Command and control system safety risk assessment method based on linear influence

Abstract

The invention discloses a command and control system safety risk assessment method based on linear influence. Firstly, a command and control system physical connection diagram and an information flow diagram are established, and a cause and effect diagram base diagram is formed through cross-layer aggregation of base diagrams; eliminating a non-causal relationship in the base map in a spanning tree form in a direction opposite to the direction of motion conduction; establishing an index extraction system, and decomposing resource nodes in the causal graph into index nodes; performing input normalization and data interpolation processing on the input system operation original data; calculating a linear relation between an abnormal node and a child node on each path through least square estimation; traversing all subsequent paths of the abnormal node, and calculating the influence degree of the abnormal node on each path; and outputting the influence degree, the influence domain range and the alarm level of the abnormal node on the subsequent node. According to the method, influence results of abnormal nodes in different risk scenes can be effectively calculated, and the reliability and safety of a command and control system are improved.

Description

Technical Field

[0001] The invention relates to the technical field of command and control system security risk assessment, and in particular to a command and control system security risk assessment method based on linear influence. Background Art

[0002] With the rapid development of robotics technology, robot swarms are increasingly used in many fields, such as industrial production, logistics distribution, and environmental monitoring. However, the complexity of robot swarm collaboration and management increases accordingly. Especially when the number of robots is large and the task environment is complex, the stability and security of the robot swarm command and control system become the key factors that determine whether the system can operate effectively. The existing robot swarm command and control systems generally adopt a multi-level, multi-node structural design, covering different functional modules and robot units, which work collaboratively through a complex communication network. In this process, due to the openness, distribution, and interactivity of the system, the system is susceptible to various external or internal risk factors, such as communication failures, hardware damage, software vulnerabilities, environmental interference, and human operation errors.

[0003] In order to reduce potential risks, reduce system defects and improve system robustness, security risk assessment has become a key means, which is of great significance to the reliability of robot cluster command and control systems in future automation tasks. In the existing technology, the methods for security risk assessment of robot cluster command and control systems mostly rely on qualitative analysis and empirical judgment, and lack the means to accurately quantify risks. In addition, the existing evaluation system often ignores the dynamic interaction between components within the system and the real-time response capability under abnormal conditions. This makes it difficult to accurately predict and evaluate the potential impact of the system when it is disturbed or fails in practical applications, which in turn affects the scientific nature of command decisions and the pertinence of system optimization. Summary of the invention

[0004] In response to the shortcomings of the above-mentioned technologies, the present invention provides a command and control system security risk assessment method based on linear impact. By constructing a dynamic task impact estimation model, it can perform real-time security risk assessment on the robot cluster command and control system under different dangerous scenarios, providing a more accurate and real-time risk assessment tool for the robot cluster command and control system.

[0005] The technical solution to the technical problem of the present invention is: a command and control system security risk assessment method based on linear influence, comprising the following steps:

[0006] S1: Establish the physical connection diagram and information flow diagram of the command and control system, and perform cross-layer aggregation of the base map to form a cause-effect diagram base map;

[0007] S2: Obtain a causal graph by eliminating the non-causal relationships in the base graph from the opposite direction of the causal conduction in the form of a spanning tree;

[0008] S3: Establish an indicator extraction system to decompose the resource nodes in the causal diagram into indicator nodes;

[0009] S4: Perform input normalization processing on the input command and control system operation raw data;

[0010] S5: Perform data interpolation on the data processed in step S4;

[0011] S6: Calculate the linear relationship from the abnormal node to the child nodes on each path through least squares estimation;

[0012] S7: traverse all subsequent paths of the abnormal node and calculate the impact of the abnormal node on each path;

[0013] S8: Output the influence degree and influence domain range of the abnormal node on the subsequent nodes according to the calculation result of step S7, and obtain the alarm level of the command and control system.

