Data security protection system and fragmentation encryption method for energy operation platform

Abstract

The present invention relates to the field of energy operation technology, and discloses a data security protection system and a fragmented encryption method for an energy operation platform. The system includes data acquisition, processing and security protection modules. The data acquisition module collects multi-source data and assesses risks; the data processing module uses a combination of fragmented encryption and dynamic access control to ensure data security; and the security protection module builds a multi-level protection system. The fragmented encryption method encrypts data in blocks. The invention can accurately assess risks, provide early warnings and prevent them; strengthen data encryption and protect privacy; achieve multi-level protection and resist various threats; and can also improve system performance, adapt to complex scenarios, and effectively solve data security issues on energy operation platforms, ensuring stable operation of the platform and data security and reliability.

Description

Technical Field

[0001] The present invention relates to the field of energy operation technology, and specifically to a data security protection system and a fragmented encryption method for an energy operation platform. Background Art

[0002] In today's digital age, the energy industry is undergoing profound changes, and the energy operation platform has become the core hub for achieving efficient energy management, optimized configuration and reliable supply. The platform brings together massive and diverse data, covering real-time operating data collected by sensors of energy production equipment, detailed consumption information fed back by user energy consumption recording terminals, and grid status data provided by grid operation monitoring systems. These data play a key role in the refined operation and scientific decision-making of energy companies. However, with the widespread application of energy operation platforms and the increasing frequency of data interaction, their data security faces unprecedented severe challenges.

[0003] From the perspective of energy production equipment sensor data, on the one hand, the energy production environment is usually harsh and complex, such as the high humidity and strong electromagnetic interference environment in coal mines, and the high temperature and high pressure conditions at oil production sites. This makes the stability of the sensor itself vulnerable to influence, and it is also very easy to have errors or losses during data transmission. On the other hand, as the "nerve endings" of energy data collection, the sensor network's openness and relatively weak security protection mechanism make it a potential risk point for data security. Criminals may exploit vulnerabilities in sensor networks to tamper with or steal key production data, thereby interfering with the energy production process, causing production accidents, and even endangering the safety of personnel and the environment. For example, malicious tampering with the temperature sensor data of a nuclear power plant reactor may cause operators to misjudge the reactor status, causing serious risks of nuclear leakage.

[0004] The user energy consumption record terminal data contains a wealth of user personal information and consumption habits. These data not only involve the user's privacy, but may also be related to sensitive information such as the user's economic status. Once these data are leaked, users will face risks such as privacy infringement and precision fraud. In addition, for energy companies, accurate energy consumption data is an important basis for forecasting energy supply and demand, formulating reasonable pricing strategies, and optimizing energy distribution. If energy consumption data is maliciously tampered with, it will cause deviations in the decision-making of energy companies, resulting in unreasonable allocation of energy resources and economic losses, and will also affect fair competition and healthy development of the energy market.

[0005] The data of the power grid operation monitoring system plays a decisive role in ensuring the safe and stable operation of the power grid. As the "artery" of energy transmission, any slight changes in the operation status of the power grid need to be accurately monitored and processed in a timely manner. However, with the improvement of the intelligence level of the power grid, its connection with the external network is becoming increasingly close, and the network attack surface is constantly expanding. Cyber ​​attackers may interfere with the accuracy of the power grid operation monitoring data through various means, such as malware injection and vulnerability exploitation, mislead the decision-making of power grid dispatchers, and cause serious consequences such as power grid failures and power outages. In 2017, a certain country's power grid was attacked by hackers. The attackers tampered with the power data in the power grid operation monitoring system, causing overload of the power grid in some areas, causing large-scale power outages, and bringing huge impacts to the social economy.

[0006] Existing data security protection technologies have exposed many limitations when dealing with data security challenges on energy operation platforms. Traditional encryption algorithms often use fixed encryption strategies when processing energy data, which makes it difficult to flexibly adjust according to the real-time characteristics of energy data (such as the dynamic changes in data sensitivity and importance over time and working conditions). For example, during the peak period of energy production, the confidentiality requirements for key production data are extremely high, but traditional encryption algorithms cannot automatically increase the encryption strength, resulting in the risk of data leakage; and in non-critical periods, the use of high-intensity encryption will cause a waste of computing resources and affect system performance.

[0007] In terms of access control, the common access control model based on static roles or permissions cannot adapt to the complex and ever-changing business scenarios of the energy operation platform. In special scenarios such as energy equipment maintenance and emergency repairs, it is necessary to temporarily grant specific data access rights to staff, but the static access control model is difficult to quickly and flexibly adjust permissions dynamically, resulting in low work efficiency and even delaying the best time to handle faults.

[0008] In the construction of security protection system, traditional border protection technology (such as simple firewall rules) can only block known network attack patterns to a limited extent, and is powerless in the face of new and complex network attacks (such as advanced persistent threats APT, zero-day vulnerability attacks, etc.). These attacks are often highly concealed and targeted, and can lurk in the system for a long time and steal key data without being detected. At the same time, most of the existing intrusion detection technologies rely on known attack feature libraries for matching detection, and the detection ability for unknown attack behaviors is seriously insufficient, and it is impossible to detect and prevent new attacks in a timely manner. In addition, data recovery technology also has problems such as long recovery time and difficulty in ensuring data consistency in energy operation platforms. It cannot meet the strict requirements of the energy industry for data real-time and integrity. After data loss or damage, it may lead to serious consequences such as energy production interruption and business stagnation. Summary of the invention

[0009] The purpose of the present invention is to provide a data security protection system and a fragmented encryption method for an energy operation platform to solve the problems raised in the above-mentioned background technology.

