Nuclear power plant network security event alarm method, equipment, storage medium and system

Abstract

The invention discloses a nuclear power plant network security event alarm method and device, a storage medium and a system, and relates to the technical field of nuclear power plant nuclear security, and the method comprises the steps: obtaining the network security alarm information of a plurality of nuclear power control systems; all the network security alarm information is classified and collected based on preset classification levels, and the number of the classification levels is at least three; whether network security alarm information exists in each classification level is judged, if yes, an alarm signal is generated according to the network security alarm information in each classification level, an alarm prompt corresponding to each classification level is displayed based on the alarm signal, and the network security alarm information of the same classification level corresponds to the same alarm prompt; and judging whether a confirmation operation signal is received or not, and if the confirmation operation signal is received or not received and the network security alarm information automatically disappears, stopping displaying the alarm prompt. According to the invention, the network security information of the nuclear power plant can be alarmed, monitored and processed.

Description

Technical Field

[0001] The present invention relates to the field of nuclear safety technology of nuclear power plants, and in particular to a method, device, storage medium and system for alarming network security events of nuclear power plants. Background Art

[0002] The industrial control system of a nuclear power plant (i.e., nuclear power control system) is the nerve center of a nuclear power plant. It undertakes the core function of nuclear safety assurance while assuming the function of automatic control of power production. At present, with the widespread application of information, digitalization, and intelligentization technologies in the digital instrumentation and control systems of nuclear power plants, network security threats have been brought to the industrial control system of nuclear power plants, thus affecting the network security and nuclear safety of nuclear power plants. At present, there is no method to centrally alarm network security incidents so that staff can centrally handle network security incidents.

[0003] Therefore, how to achieve centralized alarm for network security incidents in nuclear power plants is an issue that urgently needs to be solved. Summary of the invention

[0004] In order to solve the existing problem that network security events cannot be centrally reported, the present invention provides a nuclear power plant network security event report method, device, storage medium and system.

[0005] The technical solution adopted by the present invention to solve the technical problem is: to provide a nuclear power plant network security event alarm method, comprising:

[0006] Obtain network security alarm information of multiple nuclear power control systems;

[0007] Based on the preset classification levels, all network security alarm information is classified and collected, wherein the classification levels include at least three;

[0008] Determine whether there is network security alarm information in each classification level. If so, generate an alarm signal according to the network security alarm information in each classification level, and based on the alarm signal, display the alarm prompt corresponding to each classification level, wherein network security alarm information of the same classification level corresponds to the same alarm prompt;

[0009] Determine whether a confirmation operation signal is received. If a confirmation operation signal is received, stop displaying the alarm prompt; or if no confirmation operation signal is received and the network security alarm information disappears automatically, stop displaying the alarm prompt.

[0010] In one embodiment, based on a preset classification level, the step of classifying and collecting all network security alarm information based on the preset classification level includes:

[0011] Determine the extent of damage to the nuclear power control system caused by network security alarm information;

[0012] If the damage is to the nuclear safety protection function of the nuclear power control system and the important functions of power production, and there are no remedial measures, the classification level of the network security alarm information is emergency level information;

[0013] If the degree of damage is to the nuclear safety protection function of the nuclear power control system and the important function of power production, but there are remedial measures, the classification level of the network security alarm information is important level information;

[0014] If the extent of damage is to the nuclear safety protection function of the nuclear power control system and the general function of power production and does not affect the execution of nuclear safety protection of the nuclear power control system and the operation of power production control, the classification level of the network security alarm information is general level information.

[0015] In one embodiment, the alarm signal includes a general level alarm signal, an important level alarm signal and an emergency level alarm signal, and the step of generating the alarm signal according to the network security alarm information in each classification level includes:

[0016] Generate a general level alarm signal based on general level information;

[0017] Generate an important level alarm signal according to the important level information;

[0018] Generate an emergency level alarm signal according to the emergency level information.

[0019] In one embodiment, the alarm prompt includes a light prompt, wherein the alarm prompt includes a light prompt, wherein the light prompt includes a plurality of display colors, and different display colors correspond to different classification levels.

