset influence score based on the asset correlation of each power grid asset data in the topological network, and determines risk asset data according to the asset influence score, wherein the asset influence score is used to characterize situations in which risk impacts are generated on power grid assets; identifies the alarm information and the risk asset data, determines the risk behavior of the power grid asset data, realizes effective identification of power grid assets, ensures the safe operation of the power grid system using asset data, and thus meets the needs for identifying the danger of power grid resource data.

[0041] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0043] Figure 1 A flow chart of a method for identifying risk behavior of power grid asset data provided by an embodiment of the present invention is shown;

[0044] Figure 2 A block diagram showing the composition of a risk behavior identification device for power grid asset data provided by an embodiment of the present invention is shown;

[0045] Figure 3 A schematic diagram of the structure of a terminal provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0046] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0047] The embodiment of the present invention provides a method for identifying risk behavior of power grid asset data, such as Figure 1 As shown, the method includes:

[0048] 101. Acquire alarm information obtained by the digital substation industrial control system for alarming power grid asset data, and construct a topological network of the digital substation industrial control system.

[0049] In the embodiment of the present invention, the current execution subject can be a processing server of the digital substation industrial control system, or a cloud server, wherein the digital substation industrial control system can generate a variety of power grid asset data when performing overall control operations on different power grid terminals, including but not limited to power grid power consumption, power grid power users, power grid transaction orders, power grid data processing results, IP addresses, etc., which are not specifically limited in the embodiment of the present invention. At the same time, the digital substation industrial control system will perform alarm judgment on the power grid asset data and obtain alarm information, that is, the alarm information can be based on the content obtained by performing alarm judgment on the power grid asset data in data such as routers, system logs, server logs, application logs, databases, firewalls, and vulnerability libraries, which are not specifically limited in the embodiment of the present invention. For example, the alarm information includes the alarm information identifier alm_id, the alarm time alm_time, the alarm event name alm_name, the alarm level alm_level, the attack target IP address attack_target, the attack source IP address attack_src, the attack repetition count Repeat_count, and the attacked entity name entity_name. Suppose the number of assets in the digital substation industrial control system is N, and the alarm information set of the i-th asset is Alarm i , 1,2,...,N, can be expressed as:

[0050] Alarm i ={alm_id i , alm_time i ,alm_name i ,attack_target i ,attack_src i};

[0051] Among them, alm_id i is the alarm information identifier of the i-th asset, alm_time i is the alarm time of the i-th asset, alm_name i is the name of the alarm event for the i-th asset, attack_target i is the attack target IP address of the i-th asset, attack_src i is the attack source IP address of the i-th asset.

[0052] In another embodiment of the present invention, for further definition and explanation, the steps of constructing the topological network of the digital substation industrial control system include:

[0053] A right-authorized undirected network is defined, and the power grid asset data is configured in the right-authorized undirected network to obtain a topological network.

[0054] In order to use the topological network to calculate the correlation of power grid asset data, so as to achieve the goal of locating high-risk asset behavior, the current execution end defines a weighted undirected network, that is, each asset node in the topological network is a communicative edge, and one asset node corresponds to one power grid asset data. Among them, the communicative edge between each asset node can be pre-configured with a corresponding weight value, and can be configured based on the sameness between power grid assets, and the power grid asset data is configured in each asset node in the weighted undirected network to obtain a topological network, which is not specifically limited in the embodiment of the present invention. For example, the digital substation industrial control system network is defined as a weighted undirected network, and the digital substation industrial control system network is defined as a network topology graph G = (V, E) containing N nodes and M edges, where V = {v1, v2, ..., v N} represents the set of asset nodes, one asset corresponds to one node, and E represents the set of communicable edges between asset nodes.

[0055] 102. Determine an asset influence score based on the asset correlation of each of the power grid asset data in the topological network, and determine risk asset data according to the asset influence score.

[0056] In the embodiment of the present invention, since the topological network contains multiple asset nodes, in order to effectively determine the risk asset data, the current execution end determines the asset influence score based on the asset correlation of each power grid asset data in the topological network, and then based on the asset correlation. At this time, the asset influence score is used to characterize the situation of risk impact on power grid assets. Furthermore, after the current execution end determines the asset influence score, it queries the risk asset data that generates risks for the digital substation industrial control system.

