New energy station network security assessment method and system

Abstract

The invention discloses a new energy station network security assessment method and system, and relates to the technical field of new energy stations, and the new energy station network security assessment method comprises the following steps: obtaining network operation feature data; identifying the change trend of the network stability; identifying key security risk factors influencing the network stability; and adjusting the network protection strategy of the new energy station based on the evaluation result. According to the method, the network behavior recognition algorithm is used for carrying out stability analysis on the network operation characteristic data, the stability change trend is recognized, potential unstable behaviors or hidden dangers in the new energy station network can be found in time, the network state change can be pre-judged in advance, sufficient time and basis are provided for risk control, and the risk control efficiency is improved. According to the method, the key security risk causing network instability is accurately identified, generalization or fuzzy risk assessment is avoided, a basis is provided for formulating an accurate network protection strategy, and the risk prevention and control cost is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of new energy stations, and in particular to a network security assessment method and system for new energy stations. Background Art

[0002] The large-scale development and grid-connected utilization of new energy sources such as photovoltaics and wind power is an irresistible trend. In order to achieve low-cost, information-based, regionalized and intensive management of new energy sites, it is necessary to build a new energy control center to remotely control and monitor decentralized new energy sites. However, most new energy control centers are unmanned. In addition, as most new energy sites such as photovoltaic power stations and wind farms are built in remote locations, the outdoor protection equipment is scattered and the protection level is insufficient, which poses a huge challenge to the network security of the power grid. Therefore, how to evaluate the network security status of new energy sites in the new energy control center, timely warn, maintain stable power production and information network security has become a hot spot and difficulty in current research.

[0003] In the existing technology, it is not convenient to perform stability analysis on network operation characteristic data, so that potential unstable behaviors or hidden dangers in the new energy station network cannot be discovered in time, and it is not convenient to identify key security risks that cause network instability, which increases the subsequent risk prevention and control costs, making it inconvenient to comprehensively analyze and dynamically optimize the network operation data and network security risks of new energy stations, thereby reducing the stability, reliability and security of network operation, and cannot effectively guarantee the network security needs of new energy stations in efficient operation.

[0004] Currently, no effective solution has been proposed for the problems in the related technologies. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention proposes a network security assessment method and system for new energy stations, which solves the problem raised in the above background technology that the existing technology is not convenient for stability analysis of network operation characteristic data, thereby failing to timely discover potential unstable behaviors or hidden dangers in the new energy station network, and is not convenient for identifying key security risks that cause network instability, thereby increasing the subsequent risk prevention and control costs, making it inconvenient to comprehensively analyze and dynamically optimize the network operation data and network security risks of new energy stations, thereby reducing the stability, reliability and security of network operation, and failing to effectively guarantee the network security requirements of new energy stations in efficient operation.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0007] According to one aspect of the present invention, a new energy station network security assessment method is provided, and the new energy station network security assessment method comprises the following steps:

[0008] S1. Obtain network operation data of new energy stations, and process the network operation data to obtain network operation characteristic data;

[0009] S2. Based on the network behavior recognition algorithm, stability analysis is performed on the obtained network operation characteristic data to identify the changing trend of network stability;

[0010] S3. Based on the risk factor identification algorithm, analyze the changing trend of the identified network stability and identify the key security risk factors that affect network stability;

[0011] S4. Evaluate the identified key security risk factors and known network security risk factors in the database, and adjust the network protection strategy of the new energy site based on the evaluation results.

[0012] Further, based on the network behavior recognition algorithm, stability analysis is performed on the obtained network operation characteristic data to identify the change trend of network stability, including the following steps:

[0013] S21, randomly generating an initial network behavior feature data set, calculating the corresponding network stability objective function for each feature data in the initial network behavior feature data set, and performing non-dominated hierarchical sorting on the feature data, calculating its congestion degree, and forming a sorted preferred network behavior feature set;

[0014] S22, based on the behavior feature selection algorithm, selecting the network behavior feature with the highest fitness from the preferred network behavior feature set, and duplicating it to form a new network behavior feature set;

[0015] S23, reorganizing and disturbing the new network behavior feature set, eliminating network behavior feature data that does not meet the network stability constraint conditions, retaining feature data that meets the constraint conditions, and regenerating network behavior feature data that meets the constraint conditions using an initialization function;

[0016] S24, merging the primary network behavior feature data set with the secondary network behavior feature data set to form a new preferred network behavior feature set, and removing duplicate network behavior feature data to form a feature set without duplicate network behavior feature data;

[0017] S25, performing non-dominated hierarchical sorting on the feature set of non-repeated network behavior feature data, and calculating its congestion degree to obtain a new feature set of non-repeated network behavior feature data;

[0018] S26, determine whether the current number of iterations reaches the threshold, if so, stop the iteration and go to step S27; otherwise, return to step S22 to continue the iteration;

[0019] S27. Output the final optimal network behavior feature data set as the result of network behavior comparison analysis, and identify the changing trend of network stability in the network operation feature data.

[0020] Further, based on the behavior feature selection algorithm, the network behavior feature with the highest fitness is selected from the preferred network behavior feature set, and the network behavior feature is copied to form a new network behavior feature set, which includes the following steps:

[0021] S221, selecting a number of network behavior features with the highest fitness values ​​from the initial network behavior feature population as core feature seeds, and randomly selecting a number of network behavior features from the remaining network behavior feature population;

[0022] S222, optimizing the growth and feature expansion of each network behavior feature seed to simulate the diffusion and diversification of network behavior features;

[0023] S223, based on the niche partitioning method, classify and sort the expanded network behavior feature seed set, and select the optimal feature seeds;

[0024] S224. If the current network behavior feature population size is greater than the maximum population size, execute step S226, otherwise continue iterative optimization;

[0025] S225, sorting the network behavior features in each microhabitat from high to low according to fitness, and selecting the feature with the highest fitness from each microhabitat as the preferred feature; if the number of microhabitats reaches a preset maximum value, re-screening starts from the first microhabitat until the total number of selected preferred features is equal to the maximum population size;

[0026] S224. If the maximum number of iterations is reached, the final optimal network behavior feature set is output as a new network behavior feature set; otherwise, the process returns to step S222 to continue the optimization iteration.

[0027] Furthermore, based on the niche partitioning method, the expanded network behavior feature seed set is classified and sorted, and the selection of the optimal feature seed includes the following steps:

[0028] S2231 sorts the network behavior feature seeds in the network behavior feature seed set in descending order based on the size of the fitness value; if the number of network behavior feature seeds is greater than the preset maximum population number, retaining the network behavior feature seeds with the previous maximum population number;

[0029] S2232, setting the center of the first microhabitat to the network behavior feature seed with the highest fitness value in the network behavior feature seed set, and marking the network behavior feature seed as the microhabitat center feature;

[0030] S2233. If the Euclidean distance between the remaining network behavior feature seeds and the center feature of the current microhabitat is less than the preset microhabitat radius, the remaining network behavior feature seeds are classified into the microhabitat and marked as classified; otherwise, they are not classified;

[0031] S2234, creating a new microhabitat, and selecting the network behavior characteristic seed with the highest fitness value from the unmarked network behavior characteristic seeds as the new microhabitat center; for the remaining network behavior characteristic seeds, if the distance to the new microhabitat center is less than the microhabitat classification radius, the remaining network behavior characteristic seeds are classified into the new microhabitat, and the remaining network behavior characteristic seeds are marked as classified; otherwise, they are not classified;

[0032] S2235. If all network behavior feature seeds in the network behavior feature seed set are marked, the classification operation is terminated; otherwise, the process returns to step S2234 until all network behavior feature seeds are classified and the optimal feature seeds are selected.