[0020] In one embodiment, after the step of generating an alarm signal according to the network security alarm information in each classification level, the step further includes:

[0021] The alarm signal corresponding to each classification level is output to the corresponding DO point through the I / O system with independent signal lines;

[0022] When there is an alarm signal at the DO point, the preset DCS human-machine interface and ACP panel will execute the steps based on the alarm signal to display the alarm prompt corresponding to each classification level.

[0023] In one embodiment, the alarm prompt further includes a plurality of sound alarm prompts, and each sound alarm prompt corresponds to each light prompt.

[0024] In one embodiment, it is determined whether a confirmation operation signal is received, and if the confirmation operation signal is received, the alarm prompt is stopped from being displayed, or if the confirmation operation signal is not received and the network security alarm information disappears automatically, the step of stopping the display of the alarm prompt includes:

[0025] If a confirmation operation signal is received and network security alarm information exists, the alarm prompt state is changed;

[0026] If a confirmation operation signal is received and the network security alarm information does not exist, stop displaying the alarm prompt;

[0027] If no confirmation operation signal is received and the network security alarm message disappears automatically, the alarm prompt will stop being displayed.

[0028] In addition, the present invention also provides a device, which is a nuclear power plant network security event alarm device, including a processor and a memory storing a computer program. The processor implements the above-mentioned nuclear power plant network security event alarm steps when executing the computer program.

[0029] In addition, the present invention also provides a storage medium storing a computer program, which implements the steps of the above-mentioned nuclear power plant network security event alarm method when executed by a processor.

[0030] In addition, the present invention also provides a nuclear power plant network security event alarm system, and the nuclear power plant network security event alarm system is the above-mentioned nuclear power plant network security event alarm device.

[0031] In the present invention, by acquiring network security alarm information of multiple nuclear power control systems, the network security alarm information of all nuclear power control systems of a nuclear power plant is collected, so as to facilitate subsequent unified management and improve the management level of the overall network security of the nuclear power plant. Based on the preset classification level (the classification level includes at least three), all network security alarm information is classified and collected, and by dividing all network security alarm information according to different levels, it is possible to accurately manage security events of different levels, ensure the hierarchical display of alarm information at each level, and enable the operator to give priority to more urgent alarm information in the nuclear power control system. It is determined whether there is network security alarm information in each classification level. If so, an alarm signal is generated according to the network security alarm information in each classification level. Based on the alarm signal, the alarm prompts corresponding to each classification level are displayed respectively (network security alarm information of the same classification level corresponds to the same alarm prompt). According to the classification level, the network security alarm information appearing in the nuclear power control system of each nuclear power plant is normalized and displayed, so that the operator can intuitively find network security problems in the nuclear power control system. Determine whether a confirmation operation signal is received. If a confirmation operation signal is received, it means that the operator has discovered the network security alarm information and has processed it. At this time, the alarm prompt stops displaying. If no confirmation operation signal is received and the network security alarm information disappears automatically, the alarm prompt stops displaying. The normalized display of the alarm prompt is convenient for the operator to process the network security alarm information, thereby realizing the alarm and processing of network security alarm events in nuclear power plants. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 It is a flowchart provided by the first embodiment of the nuclear power plant network security incident alarm method of the present invention;

[0034] Figure 2 This is an event collection flow chart provided by the first embodiment of the nuclear power plant network security event alarm method of the present invention;

[0035] Figure 3 This is an alarm information classification diagram provided by the second embodiment of the nuclear power plant network security incident alarm method of the present invention;

[0036] Figure 4 This is a signal transmission diagram provided by the fourth embodiment of the nuclear power plant network security event alarm method of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] The present application embodiment provides a method for alarming network security events in a nuclear power plant. Figure 1 , Figure 1 This is a flow chart of the first embodiment of the nuclear power plant network security incident alarm method of the present application.

