New energy station 5G network security risk assessment system

Abstract

The invention discloses a new energy station 5G network security risk assessment system, and relates to the technical field of network security, and the system comprises the following components: a data collection module, a data analysis module, a threat prediction module, an early warning module and a database module. The detection and prediction accuracy of the network security threats is improved, the system can more accurately evaluate the currently occurring security threats through the hybrid model of the multi-layer perceptron and the fuzzy logic reasoning, and the prediction model based on the combination of the time sequence analysis and the Bayesian network can more accurately evaluate the security threats generated at present. And potential network security threats in the future can be predicted more accurately.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and specifically to a 5G network security risk assessment system for new energy stations. Background Art

[0002] With the vigorous development of the new energy industry, the number and scale of new energy stations are expanding, and their network security issues are becoming increasingly prominent. New energy stations usually rely on 5G networks for data transmission and remote control. The openness, complexity and dynamism of 5G networks make them vulnerable to various network security threats. These threats may cause abnormal operation of new energy stations, data leakage or damage, and even cause significant economic losses and social impacts.

[0003] The traditional network security risk assessment system for new energy stations has shortcomings. It is difficult to accurately capture potential security threats, cannot accurately evaluate current security threats, lacks comprehensive consideration of the impact of different factors on network security threats in the prediction model, and cannot accurately predict potential network security threats in the future.

[0004] To sum up, the research and development of the 5G network security risk assessment system for new energy stations is of great significance. In view of the shortcomings of traditional technologies, it is particularly important to develop a 5G network security risk assessment system for new energy stations. Summary of the invention

[0005] In order to make up for the shortcomings of the prior art, the purpose of the present invention is to provide a 5G network security risk assessment system for new energy stations. The system uses a hybrid model of multi-layer perceptron and fuzzy logic reasoning to accurately evaluate the current security threats that have occurred, and combines a prediction model that combines time series analysis and Bayesian network to accurately predict potential network security threats in the future.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a 5G network security risk assessment system for new energy stations, the system comprising a data acquisition module, a data analysis module, a threat prediction module and an early warning module and a database module;

[0007] The data acquisition module collects massive real-time data in the 5G network of the new energy station, including but not limited to equipment operation parameters, network communication data, meteorological data and data related to station operation and network status, and continuously collects relevant data according to the set collection frequency and data format by connecting with various equipment and meteorological monitoring equipment in the 5G network of the new energy station, and transmits the collected data to the data analysis module in real time;

[0008] The data analysis module: Connected to the data acquisition module, it analyzes the collected real-time data and stored historical data using an innovative artificial intelligence hybrid algorithm developed independently to detect current security threats that have occurred and predict potential future cybersecurity threats. The specific innovative artificial intelligence hybrid algorithm is as follows:

[0009] Let the set of collected real-time data be R = {r1, r2, r3, …, r n}, and the set of historical data be H = {h1, h2, h3, …, h m}. Preprocess the data, including data cleaning to remove outliers and normalization operations to make the data in the interval [0, 1]. Introduce a hybrid model of a multi-layer perceptron and fuzzy logic inference (FLI). For the MLP part, the number of neurons in the input layer is determined according to the data feature dimension and set to d. Set two hidden layers. The number of hidden neurons in the first layer is The number of hidden neurons in the second layer is The number of neurons in the output layer is 2, corresponding to the probability P c of detecting the current security threat and the probability P f of predicting future potential security threats respectively;

[0010] The weight update of the MLP adopts the adaptive gradient descent algorithm, and its learning rate η is dynamically adjusted according to the degree of data fluctuation. Let the data fluctuation index be σ, then The initial weight value adopts the random initialization method, and the value range is between [-0.1, 0.1]. For the FLI part, the division of the fuzzy set is determined according to the distribution characteristics of the data. The operating parameters of the device have a value range of [a, b], and the data is mainly concentrated in the interval [c, d] (a < c < d < b). Then the fuzzy set is divided into three levels: low, medium, and high, and their membership functions are respectively:

[0011] For the low level:

[0012] For the medium level:

[0013] For the high level:

[0014] Through the fuzzy inference rule, combine the probability output by the MLP with the fuzzy set to obtain the final security threat assessment result;