[0057] In another embodiment of the present invention, for further definition and explanation, the step of determining the asset influence score based on the asset association of each of the power grid asset data in the topological network includes:

[0058] Querying adjacent asset nodes based on the network structure in the topological network, and calculating the asset relevance of each of the power grid asset data based on the asset nodes and the alarm information feature vector of the alarm information;

[0059] The asset threat coefficient and the probability of dangerousness transfer pre-configured in the digital substation industrial control system are obtained, and an iterative solution is performed based on the asset threat coefficient, the probability of dangerousness transfer, and the asset correlation to obtain an asset influence score.

[0060] In order to identify high-risk power grid resource data, when the current execution end determines the asset influence score, it first queries the adjacent asset nodes based on the network structure in the topological network, and then calculates the asset correlation based on the correlation reconciliation parameters of the resource nodes and the power grid asset data stored in the resource nodes combined with the alarm information characteristics to obtain the asset correlation. Among them, the correlation degree w between adjacent assets i and j in the topological network G is i,j The calculation formula is: Among them, α∈(0,1) is the correlation harmonization parameter, which can be adjusted according to the situation of the industrial control system. By default, α=0.5. are the warning information feature vectors of the i-th asset and the j-th asset respectively, is the cosine similarity of the alarm data of the i-th asset and the j-th asset, is the Euclidean distance between the i-th asset and the j-th asset, and the calculation formula is and in, is the kth element of the alarm information feature vector of the ith asset and the jth asset, k = 1, 2, 3, 4.

[0061] In another embodiment of the present invention, for further definition and explanation, the step of determining risk asset data according to the asset influence score includes:

[0062] If the difference between the current asset influence score and the previous asset influence score is less than the preset influence threshold in the iterative solution process, all the asset influence scores are sorted;

[0063] The influence scores of the sorted target assets are determined based on a preset number threshold, and the risky asset data are screened out from the power grid asset data based on the target asset influence scores.

[0064] In order to determine the risk asset data using the asset influence score, and thus determine the risk behavior of the power grid asset data based on the risk asset data, specifically, first initialize an initial asset influence score and perform an iterative solution. Among them, the initial asset influence score of the i-th asset is The calculation formula is: m=1. Among them, w i,j is the correlation between adjacent assets i and j, ρ is the asset threat value of the digital substation industrial control system. Different asset threat values ​​are assigned according to the different high-risk levels of asset vulnerabilities. The specific values ​​are:

[0065]

[0066] It should be noted that the probability P of high-risk transfer from the i-th asset to the j-th asset is calculated i,j for:

[0067] Among them, it is assumed that the high-risk transfer probability P from the i-th asset to the x-th asset i,x Maximum, x∈{1,2,...N},x≠i, at this time, the high-risk transfer probability is calculated randomly on the topological network G of the digital substation industrial control system, starting with the i-th asset, and iterating m times to obtain the resource influence score of the x-th asset for:

[0068] in, The resource influence score of the i-th asset obtained after iterative calculation m-1 times. In each iteration, the asset jumps to a random asset with a probability of 1-q, and transfers along the high-risk path from the i-th asset to the x-th asset in the topological network G with a probability of q. When the q value is large, the algorithm efficiency is high. q can be adjusted according to the specific situation. By default, q = 0.9. In a specific implementation scenario, a preset influence threshold δ is set. When the resource influence score of the x-th asset After converging to the difference between the two times being less than the threshold δ, the final target asset influence score is output That is to satisfy: in, and After iterating m-1 times and m times respectively, the resource influence score of the x-th asset is obtained. δ can be adjusted according to the specific situation. By default, δ=0.00001. x=1, 2, 3...N are sorted, and the asset data of the first 10% in the sequence are output as risk asset data, which is not specifically limited in the embodiment of the present invention.

[0069] In another embodiment of the present invention, for further definition and description, the steps further include:

[0070] Determine the number of adjacent nodes in the topological network, and obtain the alarm frequency and alarm quantity of each of the power grid asset data;

[0071] The alarm information is converted based on the number of adjacent nodes, the alarm frequency, and the alarm number to obtain an alarm information feature vector.