[0033] Furthermore, based on the risk factor identification algorithm, the change trend of the identified network stability is analyzed, and the key security risk factors affecting network stability are identified, including the following steps:

[0034] S31. Obtain the historical status record of the target network, count the number of occurrences of potential risk factors in the network, and calculate the distribution ratio of the risk factors;

[0035] S32. Analyze the distribution of risk factors in the target network based on a data analysis algorithm to generate a distribution pattern of risk factor ratios;

[0036] S33. Based on the distribution law of the generated risk factor ratios, a network stability risk identification model is constructed, and the constructed network stability risk identification model is deployed to areas with high incidence of risk factors;

[0037] S34. If the risk level of the high-risk area detected in the target network exceeds the threshold, the risk factor identification algorithm is used to analyze the current target network and identify key security risk factors that affect network stability.

[0038] Furthermore, based on the data analysis algorithm, the distribution of risk factors in the target network is analyzed, and the distribution law of the risk factor ratio is generated, including the following steps:

[0039] S321, obtaining several risk factors in the target network, analyzing the correlation between the risk factor data using a data analysis algorithm, and obtaining a subset of risk factor data classified by features;

[0040] S322. Randomly select a number of risk factors from the risk factor data subset as a training set, calculate the entropy gain of risk factors related to network stability, build a risk analysis model, and screen out core risk indicators;

[0041] S323, verify the consistency of the highly correlated risk factor data, screen out the risk factor data subset with the highest integrity, and divide the risk factor data subset with the highest integrity into several subsets of equal size as the initial training set;

[0042] S324, calculating the risk change probability of the core risk indicators under different network states, and generating a risk indicator model related to the network state;

[0043] S325. Use the risk analysis model to check the consistency of the risk indicator pattern and retain the risk data subset with the highest classification accuracy;

[0044] S326. Combine the risk analysis model with the probability of risk change to analyze the impact of core risk indicators on network stability. If the classification results are inconsistent, the risk factor data will be included in the risk change matrix. If the classification results are consistent, new risk factor data will be introduced to gradually reduce the weight of the risk analysis model, and based on the probability of risk change, generate the distribution law of the risk factor ratio.

[0045] Furthermore, if the risk level of the high-risk area detected in the target network exceeds the threshold, the risk factor identification algorithm is used to analyze the current target network, and the key security risk factors affecting the network stability are identified, including the following steps:

[0046] S341, initializing risk identification algorithm parameters, generating an initial population of risk analysis models using low-discrepancy sequence sampling, each model representing a combination of risk factors, and assigning initial positions and parameters;

[0047] S342. Calculate the risk fitness value of the risk analysis model, sort the risk analysis models by fitness, assign the risk analysis models to different performance levels, and mark the risk analysis model and parameters with the best performance at present;

[0048] S343, using a model optimization algorithm to optimize the risk analysis model with the best performance, re-evaluating after adjusting the parameters, and selecting the risk analysis model with the highest fitness value as the optimization result;

[0049] S344. According to the risk probability threshold of the risk analysis model with the highest risk fitness value, adjust the position and parameters of the risk analysis models at each performance level to optimize risk coverage;

[0050] S345. Continuously evaluate and rank risk analysis models, and generate new risk analysis model positions based on Gaussian variation; if the risk fitness value of the new risk analysis model is greater than the risk fitness value of the current risk analysis model, replace the current risk analysis model, output the final risk analysis model, and identify key risk factors affecting network stability based on the final risk analysis model.

[0051] Further, the risk analysis model with the best performance is optimized using a model optimization algorithm, and re-evaluated after adjusting the parameters. The risk analysis model with the highest fitness value is selected as the optimization result, which includes the following steps:

[0052] S3431, initializing the parameters of the model optimization algorithm, and using the modified chaotic tent mapping method to generate an initial risk analysis model population in the risk analysis model parameter search space, each risk analysis model corresponding to a different parameter combination;

[0053] S3432. Calculate the fitness value of each risk analysis model in the risk analysis model group, evaluate its risk analysis capability, and determine the current optimal risk analysis model according to the fitness value;

[0054] S3433, using an adaptive learning mechanism to dynamically update the adjustment coefficient according to the current iteration state;

[0055] S3434. Update the parameter positions of all risk analysis models according to the optimization formula, generate a new risk analysis model population, introduce a refraction adversarial learning mechanism, calculate the parameter combination of each risk analysis model, and adopt a greedy selection strategy to retain the risk analysis model with the highest fitness value between the original risk analysis model and the risk analysis model after refraction adversarial to enter the next generation, while keeping the size of the risk analysis model population unchanged;

[0056] S3435. Recalculate the fitness value of the updated risk analysis model population, and update the current optimal risk analysis model according to the evaluation results;

[0057] S3436: If the number of optimization iterations reaches the maximum number of iterations, jump to step S3437; otherwise, return to step S3433 and continue the optimization iteration;

[0058] S3437. Select the risk analysis model with the highest fitness value from the final risk analysis model population as the optimization result, output the parameter combination of the risk analysis model and the corresponding fitness value, and complete the optimization process.

[0059] Furthermore, the optimization formula is:

[0060]

[0061] Where Wi，d represents the new position of the ith risk analysis model on the dth dimension parameter; r1 and r2 both represent adjustment coefficients; ub d represents the upper bound of the search space in the dth dimension; lb d represents the lower bound of the search space in the dth dimension; s represents the distance function; x j represents the parameter value of the dth dimension of the jth risk analysis model; x i represents the parameter value of the dth dimension of the ith risk analysis model; represents the global optimal risk analysis model of the dth dimension in the current risk analysis model group; N represents the total number of risk analysis models.

[0062] According to another aspect of the present invention, a new energy station network security assessment system is also provided, and the new energy station network security assessment system includes:

[0063] The data acquisition module is used to acquire the network operation data of the new energy station and process the network operation data to obtain the network operation characteristic data;

[0064] The trend analysis module is used to perform stability analysis on the obtained network operation characteristic data based on the network behavior recognition algorithm and identify the changing trend of network stability;

[0065] The factor identification module is used to analyze the changing trend of the identified network stability based on the risk factor identification algorithm and identify the key security risk factors that affect the network stability;

[0066] The security assessment module is used to evaluate the identified key security risk factors and the known network security risk factors in the database, and adjust the network protection strategy of the new energy site based on the assessment results.