[0014] Furthermore, in step S1, the step of establishing the physical connection graph includes: determining each subsystem in the command and control system as a node in the graph; identifying the physical connection medium between the subsystems, determining the physical connection relationship between the subsystems, and representing it in the graph by the connection of the edges between the nodes; determining the direction of the edges in the graph according to the communication direction between the subsystems;

[0015] The steps of establishing the information flow diagram include: determining each subsystem in the command and control system and treating it as a node in the diagram; analyzing the data flow between the subsystems and determining the propagation path of data from one subsystem to another, which is represented in the diagram by the connection between the nodes; determining the direction of the edge in the diagram according to the data propagation flow between the subsystems;

[0016] The implementation steps of cross-layer aggregation of the base map include: matching all subsystem nodes of the physical connection map and the information flow map; merging the physical connection map and the information flow map, retaining the connection relationship and direction between the nodes in the two maps to obtain the cause-effect map base map.

[0017] Furthermore, in step S2, in the causal graph base map generated in step S1, nodes that will not be affected are eliminated from the direction opposite to the cause conduction in the form of a generation tree, and first a set of abnormal nodes is generated, the set including abnormal nodes marked due to faults, errors or abnormal behaviors; nodes in the set are selected in turn as current processing nodes, if the node is not in the taboo table, a set of neighbor resource nodes directly connected to it is generated, and a neighbor resource node is selected from it to check whether it is the parent node of the current node, if so, it is added as a neighbor node and a connection is established, if not, other neighbor resource nodes are continued to be selected until all neighbor nodes are traversed, and this process is repeated until all abnormal nodes are processed, and finally the processed causal graph is output.

[0018] Furthermore, in step S3, the indicator extraction is to decompose the resource nodes in the causal graph into indicator nodes that can be quantitatively described, select the state parameters that can characterize the working performance of the nodes as the extracted indicator nodes according to the specific resource nodes, and establish an indicator extraction system; the established indicator extraction system is divided into two parts: intra-resource indicator extraction and inter-resource indicator extraction; intra-resource indicator extraction includes message output density, memory utilization, processing delay and other indicators that can characterize the internal state parameters of the resources, and inter-resource indicator extraction includes access message density, output target number, access target number and other indicators that can characterize the state parameters between resources; according to the established indicator extraction system, determine the extraction indicators corresponding to each resource node in the system, and decompose each resource node into indicator nodes.

[0019] Furthermore, in step S4, according to the indicator nodes decomposed in step S3, the corresponding state data of each indicator node during the normal operation of the command and control system are collected as raw data, and the raw data are processed by a linear normalization processing method, and the formula is:

[0020]

[0021] In the formula, x is the original data value, x max and x min are the maximum and minimum values ​​in the original data, respectively, norm is the normalized data value.

[0022] Furthermore, in step S5, data interpolation is used to process the data obtained in step S4, and the formula is as follows:

[0023]

[0024] Where, t i represents the interpolation time point, t start and t end Respectively represent the start and end time points of the interpolation interval, It means that after interpolation at time t i The data value of and Respectively represent the time t start and t end The data value of .

[0025] Furthermore, in step S6, the implementation method of calculating the linear relationship from the abnormal node to the sub-nodes on each path by least squares estimation is as follows:

[0026] When the relationship between two indicator nodes is a linear relationship y=ax+b, the measurement data can be expressed as follows:

[0027] Y=Hx+e

[0028] in:

[0029]

[0030] where {x0,x1,…,x n} and {y0,y1,…,y n} are the sampling data of the two index nodes, {e0,e1,…,e n} is process noise;

[0031] The i-th measurement residual ε i for:

[0032]

[0033] Among them, Y i is the sampling data of the i-th index node, H i is the i-th row of the linear relationship coefficient matrix;

[0034] The sum of all measurement errors J is:

[0035]

[0036] Let J The first-order partial derivative of is equal to 0, and the optimal estimate can be calculated The calculation is done using the following formula:

[0037]

[0038] Furthermore, in step S7, all subsequent paths of the abnormal node are traversed by a depth-first algorithm to calculate the influence of the abnormal node on each path. The influence calculation method for a single path is as follows:

[0039] There is a fault propagation path A→B→C→…→N. The linear relationship from A to B is y=a1x+b1, the linear relationship from A to C is y=a2x+b2, and the linear relationship from A to the nth child node is y=a n x+b n ;

