Electric power data drainage model based on cloud security technology

Abstract

The invention discloses an electric power data drainage model based on a cloud security technology, and the model combines a plurality of flow traction schemes, introduces the flow to different cloud virtual security resources, and achieves the efficient utilization of resources and security protection. The method comprises the following steps: constructing a drainage model by taking traditional virtual security resources, Huawei cloud and Ali cloud as triple coordinate origins, determining a position according to traffic parameters, and having a dynamic updating mechanism; a position characterization sub-data model capable of being adaptively adjusted is built inside to adapt to different flow characteristics and network environment changes; determining a drainage direction based on the triple coordinate system, and carrying out optimization adjustment according to virtual resource load balancing and a security policy; proposing a security service function chain construction algorithm based on a graph neural network to adapt to different scales of cloud environments; through unified management and control of security technical prevention measures, the adaptive security protection capability and the cloud security operation service support capability are improved; the model enables resource allocation to be flexible, ensures accurate drainage, guarantees safety and stability, and provides guarantee for safe operation of a power network cloud platform.

Description

Technical Field

[0001] The present invention relates to digital and information-based smart grid technology, and in particular to an electric power data diversion model based on cloud security technology. Background Art

[0002] In today's era of rapid digital development, State Grid Corporation of China is actively promoting the construction of a new power system. With the construction of the company's cloud platform and the continuous migration of business systems to the cloud, the security protection needs of the cloud platform and cloud-based businesses are constantly increasing. However, in this process, the cloud platforms of various units of the company have various problems in terms of security protection technology architecture, security component selection and deployment, etc.

[0003] On the one hand, the lack of uniformity in security protection capabilities of multiple clouds has become a prominent problem: in the complex environment where multiple clouds coexist and operate in combination, the security protection components used by different cloud platforms are different, which makes unified security management and control extremely difficult. Due to the lack of unified standards and specifications, various cloud platforms have large differences in the formulation of security protection strategies, the application of security technologies, and the execution of security management. This inconsistency not only increases the complexity of security management, but may also lead to the emergence of security vulnerabilities. At the same time, different security protection components may overlap or lack in functions, making it impossible to form an effective security protection system.

[0004] On the other hand, the inability of traditional security protection design architecture to adapt to cloud platforms is also a severe challenge: traditional security protection capabilities and cloud security protection capabilities fail to achieve coordination and unified management, and there are technical barriers between security protection components. This makes it impossible to automatically orchestrate security protection capabilities for different scenarios and difficult to dynamically perceive the global network security situation. In traditional security protection architectures, security devices are usually deployed independently and lack deep integration with cloud platforms. In cloud environments, the dynamic and elastic nature of business requires that security protection can also be quickly adjusted. However, due to the limitations of traditional security protection architectures, they cannot meet the needs of cloud platforms, resulting in security vulnerabilities. In addition, traditional security protection architectures are difficult to achieve effective security management and control of multi-tenant environments on cloud platforms, which can easily lead to incomplete security isolation between tenants.

[0005] The difficulty in achieving coordinated management and control of security protection components is also an urgent problem to be solved: the interface standards of security protection components on and off the cloud are different, making it difficult to uniformly manage and orchestrate traffic. This makes it difficult for security protection components to achieve coordinated management and control, and they cannot maximize their protection effectiveness. In a cloud environment, different security protection components need to work together to build a complete security protection system. However, due to the lack of unified interface standards, effective communication and collaboration between components are impossible. At the same time, the inability to uniformly manage traffic also greatly reduces the effectiveness of security protection, and attackers can launch attacks by bypassing certain security protection components.

[0006] In order to meet these challenges, we actively carry out work with joint protection on and off the cloud as the research focus. First, decouple the capabilities of traditional security protection equipment. Traditional security protection equipment is usually integrated, with relatively fixed functions and difficult to adapt to the dynamic changes of cloud platforms. Through decoupling, the functions of security protection equipment can be decomposed into multiple independent modules and flexibly combined according to different needs. This can not only improve the adaptability of security protection equipment but also reduce the complexity of security management. At the same time, the capabilities of security components of different cloud platforms such as Alibaba Cloud and Huawei Cloud are unified. The security components of different cloud platforms have their own advantages and disadvantages in terms of functions and performance. Through unified management, the advantages of each component can be fully utilized to maximize security protection capabilities.

[0007] On this basis, the project established an adaptive control system for security protection on and off the cloud. This system changed the current security protection measures based on hardware or virtualization stacking, and formed an adaptive cloud security protection system that meets the coexistence of multi-cloud applications, flexible component deployment, and centralized protection control. The system can automatically adjust security protection strategies according to the business needs and security situation of the cloud platform to achieve intelligent and automated security protection.

[0008] Through relevant research work, an overall solution is proposed for the implementation of the State Grid Corporation's cloud security protection system. This solution integrates the capabilities of the State Grid Corporation's existing security technical defense measures and mature cloud platform security components, reducing the duplication of cloud security protection measures. Through the unified management and control of security technical defense measures, the adaptive security protection capabilities and the support capabilities of cloud security operation services are improved. In actual applications, this solution can effectively improve the security and reliability of the State Grid Corporation's cloud platform and ensure the stable operation of the company's business.

[0009] The research on the joint dispatch of security protection resources on and off the cloud of State Grid Corporation is a work of great significance. Faced with challenges such as the lack of unified security protection capabilities of multiple clouds, the inability of traditional security protection design architecture to adapt to cloud platforms, and the difficulty in achieving coordinated management and control of security protection components, measures such as decoupling the capabilities of traditional security protection equipment, unifying the management of security components of different cloud platforms, and establishing an adaptive management and control system for security protection on and off the cloud provide strong support for the construction of State Grid Corporation's cloud security protection system, and provide solid security guarantees for the company's digital transformation and the construction of new power systems. Summary of the invention

[0010] The technical problem to be solved by the present invention is to provide a power data diversion model based on cloud security technology. The model combines a variety of traffic traction solutions to draw traffic to traditional virtual security resources, Huawei Cloud virtual security resources, Alibaba Cloud virtual security resources and other cloud virtual security resources, thereby achieving effective utilization and security protection of various cloud virtual security resources.

[0011] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows.