[0010] To achieve the above-mentioned purpose, the present invention provides the following technical solution: a data security protection system for an energy operation platform, comprising: The data collection module is used to collect various types of data from multiple data sources of the energy operation platform, including energy production equipment sensors, user energy consumption recording terminals, and power grid operation monitoring systems; extract features from the collected data based on a multimodal feature extraction method to obtain a data feature set; input the data feature set into a pre-trained risk assessment model, which uses a deep convolutional neural network structure to assess the security risks faced by the data based on a risk assessment function and generate risk assessment parameters; A data processing module is used to construct a data security processing model according to the risk assessment parameters, wherein the data security processing model takes data confidentiality, integrity and availability as protection targets, and adopts a method combining fragmented encryption with dynamic access control to process data securely, wherein the fragmented encryption introduces a dynamic block strategy and a layered encryption mechanism based on chaotic mapping, divides the data into a plurality of logically associated encryption units, and each encryption unit independently generates a chaotic key and performs a multi-dimensional encryption transformation; and outputs securely processed data based on the data security processing model; A security protection module is used to establish a multi-level security protection system based on the security processed data, wherein the multi-level security protection system includes a boundary protection layer, an intrusion detection layer and a data recovery layer, wherein the boundary protection layer performs network boundary access control based on the risk assessment parameters, the intrusion detection layer performs real-time monitoring of data access behavior based on an abnormal behavior analysis algorithm, and the data recovery layer realizes reliable data recovery based on redundant backup and rapid recovery mechanism; the security of energy operation platform data is ensured through the multi-level security protection system.

[0011] Preferably, the data feature set is input into a pre-trained risk assessment model, the risk assessment model adopts a deep convolutional neural network structure, and the security risk faced by the data is assessed based on a risk assessment function, and the risk assessment parameters generated include: The purpose of the present invention is to provide a data security protection system and a fragmented encryption method for an energy operation platform to solve the problems raised in the above-mentioned background technology.

[0012] To achieve the above-mentioned purpose, the present invention provides the following technical solution: a data security protection system for an energy operation platform, comprising: The data collection module is used to collect various types of data from multiple data sources of the energy operation platform, including energy production equipment sensors, user energy consumption recording terminals, and power grid operation monitoring systems; extract features from the collected data based on a multimodal feature extraction method to obtain a data feature set; input the data feature set into a pre-trained risk assessment model, which uses a deep convolutional neural network structure to assess the security risks faced by the data based on a risk assessment function and generate risk assessment parameters; A data processing module is used to construct a data security processing model according to the risk assessment parameters, wherein the data security processing model takes data confidentiality, integrity and availability as protection targets, and adopts a method combining fragmented encryption with dynamic access control to process data securely, wherein the fragmented encryption introduces a dynamic block strategy and a layered encryption mechanism based on chaotic mapping, divides the data into a plurality of logically associated encryption units, and each encryption unit independently generates a chaotic key and performs a multi-dimensional encryption transformation; and outputs securely processed data based on the data security processing model; A security protection module is used to establish a multi-level security protection system based on the security processed data, wherein the multi-level security protection system includes a boundary protection layer, an intrusion detection layer and a data recovery layer, wherein the boundary protection layer performs network boundary access control based on the risk assessment parameters, the intrusion detection layer performs real-time monitoring of data access behavior based on an abnormal behavior analysis algorithm, and the data recovery layer realizes reliable data recovery based on redundant backup and rapid recovery mechanism; the security of energy operation platform data is ensured through the multi-level security protection system.

[0013] Preferably, the data feature set is input into a pre-trained risk assessment model, the risk assessment model adopts a deep convolutional neural network structure, and the security risk faced by the data is assessed based on a risk assessment function, and the risk assessment parameters generated include: The deep convolutional neural network is trained by a stochastic gradient descent method, the training sample set is expanded by a data enhancement technique, random sampling is performed from the expanded training sample set for network training, wherein the network updates parameters in each round of training; risk assessment parameters are output based on the trained deep convolutional neural network, and the risk assessment parameters include a network weight matrix, a network bias vector, a feature normalization parameter, and a risk level classification parameter.