[0067] The beneficial effects of the present invention are:

[0068] 1. The present invention uses a network behavior recognition algorithm to perform stability analysis on network operation feature data and identify stability change trends. It can promptly discover potential unstable behaviors or hidden dangers in the new energy station network, predict network status changes in advance, and provide sufficient time and basis for risk control. It accurately identifies key security risks that cause network instability, avoids generalized or vague risk assessments, provides a basis for formulating accurate network protection strategies, and reduces risk prevention and control costs. At the same time, it dynamically updates the network protection strategies of new energy stations to ensure that network protection measures are always adapted to the latest risk environment, thereby improving the pertinence and effectiveness of protection strategies, avoiding resource waste or insufficient protection, and thereby reducing operational interruptions or efficiency reductions caused by network security risks in new energy stations, improving the network operation reliability of new energy stations, and providing strong guarantees for the continuous supply of green energy.

[0069] 2. The present invention is based on a network behavior identification algorithm. By performing non-dominated hierarchical sorting and fitness optimization on the preferred network behavior feature data set, the relationship between network behavior features is dynamically analyzed, and the changing trend of the network operation status can be accurately characterized. It can identify potential fluctuations or abnormal changes in network stability and help predict possible risks in advance. The changing trend of network stability directly reflects the security and reliability of the network in dynamic operation. The optimized feature data set effectively captures the key behavior patterns that affect network stability and enhances the new energy station's ability to perceive potential risks. Through trend analysis, the network stability changes can be monitored in real time. When problems are found, the protection strategy can be adjusted in time to avoid network failures or security incidents. Trend analysis not only provides the current network status, but also makes predictions based on the law of changes, thereby providing new energy stations with higher dynamic risk management capabilities.

[0070] 3. Based on the risk factor identification algorithm, the present invention can systematically count and analyze the occurrence frequency and distribution ratio of potential risk factors in the network, establish the distribution law of risk factors, deploy risk identification models in high-risk areas, and detect risk changes in these areas in real time. By real-time detection of dynamic changes in high-risk areas, the continuity and timeliness of risk monitoring and management can be ensured. Combined with the risk factor identification algorithm, it can quickly capture abnormal or high-risk factors in the current network environment, reduce response delays, and thus improve risk management efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0072] Figure 1 is a flow chart of a network security assessment method for a new energy site according to an embodiment of the present invention;

[0073] Figure 2 It is a principle block diagram of a new energy station network security assessment system according to an embodiment of the present invention.

[0074] In the figure:

[0075] 1. Data acquisition module; 2. Trend analysis module; 3. Factor identification module; 4. Safety assessment module. DETAILED DESCRIPTION

[0076] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0077] In the description of the present invention, unless otherwise specified, the meaning of "plurality" is two or more. In addition, the terms "first", "second", "third", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0078] According to an embodiment of the present invention, a new energy station network security assessment method and system are provided.

[0079] The present invention is further described with reference to the accompanying drawings and specific embodiments. Figure 1 As shown, according to the new energy station network security assessment method of the embodiment of the present invention, the new energy station network security assessment method comprises the following steps:

[0080] S1. Obtain network operation data of new energy stations, and process the network operation data to obtain network operation characteristic data;

[0081] Specifically, the network operation data of new energy stations include:

[0082] 1) Network traffic data

[0083] Traffic information: packet transmission rate, traffic peaks and fluctuations, etc.

[0084] Protocol type: usage of network protocols such as TCP, UDP, and HTTP.

[0085] Network topology: structural information of the site network (nodes, links, bandwidth, etc.).

[0086] 2) Network device log data

[0087] Equipment operation logs: such as the operation status and fault logs of routers, switches, firewalls and other equipment.

[0088] Communication status: communication delay between devices, packet loss rate, etc.

[0089] Alarm information: equipment alarm records, abnormal behavior information in logs.

[0090] 3) Safety-related data

[0091] Intrusion detection records: such as potential attack behaviors and illegal access attempts.

[0092] Network threat events: such as denial of service attacks (DDoS), malicious traffic, etc.

[0093] Access control information: records of authorized access and unauthorized access.

[0094] 4) System status data

[0095] Node performance: such as CPU usage, memory usage, hard disk read and write speed, etc.

[0096] Energy equipment data: such as the operating network communication status of equipment such as inverters and transformers.

[0097] 5) Time Series Data

[0098] Time series network status: time series records of network operation parameters, such as bandwidth usage, latency, and other trends over time.

[0099] Specifically, network operation characteristic data includes:

[0100] 1) Network performance characteristics

[0101] Throughput: The amount of data transmitted per unit time.

[0102] Latency: The time it takes for a packet to travel from source to destination.

[0103] Packet loss rate: the proportion of data packets lost during transmission.

[0104] 2) Network traffic characteristics

[0105] Traffic pattern: the characteristics of traffic changes over time (e.g. peak and idle traffic).

[0106] Traffic distribution: The distribution of traffic among different devices or protocols.

[0107] Abnormal traffic indicators: such as burst traffic, irregular traffic patterns, etc.

[0108] 3) Safety features

[0109] Abnormal behavior characteristics: such as abnormal access frequency and unauthorized access records.

[0110] Threat characteristics: such as scanning traffic characteristics and denial of service attack behavior characteristics.

[0111] Vulnerability exploitation characteristics: such as special attack characteristics in data packets (specific ports, protocols, etc.).

[0112] 4) Time series characteristics

[0113] Trend characteristics: such as time trends of network performance parameters.

[0114] Periodic characteristics: Periodic patterns in network behavior (e.g. daily traffic fluctuations).

[0115] Mutation characteristics: such as a sudden surge in traffic at a certain moment.

[0116] 5) Equipment performance characteristics

[0117] Health status: whether the device is operating normally (based on log extraction).

[0118] Communication frequency characteristics: such as the frequency and duration of communication between devices.

[0119] Load characteristics: The load capacity of the device (such as CPU or bandwidth usage).

[0120] Event logs: The time and frequency of key network events.

[0121] It should be explained that the network operation data of the new energy station is obtained and processed to obtain the network operation characteristic data including:

[0122] Obtain the network operation data of the new energy station, perform wavelet decomposition on the network operation data, remove noise and reconstruct the network operation data to obtain the pre-processed network operation data;

[0123] Decompose the reconstructed network operation data using empirical mode decomposition, extract the intrinsic mode function, calculate the mutual correlation coefficient between each intrinsic mode function and the network operation data, and select the intrinsic mode function with the highest mutual correlation coefficient;

[0124] Based on the fast Fourier transform, the feature extraction is performed on the selected intrinsic mode function with the highest mutual correlation coefficient to obtain the network operation characteristic data.

[0125] S2. Based on the network behavior recognition algorithm, stability analysis is performed on the obtained network operation characteristic data to identify the changing trend of network stability;

[0126] Specifically, the changing trend of network stability refers to the dynamic changes in the network operation status over time or events, including the characteristic manifestations of increased or decreased stability.

[0127] S3. Based on the risk factor identification algorithm, analyze the changing trend of the identified network stability and identify the key security risk factors that affect network stability;

[0128] Specifically, the key security risk factors that affect network stability include: risk factors related to network traffic, security risks of network communication equipment, risks of network protocols and communication mechanisms, risks caused by network security incidents, security risks of systems and software, human operation and management risks, and interference factors in the external environment.