[0015] The threat prediction module is connected to the data analysis module, and predicts future potential network security threats based on the analysis results of the historical data and real-time data by the data analysis module in combination with a specific prediction model. The prediction model is constructed based on a method combining time series analysis and Bayesian network. Assume that the time series data is T = {t1, t2, t3, ..., t p}, where t i It represents the characteristic value of the data related to network security collected at time i. The time series data is tested for stationarity by using the ADF test. If the data is not stationary, it is stabilized by the difference method. An autoregressive moving average model is constructed. The autoregressive order is q and the moving average order is r. The parameters of the ARMA model are estimated by the least squares method. The objective function is:

[0016]

[0017] Among them, θ represents the parameter set of the ARMA model, Represents the data feature value at time i predicted by the ARMA model;

[0018] Based on the ARMA model, the Bayesian network is introduced to consider the impact of different factors on network security threats. The nodes of the Bayesian network include time series data feature nodes, meteorological condition nodes, and equipment operation status nodes. The conditional probability distribution of the Bayesian network is determined by a large amount of historical data and expert knowledge. Through the reasoning mechanism of the Bayesian network, combined with the characteristic values ​​of the time series data predicted by the ARMA model, the prediction results of potential network security threats that may appear in the future under different conditions are obtained;

[0019] The early warning module is connected to the threat prediction module. When the threat prediction module predicts that the potential network security threat reaches the set early warning threshold, the early warning information is issued in a timely manner and sent in a variety of ways;

[0020] The database module stores collected real-time data, analyzed and processed data, and feature data related to network security threats.

[0021] Furthermore, when collecting meteorological data, the data acquisition module adopts different data acquisition frequencies for different types of meteorological sensors. For those with higher real-time requirements, the acquisition frequency is set to once every f1 seconds, f1=10; for those with relatively slow changes, the acquisition frequency is set to once every f2 seconds, f2=60. Through this differentiated acquisition frequency setting, it can not only ensure the timeliness of obtaining key meteorological data, but also avoid the burden of data storage and transmission caused by excessive collection. When collecting equipment operating parameters, the data collection accuracy of key equipment is set to p decimal places, p=3, to ensure that subtle changes in the equipment operating status can be accurately captured, providing a more accurate data basis for subsequent data analysis.

[0022] Furthermore, the data analysis module adopts an adaptive normalization method of data distribution characteristics when performing normalization operation of data preprocessing. For the collected data set D = {d1, d2, d3, ..., d s}, calculate the mean of the data set and standard deviation σ, According to the distribution of data, classification and normalization are performed. If the data distribution is relatively uniform, that is, the standard deviation σ is less than or equal to the set threshold τ1, the linear normalization method is used to normalize the data to the [0, 1] interval. The formula is: If the data distribution is uneven, that is, the standard deviation σ is greater than the set threshold τ1, then a nonlinear normalization method is used, logarithmic normalization, the formula is: is the ith data in the data set after normalization, min(D) is the minimum value in the data set D, and max(D) is the maximum value in the data set D. The adaptive normalization method can better adapt to the characteristics of different types of data, improve the effect of data preprocessing, and provide higher quality data for subsequent algorithm analysis.

[0023] Furthermore, when the data analysis module constructs a hybrid model based on a multi-layer perceptron and fuzzy logic reasoning, for the multi-layer perceptron part, its activation function adopts an adaptive hyperbolic tangent function, which is defined as: Among them, α is an adaptive parameter, and its value is dynamically adjusted according to the absolute value of the input data. When the absolute value of the input data is less than or equal to the set threshold τ2, τ2 = 0.5, α = 1; when the absolute value of the input data is greater than the set threshold τ2, Using the adaptive hyperbolic tangent function as the activation function can better adjust the output of neurons under different input data conditions, improve the learning and prediction capabilities of the multi-layer perceptron, and thus improve the accuracy of the entire data analysis module in assessing security threats.