[0014] Preferably, a data security processing model is constructed according to the risk assessment parameters. The data security processing model takes data confidentiality, integrity and availability as protection targets, and uses a method combining fragmented encryption and dynamic access control to process data securely. Outputting securely processed data based on the data security processing model includes: Constructing a multi-objective function for data security processing, the multi-objective function includes a confidentiality enhancement objective function, an integrity assurance objective function, and an availability maintenance objective function, wherein the confidentiality enhancement objective function is obtained by calculating the key dynamics of fragmented encryption and the depth of layered encryption, the integrity assurance objective function is obtained by calculating the data block hash chain verification and the topological constraints of the logical association graph, and the availability maintenance objective function is obtained by calculating the data block redundancy distribution and the recovery path optimization; Constructing data partitioning constraints based on the multi-objective function, wherein the data partitioning constraints include semantic relevance constraints, dynamic partitioning threshold constraints, and logical topology constraints, wherein the semantic relevance constraints are used to ensure that the segmented data blocks have resolvable semantic boundaries, the dynamic partitioning threshold constraints dynamically adjust the block size according to data sensitivity, and the logical topology constraints limit the dependencies between data blocks through a directed acyclic graph; The original data is segmented by a dynamic block strategy driven by chaotic mapping. Each data block generates a unique identifier and is associated with a logical position coordinate. The block parameters are generated based on the iterative equation of chaotic mapping. Construct a layered encryption mechanism, the layered encryption mechanism comprising: The first layer encryption unit: generates a chaotic initial key based on the data block identifier, generates a key sequence through Logistic mapping iteration, and performs bit-level XOR encryption on the data block; The second-layer encryption unit: constructs a permutation matrix based on the logical position coordinates, and permutes the byte positions of the encrypted data blocks through matrix transformation; The third-layer encryption unit: generates substitution rules based on the association relationship graph between data blocks, and performs byte substitution on the replaced data blocks through nonlinear S-boxes; A collaborative mechanism of dynamic access control and fragmented encryption is introduced. The data block access policy is generated through attribute-based encryption. The access policy is bound to the logical topology constraints of the data block. The decryption hierarchy is dynamically activated based on the attribute matching degree. When the access permission meets the first-layer attributes, only the first-layer encryption unit is decrypted, and the encryption is unlocked layer by layer until the full access permission is met.

[0015] Preferably, the border protection layer performs network border access control based on the risk assessment parameters, including: The network connection status is described by using state detection technology, and the network connection status is expressed as a function of connection parameters. The value range of the connection parameters is determined according to the network protocol and security policy. The network connection status includes the source IP address, the destination IP address, the port number, the protocol type and the connection time. The network connection state is described based on a directed acyclic graph, and the flow direction and dependency of the network connection are represented by the relationship between nodes and edges. The nodes of the directed acyclic graph are obtained by feature extraction of connection parameters, and the edges are determined by the conversion rules of the connection state. Constructing network access control constraints, which include source address constraints, destination address constraints, port constraints, protocol constraints, and time constraints. The source address constraints are used to limit the range of source IP addresses allowed to be accessed, the destination address constraints are used to limit the range of destination IP addresses allowed to be accessed, the port constraints are used to limit the range of port numbers allowed to be used, the protocol constraints are used to limit the types of network protocols allowed to pass, and the time constraints are used to limit the time period allowed to access. Constructing a global access control policy function, the global access control policy function including an access rule matching item, a risk assessment item, and a security policy priority item, and weighting and combining each item in the global access control policy function by a weighted coefficient; Discretize the network connection state interval into multiple connection segments, discretize the global access control policy function, and construct a global discretized policy function, wherein the global discretized policy function includes connection segment features, matching rules, and policy execution results; Iteratively optimize the global discretized policy function using a rule-based decision method, determine whether to allow access based on risk assessment results and security policy priorities by matching access rules with connection status, and update the access control list based on the decision results; The optimized network access control policy is subjected to consistency check and conflict resolution, and an effective network access control policy is generated by maintaining the consistency and coherence of the policy, and access to the network boundary is controlled based on the effective network access control policy.

[0016] Preferably, the intrusion detection layer performs real-time monitoring of data access behavior based on an abnormal behavior analysis algorithm, including: A local monitoring window is constructed based on the time series, operation type and access path of the data access behavior, and the size of the local monitoring window is adaptively adjusted through the behavior complexity coefficient, so as to establish a positive correlation between the size of the local monitoring window and the complexity of the data access behavior; A behavior model is constructed using multi-source log data, the log data is preprocessed to obtain standardized behavior records, the probability distribution of the behavior pattern library is updated based on the behavior records, and the occurrence probability value of each behavior pattern is calculated using the Bayesian reasoning method; The hidden Markov model is used to model dynamic abnormal behaviors, and the next state of the behavior is predicted by the state transition probability. The predicted state is updated based on the observed data to obtain the potential pattern and development trend of the abnormal behavior. Construct an intrusion detection model, use the characteristic vector of data access behavior as a state variable, the state variable includes access time, access subject, access object and operation type, construct state constraints and behavior trend constraints, the state constraints are used to limit the value range of the state variables, and the behavior trend constraints are used to limit the change trend of the behavior pattern; Constructing a multi-target detection cost function, the multi-target detection cost function includes a normal behavior matching item, an abnormal behavior identification item, a false positive penalty item, and a false negative penalty item, and weighting and combining each item in the multi-target detection cost function by a weighting coefficient; The particle swarm optimization algorithm is used to optimize and solve the multi-target detection cost function, calculate the gradient of the cost function with respect to the behavior characteristics, find the optimal solution by updating the position and adjusting the speed of the particles, evaluate the quality of the particles by the fitness function, and determine the optimal parameter combination by backtracking search.