[0012] A power data diversion model based on cloud security technology constructs a computing power flow traction model by combining security and platform efficiency in a complex environment where multiple clouds coexist and operate in combination during the construction of a power grid cloud platform. The model is characterized by: combining multiple traffic traction solutions including but not limited to SDN diversion, API diversion, proxy diversion and micro-proxy diversion traffic traction solutions to divert traffic to traditional virtual security resources, Huawei Cloud virtual security resources, Alibaba Cloud virtual security resources and other cloud virtual security resources, thereby achieving effective utilization and security protection of various cloud virtual security resources.

[0013] As a preferred technical solution of the present invention, the multiple traffic traction solutions are highly synergistic and automatically switched and used in combination according to the real-time status and business needs of the power network in actual operation: SDN diversion uses the flexibility of software-defined networks to dynamically adjust the network traffic path, and accurately guides the traffic to the appropriate target virtual resources according to different virtual resource load conditions and security policies; API diversion obtains detailed information on the traffic by interacting with the interfaces of various network applications, provides data support for precise diversion and seamlessly integrates with other diversion solutions; proxy diversion and micro-agent diversion set up proxy nodes at the edge of the network and specific areas, pre-process and screen the traffic according to the characteristics of the traffic and the requirements of the target virtual resources, and decide to further divert the traffic to the corresponding virtual resources.

[0014] As a preferred technical solution of the present invention, it also includes constructing a multi-origin coordinate drainage data model, with traditional virtual security resources, Huawei Cloud and Alibaba Cloud as triple coordinate origins respectively, and the system is based on dynamically adapting to changes in power data traffic and expansion or adjustment of virtual resources to maintain the accuracy and effectiveness of determining the drainage direction, specifically: the selection of coordinate origin and system dynamics, based on the importance and representativeness of different types of virtual resources in the power data drainage process, with traditional virtual security resources, Huawei Cloud and Alibaba Cloud as triple coordinate origins respectively, and the system has dynamic adaptability, and dynamically adjusts with the increase, decrease and performance changes of virtual resources in the power network; the association between coordinate system dimensions and traffic parameters, in the multi-origin coordinate drainage data system, the number of coordinate system dimensions depends on the number of parameters related to each flow and the final security orchestration, and the traffic parameters are deeply analyzed and classified to achieve more accurate establishment of this association. In addition to common network parameters, specific parameters related to power business are referenced, including but not limited to operating status parameters of power equipment and traffic priority parameters, and the dimensions of the coordinate system are determined according to the complexity and mutual relationship of these parameters.

[0015] Furthermore, in the multi-origin coordinate drainage data system, the mechanism for determining the position of the flow in the multi-origin coordinate drainage data system is specifically as follows:

[0016] A-1 Fine classification and processing of traffic parameters and determination of coordinate positions: In the multi-origin coordinate diversion data system, the parameters of each specific traffic flow itself play a decisive role: First, the traffic parameters are comprehensively and carefully classified, covering basic network parameters including but not limited to bandwidth, delay, packet loss rate, security-related parameters including but not limited to security level requirements, encryption type, and business-related parameters including but not limited to business type and priority, and differentiated quantification and normalization methods are implemented for these different types of parameters;

[0017] A-1-1 For the bandwidth in the basic network parameters, standard network bandwidth measurement units including but not limited to Mbps and Gbps are used for accurate quantification. At the same time, normalization is performed based on the common bandwidth range in actual power network application scenarios, and it is mapped to the numerical range on the coordinates, so that its representation in the coordinate system is reasonable and comparable;

[0018] A-1-2 Regarding security-related parameters, a set of quantitative numerical systems from low to high is set for security level requirements, specifically: 1 represents a low security level, which means that only basic access control is required, and 5 represents a high security level, including but not limited to confidential power data transmission, which requires multiple encryptions and strict identity authentication, so as to accurately quantify the parameters of security level requirements;

[0019] The business type in the A-1-3 business-related parameters is identified by a predefined coding method, including but not limited to 01 for power production data business and 02 for power marketing data business. The business priority is divided into different levels according to the urgency and importance of the power business, specifically: key business is set to the highest priority, daily data statistics business is set to a lower priority, and the corresponding numerical weights are assigned;

[0020] Through this multi-dimensional and refined parameter processing mode, the parameter value of each flow accurately determines its coordinate position in the three coordinate systems with traditional virtual security resources, Huawei Cloud and Alibaba Cloud as the origins, so that the position comprehensively and accurately reflects the characteristics of the flow itself.

[0021] The A-2 dynamic update mechanism ensures that the flow location is real-time and accurate. Based on the highly dynamic nature of the power network environment and the volatile characteristics of the flow itself, a complete dynamic update mechanism for flow parameters is constructed: when any parameter of the flow changes, including but not limited to network congestion resulting in reduced bandwidth, power equipment failure causing increased business priority, and security policy adjustment causing changes in security level requirements, the system responds quickly and immediately starts the process of recalculating the coordinate position of the flow in the coordinate system; at the same time, in order to adapt to the new flow types and parameter changes brought about by the innovative development of power business, the system is equipped with parameter adaptive learning capabilities: with the help of deep mining of massive historical flow data and continuous analysis of real-time monitoring data, the system automatically and keenly identifies newly emerging parameter features, including but not limited to the generation of new business parameters related to distributed energy management as new distributed energy is connected to the power network. The system can autonomously learn and timely update relevant calculation rules, and seamlessly incorporate these new parameters into the coordinate position calculation system, so that the system can consistently and accurately determine its position in the coordinate system when facing traditional business traffic and new business traffic.