[0040] The calculation steps of the influence degree of abnormal nodes on the path are as follows:

[0041] The following formula is used to sum the absolute values ​​of the linear coefficients from the abnormal node to all child nodes on the path:

[0042] a sum =|a1|+|a2|+…+|a n |

[0043] Among them, n is the total number of child nodes, a i Represents the influence weight of the abnormal node on the i-th child node;

[0044] Use the following activation function to convert a sum Mapped to between 0 and 1 to get the corresponding impact degree Inf val :

[0045]

[0046] Furthermore, in step S8, by comparing the influence of the abnormal node obtained in step S7 on all subsequent paths, the propagation path with the greatest influence is obtained, and the resource set to which the nodes on the path belong is the influence domain of the abnormal node; the maximum influence obtained in step S7 is compared with the preset threshold value, and the current alarm level Inf of the command and control system is calculated according to the following formula: lv It is divided into three levels: mild, general and severe:

[0047]

[0048] Compared with the prior art, the present invention has the following significant advantages:

[0049] According to the task requirements of robot cluster control in the information age, the present invention constructs a robot cluster command and control system network topology and an indicator extraction system, simplifies the risk assessment process of complex robot cluster command and control systems, and establishes a dynamic task impact estimation model for robot cluster command and control systems based on linear least squares. This model can simply and effectively calculate the impact results under different risk scenarios, improves the shortcomings of traditional risk assessment methods in qualitative analysis and real-time performance, and is of great significance to macro-control and system optimization in robot cluster control. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1This is an overall process framework diagram of the command and control system security risk assessment method based on linear influence of the present invention.

[0051] Figure 2 This is a schematic diagram of cross-layer aggregation of the base map of the present invention.

[0052] Figure 3 It is a schematic diagram of reverse elimination of aliasing of the present invention.

[0053] Figure 4 This is a schematic diagram of the index extraction of the present invention. DETAILED DESCRIPTION

[0054] In order to better understand the present invention, the embodiments of the present invention are explained in detail below with reference to the accompanying drawings and embodiments.

[0055] The present invention provides a command and control system security risk assessment method based on linear influence, and its overall process framework is as follows: Figure 1 As shown, the following steps are included:

[0056] S1: Establish the physical connection diagram and information flow diagram of the command and control system, and perform cross-layer aggregation of the base map to form a cause-effect diagram base map;

[0057] S2: Obtain a causal graph by eliminating the non-causal relationships in the base graph from the opposite direction of the causal conduction in the form of a spanning tree;

[0058] S3: Establish an indicator extraction system to decompose the resource nodes in the causal diagram into indicator nodes;

[0059] S4: Perform input normalization operation on the input command and control system operation raw data;

[0060] S5: Perform data interpolation on the data processed in step S4;

[0061] S6: Calculate the linear relationship from the abnormal node to the child nodes on each path through least squares estimation;

[0062] S7: traverse all subsequent paths of the abnormal node and calculate the impact of the abnormal node on each path;

[0063] S8: Output the influence degree and influence domain range of the abnormal node on the subsequent nodes according to the calculation result of step S7, and obtain the alarm level of the command and control system.

[0064] Furthermore, in step S1, since the linear influence algorithm can only be calculated on one graph, cross-layer aggregation of the base graph is required. The steps of establishing the physical connection graph include: determining each subsystem in the command and control system and using it as a node in the graph; identifying the physical connection medium between the subsystems, determining the physical connection relationship between the subsystems, and representing it in the graph through the connection of the edges between the nodes; determining the direction of the edges in the graph according to the communication direction between the subsystems. The steps of establishing the information flow graph include: determining each subsystem in the command and control system and using it as a node in the graph; analyzing the data flow direction between the subsystems, determining the propagation path of data from one subsystem to another, and representing it in the graph through the connection of the edges between the nodes; determining the direction of the edges in the graph according to the data propagation flow direction between the subsystems. The steps of implementing cross-layer aggregation of the base graph include: matching all subsystem nodes of the physical connection graph and the information flow graph; merging the physical connection graph and the information flow graph, and retaining the connection relationship and direction between the nodes of the two.