[0129] S4. Evaluate the identified key security risk factors and known network security risk factors in the database, and adjust the network protection strategy of the new energy site based on the evaluation results.

[0130] It needs to be explained that known security risk records are extracted from the network security database, including attack patterns, trigger conditions, impact range, etc.; the identified key security risk factors are compared with the known risk factors in the database; similarities (such as behavior patterns, trigger time, impact range, etc.) are analyzed using feature matching algorithms; the degree of correlation between key risk factors and historical risk factors is determined to determine whether there are repetitive or evolving risk patterns; the degree of impact of each risk factor on network stability and security is quantified (such as based on impact scores or levels); the possibility of risk factors occurring is estimated based on historical data and current monitoring information; risk factors are sorted according to the "high impact-high probability" priority principle, and risks that should be protected first are identified; targeted protection strategies are formulated for high-priority risk factors, including measures such as adjusting access control, enhancing encryption mechanisms, optimizing traffic distribution, and upgrading network equipment; risk monitoring strategies are deployed in high-risk areas or key network nodes, such as enhancing intrusion detection and enabling advanced firewall rules.

[0131] Preferably, based on the network behavior recognition algorithm, stability analysis is performed on the obtained network operation characteristic data to identify the change trend of network stability, including the following steps:

[0132] S21, randomly generating an initial network behavior feature data set, calculating the corresponding network stability objective function for each feature data in the initial network behavior feature data set, and performing non-dominated hierarchical sorting on the feature data, calculating its congestion degree, and forming a sorted preferred network behavior feature set;

[0133] S22, based on the behavior feature selection algorithm, selecting the network behavior feature with the highest fitness from the preferred network behavior feature set, and duplicating it to form a new network behavior feature set;

[0134] S23, reorganizing and disturbing the new network behavior feature set, eliminating network behavior feature data that does not meet the network stability constraint conditions, retaining feature data that meets the constraint conditions, and regenerating network behavior feature data that meets the constraint conditions using an initialization function;

[0135] S24, merging the primary (parent generation) network behavior feature data set with the secondary (child generation) network behavior feature data set to form a new optimal network behavior feature set, and removing duplicate network behavior feature data to form a feature set without duplicate network behavior feature data;

[0136] S25, performing non-dominated hierarchical sorting on the feature set of non-repeated network behavior feature data, and calculating its congestion degree to obtain a new feature set of non-repeated network behavior feature data;

[0137] S26, determine whether the current number of iterations reaches the threshold, if so, stop the iteration and go to step S27; otherwise, return to step S22 to continue the iteration;

[0138] S27. Output the final optimal network behavior feature data set as the result of network behavior comparison analysis, and identify the changing trend of network stability in the network operation feature data.

[0139] In order to facilitate understanding of the above technical solutions of the present invention, the present invention will be described in detail below in the actual process based on the network behavior recognition algorithm to perform stability analysis on the obtained network operation characteristic data and identify the changing trend of network stability.

[0140] Assumptions:

[0141] 1) It contains 5 device nodes, and its main characteristics include traffic, delay, and packet loss rate.

[0142] 2) Initial network feature data:

[0143] Dataset D = {F1, F2, F3, F4, F5}, each feature includes:

[0144] Traffic: Ti (Mbps), Latency: L i (ms), Packet loss rate: P i (%).

[0145] 3) Network stability objective function:

[0146] Si=w1·T i -w2·L i -w3·P i .

[0147] Weights w1=0.5, w2=0.3, w3=0.2.

[0148] Step 1: Generate the initial feature data set and calculate the objective function

[0149] 1) Randomly generate an initial feature data set:

[0150] Assume that the initial data set D is:

[0151]

[0152] Calculate the objective function:

[0153] Si=0.5·T i-0.3·L i -0.2·P i We get: S = {47.9, 70.34, 58.92, 33.76,

[0154] 68.88}.

[0155] Dominate hierarchical sorting and crowding calculation:

[0156] Sort by objective function value: D sorted ={F2, F5, F3, F1, F4}.

[0157] Crowding: Assuming calculation based on the distance method, the result is {0.8, 0.7, 0.6, 0.4, 0.2}.

[0158] Preferred feature set: D selected ={F2, F5, F3}.

[0159] Step 2: Feature selection and replication

[0160] 1) Select the feature with the highest fitness: The one with the highest fitness is F2.

[0161] 2) Copy to form a new feature set: The new feature set is: D new ={F2, F2′, F3, F5}.

[0162] Step 3: Reorganization and perturbation operations

[0163] 1) Recombination characteristics:

[0164] Right D new F2′, F3, F5 in are perturbed (randomly modified) to generate:

[0165] F2′={T2=152, L2=24, P2=0.9}.

[0166] F3={T3=118, L3=16, P3=0.5}.

[0167] F5={T5=138, L5=12, P5=0.65}.

[0168] 2) Eliminate features that do not meet the constraints: Assume that the constraints are T>50, L<50, P<2, and all features meet them.

[0169] 3) Initialization function generates new features: F new ={T=105, L=18, P=0.7}.

[0170] Step 4: Merge the primary and secondary feature sets

[0171] 1) Merge feature sets and remove duplicates: D merged ={F2, F2′, F3, F5, F new}, after deduplication: D merged ={F2, F5, F3, F new}.

[0172] Step 5: Non-dominated hierarchical sorting and crowding calculation

[0173] 1) Calculate the objective function again: S new ={70.5, 59.36, 68.3, 50.1}, sorting result: D final ={F2, F5, F3, F new}, congestion calculation results: {0.9, 0.8, 0.7, 0.5}.

[0174] Step 6: Iteration Check

[0175] 1) Assume that the iteration threshold is 3 times and it is currently the 2nd time, and return to step S22 to continue iterating.

[0176] Step 7: Output the optimal feature set and identify the change trend

[0177] 1) After the final iteration, the optimal feature set is output: D optimal ={F2, F5, F3}.

[0178] 2) Identify the trend of network stability changes:

[0179] Traffic stability: The main feature is that the T is stable at 120-150Mbps.

[0180] Latency trend: The overall latency is decreasing and stabilized at 10-20ms.

[0181] Packet loss rate change: maintained at less than 1%.

[0182] Specifically, the network behavior recognition algorithm is a modified NSGA-II algorithm, which is a classic multi-objective optimization algorithm. When used to deal with multi-objective optimization problems, it can effectively find a solution set that meets multi-objective requirements. The present invention improves the basic NSGA-II algorithm, designs an effective integer encoding method, and introduces a deduplication operation.