[0024] Furthermore, when determining the fuzzy set membership function of the fuzzy logic reasoning part, the data analysis module not only considers the distribution characteristics of the data, but also introduces the time factor. For the equipment operation parameter data, its value range and distribution will be different in different time periods. For example, during the peak operation period of power generation equipment during the day, the value range of the equipment operation parameters may be wider than at night, and the data distribution is also more dispersed. When determining the membership function, the distribution interval of the data is calculated according to different time periods, and the membership functions of different time periods are constructed according to the membership function construction method described in claim 1 above. Through this membership function determination method that considers the time factor, the actual situation of the data in different time periods can be more accurately reflected, thereby improving the accuracy of fuzzy logic reasoning in security threat assessment.

[0025] Furthermore, when constructing the autoregressive moving average model, the threat prediction module adopts an optimization method of the information criterion to determine the autoregressive order q and the moving average order r, and calculates the Akaike information criterion AIC and the Bayesian information criterion BIC under different order combinations respectively. The value range of the autoregressive order q is set to [1, Q], and the value range of the moving average order r is set to [1, R]. For each possible order combination (q, r), the corresponding AIC value AIC(q, r) and BIC value BIC(q, r) are calculated, and the order combination with the smallest AIC value and the smallest BIC value is selected as the final order of the autoregressive moving average model. Through this optimization method based on the information criterion, the order of the ARMA model can be determined more accurately, the model's fitting ability for time series data can be improved, and the prediction accuracy of the threat prediction module for future potential network security threats can be improved.

[0026] Furthermore, when the threat prediction module uses the Bayesian network to consider the impact of different factors on network security threats, the connection relationship between nodes in the Bayesian network is determined based on historical data and expert knowledge. A supplementary method of data correlation analysis is introduced to perform correlation analysis on the various types of collected data, calculate the correlation coefficient between each pair, and judge the potential relationship between the data based on the size and positive and negative correlation coefficient. If the absolute value of the correlation coefficient between the two data is greater than the set threshold τ3 (such as τ3=0.3), it is a positive correlation, then a direct connection between the nodes corresponding to the two data is established in the Bayesian network. If the absolute value of the correlation coefficient between the two data is greater than the set threshold τ3 and it is a negative correlation, then an indirect connection between the nodes corresponding to the two data is established in the Bayesian network (connected through intermediate nodes). Through this supplementary method based on data correlation analysis, the relationship between data can be considered more comprehensively, the structure of the Bayesian network can be improved, and the completeness of the Bayesian network's consideration of factors affecting network security threats can be improved, thereby improving the prediction accuracy of the threat prediction module.

[0027] Furthermore, when the warning module issues a warning message, in addition to the common methods of SMS, SMS sending frequency f3, email, email sending frequency f4, and the station internal alarm system, it will also adopt different display methods according to the severity of the warning. For predicted serious security threats, the warning information will be displayed in red bold font in the SMS and email, and in the station internal alarm system, it will be prompted by a flashing red indicator light with a piercing alarm sound. For more serious security threats, the warning information will be displayed in orange bold font in the SMS and email, and in the station internal alarm system, it will be prompted by a permanently lit orange indicator light. For medium security threats, the warning information will be displayed in yellow bold font in the SMS and email, and in the station internal alarm system, it will be prompted by a slowly flashing yellow indicator light. For minor security threats, the warning information will be displayed in green bold font in the SMS and email, and in the station internal alarm system, it will be prompted by a permanently lit green indicator light. Through this differentiated display method according to the severity of the warning, the station operation and maintenance personnel and management personnel can more intuitively understand the severity of the security threat, so as to take corresponding preventive measures more quickly.

[0028] Furthermore, when storing data, the database module adopts a hierarchical storage structure to store the collected real-time data in layers in chronological order, with each layer corresponding to a specific time period. The first layer corresponds to the data of the most recent month, the second layer corresponds to the data of the most recent three months, and so on. The analyzed data and the characteristic data related to network security threats are classified and stored according to their importance and relevance. Important and highly relevant data are stored near the top layer, and relatively unimportant and less relevant data are stored near the bottom layer. During the data storage process, data compression technology is used to compress the data of each layer to reduce the space occupied by data storage. Through the combination of this hierarchical storage structure and data compression technology, the efficiency of data storage can be improved, data query and extraction can be facilitated, and more convenient data support can be provided for the data analysis module and the threat prediction module.