[0065] Furthermore, in step S2, since in the causal graph, the abnormal node is used as the initial point and its influence degree and influence domain are identified in the direction of the child node, and the parent node and ancestor node of the node will not be affected by it, the nodes that will not be affected are eliminated from the opposite direction of the cause conduction in the form of a tree, so as to achieve the purpose of eliminating confusion, reducing the scale of calculation, and improving the recognition efficiency. First, an abnormal node set is generated, and the set includes abnormal nodes marked due to faults, errors or abnormal behaviors. The nodes in the set are selected as the current processing nodes in turn. If the node is not in the taboo table, its neighbor resource node set is generated, and a neighbor resource node is selected from it to check whether it is the parent node of the current node. If it is, it is added as a neighbor node and a connection is established. If not, other neighbor resource nodes are selected until all neighbor nodes are traversed. Repeat this process until all abnormal nodes are processed, and finally output the generated tree structure.

[0066] Furthermore, in step S3, the index extraction is to decompose the resource nodes in the causal graph into index nodes that can be described quantitatively, select the state parameters that can characterize the working performance of the nodes as the extracted index nodes according to the specific resource nodes, and establish an index extraction system. The established index extraction system is divided into two parts: intra-resource index extraction and inter-resource index extraction. The intra-resource index extraction includes message output density, memory utilization, processing delay and other indicators that can characterize the internal state parameters of the resources, and the inter-resource index extraction includes access message density, output target number, access target number and other indicators that can characterize the state parameters between resources. According to the established index extraction system, the extraction index corresponding to each resource node in the system is determined, and each resource node is decomposed into an index node.

[0067] Furthermore, in step S4, according to the indicator nodes decomposed in step S3, the corresponding state data of each indicator node during the normal operation of the command and control system are collected as raw data. Due to the different types of input data, there is a large order of magnitude difference, and input normalization can avoid the prediction error problem caused by the large order of magnitude difference. The processing method used is linear normalization, and its formula is:

[0068]

[0069] In the formula, x is the original data value, x max and x min are the maximum and minimum values ​​in the original data, respectively, norm is the normalized data value.

[0070] Furthermore, in step S5, since different indicator nodes have different sampling frequencies and different numbers of collected samples within a certain sampling time T, data interpolation is used to synchronize the data of different indicator nodes in time, and the formula is as follows:

[0071]

[0072] Where, t i represents the interpolation time point, t start and t end Respectively represent the start and end time points of the interpolation interval, It means that after interpolation at time t i The data value of and Respectively represent the time t start and t end The data value of .

[0073] For detailed explanation, assume that the sampling frequencies of indicator nodes A, B, and C are 2s, 3s, and 5s respectively, and the sampling time is 10s. Then the sampling data of indicator node A is {d A0 ,d A2 ,d A4 ,d A6 ,d A8 ,d A10}, the sampling data of index node B is {d B0 ,d B3 ,d B6 ,d B9}, the sampling data of the index node C is {d C0 ,d C5 ,d C10}, the sampled data subscript indicates the data sampled by a node at time. Now synchronize the data of index nodes A and C to the time axis of B. After time synchronization, the data of index node A is {dA0 ,d A3 ,d A6 ,d A9}, the data of index node C is {d C0 ,d C3 ,d C6 ,d C9}.

[0074] Furthermore, in step S6, the implementation method of calculating the linear relationship from the abnormal node to the sub-nodes on each path by least squares estimation is as follows:

[0075] When the relationship between two indicator nodes is a linear relationship y=ax+b, the measurement data can be expressed as follows:

[0076] Y=Hx+e

[0077] in:

[0078]

[0079] where {x0,x1,…,x n} and {y0,y1,…,y n} are the sampling data of the two index nodes respectively,

[0080] {e0,e1,…,e n} is process noise;

[0081] The i-th measurement residual ε i for:

[0082]

[0083] Among them, Y i is the i-th sampling data of the index node, H i is the i-th row of the linear relationship coefficient matrix;

[0084] The sum of all measurement errors J is:

[0085]

[0086] Let J The first-order partial derivative of is equal to 0, and the optimal estimate can be calculated The calculation is done using the following formula:

[0087]

[0088] Through least squares estimation, the linear relationship from the abnormal node to the child nodes on each path can be calculated, paving the way for subsequent impact search.