[0017] Preferably, the data recovery layer realizes reliable data recovery based on redundant backup and fast recovery mechanism, including: Establish a data redundancy backup model, which includes full backup, incremental backup and differential backup strategies. The full backup regularly backs up all data in full, the incremental backup only backs up data that has changed since the last backup, and the differential backup only backs up data that has changed since the last full backup; The data redundancy backup model is constructed as a storage structure expression, wherein the storage vector of the storage structure expression includes backup data, backup time, backup type and storage location, and the recovery vector of the storage structure expression includes recovery time objective, recovery point objective and data consistency requirement; Optimizing the storage structure expression, calculating the trade-off between the backup data volume, storage cost, and recovery time, and constructing an optimized backup storage strategy; Constructing a data recovery prediction cost function, wherein the prediction cost function includes a recovery time term, a data loss term, and a recovery cost term, and weighting and combining each cost term through a weight matrix; Constructing recovery constraints, including storage medium availability constraints, network bandwidth constraints, and data consistency constraints, and constructing recovery operation constraints, including backup data integrity check, recovery process sequence, and data verification mechanism; Converting the prediction cost function into a standard form of a linear programming problem, calculating linear coefficients and constant terms, and constructing an inequality constraint matrix and an equality constraint matrix; The simplex method is used to solve the linear programming problem, and the optimal recovery strategy is obtained by solving the basic feasible solution. The final recovery plan is determined based on the feasibility and optimality of the recovery strategy, the backup data is restored, and the restored data is checked and verified for consistency.

[0018] Preferably, the present invention also includes a fragmented encryption method for an energy operation platform, which is applied to the above-mentioned data security protection system, including: Divide the data to be encrypted into multiple data blocks, each of which has a unique identifier; generate an initial key fragment based on the content and location information of the data block, wherein the initial key fragment is calculated by combining the hash value of the data block and the location index; The chaotic mapping algorithm is used to perform chaotic encryption on the initial key fragment, wherein the chaotic mapping algorithm performs nonlinear transformation on the key fragment through an iterative function to generate a chaotically encrypted key fragment; Constructing an association relationship graph between data blocks, wherein the association relationship graph uses data blocks as nodes and semantic associations or logical dependencies between data blocks as edges; performing diffusion processing on the chaotically encrypted key fragments based on the association relationship graph, and generating diffused key fragments by propagating and mixing the key fragments in the association relationship graph; The data blocks are classified according to their importance and access frequency. The classification method determines the categories of the data blocks by defining importance indexes and access frequency thresholds. For data blocks of different categories, different encryption transformations are used to perform secondary encryption on the diffused key fragments. The key fragment after the secondary encryption is merged with the corresponding data block, and the fusion method is realized by XOR operation or other bit operations; fragmented encrypted data is generated based on the merged data block, and the fragmented encrypted data is output.

[0019] Preferably, using a chaotic mapping algorithm to perform chaotic encryption on the initial key fragment comprises: The initial key fragment is used as the input of the chaotic mapping function, and the chaotic mapping function is iteratively calculated to obtain a chaotic sequence; the chaotic sequence is quantized, and the continuous value of the chaotic sequence is mapped to the discrete key fragment space to generate the chaotic encrypted key fragment.

[0020] Preferably, the present invention further includes an electronic device, comprising: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to call the instructions stored in the memory to execute the operations of the above-mentioned data security protection system.

[0021] Preferably, the present invention also includes a computer-readable storage medium on which computer program instructions are stored, and the computer program instructions implement the functions of the above-mentioned data security protection system when executed by a processor.

[0022] Compared with the prior art, the present invention has the following beneficial effects: Through the data acquisition module, combined with the multimodal feature extraction method and the risk assessment model of the deep convolutional neural network structure, the security risks faced by the energy operation platform data can be comprehensively and accurately assessed. The model comprehensively considers multi-source information such as energy production data, user energy consumption data, and power grid operation status data to construct a risk assessment function covering dimensions such as data leakage, tampering, system failure, and network attack. Compared with the traditional risk assessment method based on a single factor or simple rules, its assessment results are more accurate and comprehensive, and can detect potential security risks in advance. For example, by real-time monitoring of abnormal changes in data access rights, changes in data hash values, equipment failure frequencies, and abnormal patterns of network traffic, risk warnings can be issued in a timely manner, allowing operation and maintenance personnel to take preventive measures in advance, effectively reducing the probability of security incidents, and avoiding serious consequences such as energy production interruptions, user information leakage, and power grid operation failures caused by data security issues.

[0023] The method of combining fragmented encryption and dynamic access control adopted by the data processing module provides a strong guarantee for the data confidentiality and integrity of the energy operation platform. Based on the dynamic block strategy and layered encryption mechanism of chaotic mapping, the data is divided into multiple logically related encryption units. Each encryption unit independently generates a chaotic key and performs multi-dimensional encryption transformation. This encryption method not only increases the complexity of encryption, but also can flexibly encrypt according to the sensitivity and importance of the data. Compared with the traditional fixed encryption strategy, it can better adapt to the dynamic characteristics of energy data. For example, for highly sensitive energy production core data, more refined block division and higher-level encryption are adopted to ensure the security of data during storage and transmission. At the same time, the collaborative mechanism of dynamic access control and fragmented encryption dynamically activates the decryption level based on attribute matching. Only users who meet the corresponding permissions can unlock the corresponding encryption layer, further preventing data leakage and effectively protecting the data privacy of energy enterprises and users.