[0022] As a preferred technical solution of the present invention, the model also includes a data representation sub-data model for constructing a location, which is used to represent the location of the flow in each coordinate system, specifically:

[0023] B-1 Comprehensive application of multiple representation methods: The constructed location data representation sub-data model includes multiple representation methods, including but not limited to the length from multiple coordinate origins, the angle with the selected coordinate axis, coordinate plane or hyperplane as zero degree angle, or the ratio of length to radian angle, the trigonometric function value of angle, the ratio of length to trigonometric function of angle, the linear combination and product of length and angle, and the linear combination or product of length and trigonometric function value of angle; these representation methods are optimized and combined to improve the adaptability and accuracy of the model. According to different flow characteristics and application scenarios, the system will automatically select the most appropriate representation method or combination method: for flows that are close to the coordinate origin and have relatively small angle changes, length is preferred as the main representation method; for flows with large angle changes in a certain coordinate axis direction, the trigonometric function value of the angle is selected as the main representation method and combined with length for auxiliary representation; through this mechanism of intelligent selection of representation methods, the model more accurately reflects the position of the flow in the coordinate system, especially in a complex power network environment where different flows have different characteristics, and the model based on this flexible representation method can adapt to various situations;

[0024] B-2 Adaptive adjustment of the characterization model: The digital characterization sub-data model of the location is adaptively adjusted as the power network environment and traffic characteristics change, and the model's characterization parameters and weights are automatically adjusted: When a large amount of high-priority business traffic appears in the network, the model will adjust the characterization method according to the business-related parameters, and increase the weight of the business priority-related parameters in the characterization to ensure that high-priority traffic can obtain a more accurate location representation, so that it can be given priority in the diversion process; at the same time, when the network topology changes, including but not limited to the addition and deletion of a network node, the model re-evaluates the construction and characterization method of the coordinate system to adapt to the new network environment, so as to make the location representation accurate and effective, and provide a basis for determining the diversion direction.

[0025] Furthermore, it is characterized by: specific selection and data modeling are carried out according to specific circumstances to adapt to the multiple influencing factors and high complexity of power grid operation in real environments, and the assembly combination has a highly adaptable parameter combination for power grid diversion under working environments and task objectives, and the parameter combination is adjusted in real time according to the dynamic changes of the power grid operating environment to improve the efficiency and accuracy of diversion.

[0026] As a preferred technical solution of the present invention, the diversion direction is ultimately determined based on the position and data representation in the triple coordinate system, and in the process of determining the diversion direction, optimization and adjustment are performed according to the load balancing and security strategies of different virtual resources to achieve effective utilization of various virtual resources and optimization of security protection.

[0027] As a preferred technical solution of the present invention, a security service function chain construction algorithm based on graph neural network is proposed to solve the service orchestration problem in the traditional security cloud environment. The algorithm is adaptable to cloud environments of different scales and complexities, and dynamically adjusts the construction of the security service function chain according to changes in service requirements. Specifically:

[0028] The adaptability of the C-1 algorithm to cloud environments: For small cloud environments, the algorithm converges quickly and accurately builds a security service function chain to avoid excessive computing and resource waste; for large and complex cloud environments, the algorithm processes a large amount of network topology information and security service requirements through layered processing and distributed computing, so that the construction of the security service function chain can meet the security requirements of complex cloud environments;

[0029] C-2 Feature extraction and function chain construction of graph neural network: Graph neural network is used to extract network topology features and establish a security service function chain for the power grid cloud platform. Graph neural network accurately extracts key features of network topology by learning the connection relationship and attribute information between network nodes; these features are used to build the security service function chain, and the node sequence and connection method of the security service function chain are determined according to different security service requirements and network topology structures: according to the security level requirements and business priorities of different areas in the network, security protection equipment and services are connected in a reasonable order to form an efficient security service function chain for the safe operation of the power grid cloud platform.

[0030] As a preferred technical solution of the present invention, the adaptive security protection capability and the support capability of cloud security operation business are improved through the unified management and control of security technical defense measures. The unified management and control includes the centralized management and coordination of various security devices, algorithms and strategies involved in the drainage process, so that the entire drainage process is safe and stable, specifically:

[0031] D-1 Unified management and control of security technical defense measures: Establish a unified security management platform to perform configuration management and status monitoring for different types of security equipment, including but not limited to firewalls and intrusion detection systems, and uniformly update and optimize the diversion algorithm and security strategy to make the entire diversion process safe and stable;

[0032] D-2 Evaluation and continuous improvement of capability enhancement: In order to improve the adaptive security protection capability and the support capability of cloud security operation business, an effective performance evaluation index system is established, which includes but is not limited to evaluation indicators of security protection effect, traffic diversion efficiency and stability of cloud security operation; based on the evaluation results, continuously improve security technical defense measures and diversion methods: when the intrusion detection success rate is low, analyze the reasons and adjust the algorithm or configuration of the intrusion detection system; when the traffic traction success rate is not high, optimize the coordination and parameter setting of the diversion plan to improve the adaptive security protection capability and the support capability of cloud security operation business.

[0033] The beneficial effects of adopting the above technical solutions are: through the coordinated work of multiple traffic traction solutions and automatic switching and combination according to the real-time status of the power network and business needs, efficient utilization of various virtual security resources can be achieved, thereby improving the flexibility of resource allocation; the drainage data model with traditional virtual security resources, Huawei Cloud and Alibaba Cloud as the triple coordinate origin can accurately determine the flow location and adapt to the dynamic changes of the power network, ensuring the accuracy and effectiveness of the drainage direction; through unified management and control of security technical defense measures, the adaptive security protection capability and the support capability of cloud security operation business are improved, ensuring the safety and stability of the entire drainage process; based on the graph neural network security service function chain construction algorithm to adapt to cloud environments of different scales and dynamically adjust, providing strong protection for the safe operation of the power grid cloud platform. DETAILED DESCRIPTION

[0034] The following examples describe the present invention in detail. In the description of the following examples, specific details such as specific system structures, technologies, etc. are proposed for illustration rather than limitation, so as to provide a thorough understanding of the present application embodiments. However, it should be clear to those skilled in the art that the present application can also be implemented in other embodiments without these specific details. In other cases, the detailed description of well-known systems, devices, circuits and methods is omitted to prevent unnecessary details from hindering the description of the present application.

[0035] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0036] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0037] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0038] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0039] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0040] Implementation 1 Model Implementation

[0041] 1. Implementation Background

[0042] In a large power grid area, the power system covers multiple cities, including numerous power stations, substations and a large number of terminal power equipment. With the development of intelligent power grid, cloud platform has become the core hub of power data processing and management, carrying key business systems such as power production dispatching system, power marketing management system, equipment monitoring and operation and maintenance system.

[0043] To ensure the secure and stable operation of the cloud platform and cloud services, traditional virtual security resources, Huawei Cloud virtual security resources, and Alibaba Cloud virtual security resources have been introduced.