[0089] Furthermore, in step S7, all subsequent paths of the abnormal node are traversed by a depth-first algorithm to calculate the influence of the abnormal node on each path. The influence calculation method for a single path is as follows:

[0090] There is a fault propagation path A→B→C→…→N. The linear relationship from A to B is y=a1x+b1, the linear relationship from A to C is y=a2x+b2, and the linear relationship from A to the nth child node is y=a n x+b n .

[0091] The calculation steps of the influence degree of abnormal nodes on the path are as follows:

[0092] The following formula is used to sum the absolute values ​​of the linear coefficients from the abnormal node to all child nodes on the path:

[0093] a sum =|a1|+|a2|+…+|a n |

[0094] Where n is the total number of child nodes, a i Represents the influence weight of the abnormal node on the i-th child node. The sum of the influence weights is to calculate the overall influence of the abnormal node on the propagation path rather than the influence on a single node.

[0095] Due to a sum The output result is a linear combination of the weights, which has a low data expression ability. The following activation function is used to convert a sum Mapped to between 0 and 1 to get the corresponding influence degree Inf val , giving it stronger expressive power and decision boundaries, and solving the problem of inseparable results.

[0096]

[0097] Furthermore, in step S8, the impact domain range (Inf a ) refers to the set of resource nodes on the path with the greatest impact of the abnormal node on all paths within a certain time window. By comparing the impact of the abnormal node obtained in step S7 on all subsequent paths, the propagation path with the greatest impact is obtained, and the set of resource nodes on this path is the impact domain of the abnormal node.

[0098] Alarm level (Inf lv ) is used to evaluate the severity of the impact of the resource node on other resource nodes in the command and control system within the specified time window. The maximum impact of the abnormal node obtained in step S7 is compared with the preset threshold value, and the current alarm level of the command and control system can be divided into three levels: slight, general, and severe according to the following formula:

[0099]

[0100] In order to facilitate the understanding of the present invention, the command and control system security risk assessment method of the present invention is described below in conjunction with specific embodiments:

[0101] Example 1

[0102] like Figure 2 As shown in the figure, the constructed robot cluster command and control system includes 5 visual perception systems, 3 sensor perception systems, 3 data processing systems, and 5 decision analysis systems. The abnormal node is the 012 visual perception system. The failure of this node causes the message output density to be too high. A command and control system security risk assessment method based on linear influence is proposed. The method steps include:

[0103] S1: Establish the physical connection diagram and information flow diagram of the robot cluster command and control system and perform cross-layer aggregation of the base map to form a causal diagram base map such as Figure 2 As shown;

[0104] S2: Figure 2 As shown in the figure, if the 012 visual perception system is abnormal, the 200 comprehensive processing system, 103 command and control system, 403 command and control system, 301 situation analysis system, 302 command and guidance system, and 303 task planning system will be affected, and the remaining nodes will not be affected. Eliminate the nodes that will not be affected, and the cause-effect diagram is obtained after processing. Figure 3 As shown;

[0105] S3: Figure 4 As shown, an indicator extraction system is established, and the resource nodes in the influence transmission diagram obtained in step S2 are decomposed into indicator nodes. For the 012 visual perception system, it is decomposed into 012 output message density, for the 200 comprehensive processing system, it is decomposed into 200 access message density, 200 memory utilization, 200 processing delay, and 200 distribution target. For the 103 accusation system and the 403 accusation system, it is decomposed into 103 acquisition target quantity and 403 acquisition target quantity. Since there is no causal relationship between the abnormal indicator of the 200 comprehensive processing system and the indicator of the 301 situation analysis system after decomposition, the 301 situation analysis system and subsequent sub-nodes are eliminated;