[0072] In order to use alarm information as the identification purpose of risk assets, thereby improving the accuracy of risk behavior identification of power grid asset data, the current execution end first determines the number of adjacent nodes in the topological network, and at the same time, counts the alarm frequency and number of alarms of each power grid asset data, and then converts the alarm information based on the number of adjacent nodes, alarm frequency, and alarm number to obtain the alarm information feature vector. For example, the alarm information feature vector of the i-th asset is It is expressed as:

[0073]

[0074] in, is the alarm duration of the ith asset, is the number of serious alarms for the ith asset, is the number of adjacent nodes of the ith asset, is the risk level of the ith asset, indicating the frequency of the asset appearing in the warning information. The calculation formula is expressed as:

[0075]

[0076] in, is the number of assets included in all warning messages, V num The total number of all alarm messages.

[0077] In another embodiment of the present invention, for further definition and explanation, before the step of constructing the topological network of the digital substation industrial control system, the method further includes:

[0078] The alarm information is de-redundanted based on the alarm time threshold, alarm classification and alarm identification of the digital substation industrial control system to obtain the alarm information to be converted.

[0079] In order to avoid redundant information in the alarm information, the current execution end performs redundant processing on the alarm information and deletes the duplicate alarm information. Therefore, the current execution end performs redundant processing on the alarm information based on the alarm time threshold, alarm classification and alarm identification of the digital substation industrial control system to obtain the alarm information to be converted. Among them, since the duplicate alarm information generally exists within a very small time threshold t min Within, remove the alarm information interval less than the time threshold t min and have the same alarm event name alm_name, attack source IP address attack_src, and attack target IP address attack_target, if the asset alarm time interval satisfies |alm_time i -alm_time j | <t min , it means the alarm information is repeated, where the time threshold t min By default, it is 15 seconds, which can be adjusted according to the actual situation. i -alm_time j| represents the alarm time interval between the i-th asset and the j-th asset, i=1,2,...,N,j=1,2,...,N,i≠j.

[0080] 103. Identify the alarm information and the risky asset data, and determine the risky behavior of the power grid asset data.

[0081] In the embodiment of the present invention, after the risk asset data is determined, in order to achieve the purpose of targeted identification of behavior, the risk behavior is determined in combination with the alarm information and sent to the front end for output and display to the user.

[0082] In another embodiment of the present invention, for further definition and explanation, the step of identifying the alarm information and the risk asset data, and determining the risk behavior of the power grid asset data includes:

[0083] An alarm object matching the risk asset data is searched from the alarm information, and the risk behavior of the power grid asset data is matched based on the alarm object.

[0084] In order to identify behaviors with high risks in power grid asset data, the current execution end, when identifying alarm information and risk asset data to determine risk behaviors, specifically, first queries the alarm object that matches the risk asset data from the alarm information. For example, the alarm information is an IP address alarm, and the risk asset data is a web page IP. At this time, the IP access address is determined as the alarm object. Furthermore, based on this alarm object, the risk behavior matched to the power grid asset data is the access behavior. At this time, the current execution end can match based on the pre-created query list, which records the correspondence between different alarm objects and different risk behaviors, so as to quickly and conveniently query the risk behavior that matches the alarm object.

[0085] An embodiment of the present invention provides a method for identifying risk behaviors of power grid asset data. Compared with the prior art, the embodiment of the present invention obtains alarm information obtained by a digital substation industrial control system for alarming power grid asset data, and constructs a topological network of the digital substation industrial control system; determines an asset influence score based on the asset correlation of each of the power grid asset data in the topological network, and determines risk asset data according to the asset influence score, wherein the asset influence score is used to characterize situations in which risk impacts are generated on power grid assets; identifies the alarm information and the risk asset data, determines the risk behaviors of the power grid asset data, realizes effective identification of power grid assets, ensures the safe operation of the power grid system using asset data, and thus meets the needs for identifying the dangers of power grid resource data.