[0183] Preferably, based on the behavior feature selection algorithm, the network behavior feature with the highest fitness is selected from the preferred network behavior feature set, and the network behavior feature is copied to form a new network behavior feature set, which includes the following steps:

[0184] S221, selecting a number of network behavior features with the highest fitness values ​​from the initial network behavior feature population as core feature seeds, and randomly selecting a number of network behavior features from the remaining network behavior feature population;

[0185] S222, optimizing the growth and feature expansion of each network behavior feature seed to simulate the diffusion and diversification of network behavior features;

[0186] S223, based on the niche partitioning method, classify and sort the expanded network behavior feature seed set, and select the optimal feature seeds;

[0187] S224. If the current network behavior feature population size is greater than the maximum population size, execute step S226, otherwise continue iterative optimization;

[0188] S225, sorting the network behavior features in each microhabitat from high to low according to fitness, and selecting the feature with the highest fitness from each microhabitat as the preferred feature; if the number of microhabitats reaches a preset maximum value, re-screening starts from the first microhabitat until the total number of selected preferred features is equal to the maximum population size;

[0189] S224. If the maximum number of iterations is reached, the final optimal network behavior feature set is output as a new network behavior feature set; otherwise, the process returns to step S222 to continue the optimization iteration.

[0190] It should be explained that from the initial feature population, several features with the highest fitness values ​​are selected as core feature seeds. The core feature seeds give priority to features that have a greater impact on network stability; features with better traffic stability are selected as core seeds; several features are randomly selected from the remaining features to ensure the diversity of the feature population; some features with relatively random delay or packet loss characteristics are added; the core feature seeds are optimized to simulate their impact on network behavior and further enhance it. For example: adjust the traffic range of a feature to reflect higher network performance; the optimized feature retains the basic characteristics of the original feature and is more adaptable; simulate the diversification process of the feature and generate multiple extended features for each core feature seed to reflect the behavior changes under different network conditions; extended features include attribute combinations or deviations of the core features, such as changing the delay value of the feature in a small range; according to the fitness value of the feature, all feature populations are divided into several small habitats to ensure that the fitness range of the features in each niche is relatively concentrated; the features in each niche are sorted from high to low according to the fitness value, and the features with higher fitness are selected as the preferred seeds; the features with the highest fitness are retained as the preferred features, and the features with lower fitness are eliminated to ensure the efficiency and representativeness of the feature set ; If the current population size exceeds the maximum population size, remove features with lower fitness; if the size is insufficient, add new features through optimization and expansion; form an optimal feature set that meets the size limit to provide a basis for the next iteration; select the feature with the highest fitness from each microhabitat as part of the final optimal feature set; if the number of microhabitats exceeds the preset value, repeat the screening from the first microhabitat until the target population size is reached; if the maximum number of iterations has not yet been reached, return to step S222 to continue optimization iteration; if the maximum number of iterations is reached, stop the optimization, and the final optimal feature set includes all optimized and screened features for further network behavior comparison and analysis; the final feature set has stronger diversity and adaptability, and can accurately reflect the changing laws of network behavior.

[0191] Specifically, the behavioral feature selection algorithm is to improve the invasive weed algorithm. It combines the microhabitat idea with the standard invasive weed algorithm, classifies the weed population for competitive reproduction, increases the diversity of the population, and improves the global optimization ability of the algorithm. At the same time, in the later stage of the algorithm, an adaptive microhabitat number is used to improve the convergence accuracy, thereby improving the accuracy of text feature selection.

[0192] Preferably, based on the niche partitioning method, the expanded network behavior feature seed set is classified and sorted, and the screening of the optimal feature seeds includes the following steps:

[0193] S2231 sorts the network behavior feature seeds in the network behavior feature seed set in descending order based on the size of the fitness value; if the number of network behavior feature seeds is greater than the preset maximum population number, retaining the network behavior feature seeds with the previous maximum population number;

[0194] S2232, setting the center of the first microhabitat to the network behavior feature seed with the highest fitness value in the network behavior feature seed set, and marking the network behavior feature seed as the microhabitat center feature;

[0195] S2233. If the Euclidean distance between the remaining network behavior feature seeds and the center feature of the current microhabitat is less than the preset microhabitat radius, the remaining network behavior feature seeds are classified into the microhabitat and marked as classified; otherwise, they are not classified;

[0196] S2234, creating a new microhabitat, and selecting the network behavior characteristic seed with the highest fitness value from the unmarked network behavior characteristic seeds as the new microhabitat center; for the remaining network behavior characteristic seeds, if the distance to the new microhabitat center is less than the microhabitat classification radius, the remaining network behavior characteristic seeds are classified into the new microhabitat, and the remaining network behavior characteristic seeds are marked as classified; otherwise, they are not classified;

[0197] S2235. If all network behavior feature seeds in the network behavior feature seed set are marked, the classification operation is terminated; otherwise, the process returns to step S2234 until all network behavior feature seeds are classified and the optimal feature seeds are selected.

[0198] Preferably, based on the risk factor identification algorithm, analyzing the change trend of the identified network stability, identifying the key security risk factors affecting the network stability includes the following steps:

[0199] S31. Obtain the historical status record of the target network, count the number of occurrences of potential risk factors in the network, and calculate the distribution ratio of the risk factors;

[0200] S32. Analyze the distribution of risk factors in the target network based on a data analysis algorithm to generate a distribution pattern of risk factor ratios;

[0201] S33. Based on the distribution law of the generated risk factor ratios, a network stability risk identification model is constructed, and the constructed network stability risk identification model is deployed to areas with high incidence of risk factors;

[0202] S34. If the risk level of the high-risk area detected in the target network exceeds the threshold, the risk factor identification algorithm is used to analyze the current target network and identify key security risk factors that affect network stability.

[0203] It should be explained that key indicators (such as the number of traffic anomalies and the number of equipment load anomalies) are extracted from the historical records of the target network. The number of occurrences of various risk factors in the network in the past month is counted; the number of occurrences of each type of risk factor is counted and its proportion in the overall risk is calculated; it is found that traffic anomalies account for the highest proportion, followed by equipment failures and delay surges; risk factor data in the target network (such as abnormal traffic and delay surges) is extracted; the correlation between risk factors is analyzed using a data analysis algorithm (i.e., the Apriori algorithm), and the data is divided into risk factor data subsets with different feature classifications; traffic anomalies and delay surges are classified into the same category, and equipment failures and packet loss rates are classified into another category; risk factors are randomly selected from the data subset as a training set; by analyzing entropy gain, the core risk indicators related to network stability are screened; the core risk indicators are traffic anomaly rate and equipment load rate; the consistency of highly correlated risk factor data is verified, and the subset with the highest integrity is screened; the complete data subset is divided into Several subsets of equal size are used as initial training sets to calculate the probability of risk changes of core indicators (such as traffic anomaly rate) under different network conditions; the probability of traffic anomaly rate changes is higher during peak hours; the risk analysis model is used to verify the accuracy of the risk indicator pattern, and the risk data subset with the highest classification accuracy is retained; the impact of core risk indicators on network stability is analyzed; if the classification results are consistent, new risk data is introduced and the model weight is gradually reduced; the distribution law of risk factor proportions is finally generated; a network stability risk identification model is constructed based on the generated distribution law; the input of the model includes core risk indicators and historical status data; the model is deployed to areas with high incidence of risk factors, focusing on monitoring nodes with high incidence of traffic anomalies; if the risk level in high-incidence areas exceeds the threshold (such as too high frequency of traffic anomalies), the risk identification algorithm is triggered; the identification algorithm is used to analyze the current target network. It is found that frequent traffic anomalies and excessive equipment loads jointly lead to a surge in delays, which is the key security risk factor that mainly affects network stability; the main risk factors are traffic anomalies, high equipment loads, and surges in delays. These risk factors pose a direct threat to network stability; the distribution of risk factors is time-specific (e.g., higher risks during peak hours); and the core risk indicators are highly correlated, such as traffic anomalies accompanied by a surge in latency.