[0039] In this embodiment, the data transmission method includes steps S10 to S40:

[0040] Step S10, obtaining network security alarm information of multiple nuclear power control systems;

[0041] It should be noted that a network security alarm event collector is set up in the nuclear power control system of each nuclear power plant, and the network security alarm information is obtained through the network security alarm event collector. After the network security alarm event collector obtains the network security alarm information, it will pass through a safety isolation device, and then the network security alarm information will be centrally sent to the network security alarm event management platform. For example, the network security alarm event collector is similar to the anti-virus software in the computer, and the safety isolation device is similar to the firewall in the computer.

[0042] Specifically, refer to Figure 2 There are n nuclear power plants and n nuclear power control systems, nuclear power control system 1, nuclear power control system 2, ..., nuclear power control system n. Network security alarm event collectors are set in multiple nuclear power control systems of nuclear power plants to respectively collect network security alarm information in the nuclear power control systems of corresponding nuclear power plants, and send the network security alarm information to the same network security alarm event management platform through the safety isolation device of each nuclear power control system of the nuclear power plant. It should be noted that the purpose of setting the safety isolation device is to avoid the network of each nuclear power control system of the nuclear power plant being connected when the network security alarm event collector sends the network security alarm information to the same network security alarm event management platform.

[0043] Step S20, classifying and collecting all network security alarm information based on preset classification levels, wherein the classification levels include at least three;

[0044] It should be noted that the preset classification level is artificially set based on the urgency of the alarm and the degree of damage to the nuclear power control system. All transmitted network security alarm information is classified and collected on the network security alarm event management platform. In order to more accurately display the urgency of the network security alarm information, the classification level includes at least three, rather than simply being divided into two categories: urgent and non-urgent.

[0045] Specifically, network security alarm information from multiple nuclear power control systems in a nuclear power plant is centrally sent to a network security alarm event management platform through a safety isolation device, and is classified on the network security alarm event management platform.

[0046] Step S30, determining whether there is network security alarm information in each classification level, and if so, generating an alarm signal according to the network security alarm information in each classification level, and displaying the alarm prompt corresponding to each classification level based on the alarm signal, wherein network security alarm information of the same classification level corresponds to the same alarm prompt;

[0047] It should be noted that the alarm signal may be an electrical signal, and this electrical signal may be realized through a digital signal or an analog signal.

[0048] Specifically, for a certain classification level, when network security alarm information of this classification level exists, the alarm signal of this classification level will be continuously generated to continuously control the display of the alarm prompt. When there is no network security alarm information in this classification level, the alarm signal will not be generated accordingly. It is judged whether there is network security alarm information in each classification level. If so, an electrical signal is generated according to the network security alarm information in each classification level, and the alarm prompt corresponding to each classification level is controlled and displayed by the corresponding electrical signal.

[0049] Step S40, determining whether a confirmation operation signal is received, if the confirmation operation signal is received, stopping displaying the alarm prompt; or if the confirmation operation signal is not received and the network security alarm information automatically disappears, stopping displaying the alarm prompt.

[0050] It should be noted that the confirmation operation signal is input by the operator on the ACP panel or DCS human-machine interface.

[0051] Specifically, when a confirmation operation signal is received, it means that the operator has processed the network security alarm information and stops displaying the alarm prompt. If no confirmation operation signal is received, but the network security alarm information disappears automatically, the alarm prompt will also stop being displayed. For example, if the alarm signal in the nuclear power control system of a nuclear power plant is caused by a Trojan virus invasion, and there is no manual confirmation by the operator after the virus is cleared, the nuclear power control system may determine through an automatic diagnosis mechanism (for example, the virus removal program detects no abnormality or the system returns to normal) that the alarm information no longer needs to be displayed, and then automatically stops the flashing of the alarm indicator light, cancels the alarm sound, and turns off the flashing icon on the DCS human-machine interface.

[0052] In a feasible implementation manner, the alarm prompt includes a light prompt, wherein the light prompt includes a plurality of display colors, and different display colors correspond to different classification levels.

[0053] In a feasible implementation manner, the alarm prompt further includes a plurality of sound alarm prompts, and each sound alarm prompt corresponds to each light prompt.