[0086] Furthermore, as a response to the above Figure 1The implementation of the method shown in the figure, the embodiment of the present invention provides a risk behavior identification device for power grid asset data, such as Figure 2 As shown, the device comprises:

[0087] The acquisition module 21 is used to obtain the alarm information obtained by the digital substation industrial control system for the power grid asset data, and to construct a topological network of the digital substation industrial control system;

[0088] A determination module 22, configured to determine an asset influence score based on the asset correlation of each of the power grid asset data in the topological network, and determine risk asset data according to the asset influence score, wherein the asset influence score is used to characterize the situation of risk impact on power grid assets;

[0089] The identification module 23 is used to identify the alarm information and the risky asset data, and determine the risk behavior of the power grid asset data.

[0090] Furthermore, the determination module is specifically used to query adjacent asset nodes based on the network structure in the topological network, and calculate the asset correlation of each power grid asset data based on the asset node and the alarm information feature vector of the alarm information; obtain the asset threat coefficient and the danger transfer probability pre-configured in the digital substation industrial control system, and iteratively solve based on the asset threat coefficient, the danger transfer probability, and the asset correlation to obtain the asset influence score.

[0091] Furthermore, the determination module is specifically used to sort all the asset influence scores if the difference between the current asset influence score and the previous asset influence score is less than a preset influence threshold during the iterative solution process; determine the sorted target asset influence score based on a preset number threshold, and filter out risky asset data from the power grid asset data based on the target asset influence score.

[0092] Furthermore, the device further comprises: a conversion module,

[0093] The determination module is further used to determine the number of adjacent nodes in the topological network, and obtain the alarm frequency and alarm quantity of each of the power grid asset data;

[0094] The conversion module is used to convert the alarm information based on the number of adjacent nodes, the alarm frequency, and the alarm number to obtain an alarm information feature vector.

[0095] Furthermore, the acquisition module is specifically used to define a weighted undirected network, and configure the power grid asset data in the weighted undirected network to obtain a topological network, wherein each asset node in the topological network has a communicative edge, and one asset node corresponds to one power grid asset data.

[0096] Furthermore, the device also includes:

[0097] The processing module is used to perform redundancy removal processing on the alarm information based on the alarm time threshold, alarm classification and alarm identification of the digital substation industrial control system to obtain the alarm information to be converted.

[0098] Furthermore, the identification module is specifically used to search for an alarm object matching the risk asset data from the alarm information, and match the risk behavior of the power grid asset data based on the alarm object.

[0099] An embodiment of the present invention provides a device for identifying risk behavior of power grid asset data. Compared with the prior art, the embodiment of the present invention obtains alarm information obtained by a digital substation industrial control system for alarming power grid asset data, and constructs a topological network of the digital substation industrial control system; determines an asset influence score based on the asset correlation of each power grid asset data in the topological network, and determines risk asset data according to the asset influence score, wherein the asset influence score is used to characterize the situation of risk impact on power grid assets; identifies the alarm information and the risk asset data, determines the risk behavior of the power grid asset data, realizes effective identification of power grid assets, ensures the safe operation of the power grid system using asset data, and thus meets the demand for identifying the danger of power grid resource data.

[0100] According to an embodiment of the present invention, a storage medium is provided, wherein the storage medium stores at least one executable instruction, and the computer executable instruction can execute the risk behavior identification method of power grid asset data in any of the above method embodiments.

[0101] Figure 3 A schematic diagram of the structure of a terminal provided according to an embodiment of the present invention is shown. The specific embodiment of the present invention does not limit the specific implementation of the terminal.

[0102] like Figure 3 As shown, the terminal may include: a processor (processor) 302, a communication interface (Communications Interface) 304, a memory (memory) 306, and a communication bus 308.

[0103] The processor 302 , the communication interface 304 , and the memory 306 communicate with each other via the communication bus 308 .

[0104] The communication interface 304 is used to communicate with other devices such as clients or other servers.

[0105] The processor 302 is used to execute the program 310, and specifically can execute the relevant steps in the above-mentioned embodiment of the risk behavior identification method for power grid asset data.

[0106] Specifically, the program 310 may include program codes, which include computer operation instructions.