[0024] The multi-level security protection system constructed by the security protection module includes a boundary protection layer, an intrusion detection layer, and a data recovery layer to comprehensively resist various security threats. The boundary protection layer performs network boundary access control based on risk assessment parameters, adopts state detection technology and directed acyclic graphs to describe network connection status, constructs comprehensive access control constraints and global access control policy functions, and generates effective access control policies through iterative optimization and consistency checks. Compared with traditional simple firewall rules, it can more accurately identify and block illegal network access and effectively resist external malicious attacks. The intrusion detection layer monitors data access behavior in real time based on abnormal behavior analysis algorithms. By building local monitoring windows, building behavior models with multi-source log data, and modeling hidden Markov models, it can timely detect internal and external abnormal data access behaviors, including unknown attack behaviors. Compared with traditional intrusion detection technologies that rely on known attack feature libraries, it has stronger detection capabilities and lower false alarm rates. Based on redundant backup and fast recovery mechanisms, the data recovery layer establishes a data redundant backup model that includes full backup, incremental backup, and differential backup strategies, and determines the optimal recovery strategy by optimizing storage structure expressions and solving linear programming problems. This ensures that when data is lost or damaged, it can be restored quickly and accurately, ensuring data consistency and availability, greatly shortening the downtime of the energy operation platform due to data problems and improving the reliability of the system.

[0025] The technical solution of the present invention effectively improves the overall performance of the energy operation platform while ensuring data security. In the data encryption process, the dynamic block strategy and layered encryption mechanism based on chaotic mapping reduce the computational overhead of encryption and decryption and improve data processing efficiency by reasonable block division and optimization of the encryption process. The dynamic access control mechanism can quickly adjust user permissions according to actual business needs, avoiding the problem of untimely permission adjustment in special scenarios in the traditional static access control model, and improving work efficiency. In terms of security protection, the various layers of the multi-level security protection system work together to achieve rapid response and processing of security threats and reduce the impact of security incidents on system performance. For example, the boundary protection layer promptly blocks illegal access, reducing the burden on the intrusion detection layer and the data recovery layer; the intrusion detection layer quickly detects abnormal behavior and blocks it in time to prevent further expansion of security incidents and ensure the stable operation of the system. This enables the energy operation platform to better adapt to the complex and changeable business scenarios of the energy industry, such as seasonal fluctuations in energy production and emergency data access needs during emergency repairs. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a working principle diagram of the data security protection system for the energy operation platform according to the present invention; Figure 2 A flowchart for the construction and training of the risk assessment model; Figure 3 Flowchart for abnormal behavior monitoring at the intrusion detection layer of the energy operation platform. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] See also Figure 1-3 The present invention provides a technical solution: a data security protection system for an energy operation platform, which can efficiently and accurately monitor the stability of slopes, predict potential landslide risks, and provide timely warning information. The specific implementation of the system will be described in detail below.

[0029] Data collection module: collects data from multiple data sources of the energy operation platform, including energy production equipment sensors, user energy consumption recording terminals, power grid operation monitoring systems, etc. The collected data is extracted using a multimodal feature extraction method to obtain a data feature set. Next, the data feature set is input into a pre-trained risk assessment model, which uses a deep convolutional neural network structure to assess the security risks faced by the data based on a risk assessment function, and finally generates risk assessment parameters.

[0030] Data processing module: A data security processing model is constructed based on risk assessment parameters. This model takes data confidentiality, integrity and availability as protection goals, and uses a combination of fragmented encryption and dynamic access control to process data securely. Fragmented encryption introduces a dynamic block strategy and layered encryption mechanism based on chaotic mapping, which divides the data into multiple logically related encryption units. Each encryption unit independently generates a chaotic key and performs multi-dimensional encryption transformation. Finally, the securely processed data is output based on the data security processing model.

[0031] Security protection module: A multi-level security protection system is established based on the data after security processing. The system includes a boundary protection layer, an intrusion detection layer, and a data recovery layer. The boundary protection layer performs network boundary access control based on risk assessment parameters; the intrusion detection layer performs real-time monitoring of data access behavior based on abnormal behavior analysis algorithms; the data recovery layer achieves reliable data recovery based on redundant backup and rapid recovery mechanisms, and the security of energy operation platform data is fully guaranteed through a multi-level security protection system.

[0032] The present invention will be further described below in conjunction with Examples 1 to 5: Embodiment 1:

[0033] This embodiment elaborates on the construction and training process of the risk assessment model, which can accurately assess the security risks faced by the energy operation platform data, provide a key basis for subsequent data security processing and security protection, and ensure the effectiveness and pertinence of the data security protection system.

[0034] ① Data acquisition and feature construction: Acquire the collected data, which includes energy production data, user energy consumption data, power grid operation status data, equipment failure information and network traffic data. Construct feature space based on these data, and construct feature vectors from the data attributes, time series characteristics and association relationships. For example, for energy production data, its attributes may include production equipment type, production power, etc.; time series characteristics can be the trend of production data changes at different times; and association relationships are reflected in the mutual influence between user energy consumption data and power grid operation status data.

[0035] ② Construct a multi-dimensional risk assessment function: The constructed multi-dimensional risk assessment function includes data leakage risk items, data tampering risk items, system failure risk items and network attack risk items.

[0036] Data leakage risk item: Calculated by abnormal changes in data access rights. The calculation formula is: Data leakage risk item = abnormal access rights change number / total access rights change number. Assume that within a period of time, the total number of access rights changes is , where the number of abnormal access rights changes is , then the data leakage risk item is Abnormal access rights changes can be determined by comparing the current access rights with the historical normal access rights range. If they are outside the normal range, they are considered abnormal.

[0037] Data tampering risk item: calculated by comparing the change of data hash value with historical records. The calculation formula is: Data tampering risk item .in, is the number of data updates, For the The data hash value after the update, It is the hash value of the last updated data. When the data is tampered, its hash value will change. The risk of data tampering is measured by calculating the relative size of the hash value change.