[0054] In the present invention, by acquiring network security alarm information of multiple nuclear power control systems, the network security alarm information of all nuclear power control systems of a nuclear power plant is collected, so as to facilitate subsequent unified management and improve the management level of the overall network security of the nuclear power plant. Based on the preset classification level (the classification level includes at least three), all network security alarm information is classified and collected, and by dividing all network security alarm information according to different levels, it is possible to accurately manage security events of different levels, ensure the hierarchical display of alarm information at each level, and enable the operator to give priority to more urgent alarm information in the nuclear power control system. It is determined whether there is network security alarm information in each classification level. If so, an alarm signal is generated according to the network security alarm information in each classification level. Based on the alarm signal, the alarm prompts corresponding to each classification level are displayed respectively (network security alarm information of the same classification level corresponds to the same alarm prompt). According to the classification level, the network security alarm information appearing in the nuclear power control system of each nuclear power plant is normalized and displayed, so that the operator can intuitively find network security problems in the nuclear power control system. Determine whether a confirmation operation signal is received. If a confirmation operation signal is received, it means that the operator has discovered the network security alarm information and has processed it. At this time, the alarm prompt stops displaying. If no confirmation operation signal is received and the network security alarm information disappears automatically, the alarm prompt stops displaying. The normalized display of the alarm prompt is convenient for the operator to process the network security alarm information, thereby realizing the alarm and processing of network security alarm events in nuclear power plants.

[0055] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be described in detail later. Figure 3 The step S20 classifies and collects all network security alarm information based on the preset classification level, and further includes steps S21 to S24:

[0056] Step S21, determining the degree of damage caused by the network security alarm information to the nuclear power control system;

[0057] Specifically, for each network security alarm information, sufficient research and analysis is required to analyze the source of the attack, possible attack paths, and assets of the attacked nuclear power control system that may be affected by the attack. Based on the analysis of the attacked assets, the system function execution capabilities affected by the attack, as well as the nuclear power control system's own response measures, the extent of damage suffered by the nuclear power control system can be determined.

[0058] Step S22: If the damage degree is to damage the nuclear safety protection function and the important power production function of the nuclear power control system and there is no remedial measure, the classification level of the network security alarm information is emergency level information;

[0059] It should be noted that the nuclear safety protection function refers to the key control functions in nuclear power plants used to ensure the safe shutdown of nuclear reactors, prevent the release of radioactive materials, and protect the safety of on-site workers and the public. The important power production function refers to the core control and operation functions that nuclear power plants must have in order to achieve safe and stable power generation. For example, the rapid insertion function of nuclear reactor control rods is used to quickly stop nuclear reactions under abnormal circumstances. If this function fails due to a cyber attack, it may lead to serious consequences such as core meltdown. The automatic load regulation function of the generator set or the main steam pressure control function of the turbine. If these functions fail, it may cause equipment damage or power supply interruption.

[0060] Specifically, the degree of damage caused by the network security alarm information to the nuclear power control system is judged. If the degree of damage is to the safety protection function and important production functions of the store, and there is no remedial measure, then the network security alarm information is classified as emergency level information.

[0061] Step S23: If the degree of damage is that the nuclear safety protection function of the nuclear power control system and the important function of power production are damaged but there are remedial measures, the classification level of the network security alarm information is important level information;

[0062] For example, a cyber attack causes the loss of the main reactor cooling pump monitoring signal, but the backup cooling pump can be enabled through backup sensors or manual operation to maintain the core cooling function.

[0063] Specifically, if the extent of damage is to the nuclear safety protection function of the nuclear power control system and the important power production function, but for some equipment, there are other remedial measures, such as direct control or replacement of equipment through buttons, control switches, backup equipment, etc. to ensure the normal operation of the equipment, then this network security alarm information is classified as important level information.

[0064] Step S24: If the degree of damage is to the nuclear safety protection function of the nuclear power control system and the general function of power production and does not affect the execution of nuclear safety protection of the nuclear power control system and the operation of power production control, the classification level of the network security alarm information is general level information.

[0065] It should be noted that general functions refer to some auxiliary systems, such as data acquisition systems, surveillance camera systems, equipment health monitoring, etc. They have no direct impact on the protection of nuclear safety, but they can improve the visibility and monitoring of the system.