[0044] 2. Implementation Process

[0045] (I) Traffic traction solution

[0046] 1. SDN traffic diversion

[0047] The SDN controller is used to monitor the network traffic status in real time, and collects information such as bandwidth utilization, latency, and packet loss rate of network links every 5 minutes. When a sudden failure of power equipment in a certain area is detected, causing a large amount of equipment monitoring data traffic (about 300Mbps) to flow to the cloud platform, the SDN controller starts dynamic adjustment according to the preset strategy.

[0048] First, calculate the load of each virtual security resource. The load calculation method is: current resource occupied bandwidth / total resource bandwidth. The total bandwidth of Huawei Cloud virtual security resources is 000Mbps, the currently occupied bandwidth is 300Mbps, and its load is 300 / 1000=0.3; the total bandwidth of Alibaba Cloud virtual security resources is 800Mbps, the currently occupied bandwidth is 200Mbps, and the load is 200 / 800=0.25; the total bandwidth of traditional virtual security resources is 500Mbps, the currently occupied bandwidth is 150Mbps, and the load is 150 / 500=0.3.

[0049] Since the load on Alibaba Cloud's virtual security resources is relatively low and its security policies are suitable for processing such device monitoring data (according to the security policy matching algorithm, the matching degree of Alibaba Cloud is 0.8, that of Huawei Cloud is 0.7, and that of traditional virtual security resources is 0.6), the SDN controller directs the device monitoring data traffic in the fault area to Alibaba Cloud's virtual security resources for processing.

[0050] 2. API traffic diversion

[0051] The API traffic diversion module establishes an interface connection with key business systems such as the power production dispatching system and the power marketing management system, and interacts every 10 minutes to obtain detailed traffic information. The traffic generated by the power production dispatching system involves the core operation data of the power grid, and has high security requirements, which is set to level 4 (security level quantification system: 1-5, level 5 is the highest confidential level). The business type code is 01 (representing power production data business), and the business priority weight is set to 0.8 (the highest priority weight range for key business is 0.7-1).

[0052] Proxy diversion and micro-proxy diversion set up proxy nodes at key nodes at the edge of the network (network access points close to power stations and large substations) to pre-process the traffic from the power production and dispatching system. Check whether the traffic meets the security policy requirements of the target virtual security resource (Huawei Cloud) according to the preset rules, such as whether the encryption type matches (Huawei Cloud requires AES-256 encryption, and this traffic uses this encryption method). After confirming that it meets the requirements, the traffic is diverted to the Huawei Cloud virtual security resource.

[0053] (II) Multi-origin coordinate drainage data model

[0054] 1. Coordinate origin selection and system dynamics

[0055] The drainage data model is built with traditional virtual security resources, Huawei Cloud, and Alibaba Cloud as the triple coordinate origins. The system monitors the performance changes of virtual resources every hour, including computing power, storage capacity, etc. When Huawei Cloud adds a group of high-performance computing nodes and the computing power increases by 30%, the system dynamically adjusts the relevant parameters to adapt to the expansion of virtual resources.

[0056] 2. Coordinate system dimensions and traffic parameters are associated

[0057] For the traffic generated by the power marketing management system, in addition to the basic network parameters (bandwidth 100Mbps, delay 20ms, packet loss rate 0.1%), the power business related parameters are also referred to. According to the current marketing activities, the business priority is set to medium, the weight is 0.5 (the medium priority weight range is 0.4-0.6), and the number of traffic and security orchestration related parameters is 5 (bandwidth, delay, packet loss rate, business priority, security level requirements), so the coordinate system dimension is determined to be 5 dimensions.

[0058] The security level requirement is level 3 (involving sensitive data such as customer information, requiring medium-strength encryption and identity authentication), and the business type code is 02 (representing power marketing data business).

[0059] The flow parameter processing process is as follows:

[0060] Bandwidth quantification: Mbps is used as the unit. 100Mbps is normalized within the common bandwidth range (50-200Mbps). Assuming that the numerical range mapped to the coordinate is [0.4,0.6], the normalized value is calculated to be 0.5.

[0061] Security level quantification: According to the set quantification system, the corresponding quantization value of level 3 security level is 0.6 (level 1 is 0.2, level 5 is 1, calculated using linear interpolation).

[0062] Business type coding conversion: The 02 code corresponds to a specific vector representation in the preset business type coding system, such as [0,1] (01 is encoded as [1,0], which is used to distinguish different business types).

[0063] Business priority weight: set to 0.5.

[0064] The delay and packet loss rate are processed using a similar normalization method. It is assumed that the delay of 20ms is normalized to 0.4, and the packet loss rate of 0.1% is normalized to 0.3.

[0065] Through these parameters, the coordinate position of the traffic in three 5-dimensional coordinate systems with traditional virtual security resources, Huawei Cloud, and Alibaba Cloud as the origin is determined. For example, in the coordinate system with Huawei Cloud as the origin, the coordinates may be (0.5, 0.4, 0.3, 0.5, 0.6) (assuming the order is bandwidth, delay, packet loss rate, business priority, security level).

[0066] 3. Location digital representation sub-data model

[0067] 1. Comprehensive application of multiple representation methods

[0068] For the monitoring data flow of power equipment that is close to the origin of the coordinate system and has relatively small angle changes (such as the normal monitoring data flow of some equipment in the fault area mentioned above, with a bandwidth of 50Mbps and a relatively stable position in the coordinate system), length is preferred as the main representation method. Calculate its distance to the origin of Huawei Cloud using the Euclidean distance formula where x 0 ,y 0 ,…,n 0 is the origin coordinate, x 1 ,y 1 ,…n 1 , is the flow coordinate, here it is assumed to be a 5-dimensional coordinate, and the distance value obtained after calculation is 0.3 (after normalization).

[0069] For the power marketing management system flow with a large angle change in a certain coordinate axis direction (such as a significant change in the direction of the security level coordinate axis), the trigonometric function value of the angle is selected as the main representation method and combined with the length for auxiliary representation. The cosine value of the angle with the security level coordinate axis is calculated to be 0.7, and the distance from the origin to 0.4 (normalized) is combined to represent its position.