[0204] Preferably, based on a data analysis algorithm, the distribution of risk factors in the target network is analyzed, and the distribution law of the risk factor ratio is generated, including the following steps:

[0205] S321, obtaining a number of risk factors in the target network, using a data analysis algorithm (i.e., Apriori algorithm) to analyze the correlation between the risk factor data, and obtaining a subset of risk factor data classified by features;

[0206] Specifically, the Apriori algorithm is a classic association rule mining algorithm used to discover frequent itemsets and association rules from a data set. The algorithm is based on the important property that all subsets of frequent itemsets are also frequent, which effectively reduces the search space.

[0207] S322. Randomly select a number of risk factors from the risk factor data subset as a training set, calculate the entropy gain of risk factors related to network stability, build a risk analysis model, and screen out core risk indicators;

[0208] S323, verify the consistency of the highly correlated risk factor data, screen out the risk factor data subset with the highest integrity, and divide the risk factor data subset with the highest integrity into several subsets of equal size as the initial training set;

[0209] S324, calculating the risk change probability of the core risk indicators under different network states, and generating a risk indicator model related to the network state;

[0210] S325. Use the risk analysis model to check the consistency of the risk indicator pattern and retain the risk data subset with the highest classification accuracy;

[0211] S326. Combine the risk analysis model with the probability of risk change to analyze the impact of core risk indicators on network stability. If the classification results are inconsistent, the risk factor data will be included in the risk change matrix. If the classification results are consistent, new risk factor data will be introduced to gradually reduce the weight of the risk analysis model, and based on the probability of risk change, generate the distribution law of the risk factor ratio.

[0212] Preferably, if the risk level of the high-risk area detected in the target network exceeds the threshold, the risk factor identification algorithm is used to analyze the current target network, and the key security risk factors affecting the network stability are identified, including the following steps:

[0213] S341, initializing risk identification algorithm parameters, generating an initial population of risk analysis models using low-discrepancy sequence sampling, each model representing a combination of risk factors, and assigning initial positions and parameters;

[0214] S342. Calculate the risk fitness value of the risk analysis model, sort the risk analysis models by fitness, assign the risk analysis models to different performance levels, and mark the risk analysis model and parameters with the best performance at present;

[0215] S343, using a model optimization algorithm to optimize the risk analysis model with the best performance, re-evaluating after adjusting the parameters, and selecting the risk analysis model with the highest fitness value as the optimization result;

[0216] S344. According to the risk probability threshold of the risk analysis model with the highest risk fitness value, adjust the position and parameters of the risk analysis models at each performance level to optimize risk coverage;

[0217] S345. Continuously evaluate and rank risk analysis models, and generate new risk analysis model positions based on Gaussian variation; if the risk fitness value of the new risk analysis model is greater than the risk fitness value of the current risk analysis model, replace the current risk analysis model, output the final risk analysis model, and identify key risk factors affecting network stability based on the final risk analysis model.

[0218] Specifically, the risk factor identification algorithm is a hybrid of the improved grasshopper optimization algorithm and the Gaussian mutation squirrel search algorithm. The algorithm generates a chaotic initial population through a low-discrepancy sequence sampling initialization strategy, enhances the uniformity of the initial population distribution, and achieves a more efficient search of the solution space. It adopts a nonlinear decreasing predator probability strategy to balance the global search and local development capabilities of the squirrel search algorithm.

[0219] Specifically, the squirrel search algorithm simulates the dynamic foraging behavior of a southern squirrel: in autumn, squirrels glide between different trees in the forest (hickory, oak, and ordinary trees) to find food sources, with hickory trees being the best food source; in winter, due to the reduced leaf cover and the increased probability of being preyed on, squirrels become less active until the end of winter when they become active again. This process is repeated continuously, forming a squirrel search algorithm that uses a position-greedy selection strategy to continuously retain dominant individuals in the population during the iteration process to improve the algorithm's convergence speed; the introduction of Gaussian mutation generation and improved grasshopper optimization algorithm global optimization increases the diversity of the population while improving the algorithm's ability to jump out of the local optimum.

[0220] Specifically, the model optimization algorithm is an improved grasshopper optimization algorithm. The traditional grasshopper optimization algorithm GOA is a newer natural heuristic algorithm that simulates the social behavior of insects such as grasshoppers. Pests such as grasshoppers will affect crop yields, and their entire life cycle consists of three stages: eggs, larvae and adults. In the larval stage, the movement characteristics of grasshoppers include jumping and columnar rotation flight, small step length, slow movement, and predation on vegetation on the path; while in the adult stage, grasshoppers migrate over a large range in groups, with large steps and suddenness. The present invention uses completely random chaotic tent mapping to initialize the population to improve the traversal and diversity of the population; uses a learning automaton to update the adjustment coefficient that determines the search direction to balance global search and local development; introduces a refraction opposition learning position update mechanism for improvement to avoid the algorithm from falling into a local optimum.

[0221] Preferably, the risk analysis model with the best performance is optimized by using a model optimization algorithm, and re-evaluated after adjusting the parameters, and the risk analysis model with the highest fitness value is selected as the optimization result, which includes the following steps:

[0222] S3431, initializing the parameters of the model optimization algorithm, and using the modified chaotic tent mapping method to generate an initial risk analysis model population in the risk analysis model parameter search space, each risk analysis model corresponding to a different parameter combination;

[0223] S3432. Calculate the fitness value of each risk analysis model in the risk analysis model group, evaluate its risk analysis capability, and determine the current optimal risk analysis model according to the fitness value;

[0224] S3433, using an adaptive learning mechanism to dynamically update the adjustment coefficient according to the current iteration state;

[0225] S3434. Update the parameter positions of all risk analysis models according to the optimization formula, generate a new risk analysis model population, introduce a refraction adversarial learning mechanism, calculate the parameter combination of each risk analysis model, and adopt a greedy selection strategy to retain the risk analysis model with the highest fitness value between the original risk analysis model and the risk analysis model after refraction adversarial to enter the next generation, while keeping the size of the risk analysis model population unchanged;

[0226] S3435. Recalculate the fitness value of the updated risk analysis model population, and update the current optimal risk analysis model according to the evaluation results;

[0227] S3436: If the number of optimization iterations reaches the maximum number of iterations, jump to step S3437; otherwise, return to step S3433 and continue the optimization iteration;

[0228] S3437. Select the risk analysis model with the highest fitness value from the final risk analysis model population as the optimization result, output the parameter combination of the risk analysis model and the corresponding fitness value, and complete the optimization process.