[0029] Compared with the existing technology, a 5G network security risk assessment system for new energy stations has the following beneficial effects:

[0030] 1. The present invention improves the accuracy of detection and prediction of network security threats through artificial intelligence hybrid algorithms and prediction models. Through the hybrid model of multi-layer perceptron and fuzzy logic reasoning, the system can more accurately evaluate the current security threats that have occurred, and the prediction model based on the combination of time series analysis and Bayesian network can more accurately predict potential network security threats in the future.

[0031] 2. The present invention realizes comprehensive and real-time monitoring and evaluation of 5G network security of new energy stations by integrating multiple modules such as data collection, data analysis, threat prediction, early warning and database management. The system can timely detect and warn of potential network security threats, effectively improving the network security protection capabilities of new energy stations. At the same time, the system can also efficiently process and analyze the massive amount of collected data, providing scientific and accurate decision-making support for station operation and maintenance personnel, and further ensuring the stable operation of new energy stations. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 An operation flow chart of a 5G network security risk assessment system for new energy stations. DETAILED DESCRIPTION

[0034] The technical solutions in the embodiments of the present invention are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] Embodiment 1

[0036] This embodiment describes a new energy wind farm located in a remote area, which uses a 5G network for data transmission and remote control. In view of the geographical location and operational characteristics of the wind farm, its network security faces multiple challenges. To ensure the network security of the wind farm, the wind farm adopts a new energy site 5G network security risk assessment system to achieve comprehensive network security monitoring and early warning.

[0037] Through customized interfaces, it connects with various equipment in the wind farm, including wind turbines, transformers, meteorological sensors, and meteorological monitoring equipment, to ensure the comprehensiveness and accuracy of the data. According to the equipment characteristics and operational needs, a reasonable collection frequency and data format are set. For example, for wind speed and wind direction meteorological data, a collection frequency of once per second is adopted. For the speed and temperature of key equipment operating parameters of wind turbines, high-precision and high-frequency data collection methods are adopted to capture slight changes in the equipment. 5G network is used for data transmission to ensure the real-time and reliability of the data. At the same time, the data is encrypted to prevent the data from being stolen or tampered with during transmission.

[0038] Using an artificial intelligence hybrid algorithm, analyze the collected real-time data and the stored historical data. Let the set of collected real-time data be R = {r1, r2, r3, …, r n}, and the set of historical data be H = {h1, h2, h3, …, h m}. Preprocess the data, including data cleaning to remove outliers and normalization operations to make the data in the interval [0, 1]. Introduce a hybrid model of a multi-layer perceptron and fuzzy logic inference (FLI). For the MILP part, the number of neurons in the input layer is determined according to the data feature dimension, set as d. Set two hidden layers. The number of neurons in the first hidden layer is The number of neurons in the second hidden layer is The number of neurons in the output layer is 2, corresponding to the probability P c of detecting the current security threat and the probability P f of predicting future potential security threats respectively;

[0039] For the weight update of the MLP, use the adaptive gradient descent algorithm, and its learning rate η is dynamically adjusted according to the degree of data fluctuation. Let the data fluctuation index be σ, then The initial weight value is randomly initialized, and the value range is between [-0.1, 0.1]. For the FLI part, the division of the fuzzy set is determined according to the distribution characteristics of the data. The operating parameters of the device have a value range of [a, b], and the data is mainly concentrated in the interval [c, d] (a < c < d < b). Then the fuzzy set is divided into three levels: low, medium, and high, and their membership functions are respectively:

[0040] For the low level:

[0041] For the medium level:

[0042] For the high level:

[0043] Through the fuzzy inference rules, combine the probability output by the MLP with the fuzzy set to obtain the final security threat assessment result. The fuzzy inference rules are as follows: If P current is “high” and P future is “high” then the security threat level is “severe”. If P current is “high” and P future is “medium” then the security threat level is “relatively severe”. If P current is “high” and P future is “low” then the security threat level is “medium”. If P current is “medium” and P futureIf it is “high”, then the security threat level is “relatively serious”. If P current is “medium” and P future If it is “medium”, then the security threat level is “medium”. If P current is “medium” and P future If it is “low”, then the security threat level is “slight”. If P current is “low” and P future If it is “high”, then the security threat level is “medium”. If P current is “low” and P future If it is “medium”, then the security threat level is “slight”. If P current is “low” and P future If it is “low”, then the security threat level is “no obvious threat”. This algorithm combines multiple technologies such as data preprocessing, multi-layer perceptron, and fuzzy logic reasoning to improve the accuracy and efficiency of analysis. Through in-depth analysis of data, it can timely detect current security threats that have occurred, such as equipment failures and network attacks. The system can automatically identify the threat type, source, and severity, and generate corresponding reports. Based on the historical data and the changing trend of current data, a prediction model combining time series analysis and Bayesian network is used to predict potential future network security threats. The prediction results include threat type, occurrence time, and impact scope, providing strong support for the network security protection of the wind farm.