[0070] 2. Adaptive Adjustment of Representation Model

[0071] When a large amount of high-priority business traffic appears in the network (such as a large amount of high-priority traffic generated by the power production dispatching system in an emergency dispatching situation), the model adjusts the representation method according to the parameters related to the business priority. The business priority weight is increased from the original 0.8 to 0.9, and the representation position of the traffic in the coordinate system is recalculated to ensure that the high-priority traffic can be more accurately represented, so that it can be given priority in the diversion process.

[0072] (IV) Determination of drainage direction

[0073] 1. Determine the diversion direction based on the position and data representation in the triple coordinate system, and optimize and adjust it according to the load balancing and security policies of different virtual resources.

[0074] The load of each virtual resource and the adaptability of the security policy are re-evaluated every 15 minutes. When it is found that the load of Huawei Cloud has increased to 0.6 (the calculation method is the same as before), and some security protection service resources are tight (such as the intrusion detection service resource utilization rate reaches 80%), and the load of Alibaba Cloud is 0.3 and the security policy meets most of the current traffic needs, the system adjusts the algorithm according to the preset diversion strategy, and diverts part of the power production dispatching system traffic originally diverted to Huawei Cloud (according to the traffic characteristics and business needs, select the appropriate proportion, 30%) to Alibaba Cloud, so as to achieve the effective utilization of various virtual resources and the optimization of security protection.

[0075] (V) Security Service Function Chain Construction Algorithm

[0076] 1. Algorithm adaptability to cloud environment

[0077] In a small cloud environment (a cloud platform subsystem of a small substation in the region, including a small number of devices and simple services), the graph neural network is used to quickly converge and accurately build a security service function chain. The graph neural network learns the connection relationship and attribute information (device type, business function, etc.) between network nodes in the small cloud environment, quickly extracts key features, and builds a simple security service function chain including a firewall (for access control), an intrusion detection system (for real-time monitoring), and a data encryption module (for data security), avoiding excessive computing and resource waste.

[0078] In large and complex cloud environments (core cloud platforms for the entire power grid area), hierarchical processing and distributed computing are used. The network topology is divided into multiple layers, such as the core layer, aggregation layer, and access layer, and features are extracted at different layers. For example, the core layer focuses on the connection relationship between large-scale data transmission and core business systems, and the aggregation layer focuses on the aggregation of devices in the region. Distributed computing nodes are used to process a large amount of network topology information and security service requirements in parallel, and a complex security service function chain is constructed to meet the security requirements of complex cloud environments.

[0079] 2. Feature extraction and function chain construction of graph neural network

[0080] In view of the differences in security level requirements and business priorities in different areas of the power grid, corresponding security service function chains are constructed. For example, in the power station area, the security level requirements are extremely high and the business priority is also high. After the graph neural network extracts the network topology characteristics of the area, the node order of the security service function chain is determined as follows: first, the advanced firewall (strict access control), then the multiple encryption modules (high-intensity encryption of power generation data), followed by the intrusion detection and prevention system (real-time monitoring and defense against attacks), and finally the data backup and recovery node (to ensure data security). These security protection equipment and services are connected in a reasonable order to form an efficient security service function chain for the safe operation of the power grid cloud platform in this area.

[0081] (VI) Unified control of security technical measures

[0082] 1. Unified control of security technical measures

[0083] Establish a unified security management platform to centrally manage the configuration and status of different types of security equipment (firewalls, intrusion detection systems, encryption devices, etc.). Collect security equipment status information every 30 minutes, including the number of firewall rule matches, the number of intrusion detection system alarms, etc. Adjust the configuration of security equipment in a timely manner based on this information. For example, when it is found that the number of firewall rule matches in a certain area has increased abnormally, there may be a potential attack risk, update the firewall rules in a timely manner and add access restriction rules for this area.

[0084] At the same time, the traffic diversion algorithm and security policy are uniformly updated and optimized. The performance indicators of the traffic diversion algorithm are analyzed regularly (weekly), such as the traffic diversion success rate, traffic distribution balance, etc. When the traffic traction success rate is lower than 80% for two consecutive days, the cause is analyzed in depth. If it is found that the SDN traffic diversion path selection algorithm is not adaptable under complex network topology, the algorithm parameters are adjusted in time to optimize the path selection strategy.

[0085] 2. Evaluation of the effectiveness of capacity enhancement and continuous improvement

[0086] Establish an effective performance evaluation indicator system, including evaluation indicators of security protection effect (intrusion detection success rate, number of data leakage incidents), traffic diversion efficiency (traffic diversion success rate, average traffic diversion delay), and stability of cloud security operations (system failure rate, service interruption time). Collect and analyze these indicator data every day.

[0087] When the intrusion detection success rate is lower than 90% for a week in a row, the reason may be that the signature database of the intrusion detection system has not been updated in time or the algorithm is not able to identify new attacks. For the problem of signature database not being updated, download the latest intrusion detection signature database in time; for algorithm problems, organize security experts to optimize or upgrade the algorithm.

[0088] When the traffic traction success rate drops to 70% in a certain period of time, optimize the coordination and parameter settings of the traffic diversion plan. For example, adjust the interaction parameters between API diversion and other traffic diversion plans to improve the accuracy and timeliness of data interaction, thereby improving the adaptive security protection capabilities and the support capabilities of cloud security operation services.

[0089] 3. Implementation Effect

[0090] By implementing a power data diversion model based on cloud security technology, the cloud platform in this large power grid area achieved efficient and secure data diversion.

[0091] 1. Resource utilization efficiency has been significantly improved, and the load balancing of various virtual security resources has been effectively improved, avoiding resource idleness and overload, and the overall resource utilization rate has been increased by 25%.

[0092] 2. Security protection capabilities have been enhanced, the success rate of intrusion detection has increased to more than 95%, and the number of data leakage incidents has been reduced by 90%, effectively ensuring the security and integrity of power data.

[0093] 3. The traffic diversion efficiency has been greatly improved, the traffic traction success rate has stabilized at more than 90%, and the average traffic diversion delay has been reduced by 40%, ensuring the stable operation of the power business system.

[0094] 4. The stability of cloud security operations is guaranteed, the system failure rate is reduced to less than once a month, and the service interruption time is almost zero, providing strong support for the reliable power supply of the power grid.

[0095] During actual operation, the model can automatically adjust the diversion strategy according to the real-time status of the power network and business needs, adapt to the dynamic changes of power grid business, and provide a solid security guarantee for the intelligent development of the power grid.