[0066] In this embodiment, by classifying all network security alarm information of multiple nuclear power control systems into emergency level information, important level information and general level information, it is ensured that in subsequent operations, operators can make timely and reasonable response measures under different network security threat scenarios.

[0067] Based on the first and second embodiments of the present application, in the third embodiment of the present application, the same or similar contents as those in the first or second embodiments can be referred to the above description, and will not be described in detail later. On this basis, the alarm signal includes a general level alarm signal, an important level alarm signal, and an emergency level alarm signal, and the step S30 of generating an alarm signal according to the network security alarm information in each classification level also includes steps S31 to S33:

[0068] Step S31, generating a general level alarm signal according to the general level information; Step S32, generating an important level alarm signal according to the important level information; Step S33, generating an emergency level alarm signal according to the emergency level information.

[0069] It should be noted that general level alarm signals, important level alarm signals and emergency level alarm signals are all control signals used to control the display and stop display of alarm prompts. These control signals can be digital signals (0 or 1) or logic signals (high level or low level). The three levels of alarm signals will be transmitted to different places. In addition, the alarm signal is generated and output through the I / O (input / output) system or I / O device.

[0070] Specifically, for general level information, the I / O system will output an alarm signal to the corresponding alarm prompt device. For important level information, the I / O system will output an alarm signal to the alarm prompt device corresponding to the important level information. For emergency level information, the I / O system will also output an alarm signal to the alarm prompt device corresponding to the emergency level information.

[0071] Based on the first, second and third embodiments of the present application, in the fourth embodiment of the present application, the same or similar contents as those of the first, second or third embodiments can be referred to the above description, and will not be described in detail later. On this basis, after the step S30 generates an alarm signal according to the network security alarm information in each classification level, steps S31 to S32 are also included:

[0072] Step S31, output the alarm signal corresponding to each classification level to the corresponding DO point through the I / O system with independent signal lines; Step S32, when there is an alarm signal at the DO point, the preset DCS human-machine interface and ACP panel will execute the steps of displaying the alarm prompt corresponding to each classification level based on the alarm signal.

[0073] It should be noted that the DO point is a data output point (logical quantity), which is used to control the start and stop, switch, output strength, etc. of the equipment displaying the alarm prompt. The DCS (Digital Control System, which is the nuclear power control system of the present invention) human-machine interface and ACP (Auxiliary control panel, nuclear power plant auxiliary control panel) panel are devices used to display alarm prompts, and can also receive external input operations. The signal line refers to the hard wiring.

[0074] In addition, it should be noted that through network communication, the DCS human-machine interface will also display the detailed content and alarm location of the network security alarm information, which is convenient for operators to view and process.

[0075] Specifically, the network security alarm information corresponding to each classification level is transmitted to the I / O system, and the corresponding alarm signal is generated by the I / O system. Then, through the I / O system, multiple hard wirings are connected, and the alarm signal corresponding to each classification level is output to the corresponding DO point through hard wiring. The alarm signal is output through the DO point to control the DCS human-machine interface and ACP panel to display the alarm prompt corresponding to each classification level. In addition, the alarm signal output at the DO point also needs to be connected to the hard wiring and equipment (such as switches) of the DCS system to be transmitted to the DCS human-machine interface at the ACP panel for transmission.