[0107] The processor 302 may be a central processing unit (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiment of the present invention. The one or more processors included in the terminal may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0108] The memory 306 is used to store the program 310. The memory 306 may include a high-speed RAM memory, and may also include a non-volatile memory, such as at least one disk memory.

[0109] The program 310 may be specifically configured to enable the processor 302 to perform the following operations:

[0110] Acquire alarm information obtained by the digital substation industrial control system for power grid asset data, and construct a topological network of the digital substation industrial control system;

[0111] Determine an asset influence score based on the asset correlation of each of the power grid asset data in the topological network, and determine risk asset data according to the asset influence score, wherein the asset influence score is used to characterize the situation of risk impact on power grid assets;

[0112] The warning information and the risky asset data are identified, and risky behavior of the power grid asset data is determined.

[0113] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0114] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for identifying risk behavior of power grid asset data, characterized in that: include: Acquire alarm information obtained by the digital substation industrial control system for power grid asset data, and construct a topological network of the digital substation industrial control system; Determine an asset influence score based on the asset correlation of each of the power grid asset data in the topological network, and determine risk asset data according to the asset influence score, wherein the asset influence score is used to characterize the situation of risk impact on power grid assets; The warning information and the risky asset data are identified, and risky behavior of the power grid asset data is determined.

2. The method according to claim 1, characterized in that: Determining the asset influence score based on the asset association of each of the power grid asset data in the topological network includes: Querying adjacent asset nodes based on the network structure in the topological network, and calculating the asset relevance of each of the power grid asset data based on the asset nodes and the alarm information feature vector of the alarm information; The asset threat coefficient and the probability of dangerousness transfer pre-configured in the digital substation industrial control system are obtained, and an iterative solution is performed based on the asset threat coefficient, the probability of dangerousness transfer, and the asset correlation to obtain an asset influence score.

3. The method according to claim 2, characterized in that Determining risk asset data according to the asset influence score includes: If the difference between the current asset influence score and the previous asset influence score is less than the preset influence threshold in the iterative solution process, all the asset influence scores are sorted; The influence scores of the sorted target assets are determined based on a preset number threshold, and the risky asset data are screened out from the power grid asset data based on the target asset influence scores.

4. The method according to claim 2, characterized in that: The method further comprises: Determine the number of adjacent nodes in the topological network, and obtain the alarm frequency and alarm quantity of each of the power grid asset data; The alarm information is converted based on the number of adjacent nodes, the alarm frequency, and the alarm number to obtain an alarm information feature vector.

5. The method according to claim 1, characterized in that The topological network of the digital substation industrial control system is constructed as follows: A weighted undirected network is defined, and the power grid asset data is configured in the weighted undirected network to obtain a topological network, wherein each asset node in the topological network has a communicable edge, and one asset node corresponds to one power grid asset data.

6. The method according to claim 1, characterized in that Before constructing the topological network of the digital substation industrial control system, the method further includes: The alarm information is de-redundanted based on the alarm time threshold, alarm classification and alarm identification of the digital substation industrial control system to obtain the alarm information to be converted.

7. The method according to any one of claims 1 to 6, characterized in that: The identifying the alarm information and the risky asset data and determining the risk behavior of the power grid asset data includes: An alarm object matching the risk asset data is searched from the alarm information, and the risk behavior of the power grid asset data is matched based on the alarm object.

8. A risk behavior identification device for power grid asset data, characterized in that: include: An acquisition module is used to acquire alarm information obtained by the digital substation industrial control system for alarming power grid asset data, and to construct a topological network of the digital substation industrial control system; A determination module, configured to determine an asset influence score based on the asset correlation of each of the power grid asset data in the topological network, and determine risk asset data according to the asset influence score, wherein the asset influence score is used to characterize the situation of risk impact on power grid assets; An identification module is used to identify the alarm information and the risky asset data, and determine the risk behavior of the power grid asset data.

9. A storage medium storing at least one executable instruction, wherein the executable instruction enables a processor to execute operations corresponding to the risk behavior identification method for power grid asset data according to any one of claims 1 to 7.

10. A terminal, comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the risk behavior identification method for power grid asset data according to any one of claims 1-7.

Images