[0096] Example 2 Distributed Energy Access Scenario (Flow Diversion)

[0097] 1. Implementation Background

[0098] In an emerging smart grid demonstration area, distributed energy (such as solar power stations, small wind farms, etc.) is actively promoted to access the grid system. With the large-scale access of distributed energy, the cloud platform needs to process massive data from different energy sources and traditional grid equipment while ensuring data security and efficient flow. The cloud platform in this area integrates traditional virtual security resources, Huawei Cloud virtual security resources, and Alibaba Cloud virtual security resources to cope with complex security protection and data management challenges.

[0099] 2. Implementation Process

[0100] (I) Traffic traction solution

[0101] SDN traffic diversion: The SDN controller continuously monitors network traffic and collects traffic data every 3 minutes. When the power generation of distributed energy increases sharply during the noon period (peak solar power generation), resulting in a large amount of real-time power generation data (about 400Mbps) pouring into the cloud platform, the SDN controller quickly analyzes the load status of each virtual security resource. The formula for calculating the load is: the amount of computing resources currently occupied by the resource / the total amount of computing resources (assuming that the amount of computing resources is proportional to the amount of traffic that can be processed). Assume that Huawei Cloud virtual security resources currently occupy computing resources equivalent to the processing capacity of 350Mbps traffic, and the total computing resources can handle 1200Mbps traffic, with a load of 350 / 1200≈0.29; Alibaba Cloud virtual security resources currently occupy computing resources equivalent to the processing capacity of 280Mbps traffic, and the total computing resources can handle 1000Mbps traffic, with a load of 280 / 1000=0.28; traditional virtual security resources currently occupy computing resources equivalent to the processing capacity of 300Mbps traffic, and the total computing resources can handle 800Mbps traffic, with a load of 300 / 800=0.375.

[0102] Since Alibaba Cloud's virtual security resources have a light load and good elastic expansion capabilities (according to the resource elasticity evaluation algorithm, Alibaba Cloud's elasticity score is 0.85, Huawei Cloud's is 0.75, and traditional virtual security resources are 0.6), the SDN controller guides this part of the power generation data traffic to Alibaba Cloud's virtual security resources for preliminary processing.

[0103] API drainage: API drainage interacts with the distributed energy management system and the power grid dispatching system interface, and obtains detailed traffic information every 8 minutes. For example, the traffic generated by the distributed energy management system involves key data such as power generation adjustment instructions, and the security level requirement is level 3 (important operation instructions require medium-intensity security protection), the business type code is 0 (representing distributed energy management business), and the business priority weight is set to 0.7 (the priority of traffic related to key business operations is higher).

[0104] Proxy diversion and micro-proxy diversion set up proxy nodes at the edge of the network close to the distributed energy access point to filter the traffic from the distributed energy management system. For example, check whether the instruction format in the traffic complies with the standard specification (this is one of the important requirements for the safe access of distributed energy). After confirming that it complies, the traffic is diverted to Huawei Cloud virtual security resources according to the preset strategy (Huawei Cloud is highly efficient in processing such instruction-type traffic. According to historical data processing efficiency evaluation, Huawei Cloud's processing efficiency is 0.9, Alibaba Cloud's is 0.8, and traditional virtual security resources are 0.7).

[0105] (II) Multi-origin coordinate drainage data model

[0106] Coordinate origin selection and system dynamics: The drainage data model is constructed with traditional virtual security resources, Huawei Cloud and Alibaba Cloud as the triple coordinate origins. As the number of distributed energy access increases or decreases (for example, a new small wind farm is connected or a solar power station is temporarily closed due to maintenance), the system monitors and adjusts relevant parameters in real time. When a new distributed energy source is connected, the system will update the resource information within 5 minutes and dynamically adjust the relevant parameters of the coordinate system according to the new resource distribution to ensure the accuracy of the drainage direction.

[0107] The coordinate system dimensions are associated with traffic parameters: For real-time power generation data traffic from distributed energy, in addition to basic network parameters (bandwidth 400Mbps, delay 15ms, packet loss rate 0.08%), power business related parameters are also combined. Due to the intermittent and volatile nature of distributed energy generation, power generation stability parameters are introduced (for example, according to real-time power fluctuations, stability is quantified as 0.6, stable state is 1, and large fluctuations are 0-0.5). At this time, the number of traffic and security orchestration related parameters is 6 (bandwidth, delay, packet loss rate, business priority, security level requirements, power generation stability), then the coordinate system dimension is determined to be 6, the security level requirement is level 3, and the business type code is 03.

[0108] Traffic parameters are processed as follows:

[0109] Bandwidth quantification: Mbps is used as the unit. 400Mbps is normalized within the common bandwidth range (300-500Mbps). Assuming that the numerical range mapped to the coordinate is [0.5,0.7], the normalized value is calculated to be 0.6.

[0110] Security level quantification: According to the set quantification system, the security level 3 corresponds to a quantification value of 0.6.

[0111] Business type coding conversion: The corresponding vector of 03 coding in the preset business type coding system is represented as [0,0,1] (assuming that a three-dimensional vector is used to distinguish different business types).

[0112] Business priority weight: set to 0.7.

[0113] The delay and packet loss rate are processed using a similar normalization method. It is assumed that the delay of 15ms is normalized to 0.5, and the packet loss rate of 0.08% is normalized to 0.4.

[0114] Quantification of power generation stability: According to the above setting value is 0.6.

[0115] Through these parameters, the coordinate position of the traffic in three 6-dimensional coordinate systems with traditional virtual security resources, Huawei Cloud and Alibaba Cloud as the origin is determined. For example, in the coordinate system with Alibaba Cloud as the origin, the coordinates may be (0.6, 0.5, 0.4, 0.7, 0.6, 0.6) (the order is bandwidth, delay, packet loss rate, business priority, security level, power generation stability).

[0116] 3. Location digital representation sub-data model

[0117] Comprehensive application of multiple characterization methods

[0118] For conventional power grid equipment monitoring data flow that is close to the coordinate origin and has relatively small angle changes (such as substation equipment status monitoring data, bandwidth 80Mbps, relatively stable), length is preferred as the main representation method. Calculate its distance to the origin of the traditional virtual security resource, assuming that the Manhattan distance formula is used (where the origin coordinate is the flow coordinate, here it is assumed to be a 6-dimensional coordinate, and the distance value obtained after calculation is 0.2 (normalized).