[0076] Reference Figure 4In a feasible implementation, the emergency level information (orange) indicates that when the network security alarm information of the emergency level is transmitted to the I / O system, the network security alarm information is generated into an emergency level alarm signal through the I / O system, the I / O system is connected to a hard wiring, and the emergency level alarm signal is transmitted to the emergency level DO point through the hard wiring, and the alarm signal (e.g., high level (1)) is output to the DCS human-machine interface and the ACP panel through the emergency level DO point, the orange icon of the DCS human-machine interface is controlled to light up, and a continuous high-pitched alarm sound of 85dB to 110dB is emitted at the DCS host, and an alarm light at the ACP panel is controlled to emit an orange light and a continuous high-pitched alarm sound of 85dB to 110dB is emitted at the ACP panel. Important level information (yellow) indicates that when important level network security alarm information is transmitted to the I / O system, an important level alarm signal is generated, and the important level alarm signal is transmitted to the important level DO point through hard wiring. Similarly, the yellow icon of the DCS human-machine interface is controlled to light up, and an intermittent medium-pitched alarm sound of 75dB to 90dB is emitted at the DCS host, and another alarm light at the ACP panel is controlled to emit a yellow light and an intermittent medium-pitched alarm sound of 75dB to 90dB is emitted at the ACP panel. General level information (white) indicates that when important level network security alarm information is transmitted to the I / O system, a general level alarm signal is generated, and the general level alarm signal is transmitted to the general level DO point through hard wiring. Similarly, the white icon of the DCS human-machine interface is controlled to light up, and an alarm sound of a low-frequency intermittent prompt sound of 60dB to 75dB (such as a "beep") is emitted at the DCS host, and another alarm light at the ACP panel is controlled to emit a white light and an intermittent medium-pitched alarm sound of 60dB to 75dB is emitted at the ACP panel.

[0077] In addition, network security alarm information at each classification level will also be transmitted to the KSM (factory-wide industrial control system network security management center) system.

[0078] In this embodiment, network security alarm information of different classification levels is converted into alarm signals, and corresponding alarm prompts are displayed on the same DCS human-machine interface and ACP panel. This unified display method facilitates operators to quickly process network security alarm information.

[0079] Based on the first and second embodiments and the third and fourth embodiments of the present application, in the fifth embodiment of the present application, the same or similar contents as those of the first embodiment, the second embodiment, the third embodiment, or the fourth embodiment can be referred to the above description, and will not be described in detail later. On this basis, step S40 determines whether a confirmation operation signal is received. If the confirmation operation signal is received, the alarm prompt is stopped from being displayed, or if the confirmation operation signal is not received and the network security alarm information disappears automatically, the step of stopping the display of the alarm prompt also includes steps S41 to S43:

[0080] Step S41, if a confirmation operation signal is received and the network security alarm information exists, the alarm prompt state is changed; Step S42, if a confirmation operation signal is received and the network security alarm information does not exist, the alarm prompt is stopped; Step S43, if no confirmation operation signal is received and the network security alarm information disappears automatically, the alarm prompt is stopped.

[0081] It should be noted that both the DCS human-machine interface and the ACP panel can receive confirmation operations, and the two are synchronized. The confirmation operation received on the DCS human-machine interface or the ACP panel will synchronously affect the other party.

[0082] Specifically, when an alarm signal is output, the alarm icon on the DCS human-machine interface will flash and display, and the host of the DCS system will make a sound. The ACP panel is equipped with an alarm indicator corresponding to each classification level, and the alarm indicator will also flash and display and make a sound. The operator confirms the alarm, the DCS human-machine interface or the ACP panel receives the confirmation operation signal, but the alarm source does not disappear, the alarm indicator lights up but does not flash, does not make a sound, the icon on the DCS human-machine interface lights up but does not flash, and the alarm sound disappears; the operator confirms the alarm, the DCS human-machine interface or the ACP panel receives the confirmation operation signal, and the alarm source disappears, the alarm indicator does not display or make a sound, the icon on the DCS human-machine interface does not display, and the alarm sound disappears; when the alarm source disappears, but the operator does not confirm the alarm, the DCS human-machine interface or the ACP panel does not receive the confirmation operation, the alarm indicator does not flash, the icon on the DCS human-machine interface flashes less frequently, and the alarm sound disappears.