[0106] S4: Perform input normalization operation on the input command and control system operation raw data;

[0107] S5: Perform data interpolation on the data processed in step S4;

[0108] S6: The linear relationship between the abnormal node and the sub-nodes on each path is calculated by least square estimation. The obtained 012 output message density and the absolute value of the linear coefficient between each sub-index node are shown in Table 1;

[0109] Table 1 Relationship between linear model coefficients between nodes

[0110]

[0111]

[0112] S7: Traverse all the paths following the abnormal node. There are two propagation paths in total. Calculate the influence of the abnormal node on each path. The propagation path with the greatest influence is: 012 output message density → 200 access message density → 200 memory utilization → 200 processing delay → 200 distribution target → 103 obtain the number of targets, sum all the child nodes of the path and map through the activation function to obtain the influence of the propagation path as 0.87;

[0113] S8: Based on the calculation result of step S7, Figure 3 and Figure 4 , the results of the influence degree of abnormal nodes on subsequent nodes, the scope of the impact domain and the current alarm level of the command and control system are obtained as follows:

[0114] Impact area: 200 integrated processing system, 103 command and control system;

[0115] Impact: 0.87;

[0116] Current alarm level: severe.

[0117] Although the above describes the specific implementation methods of the invention in combination with the drawings and embodiments, it does not limit the scope of protection of the invention. On the basis of the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present invention.

Claims

1. A command and control system security risk assessment method based on linear influence, characterized in that: The steps include: S1: Establish the physical connection diagram and information flow diagram of the command and control system, and perform cross-layer aggregation of the base map to form a cause-effect diagram base map; S2: Eliminate the non-causal relationships in the base graph from the opposite direction of the cause conduction in the form of a spanning tree to obtain a causal graph; S3: Establish an indicator extraction system to decompose the resource nodes in the causal diagram into indicator nodes; S4: Perform input normalization processing on the input command and control system operation raw data; S5: Perform data interpolation on the data processed in step S4; S6: Calculate the linear relationship from the abnormal node to the child nodes on each path through least squares estimation; S7: traverse all subsequent paths of the abnormal node and calculate the impact of the abnormal node on each path; S8: Output the influence degree and influence domain range of the abnormal node on the subsequent nodes according to the calculation result of step S7, and obtain the current alarm level of the command and control system.

2. The command and control system security risk assessment method based on linear impact according to claim 1 is characterized by: In step S1, the step of establishing the physical connection graph includes: determining each subsystem in the command and control system as a node in the graph; identifying the physical connection medium between the subsystems, determining the physical connection relationship between the subsystems, and representing it in the graph by the connection of the edges between the nodes; determining the direction of the edge in the graph according to the communication direction between the subsystems; The steps of establishing the information flow diagram include: determining each subsystem in the command and control system and treating it as a node in the diagram; analyzing the data flow between the subsystems and determining the propagation path of data from one subsystem to another, which is represented in the diagram by the connection between the nodes; determining the direction of the edge in the diagram according to the data propagation flow between the subsystems; The implementation steps of cross-layer aggregation of the base map include: matching all subsystem nodes of the physical connection map and the information flow map; merging the physical connection map and the information flow map, retaining the connection relationship and direction between the nodes in the two maps to obtain the cause-effect map base map.

3. The command and control system security risk assessment method based on linear impact according to claim 1 is characterized by: In step S2, in the causal graph base map generated in step S1, nodes that will not be affected are eliminated from the direction opposite to the cause conduction in the form of a generation tree, and first a set of abnormal nodes is generated, the set includes abnormal nodes marked due to faults, errors or abnormal behaviors; nodes in the set are selected in turn as current processing nodes, if the node is not in the taboo table, a set of neighbor resource nodes directly connected to it is generated, and a neighbor resource node is selected from it to check whether it is the parent node of the current node, if so, it is added as a neighbor node and a connection is established, if not, other neighbor resource nodes are continuously selected until all neighbor nodes are traversed, and this process is repeated until all abnormal nodes are processed, and finally the processed causal graph is output.