[0119] For distributed energy control instruction traffic with large angle changes in a certain coordinate axis direction (such as obvious changes in the business priority coordinate axis direction because different instructions have different urgency levels), the trigonometric function value of the angle is selected as the main representation method and combined with the length for auxiliary representation. The sine value of the angle with the business priority coordinate axis is calculated to be 0.8, and its distance to the origin is 0.3 (normalized) to represent its position.

[0120] Adaptive Adjustment of Representation Model

[0121] When a large amount of high-priority business traffic appears in the network (such as the emergency dispatch instruction traffic issued by the power grid dispatch system in response to the imbalance of power supply and demand), the model adjusts the representation method according to the parameters related to business priority. The business priority weight is increased from the original 0.7 to 0.95, and the representation position of the traffic in the coordinate system is recalculated to ensure that high-priority traffic can be more accurately represented and thus given priority in the diversion process.

[0122] (IV) Determination of drainage direction

[0123] The diversion direction is determined based on the position and data representation in the triple coordinate system, and optimized and adjusted according to the load balancing and security policies of different virtual resources.

[0124] The load of each virtual resource and the adaptability of the security policy are re-evaluated every 10 minutes. When it is found that the load of Huawei Cloud increases to 0.65 (the calculation method is the same as before), and the security policy encounters bottlenecks when processing some distributed energy data (such as reduced decryption efficiency of new encrypted distributed energy data), and the load of Alibaba Cloud is 0.35 and the security policy has good compatibility with distributed energy data, the system adjusts the algorithm according to the preset diversion strategy, and diverts part of the distributed energy management system traffic originally diverted to Huawei Cloud (according to traffic characteristics and business needs, select a suitable proportion, such as 40%) to Alibaba Cloud, so as to achieve effective utilization of various virtual resources and optimization of security protection.

[0125] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A power data diversion model based on cloud security technology, which combines security and platform efficiency to construct a traction model for computing power flow in a complex environment where multiple clouds coexist and operate in combination during the construction of a power grid cloud platform, and is characterized by: Combined with a variety of traffic traction solutions including but not limited to SDN diversion, API diversion, proxy diversion and micro-agent diversion traffic traction solutions, traffic is diverted to traditional virtual security resources, Huawei Cloud virtual security resources, Alibaba Cloud virtual security resources and other cloud virtual security resources to achieve effective utilization and security protection of various cloud virtual security resources.

2. According to the power data diversion model based on cloud security technology described in claim 1, it is characterized by: The above-mentioned multiple traffic traction solutions are highly synergistic and are automatically switched and used in combination according to the real-time status of the power network and business needs in actual operation: SDN diversion uses the flexibility of software-defined networks to dynamically adjust the network traffic path, and accurately guides the traffic to the appropriate target virtual resources according to different virtual resource load conditions and security policies; API diversion obtains detailed information on traffic by interacting with the interfaces of various network applications, providing data support for accurate diversion and seamlessly integrating with other diversion solutions; Proxy diversion and micro-proxy diversion set up proxy nodes at the edge of the network and in specific areas, pre-process and filter the traffic based on the characteristics of the traffic and the requirements of the target virtual resources, and decide whether to further divert the traffic to the corresponding virtual resources.

3. According to claim 1, a power data diversion model based on cloud security technology is characterized in that: It also includes constructing a multi-origin coordinate drainage data model, with traditional virtual security resources, Huawei Cloud and Alibaba Cloud as triple coordinate origins, and the system is based on dynamically adapting to changes in power data traffic and expansion or adjustment of virtual resources to maintain the accuracy and effectiveness of determining the drainage direction. Specifically, the selection of coordinate origins and system dynamics are based on the importance and representativeness of different types of virtual resources in the power data drainage process. Traditional virtual security resources, Huawei Cloud and Alibaba Cloud are used as triple coordinate origins, and the system has dynamic adaptability. It is dynamically adjusted as virtual resources in the power network increase, decrease and performance changes; the association between coordinate system dimensions and traffic parameters. In the multi-origin coordinate drainage data system, the number of coordinate system dimensions depends on the number of parameters related to each flow and the final security orchestration. In-depth analysis and classification of traffic parameters are carried out to more accurately establish this association. In addition to common network parameters, specific parameters related to power business are also referenced, including but not limited to the operating status parameters of power equipment and traffic priority parameters. The dimensions of the coordinate system are determined according to the complexity and mutual relationship of these parameters.

4. According to claim 3, a power data diversion model based on cloud security technology is characterized in that: In the multi-origin coordinate drainage data system, the mechanism for determining the position of flow in the multi-origin coordinate drainage data system is specifically as follows: A-1 Fine classification and processing of traffic parameters and determination of coordinate positions: In the multi-origin coordinate diversion data system, the parameters of each specific traffic flow itself play a decisive role: First, the traffic parameters are comprehensively and carefully classified, covering basic network parameters including but not limited to bandwidth, delay, packet loss rate, security-related parameters including but not limited to security level requirements, encryption type, and business-related parameters including but not limited to business type and priority, and differentiated quantification and normalization methods are implemented for these different types of parameters; A-1-1 For the bandwidth in the basic network parameters, standard network bandwidth measurement units including but not limited to Mbps and Gbps are used for accurate quantification. At the same time, normalization is performed based on the common bandwidth range in actual power network application scenarios, and it is mapped to the numerical range on the coordinates, so that its representation in the coordinate system is reasonable and comparable; A-1-2 In terms of security-related parameters, a set of quantitative numerical systems from low to high is set for security level requirements, specifically: 1 represents a low security level, which means that only basic access control is required, and 5 represents a high security level, including but not limited to confidential power data transmission, which requires multiple encryptions and strict identity authentication, so as to accurately quantify the security level requirement parameters; The business type in the A-1-3 business-related parameters is identified by a predefined coding method, including but not limited to 01 for power production data business and 02 for power marketing data business. The business priority is divided into different levels according to the urgency and importance of the power business, specifically: key business is set to the highest priority, daily data statistics business is set to a lower priority, and the corresponding numerical weights are assigned; The A-2 dynamic update mechanism ensures that the flow location is real-time and accurate. Based on the highly dynamic nature of the power network environment and the volatile characteristics of the flow itself, a complete dynamic update mechanism for flow parameters is constructed: when any parameter of the flow changes, including but not limited to network congestion resulting in reduced bandwidth, power equipment failure causing increased business priority, and security policy adjustment causing changes in security level requirements, the system responds quickly and immediately starts the process of recalculating the coordinate position of the flow in the coordinate system; at the same time, in order to adapt to the new flow types and parameter changes brought about by the innovative development of power business, the system is equipped with parameter adaptive learning capabilities: with the help of deep mining of massive historical flow data and continuous analysis of real-time monitoring data, the system automatically and keenly identifies newly emerging parameter features, including but not limited to the generation of new business parameters related to distributed energy management as new distributed energy is connected to the power network. The system can autonomously learn and timely update relevant calculation rules, and seamlessly incorporate these new parameters into the coordinate position calculation system, so that the system can consistently and accurately determine its position in the coordinate system when facing traditional business traffic and new business traffic.