[0229] It should be explained that the key parameters of the model optimization algorithm are set, including the search range, number of iterations, adaptive adjustment coefficient, etc. The search range covers all possible combinations of risk analysis model parameters. The modified chaotic Tent mapping method is used to randomly generate an initial risk analysis model population, each model has a different parameter combination. The size of the initial model population is fixed to ensure computational efficiency and result diversity. The fitness value of each model in the initial model population is evaluated, and the fitness value reflects the model's ability to analyze risks. The fitness value is determined by the performance indicators of the model in the risk analysis task (such as accuracy and precision). The model with the highest fitness value in the initial population is selected as the current optimal risk analysis model. According to the current iteration status, the optimization is dynamically adjusted. The update coefficient of the algorithm; a wide range of parameter adjustments is allowed at the beginning of the iteration, and gradually converges to subtle optimization in the later stage of the iteration; the parameter position of each risk analysis model is updated according to the optimization formula to generate a new model group; the refraction opposition learning mechanism is introduced to perform opposition updates on the parameter combination of each model to generate an opposition model group; if the initial value of a parameter is high, a lowest opposition value is generated after the opposition update, the fitness values ​​of the original model and the opposition model are compared, and the model with the highest fitness value is retained to enter the next generation, while ensuring that the size of the model group remains unchanged; the fitness value of the updated model group is recalculated; according to the new fitness evaluation result, the current optimal risk analysis model is updated; if the maximum number of iterations has been reached, the iteration process is terminated and jumps to step S3437. Otherwise, return to step S3433 and continue optimization iteration; select the model with the highest fitness value from the final model group as the optimization result; provide the parameter combination of the model and the corresponding fitness value; the optimized model parameter combination includes weight, learning rate, threshold, etc., and the fitness value indicates its superior performance in risk analysis.

[0230] Preferably, the optimization formula is:

[0231]

[0232] Where W i，d represents the new position of the ith risk analysis model on the dth dimension parameter; r1 and r2 both represent adjustment coefficients; ub d represents the upper bound of the search space in the dth dimension; lb d represents the lower bound of the search space in the dth dimension; s represents the distance function; x j represents the parameter value of the dth dimension of the jth risk analysis model; x i represents the parameter value of the dth dimension of the ith risk analysis model; represents the global optimal risk analysis model of the dth dimension in the current risk analysis model group; N represents the total number of risk analysis models.

[0233] According to another embodiment of the present invention, Figure 2 As shown, a new energy station network security assessment system is also provided, and the new energy station network security assessment system includes:

[0234] Data acquisition module 1, used to acquire network operation data of new energy stations, and process the network operation data to obtain network operation characteristic data;

[0235] Trend analysis module 2, used to perform stability analysis on the obtained network operation characteristic data based on the network behavior recognition algorithm, and identify the changing trend of network stability;

[0236] Factor identification module 3 is used to analyze the changing trend of the identified network stability based on the risk factor identification algorithm and identify the key security risk factors that affect the network stability;

[0237] The security assessment module 4 is used to evaluate the identified key security risk factors and the known network security risk factors in the database, and adjust the network protection strategy of the new energy station based on the assessment results.

[0238] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A new energy station network security assessment method, characterized in that: The new energy station network security assessment method includes the following steps: S1. Obtain network operation data of new energy stations, and process the network operation data to obtain network operation characteristic data; S2. Based on the network behavior recognition algorithm, stability analysis is performed on the obtained network operation characteristic data to identify the changing trend of network stability; S3. Based on the risk factor identification algorithm, analyze the changing trend of the identified network stability and identify the key security risk factors that affect network stability; S4. Evaluate the identified key security risk factors and known network security risk factors in the database, and adjust the network protection strategy of the new energy site based on the evaluation results.

2. A new energy station network security assessment method according to claim 1, characterized in that: The method of performing stability analysis on the obtained network operation characteristic data based on the network behavior recognition algorithm and identifying the change trend of network stability includes the following steps: S21, randomly generating an initial network behavior feature data set, calculating the corresponding network stability objective function for each feature data in the initial network behavior feature data set, and performing non-dominated hierarchical sorting on the feature data, calculating its congestion degree, and forming a sorted preferred network behavior feature set; S22, based on the behavior feature selection algorithm, selecting the network behavior feature with the highest fitness from the preferred network behavior feature set, and duplicating it to form a new network behavior feature set; S23, reorganizing and disturbing the new network behavior feature set, eliminating network behavior feature data that does not meet the network stability constraint conditions, retaining feature data that meets the constraint conditions, and regenerating network behavior feature data that meets the constraint conditions using an initialization function; S24, merging the primary network behavior feature data set with the secondary network behavior feature data set to form a new preferred network behavior feature set, and removing duplicate network behavior feature data to form a feature set without duplicate network behavior feature data; S25, performing non-dominated hierarchical sorting on the feature set of non-repeated network behavior feature data, and calculating its congestion degree to obtain a new feature set of non-repeated network behavior feature data; S26, determine whether the current number of iterations reaches the threshold, if so, stop the iteration and go to step S27; otherwise, return to step S22 to continue the iteration; S27. Output the final optimal network behavior feature data set as the result of network behavior comparison analysis, and identify the changing trend of network stability in the network operation feature data.

3. A new energy station network security assessment method according to claim 2, characterized in that: The method of selecting the network behavior feature with the highest fitness from the preferred network behavior feature set based on the behavior feature selection algorithm and duplicating it to form a new network behavior feature set includes the following steps: S221, selecting a number of network behavior features with the highest fitness values ​​from the initial network behavior feature population as core feature seeds, and randomly selecting a number of network behavior features from the remaining network behavior feature population; S222, optimizing the growth and feature expansion of each network behavior feature seed to simulate the diffusion and diversification of network behavior features; S223, based on the niche partitioning method, classify and sort the expanded network behavior feature seed set, and select the optimal feature seeds; S224. If the current network behavior feature population size is greater than the maximum population size, execute step S226, otherwise continue iterative optimization; S225, sorting the network behavior features in each microhabitat from high to low according to fitness, and selecting the feature with the highest fitness from each microhabitat as the preferred feature; if the number of microhabitats reaches a preset maximum value, re-screening starts from the first microhabitat until the total number of selected preferred features is equal to the maximum population size; S224. If the maximum number of iterations is reached, the final optimal network behavior feature set is output as a new network behavior feature set; otherwise, the process returns to step S222 to continue the optimization iteration.