[0038] System failure risk item: It is calculated by comprehensive evaluation of equipment failure frequency and impact range. The calculation formula is: System failure risk item = equipment failure frequency × impact range coefficient. Equipment failure frequency can be obtained by counting the number of equipment failures that occur over a period of time. Assuming that Equipment failure occurs within the time times, the equipment failure frequency is The impact range coefficient is determined based on factors such as the number of devices affected by the fault and the business process. If the number of devices affected by the fault is large and the impact on the core business process is large, the impact range coefficient is larger. Network attack risk item: It is calculated by matching the abnormal pattern of network traffic with the known attack characteristics. The calculation formula is: Network attack risk item = number of matched abnormal traffic patterns / total number of traffic patterns. Assume that in the monitored network traffic, the total number of traffic patterns is , the number of abnormal traffic patterns matched is , then the network attack risk item is Known attack features can be collected by collecting attack samples in the field of network security and extracting their features to establish a feature library, and abnormal traffic patterns can be identified by comparing real-time network traffic patterns with the features in the feature library.

[0039] ③Construct a deep convolutional neural network structure and loss function: Construct a deep convolutional neural network structure, which includes an input layer, multiple convolutional layers, a pooling layer, and a fully connected layer. The dimension of the input layer is the same as the dimension of the feature space. The convolution layer uses convolution kernels of different sizes to extract data features, such as , The convolution kernels of different sizes can capture data features of different scales. The pooling layer is used to reduce the data dimension. Common pooling methods include maximum pooling and average pooling to reduce the amount of calculation and prevent overfitting. The fully connected layer is used to integrate the extracted features. Based on this, the loss function is constructed. The loss function includes the mean square error term of the predicted risk and the actual risk. The calculation formula is: loss function .in, is the sample size, is the actual risk value, To predict the risk value.

[0040] Model training: The deep convolutional neural network is trained using the stochastic gradient descent method, and the training sample set is expanded through data enhancement technology, such as rotating, translating, and scaling the original data to generate new data samples. Random sampling is used for network training from the expanded training sample set, and the network parameters are updated in each round of training. During the training process, the weights and biases of the network are continuously adjusted so that the value of the loss function gradually decreases, thereby improving the prediction accuracy of the model. Finally, the risk assessment parameters are output based on the trained deep convolutional neural network, including the network weight matrix, network bias vector, feature normalization parameters, and risk level classification parameters.

[0041] Embodiment 2: This embodiment specifically illustrates the construction and application process of the data security processing model. By combining fragmented encryption with dynamic access control, it effectively protects the confidentiality, integrity and availability of data, and ensures the security of data during storage and transmission.

[0042] ① Construct multi-objective functions: Construct multi-objective functions for data security processing, including confidentiality enhancement objective function, integrity assurance objective function and availability maintenance objective function.

[0043] Confidentiality enhancement objective function: calculated through the key dynamics of fragmented encryption and the depth of layered encryption. The calculation formula is: Confidentiality enhancement objective function = key update frequency The number of hierarchical encryption layers. Assume that the key update frequency is every The time is updated once, and the number of layered encryption layers is , then the confidentiality enhancement objective function is The higher the key update frequency and the more layers of layered encryption, the larger the value of the confidentiality enhancement objective function and the stronger the data confidentiality.

[0044] Integrity assurance objective function: obtained through data block hash chain verification and logical association graph topology constraint calculation, the calculation formula is: Integrity assurance objective function .in, is the number of data block updates, For the The hash value of the data block after the update, The hash value of the last updated data block; is the number of logically associated edges of the data block, For the The distance between the edges (can be determined based on the relationship between nodes in the logical association graph). The data block hash chain verification detects whether the data has been tampered with by calculating the change in the hash value, and the logical association graph topology constraint ensures the integrity of the data by limiting the dependency between data blocks.

[0045] Availability maintenance objective function: obtained through data block redundancy distribution and recovery path optimization calculation, the calculation formula is: Availability maintenance objective function = number of redundant data blocks / total number of data blocks The shortest recovery path length. Assume that the number of redundant data blocks is , the total number of data blocks is , the shortest recovery path length is , then the availability maintenance objective function is The more redundant data blocks there are, the shorter the recovery path is, the larger the value of the availability maintenance objective function is, and the higher the data availability is.

[0046] ②Construct data partitioning constraints: Construct data partitioning constraints based on multi-objective functions, including semantic relevance constraints, dynamic partitioning threshold constraints, and logical topology constraints.

[0047] Semantic relevance constraints: ensure that the segmented data blocks have resolvable semantic boundaries. For example, for energy production data, the data blocks are segmented according to semantic features such as production process and equipment type, so that each data block has a clear meaning, which is convenient for subsequent data processing and analysis.

[0048] Dynamic block threshold constraint: dynamically adjust the block size according to the data sensitivity. The blocks with high sensitivity are divided into smaller blocks to improve the encryption precision and security; the blocks with low sensitivity can be divided into larger blocks to reduce the encryption and decryption overhead. Assume that the data sensitivity is measured by a sensitivity index To measure, when ( is the set sensitivity threshold), the data block size is ;when When the data block size is ,and .

[0049] Logical topology constraints: The dependencies between data blocks are limited by directed acyclic graphs to ensure that the processing order of data blocks is logical and to avoid problems such as circular dependencies. In a directed acyclic graph, nodes represent data blocks, and edges represent dependencies between data blocks. Data blocks can only be processed along the direction of the edges.