[0083] In this embodiment, by receiving the confirmation operation signal and eliminating the corresponding network security alarm information, it is ensured that the operator responds and confirms the alarm in time, thereby reducing unnecessary alarm prompts and sound interference, and improving the efficiency and accuracy of alarm processing. By synchronously displaying the confirmation operation on the DCS human-computer interaction interface and the ACP panel, after the operator confirms on any interface, the alarm indicator light and icon will no longer flash and display, and the alarm sound will disappear, avoiding repeated alarm interference. At the same time, it is determined whether there is network security alarm information in each classification level and whether to continue to output the alarm signal or stop displaying the alarm prompt according to whether there is an alarm signal, which can ensure that the alarm prompt always remains valid when the alarm source continues to exist, and stop the alarm prompt in time after the alarm source disappears. If the alarm source still exists, the system continues to output the alarm signal and display the alarm prompt; if the alarm source has disappeared, the alarm signal is stopped and the alarm prompt is turned off, avoiding the interference of invalid alarm prompts and optimizing the alarm management process. Based on the processing flow of alarm confirmation and state change, the alarm response efficiency of the nuclear power plant is improved, while the efficient response of the operator is guaranteed.

[0084] In combination with one or more of the above embodiments, illustratively, two nuclear power control systems (i.e., nuclear power plant industrial control systems) of a nuclear power plant are invaded by Trojan viruses, resulting in the nuclear power control system being unable to control the reactor cooling system. The network security alarm event collector collects the network security alarm information, and sends the network security alarm information to the network security alarm event management platform through the safety isolation device. According to the classification level, the network security alarm information is classified as important level information on the network security alarm event management platform, and an important level alarm signal is generated in the I / O system. The important level alarm signal is transmitted to the important level DO point through a hard wiring connection to the important level DO point. The alarm signal of the important level DO point controls an alarm indicator light of the ACP panel to emit a 2Hz yellow flashing light and an intermittent medium-pitched alarm sound of 75dB to 90dB. The alarm signal of the important level DO point controls the DCS human-machine interface to display a yellow flashing icon, and an intermittent medium-pitched alarm sound of 75dB to 90dB is emitted at the host of the DCS system. A few minutes later, the operator controlled the reactor cooling system through buttons or controllers, and cleared the Trojan viruses of the two nuclear power control systems. The network security alarm information disappeared, but no operator performed the alarm confirmation operation. Neither the DCS human-machine interface nor the ACP panel received the confirmation operation signal. The flashing frequency of the alarm indicator light became 0.5Hz, and no sound was made. At the same time, the flashing frequency of the icon on the DCS human-machine interface also became lower, and the host of the DCS system did not make an alarm sound. When the operator came to the main control room and performed the alarm confirmation operation on the DCS human-machine interface, the DCS human-machine interface received the confirmation operation signal, the alarm prompt disappeared, the alarm indicator light no longer flashed, no longer made an alarm sound, the icon on the DCS human-machine interface did not light up, and the host of the DCS system no longer made a sound.

[0085] Finally, it should be noted that the steps in the method of the embodiment of the present invention can be adjusted in order, combined, and deleted according to actual needs.

[0086] In addition, the present invention also provides a nuclear power plant network security event alarm device, including a processor and a memory storing a computer program, and the processor implements the above-mentioned nuclear power plant network security event alarm steps when executing the computer program.

[0087] The nuclear power plant network security event alarm device provided by the present application adopts the nuclear power plant network security event alarm method in the above embodiment, which can solve the technical problem of alarm monitoring and processing of the network security of the nuclear power plant. Compared with the prior art, the beneficial effects of the intelligent device provided by the present application are the same as the beneficial effects of the nuclear power plant network security event alarm method provided by the above embodiment, and the other technical features of the nuclear power plant network security event alarm device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0088] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the nuclear power plant network security incident alarm method as described above are implemented.

[0089] A person skilled in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing the hardware related to the device through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0090] In addition, the present invention also provides a nuclear power plant network security event alarm system, and the nuclear power plant network security event alarm system is the above-mentioned nuclear power plant network security event alarm device.

[0091] The nuclear power plant network security event alarm method provided by the present application can solve the technical problem of alarm monitoring and processing of the network security of the nuclear power plant. Compared with the prior art, the beneficial effects of the nuclear power plant network security event alarm system provided by the present application are the same as the beneficial effects of the nuclear power plant network security event alarm method provided by the above embodiment, which will not be repeated here.

[0092] In addition, those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by functional modules in the device, which will not be elaborated herein.