4. The command and control system security risk assessment method based on linear impact according to claim 1 is characterized in that: In the step S3, the indicator extraction is to decompose the resource nodes in the causal graph into indicator nodes that can be quantitatively described, select the state parameters that can characterize the working performance of the nodes as the extracted indicator nodes according to the specific resource nodes, and establish an indicator extraction system; the established indicator extraction system is divided into two parts: intra-resource indicator extraction and inter-resource indicator extraction; the intra-resource indicator extraction includes message output density, memory utilization, processing delay and other indicators that can characterize the internal state parameters of the resources, and the inter-resource indicator extraction includes access message density, output target number, access target number and other indicators that can characterize the state parameters between resources; according to the established indicator extraction system, determine the extraction indicators corresponding to each resource node in the system, and decompose each resource node into indicator nodes.

5. The command and control system security risk assessment method based on linear impact according to claim 1 is characterized in that: In step S4, according to the indicator nodes decomposed in step S3, the corresponding state data of each indicator node during the normal operation of the command and control system are collected as raw data, and the raw data is processed by a linear normalization processing method, and the formula is: In the formula, x is the original data value, x max and x min are the maximum and minimum values ​​in the original data, respectively, norm is the normalized data value.

6. The command and control system security risk assessment method based on linear impact according to claim 1 is characterized by: In step S5, data interpolation is used to process the data obtained in step S4, and the formula is as follows: Where, t i represents the interpolation time point, t start and t end Respectively represent the start and end time points of the interpolation interval, It means that after interpolation at time t i The data value of and Respectively represent the time t start and t end The data value of .

7. The command and control system security risk assessment method based on linear impact according to claim 1 is characterized by: In step S6, the implementation method of calculating the linear relationship from the abnormal node to the sub-nodes on each path by least squares estimation is as follows: When the relationship between two indicator nodes is a linear relationship y=ax+b, the measurement data can be expressed as follows: Y=Hx+e in: where {x0,x1,…,x n } and {y0,y1,…,y n } are the sampling data of the two index nodes, {e0,e1,…,e n } is process noise; The i-th measurement residual ε i for: Among them, Y i is the sampling data of the ith index node, H i is the i-th row of the linear relationship coefficient matrix; The sum of all measurement errors J is: Let J The first-order partial derivative of is equal to 0, and the optimal estimate can be calculated The calculation is done using the following formula:

8. The command and control system security risk assessment method based on linear impact according to claim 1 is characterized by: In step S7, all subsequent paths of the abnormal node are traversed by the depth-first algorithm to calculate the influence of the abnormal node on each path. The influence calculation method for a single path is as follows: There is a fault propagation path A→B→C→…→N. The linear relationship from A to B is y=a1x+b1, the linear relationship from A to C is y=a2x+b2, and the linear relationship from A to the nth child node is y=a n x+b n ; The calculation steps of the influence degree of abnormal nodes on the path are as follows: The following formula is used to sum the absolute values ​​of the linear coefficients from the abnormal node to all child nodes on the path: <h2 style=";text-align:left;direction:ltr">a<h2 style=";text-align:left;direction:ltr"> sum <h2 style=";text-align:left;direction:ltr"> =|a1|+|a2|+…+|a<h2 style=";text-align:left;direction:ltr"> n <h2 style=";text-align:left;direction:ltr"> | Among them, n is the total number of child nodes, a i Represents the influence weight of the abnormal node on the i-th child node; Use the following activation function to convert a sum Mapped to between 0 and 1 to obtain the corresponding influence degree Infv val :

9. The command and control system security risk assessment method based on linear impact according to claim 1 is characterized by: In step S8, by comparing the influence of the abnormal node obtained in step S7 on all subsequent paths, the propagation path with the greatest influence is obtained, and the resource set to which the node on the path belongs is the influence domain of the abnormal node; the maximum influence value obtained in step S7 is compared with the preset threshold value, and the current alarm level Infl of the command and control system is calculated according to the following formula: lv It is divided into three levels: mild, general and severe:

Images