[0050] ③ Data segmentation and key generation: The original data is segmented using a dynamic segmentation strategy driven by chaotic mapping. Each data block generates a unique identifier and associates the logical position coordinates. The segmentation parameters are generated based on the iterative equation of chaotic mapping. The iterative equation of chaotic mapping can use Logistic mapping, and the formula is: .in, For the The value of the iteration, is the control parameter (usually between 3.57 and 4). By adjusting the initial value and control parameters , different chaotic sequences can be generated to determine the segmentation position and size of data blocks.

[0051] ④Layered encryption mechanism: Build a layered encryption mechanism, including the following three layers of encryption units.

[0052] The first layer encryption unit: Generates a chaotic initial key based on the data block identifier, generates a key sequence through Logistic mapping iteration, and performs bit-level XOR encryption on the data block. Assume that the data block identifier is , through the hash function Convert it to a numeric value As the initial value of the Logistic map, that is Then the key sequence is generated iteratively through the Logistic map , for data blocks Perform bit-level XOR encryption, the encrypted data block for: .

[0053] The second encryption unit: constructs a permutation matrix based on the logical position coordinates, and performs byte position permutation on the encrypted data block through matrix transformation. Assume that the logical position coordinates are , construct a permutation matrix according to certain rules For example, the row and column transformation rules of the matrix are determined according to the coordinate values. Perform byte position replacement to obtain the replaced data block for: .

[0054] The third layer encryption unit: Generates substitution rules based on the association relationship diagram between data blocks, and replaces bytes of the replaced data blocks through nonlinear S-boxes. According to the association relationship diagram between data blocks, determines the substitution rule for each byte, and replaces the replaced data blocks Each byte in is replaced by a nonlinear S-box according to the replacement rule to obtain the final encrypted data block .

[0055] ⑤ Dynamic access control and encryption coordination mechanism: Introduce the coordination mechanism of dynamic access control and fragmented encryption, generate data block access policy through attribute-based encryption, bind the access policy with the logical topology constraint of the data block, and dynamically activate the decryption level based on the attribute matching degree. When the access right meets the first-layer attribute, only the first-layer encryption unit is decrypted, and unlocked layer by layer until the full access right is met. Assume that the user's access attribute is , the access policy attribute of the data block is , by calculating the attribute matching .when ( is the attribute matching degree threshold of the first-layer decryption, unlock the first-layer encryption unit; when ( is the attribute matching threshold for the second layer decryption, and ), unlock the second layer of encryption unit, and so on, until the full access right is met, unlock all encryption layers, and obtain the original data.

[0056] Embodiment 3: This embodiment describes in detail the network boundary access control process of the boundary protection layer. Through the combination of multiple technologies and strategies, it effectively blocks illegal network access, ensures the security of the network boundary of the energy operation platform, and prevents external malicious attacks and illegal data transmission.

[0057] ① Network connection status description: The network connection status is described using status detection technology, and the network connection status is expressed as a function of connection parameters. The connection parameters include source IP address, destination IP address, port number, protocol type, and connection time. The value range is determined according to the network protocol and security policy. For example, according to the TCP / IP protocol, the value range of the source IP address and the destination IP address is a legal IP address segment; the value range of the port number has specific regulations according to different application protocols, such as the default port number of the HTTP protocol is 80, and the default port number of the HTTPS protocol is 443. The network connection status can be expressed as: .in, Indicates the network connection status. Indicates the source IP address. Indicates the destination IP address. Indicates the port number. Indicates the protocol type. Indicates the connection time.

[0058] ②Describe the network connection status based on a directed acyclic graph: Describe the network connection status based on a directed acyclic graph, and represent the flow and dependency of the network connection through the relationship between nodes and edges. The nodes of the directed acyclic graph are obtained by extracting the features of the connection parameters. For example, the network segment information of the source IP address and the service type information of the destination IP address can be extracted as node features; the edges are determined by the conversion rules of the connection status, such as the conversion conditions from one network connection status to another. Assume that the node Indicates the connection status of a specific source IP address segment and port number. Indicates another related connection state. When certain transition conditions are met (such as successful establishment of a TCP connection), arrive There is an edge.

[0059] ③Construct network access control constraints: Construct network access control constraints, including source address constraints, destination address constraints, port constraints, protocol constraints and time constraints.

[0060] Source address constraint: used to limit the range of source IP addresses allowed to access. For example, IP addresses from a specific network segment within the company are allowed to access the energy operation platform. This can be expressed as: .in, and The starting and ending addresses of the allowed source IP address range.

[0061] Destination address constraint: used to limit the range of destination IP addresses that are allowed to be accessed. For example, only IP addresses that are allowed to access specific services within the platform can be expressed as: .in, and The starting and ending addresses of the allowed destination IP address range.

[0062] Port constraint: used to limit the range of port numbers allowed to be used. For example, only specific port numbers are allowed to be used for data transmission, which can be expressed as: .in, and The starting and ending port numbers of the allowed port number range.

[0063] Protocol constraint: used to limit the types of network protocols allowed to pass. For example, only TCP and UDP protocols are allowed to pass, which can be expressed as: .

[0064] Time constraint: used to limit the time period during which access is allowed. For example, access is only allowed during a specific time period on weekdays. It can be expressed as: .in, and The start and end time of the access permission.