[0044] According to the results of the data analysis module and the actual situation of the wind farm, continuously optimize the prediction model to improve the accuracy and reliability of the prediction. Consider different weather conditions, equipment status, and operation strategy factors to predict potential network security threats under multiple scenarios. Let the time series data be T = {t1, t2, t3, …, t p}, where t i represents the data characteristic value related to network security collected at time i. Conduct a stationarity test on the time series data using the ADF test. If the data is non-stationary, make it stationary through the differencing method. Construct an autoregressive moving average model. Let the autoregressive order be q and the moving average order be r. Estimate the parameters of the ARMA model by the least squares method, and its objective function is:

[0045]

[0046] where θ represents the parameter set of the ARMA model, represents the data characteristic value predicted at time i through the ARMA model. This helps the wind farm formulate a more comprehensive security protection plan.

[0047] When the threat prediction module predicts that the potential network security threat reaches the set warning threshold, the warning module will issue a warning message in a timely manner. The warning information is sent through a variety of methods, including SMS, email, phone and the internal alarm system of the station to ensure that relevant personnel can quickly receive the warning information. According to the severity and urgency of the warning, different display methods are used, such as red bold font, flashing red indicator light, and sound alarm to attract the attention of relevant personnel. At the same time, the system can also provide detailed warning information and recommended measures to help relevant personnel respond and handle quickly.

[0048] The collected real-time data, analyzed and processed data, and characteristic data related to network security threats are stored in the database. A hierarchical storage structure is used to classify and store data from different time periods, and the data is classified and managed according to its importance and relevance. The database is encrypted to prevent illegal access or tampering of the data. At the same time, the database is backed up and restored regularly to ensure data reliability and availability.

[0049] Embodiment 2

[0050] This embodiment describes a new energy photovoltaic power station. As an important part of regional energy supply, it has thousands of photovoltaic panels and supporting inverters and combiner boxes. Throughout the site, data transmission and remote monitoring of various equipment rely on 5G network technology. However, with the widespread application of 5G networks, network security issues have become increasingly prominent. In order to ensure the stability and security of the photovoltaic power station's 5G network, the power station management decided to implement a real-time network security risk assessment system.

[0051] The system is connected to various equipment of the photovoltaic power station through interfaces, including but not limited to photovoltaic panels, inverters, junction boxes and meteorological monitoring equipment. The system collects the operating parameters of photovoltaic panels, inverter status data, network communication data and meteorological data in real time according to the set collection frequency. After these data are collected, they will be immediately transmitted to the data analysis module for further processing. In the data collection process, the system adopts differentiated collection strategies for different types of data and equipment. For data with high real-time requirements, such as the voltage and current of photovoltaic panels, the system sets a higher collection frequency to ensure the timeliness and accuracy of the data. For data that changes relatively slowly, such as meteorological data, the system appropriately reduces the collection frequency to reduce the burden of data storage and transmission.

[0052] After receiving the collected data, the data analysis module first performs data preprocessing, including data cleaning, outlier removal and normalization operations. Then, the preprocessed data is analyzed using an artificial intelligence hybrid algorithm. Suppose the collected real-time data set is R = {r1, r2, r3, …, r n}, the historical data set is H = {h1, h2, h3, …, h m}, preprocess the data, including data cleaning to remove outliers and normalization operations to make the data in the interval [0, 1]. Introduce a hybrid model of a multi-layer perceptron and fuzzy logic inference (FLI). For the MILP part, the number of neurons in the input layer is determined according to the data feature dimension and set to d. Set two hidden layers. The number of neurons in the first hidden layer is The number of neurons in the second hidden layer is The number of neurons in the output layer is 2, corresponding to the probability P of detecting the current security threat c and the probability P of predicting future potential security threats f ;