4. A new energy station network security assessment method according to claim 3, characterized in that: The method of classifying and sorting the expanded network behavior feature seed set based on the niche partitioning method and screening the optimal feature seeds includes the following steps: S2231 sorts the network behavior feature seeds in the network behavior feature seed set in descending order based on the size of the fitness value; if the number of network behavior feature seeds is greater than the preset maximum population number, retaining the network behavior feature seeds with the previous maximum population number; S2232, setting the center of the first microhabitat to the network behavior feature seed with the highest fitness value in the network behavior feature seed set, and marking the network behavior feature seed as the microhabitat center feature; S2233. If the Euclidean distance between the remaining network behavior feature seeds and the center feature of the current microhabitat is less than the preset microhabitat radius, the remaining network behavior feature seeds are classified into the microhabitat and marked as classified; otherwise, they are not classified; S2234, creating a new microhabitat, and selecting the network behavior characteristic seed with the highest fitness value from the unmarked network behavior characteristic seeds as the new microhabitat center; for the remaining network behavior characteristic seeds, if the distance to the new microhabitat center is less than the microhabitat classification radius, the remaining network behavior characteristic seeds are classified into the new microhabitat, and the remaining network behavior characteristic seeds are marked as classified; otherwise, they are not classified; S2235. If all network behavior feature seeds in the network behavior feature seed set are marked, the classification operation is terminated; otherwise, the process returns to step S2234 until all network behavior feature seeds are classified and the optimal feature seeds are selected.

5. A new energy station network security assessment method according to claim 1, characterized in that: The risk factor identification algorithm is used to analyze the change trend of the identified network stability and identify the key security risk factors that affect the network stability, including the following steps: S31. Obtain the historical status record of the target network, count the number of occurrences of potential risk factors in the network, and calculate the distribution ratio of the risk factors; S32. Analyze the distribution of risk factors in the target network based on a data analysis algorithm to generate a distribution pattern of risk factor ratios; S33. Based on the distribution law of the generated risk factor ratios, a network stability risk identification model is constructed, and the constructed network stability risk identification model is deployed to areas with high incidence of risk factors; S34. If the risk level of the high-risk area detected in the target network exceeds the threshold, the risk factor identification algorithm is used to analyze the current target network and identify key security risk factors that affect network stability.

6. A new energy station network security assessment method according to claim 5, characterized in that: The method of analyzing the distribution of risk factors in the target network based on the data analysis algorithm and generating the distribution law of the risk factor ratio includes the following steps: S321, obtaining several risk factors in the target network, analyzing the correlation between the risk factor data using a data analysis algorithm, and obtaining a subset of risk factor data classified by features; S322. Randomly select a number of risk factors from the risk factor data subset as a training set, calculate the entropy gain of risk factors related to network stability, build a risk analysis model, and screen out core risk indicators; S323, verify the consistency of the highly correlated risk factor data, screen out the risk factor data subset with the highest integrity, and divide the risk factor data subset with the highest integrity into several subsets of equal size as the initial training set; S324, calculating the risk change probability of the core risk indicators under different network states, and generating a risk indicator model related to the network state; S325. Use the risk analysis model to check the consistency of the risk indicator pattern and retain the risk data subset with the highest classification accuracy; S326. Combine the risk analysis model with the probability of risk change to analyze the impact of core risk indicators on network stability. If the classification results are inconsistent, the risk factor data will be included in the risk change matrix. If the classification results are consistent, new risk factor data will be introduced to gradually reduce the weight of the risk analysis model, and based on the probability of risk change, generate the distribution law of the risk factor ratio.

7. A new energy station network security assessment method according to claim 6, characterized in that: If the risk level of the high-risk area detected in the target network exceeds the threshold, the risk factor identification algorithm is used to analyze the current target network, and the key security risk factors affecting the network stability are identified, including the following steps: S341, initializing risk identification algorithm parameters, generating an initial population of risk analysis models using low-discrepancy sequence sampling, each model representing a combination of risk factors, and assigning initial positions and parameters; S342. Calculate the risk fitness value of the risk analysis model, sort the risk analysis models by fitness, assign the risk analysis models to different performance levels, and mark the risk analysis model and parameters with the best performance at present; S343, using a model optimization algorithm to optimize the risk analysis model with the best performance, re-evaluating after adjusting the parameters, and selecting the risk analysis model with the highest fitness value as the optimization result; S344. According to the risk probability threshold of the risk analysis model with the highest risk fitness value, adjust the position and parameters of the risk analysis models at each performance level to optimize risk coverage; S345. Continuously evaluate and rank risk analysis models, and generate new risk analysis model positions based on Gaussian variation; if the risk fitness value of the new risk analysis model is greater than the risk fitness value of the current risk analysis model, replace the current risk analysis model, output the final risk analysis model, and identify key risk factors affecting network stability based on the final risk analysis model.

8. A new energy station network security assessment method according to claim 7, characterized in that: The method of optimizing the risk analysis model with the best performance by using the model optimization algorithm, re-evaluating after adjusting the parameters, and selecting the risk analysis model with the highest fitness value as the optimization result comprises the following steps: S3431, initializing the parameters of the model optimization algorithm, and using the modified chaotic tent mapping method to generate an initial risk analysis model population in the risk analysis model parameter search space, each risk analysis model corresponding to a different parameter combination; S3432. Calculate the fitness value of each risk analysis model in the risk analysis model group, evaluate its risk analysis capability, and determine the current optimal risk analysis model according to the fitness value; S3433, using an adaptive learning mechanism to dynamically update the adjustment coefficient according to the current iteration state; S3434. Update the parameter positions of all risk analysis models according to the optimization formula, generate a new risk analysis model population, introduce a refraction adversarial learning mechanism, calculate the parameter combination of each risk analysis model, and adopt a greedy selection strategy to retain the risk analysis model with the highest fitness value between the original risk analysis model and the risk analysis model after refraction adversarial to enter the next generation, while keeping the size of the risk analysis model population unchanged; S3435. Recalculate the fitness value of the updated risk analysis model population, and update the current optimal risk analysis model according to the evaluation results; S3436: If the number of optimization iterations reaches the maximum number of iterations, jump to step S3437; otherwise, return to step S3433 and continue the optimization iteration; S3437. Select the risk analysis model with the highest fitness value from the final risk analysis model population as the optimization result, output the parameter combination of the risk analysis model and the corresponding fitness value, and complete the optimization process.

9. A new energy station network security assessment method according to claim 8, characterized in that: The optimization formula is: Where W i，d represents the new position of the ith risk analysis model on the dth dimension parameter; r1 and r2 both represent adjustment coefficients; ub d represents the upper bound of the search space in the dth dimension; lb d represents the lower bound of the search space in the dth dimension; s represents the distance function; x j represents the parameter value of the dth dimension of the jth risk analysis model; x i represents the parameter value of the dth dimension of the ith risk analysis model; represents the global optimal risk analysis model of the dth dimension in the current risk analysis model group; N represents the total number of risk analysis models.

10. A new energy station network security assessment system, used to implement the new energy station network security assessment method described in any one of claims 1-9, characterized in that: The new energy site network security assessment system includes: The data acquisition module is used to acquire the network operation data of the new energy station and process the network operation data to obtain the network operation characteristic data; The trend analysis module is used to perform stability analysis on the obtained network operation characteristic data based on the network behavior recognition algorithm and identify the changing trend of network stability; The factor identification module is used to analyze the changing trend of the identified network stability based on the risk factor identification algorithm and identify the key security risk factors that affect the network stability; The security assessment module is used to evaluate the identified key security risk factors and the known network security risk factors in the database, and adjust the network protection strategy of the new energy site based on the assessment results.

Images