[0093] What is disclosed above is only a preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. A person skilled in the art can understand that all or part of the processes of the above embodiments and equivalent changes made according to the claims of the present invention still fall within the scope of the invention.

Claims

1. A method for alarming network security events in a nuclear power plant, characterized in that: The nuclear power plant network security incident alarm method comprises: Obtain network security alarm information of multiple nuclear power control systems; Classify and collect all the network security alarm information based on preset classification levels, wherein the classification levels include at least three; Determine whether the network security alarm information exists in each of the classification levels; if so, generate an alarm signal according to the network security alarm information in each of the classification levels; based on the alarm signal, respectively display the alarm prompt corresponding to each of the classification levels, wherein the network security alarm information of the same classification level corresponds to the same alarm prompt; Determine whether a confirmation operation signal is received, if the confirmation operation signal is received, stop displaying the alarm prompt; or if the confirmation operation signal is not received and the network security alarm information automatically disappears, stop displaying the alarm prompt.

2. The nuclear power plant network security incident alarm method according to claim 1, characterized in that: The step of classifying and collecting all the network security alarm information based on the preset classification level includes: Determining the extent of damage to the nuclear power control system caused by the network security alarm information; If the degree of damage is damage to the nuclear safety protection function and important power production function of the nuclear power control system, and there is no remedial measure, the classification level of the network security alarm information is emergency level information; If the degree of damage is damage to the nuclear safety protection function and important power production function of the nuclear power control system but there are remedial measures, the classification level of the network security alarm information is important level information; If the degree of damage is damage to the nuclear safety protection function and the general function of power production of the nuclear power control system and does not affect the execution of nuclear safety protection and the operation of power production control of the nuclear power control system, then the classification level of the network security alarm information is general level information.

3. The method for alarming network security incidents in a nuclear power plant according to claim 2, characterized in that: The alarm signal includes a general level alarm signal, an important level alarm signal and an emergency level alarm signal. The step of generating an alarm signal according to the network security alarm information in each classification level includes: generating the general level alarm signal according to the general level information; Generate the importance level alarm signal according to the importance level information; The emergency level alarm signal is generated according to the emergency level information.

4. The nuclear power plant network security event alarm method according to claim 1, characterized in that: The alarm prompt includes a light prompt, wherein the light prompt includes a plurality of display colors, and different display colors correspond to different classification levels.

5. The nuclear power plant network security incident alarm method according to claim 1, characterized in that: After the step of generating an alarm signal according to the network security alarm information in each classification level, the following step is further included: Outputting the alarm signal corresponding to each classification level to the corresponding DO point through an I / O system with an independent signal line; When the DO point has the alarm signal, the preset DCS human-machine interface and ACP panel execute the steps of displaying the alarm prompt corresponding to each classification level based on the alarm signal.

6. The method for alarming network security incidents in a nuclear power plant according to claim 4, characterized in that: The alarm prompt also includes a plurality of sound alarm prompts, and each of the sound alarm prompts corresponds to each of the light prompts.

7. The nuclear power plant network security event alarm method according to claim 1, characterized in that: The step of judging whether a confirmation operation signal is received, and if the confirmation operation signal is received, stopping displaying the alarm prompt, or if the confirmation operation signal is not received and the network security alarm information disappears automatically, stopping displaying the alarm prompt also includes: If the confirmation operation signal is received and the network security alarm information exists, then the alarm prompt state is changed; If the confirmation operation signal is received and the network security alarm information does not exist, stop displaying the alarm prompt; If the confirmation operation signal is not received and the network security alarm message disappears automatically, the alarm prompt is stopped from being displayed.

8. A nuclear power plant network security event alarm device, comprising a processor and a memory storing a computer program, characterized in that: The processor implements the steps of the nuclear power plant network security incident alarm method as described in any one of claims 1-7 when executing the computer program.

9. A storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the nuclear power plant network security incident alarm method described in any one of claims 1 to 7 are implemented.

10. A nuclear power plant network security incident alarm system, characterized in that: The nuclear power plant network security event alarm system includes the nuclear power plant network security event alarm device described in claim 8.

Images