[0053] The weight update of the MLP adopts the adaptive gradient descent algorithm, and its learning rate η is dynamically adjusted according to the degree of data fluctuation. Let the data fluctuation index be σ, then The initial weight value adopts the random initialization method, and the value range is between [-0.1, 0.1]. For the FLI part, the division of the fuzzy set is determined according to the distribution characteristics of the data. The operating parameters of the device have a value range of [a, b], and the data is mainly concentrated in the interval [c, d] (a < c < d < b). Then the fuzzy set is divided into three levels: low, medium, and high, and their membership functions are respectively:

[0054] For the low level:

[0055] For the medium level:

[0056] For the high level:

[0057] Through the fuzzy inference rules, combine the probability output by the MLP with the fuzzy set to obtain the final security threat assessment result. The fuzzy inference rules are as follows: If P current is “high” and P future is “high” then the security threat level is “severe”. If P current is “high” and P future is “medium” then the security threat level is “relatively severe”. If P current is “high” and P future is “low” then the security threat level is “medium”. If P current is “medium” and P future is “high” then the security threat level is “relatively severe”. If P current is “medium” and P future is “medium” then the security threat level is “medium”. If P currentis” in” andP future is "low" then the security threat level is "minor" IfP current is”low” andP future is "high" then the security threat level is "medium" IfP current is”low” andP future is "medium" then the security threat level is "minor" IfP current is "low" and P future is”low” then the security threat level is “no obvious threat”, in order to detect the current security threats and predict the potential network security threats in the future. This artificial intelligence hybrid algorithm combines the advantages of multi-layer perceptron (MLP) and fuzzy logic reasoning (FLI), and can more accurately assess network security risks. In the MLP part, the system uses an adaptive hyperbolic tangent function as the activation function to improve the generalization ability of the model. In the FLI part, the system introduces the time factor. According to the distribution characteristics of the data and the different time periods, the membership functions of different time periods are constructed respectively, making the security threat assessment results more accurate;

[0058] Based on the output results of the data analysis module, a prediction model is constructed by combining time series analysis and Bayesian network methods to predict potential threats. The system first tests the stability of the time series data and uses the difference method to make it stable. Then, an autoregressive moving average (ARMA) model is constructed and the model parameters are estimated by the least squares method.

[0059] Among them, θ represents the parameter set of the ARMA model, It represents the data feature value at time i predicted by the ARMA model. On the basis of the ARMA model, the system introduces the Bayesian network to consider the impact of different factors on network security threats. The nodes of the Bayesian network include time series data feature nodes, meteorological condition nodes and equipment operation status nodes. Through the reasoning mechanism of the Bayesian network, the system can predict potential network security threats that may appear in the future under different conditions.

[0060] When a potential network security threat is predicted, the early warning module will be activated immediately, and the system will send out early warning information in a variety of ways, including text messages, emails and the internal alarm system of the station. The frequency and content of the early warning information are customized according to the severity of the warning. For predicted serious security threats, the early warning information will be displayed in red bold font, and in the internal alarm system of the station, a flashing red indicator light and a piercing alarm sound will be used to prompt. For more serious, medium and minor security threats, the early warning information will be displayed in orange, yellow and green bold fonts respectively, and different indicator lights will be used in the internal alarm system of the station. After receiving the early warning information, the power station staff will immediately take corresponding countermeasures. For serious and more serious security threats, the staff will immediately activate the emergency plan and report to the superior management department. For medium and minor security threats, the staff will investigate and handle them according to the specific circumstances.

[0061] The database module uses a hierarchical storage structure to store relevant data. The system stores the collected real-time data in layers in chronological order. Each layer corresponds to a specific time period. For the data of the most recent month, the system stores it near the top layer for quick access and analysis. For older data, it is gradually stored downward to the bottom layer. At the same time, the system also classifies, stores and manages the analyzed data and feature data related to network security threats. These data are sorted and stored according to their importance and relevance to ensure that important data can be processed and managed with priority. During the data storage process, the system also uses data compression technology to reduce the occupancy of data storage space. By compressing the data at each layer, the system can more effectively utilize storage space and reduce storage costs.