5. According to claim 3, a power data diversion model based on cloud security technology is characterized in that: The model also includes a data representation sub-data model for constructing the location, which is used to represent the location of the traffic in each coordinate system. Specifically: B-1 Comprehensive application of multiple representation methods: The constructed location data representation sub-data model includes multiple representation methods, including but not limited to the length from multiple coordinate origins, the angle with the selected coordinate axis, coordinate plane or hyperplane as zero degree angle, or the ratio of length to radian angle, the trigonometric function value of angle, the ratio of length to trigonometric function of angle, the linear combination and product of length and angle, and the linear combination or product of length and trigonometric function value of angle; these representation methods are optimized and combined to improve the adaptability and accuracy of the model. According to different flow characteristics and application scenarios, the system will automatically select the most appropriate representation method or combination method: for flows that are close to the coordinate origin and have relatively small angle changes, length is preferred as the main representation method; for flows with large angle changes in a certain coordinate axis direction, the trigonometric function value of the angle is selected as the main representation method and combined with length for auxiliary representation; through this mechanism of intelligent selection of representation methods, the model more accurately reflects the position of the flow in the coordinate system, especially in a complex power network environment where different flows have different characteristics, and the model based on this flexible representation method can adapt to various situations; B-2 Adaptive adjustment of the characterization model: The digital characterization sub-data model of the location is adaptively adjusted as the power network environment and traffic characteristics change, and the model's characterization parameters and weights are automatically adjusted: When a large amount of high-priority business traffic appears in the network, the model will adjust the characterization method according to the business-related parameters, and increase the weight of the business priority-related parameters in the characterization to ensure that high-priority traffic can obtain a more accurate location representation, so that it can be given priority in the diversion process; at the same time, when the network topology changes, including but not limited to the addition and deletion of a network node, the model re-evaluates the construction and characterization method of the coordinate system to adapt to the new network environment, so as to make the location representation accurate and effective, and provide a basis for determining the diversion direction.

6. The power data diversion model based on cloud security technology according to claim 5 is characterized by: Specific selection and data modeling are carried out according to the specific situation to adapt to the multiple influencing factors and high complexity of power grid operation in the real environment. For the grid diversion under the working environment and task objectives, the assembly combination has a highly adaptable parameter combination, and this parameter combination is adjusted in real time according to the dynamic changes of the power grid operation environment to improve the efficiency and accuracy of diversion.

7. The power data diversion model based on cloud security technology according to claim 3 is characterized by: Finally, the diversion direction is determined based on the position and data representation in the triple coordinate system, and in the process of determining the diversion direction, optimization and adjustment are made according to the load balancing and security strategies of different virtual resources to achieve effective utilization of various virtual resources and optimization of security protection.

8. The power data diversion model based on cloud security technology according to claim 3 is characterized by: Aiming at the service orchestration problem in traditional secure cloud environments, a security service function chain construction algorithm based on graph neural network is proposed. The algorithm is adaptable to cloud environments of different scales and complexities, and dynamically adjusts the construction of the security service function chain according to changes in service requirements. Specifically: The adaptability of the C-1 algorithm to cloud environments: For small cloud environments, the algorithm converges quickly and accurately builds a security service function chain to avoid excessive computing and resource waste; for large and complex cloud environments, the algorithm processes a large amount of network topology information and security service requirements through layered processing and distributed computing, so that the construction of the security service function chain can meet the security requirements of complex cloud environments; C-2 Feature extraction and function chain construction of graph neural network: Graph neural network is used to extract network topology features and establish a security service function chain for the power grid cloud platform. Graph neural network accurately extracts key features of network topology by learning the connection relationship and attribute information between network nodes; These features are used to construct a security service function chain. The node sequence and connection method of the security service function chain are determined according to different security service requirements and network topology structures. According to the security level requirements and business priorities of different areas in the network, security protection equipment and services are connected in a reasonable order to form an efficient security service function chain for the safe operation of the power grid cloud platform.

9. The power data diversion model based on cloud security technology according to claim 3 is characterized by: Through unified management and control of security technical defense measures, we can improve the adaptive security protection capability and the support capability of cloud security operation business. Unified management and control includes centralized management and coordination of various security devices, algorithms and strategies involved in the traffic diversion process, making the entire traffic diversion process safe and stable. Specifically: D-1 Unified management and control of security technical defense measures: Establish a unified security management platform to perform configuration management and status monitoring for different types of security equipment, including but not limited to firewalls and intrusion detection systems, and uniformly update and optimize the diversion algorithm and security strategy to make the entire diversion process safe and stable; D-2 Evaluation and continuous improvement of capability enhancement: In order to improve the adaptive security protection capability and the support capability of cloud security operation business, an effective performance evaluation indicator system is established, which includes but is not limited to evaluation indicators of security protection effect, drainage efficiency and stability of cloud security operation; based on the evaluation results, continuously improve security technical defense measures and drainage methods: when the success rate of intrusion detection is low, analyze the reasons and adjust the algorithm or configuration of the intrusion detection system; The success rate of traffic traction is not high. The coordination and parameter settings of the traffic diversion plan are optimized to improve the adaptive security protection capabilities and support capabilities of cloud security operation services.