[0062] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A 5G network security risk assessment system for new energy stations, characterized in that: The system includes data acquisition module, data analysis module, threat prediction module, early warning module and database module: The data acquisition module collects massive real-time data in the 5G network of the new energy station, including but not limited to equipment operation parameters, network communication data, meteorological data and data related to station operation and network status, and continuously collects relevant data according to the set collection frequency and data format by connecting with various equipment and meteorological monitoring equipment in the 5G network of the new energy station, and transmits the collected data to the data analysis module in real time; The data analysis module is connected to the data acquisition module and uses an artificial intelligence hybrid algorithm to analyze the collected real-time data and the stored historical data. The artificial intelligence hybrid algorithm is as follows: Assume that the real-time data set collected is R = {r1, r2, r3, ..., r n }, the historical data set is H = {h1,h2,h3,…,h m }, preprocess the data, including data cleaning to remove outliers and normalization operations, so that the data is in the range of [0, 1]. A hybrid model of multilayer perceptron and fuzzy logic inference (FLI) is introduced. For the MILP part, the number of neurons in the input layer is determined according to the data feature dimension and is set to d. The hidden layer is set to two layers, and the number of hidden neurons in the first layer is The number of hidden neurons in the second layer is The number of neurons in the output layer is 2, corresponding to the probability P of detecting the current security threat. c and the probability P of predicting future potential security threats f ; The weight update of the MLP adopts the adaptive gradient descent algorithm, and its learning rate η is dynamically adjusted according to the degree of data fluctuation. Let the data fluctuation index be σ, then The initial weight value is randomly initialized, and the value range is between [-0.1, 0.1]. For the FLI part, the division of the fuzzy set is determined according to the distribution characteristics of the data. The device operation parameters have a value range of [a, b], and the data is mainly concentrated in the interval [c, d] (a < c < d < b). Then the fuzzy set is divided into three levels: low, medium, and high, and their membership functions are respectively: For low level: For the intermediate level: For high level: Through fuzzy inference rules, the probability output by MLP is combined with the fuzzy set to obtain the final security threat assessment result; The threat prediction module is connected to the data analysis module, and predicts future potential network security threats based on the analysis results of the historical data and real-time data by the data analysis module in combination with a specific prediction model. The prediction model is constructed based on a method combining time series analysis and Bayesian network. Assume that the time series data is T = {t1, t2, t3, ..., t p }, where t i It represents the characteristic value of the data related to network security collected at time i. The time series data is tested for stationarity by using the ADF test. If the data is not stationary, it is stabilized by the difference method. An autoregressive moving average model is constructed. The autoregressive order is q and the moving average order is r. The parameters of the ARMA model are estimated by the least squares method. The objective function is: Among them, θ represents the parameter set of the ARMA model, Represents the data feature value at time i predicted by the ARMA model; Based on the ARMA model, the Bayesian network is introduced to consider the impact of different factors on network security threats. The nodes of the Bayesian network include time series data feature nodes, meteorological condition nodes, and equipment operation status nodes. Through the reasoning mechanism of the Bayesian network and the time series data feature values ​​predicted by the ARMA model, the prediction results of potential network security threats that may appear in the future under different conditions are obtained. The early warning module is connected to the threat prediction module. When the threat prediction module predicts that the potential network security threat reaches the set early warning threshold, the early warning information is issued in a timely manner and sent in a variety of ways; The database module stores collected real-time data, analyzed and processed data, and feature data related to network security threats.

2. According to claim 1, a 5G network security risk assessment system for new energy stations is characterized in that: When collecting meteorological data, the data acquisition module adopts different data acquisition frequencies for different types of meteorological sensors. For those with higher real-time requirements, the acquisition frequency is set to once every f1 seconds, f1=10. For those with relatively slow changes, the acquisition frequency is set to once every f2 seconds, f2=60. When collecting equipment operating parameters, the data acquisition accuracy for key equipment is set to p decimal places, p=3.

3. According to claim 1, a 5G network security risk assessment system for new energy stations is characterized in that: The data analysis module adopts an adaptive normalization method of data distribution characteristics when performing normalization operation of data preprocessing. For the collected data set D={d1, d2, d3, ..., d s }, calculate the mean of the data set and standard deviation σ, According to the distribution of data, classification and normalization are performed. If the data distribution is relatively uniform, that is, the standard deviation σ is less than or equal to the set threshold τ1, the linear normalization method is used to normalize the data to the [0, 1] interval. The formula is: If the data distribution is uneven, that is, the standard deviation σ is greater than the set threshold τ1, then a nonlinear normalization method is used, logarithmic normalization, the formula is: is the i-th data in the normalized data set, min(D) is the minimum value in the data set D, and max(D) is the maximum value in the data set D.

4. According to claim 1, a 5G network security risk assessment system for new energy stations is characterized in that: When the data analysis module constructs a hybrid model based on a multi-layer perceptron and fuzzy logic reasoning, for the multi-layer perceptron part, its activation function adopts an adaptive hyperbolic tangent function, which is defined as: Among them, α is an adaptive parameter, and its value is dynamically adjusted according to the absolute value of the input data. When the absolute value of the input data is less than or equal to the set threshold τ2, τ2 = 0.5, α = 1; when the absolute value of the input data is greater than the set threshold τ2, 5. According to claim 1, a 5G network security risk assessment system for new energy stations is characterized in that: When determining the fuzzy set membership function of the fuzzy logic reasoning part, the data analysis module not only considers the distribution characteristics of the data, but also introduces the time factor. For the equipment operation parameter data, its value range and distribution will be different in different time periods. When determining the membership function, the distribution interval of the data is calculated according to different time periods, and the membership functions of different time periods are constructed according to the membership function construction method described in claim 1 above.

6. According to claim 1, a 5G network security risk assessment system for new energy stations is characterized in that: When constructing the autoregressive moving average model, the threat prediction module adopts an optimization method of information criterion to determine the autoregressive order q and the moving average order r, and calculates the Akaike information criterion AIC and the Bayesian information criterion BIC under different order combinations respectively. Assuming that the value range of the autoregressive order q is [1, Q], and the value range of the moving average order r is [1, R], for each possible order combination (q, r), calculate its corresponding AIC value AIC(q, r) and BIC value BIC(q, r), and select the order combination with the smallest AIC value and the smallest BIC value as the final order of the autoregressive moving average model.

7. According to claim 1, a 5G network security risk assessment system for new energy stations is characterized in that: When the threat prediction module uses the Bayesian network to consider the impact of different factors on network security threats, in addition to determining the connection relationship between nodes in the Bayesian network based on historical data and expert knowledge, it also introduces a supplementary method of data correlation analysis, performs correlation analysis on various types of collected data, calculates the correlation coefficient between each pair, and judges the potential relationship between the data based on the size and positive and negative correlation coefficient.

8. According to claim 1, a 5G network security risk assessment system for new energy stations is characterized in that: When issuing a warning message, the warning module will use different display methods according to the severity of the warning, in addition to the common methods of SMS, SMS sending frequency f3, email, email sending frequency f4, and the station internal alarm system. For predicted serious security threats, the warning message will be displayed in red bold font in the SMS and email, and in the station internal alarm system, it will be prompted by a flashing red indicator light and a shrill alarm sound. For more serious security threats, the warning message will be displayed in orange bold font in the SMS and email, and in the station internal alarm system, it will be prompted by a permanently lit orange indicator light. For medium security threats, the warning message will be displayed in yellow bold font in the SMS and email, and in the station internal alarm system, it will be prompted by a slowly flashing yellow indicator light. For minor security threats, the warning message will be displayed in green bold font in the SMS and email, and in the station internal alarm system, it will be prompted by a permanently lit green indicator light.

9. According to claim 1, a 5G network security risk assessment system for new energy stations is characterized in that: When storing data, the database module adopts a hierarchical storage structure, and stores the collected real-time data in layers in chronological order. Each layer corresponds to a specific time period. The data that has been analyzed and processed and the characteristic data related to network security threats are classified and stored according to their importance and relevance. Important and highly relevant data are stored near the top layer, and relatively unimportant and less relevant data are stored near the bottom layer. During the data storage process, data compression technology is used to compress the data of each layer.

Images