[0065] ④Build a global access control policy function: Build a global access control policy function, including access rule matching items, risk assessment items, and security policy priority items, and combine each item by weighted coefficient. Assume that the access rule matching item is , the risk assessment items are , the security policy priority items are , and the weighting coefficients are , , , then the global access control policy function is The access rule matching items are determined based on the matching degree between the network connection status and the access control constraint conditions; the risk assessment items are calculated based on the risk assessment parameters output by the risk assessment model; and the security policy priority items are determined based on the pre-set security policy priority.

[0066] ⑤ Discretization and policy optimization: Discretize the network connection status interval into multiple connection segments, discretize the global access control policy function, and construct a global discretization policy function, including connection segment characteristics, matching rules, and policy execution results. For example, discretize the connection time according to a certain time interval, discretize the port number range according to a certain step size, etc. Use a rule-based decision method to iteratively optimize the global discretization policy function, match the access rules with the connection status, determine whether to allow access based on the risk assessment results and security policy priority, and update the access control list based on the decision results. Suppose at a certain moment, the network connection status is , by matching with the access control constraints, calculate the access rule matching items The value of; at the same time, obtain the risk assessment items of the current connection according to the risk assessment model The value of the security policy priority item is combined with the pre-set , substitute into the global access control policy function Calculate the result. If the value of meets the threshold condition for allowing access, the connection is allowed to pass, otherwise it is rejected, and the decision result is recorded in the access control list, and the content of the access control list is updated for subsequent connection judgment.

[0067] ⑥ Policy consistency check and conflict resolution: Perform consistency check and conflict resolution on the optimized network access control policy. During the consistency check, traverse the access control list to check whether there are contradictions between different rules. For example, for the same source IP address and destination IP address, within the same time range, one rule allows access to a specific port, while another rule prohibits access to the port, which creates a conflict. By analyzing the logical relationship between the rules, prioritize the rules with high security policy priority, delete or modify conflicting rules to maintain policy consistency and coherence, and generate an effective network access control policy. Based on the effective network access control policy, control access to the network boundary. When there is a new network connection request, make a judgment based on the policy to decide whether to allow the connection to the energy operation platform network.

[0068] Embodiment 4: This embodiment mainly describes the specific implementation method of the intrusion detection layer to perform real-time monitoring of data access behavior based on the abnormal behavior analysis algorithm. By timely discovering abnormal data access behavior, it can effectively prevent internal and external illegal data access and ensure the security and integrity of the energy operation platform data.

[0069] Construct a local monitoring window: Construct a local monitoring window based on the time series of data access behavior, operation type, and access path. For example, the data access behavior within a period of time (such as 5 minutes) is a time series range, the operation types include read, write, delete, etc., and the access path is the system path through which the data is accessed. The size of the local monitoring window is adaptively adjusted through the behavior complexity coefficient. The behavior complexity coefficient can be determined based on factors such as the diversity of operation types and the complexity of the access path. Assume that the behavior complexity coefficient is , the initial local monitoring window size is , then the adjusted local monitoring window size ,A positive correlation is established between the size of the local monitoring window and the complexity of the data access behavior, i.e., the more complex the behavior, the larger the monitoring window size is, so as to capture the abnormal behavior more comprehensively.

[0070] Constructing behavior models: Use multi-source log data to construct behavior models. The sources of multi-source log data include system logs, application logs, security logs, etc. Preprocess the log data, such as data cleaning, removing duplicate, erroneous or irrelevant data records; data standardization, converting log data in different formats into a unified format for subsequent analysis. After preprocessing, standardized behavior records are obtained, and the probability distribution of the behavior pattern library is updated based on these behavior records. Assume that there are Behavior Pattern , calculate the probability value of each behavior pattern according to the Bayesian inference method , the calculation formula is: ,in represents the observed behavior record, In behavior mode Observation behavior records appear below The probability of It is a behavior pattern By continuously updating the probability distribution of the behavior pattern library, the behavior model can more accurately reflect the normal data access behavior pattern.

[0071] Modeling with Hidden Markov Model: Hidden Markov model is used to model dynamic abnormal behavior. Hidden Markov model contains state set, observation set, state transition probability matrix and observation probability matrix. Different states of data access behavior (such as login state, data reading state, data writing state, etc.) are used as the state set of hidden Markov model; the actual observed data access behavior (such as specific operation type, access time, etc.) is used as the observation set. The next state of the behavior is predicted by the state transition probability. Assume that the state transition probability matrix is ,in Indicates from the state Transfer to state The predicted state is updated based on the observed data, and the potential pattern and development trend of abnormal behavior are obtained using the forward-backward algorithm or Viterbi algorithm. For example, by analyzing the state transition of data access behavior over a period of time, if it is found that the normal login state frequently transitions to the abnormal data deletion state, and this transition does not conform to the normal behavior pattern probability distribution, a potential pattern of abnormal behavior may be detected.

[0072] Construct an intrusion detection model: Construct an intrusion detection model and use the characteristic vector of data access behavior as the state variable. The state variables include access time, access subject, access object, and operation type. Construct state constraints and behavior trend constraints. The state constraints are used to limit the value range of state variables. For example, the access time should be within the normal time period of system operation, and the access subject must be a registered legitimate user.

[0073] Assume that the normal range of access time is , then the state constraint can be expressed as Access time ; Behavior trend constraints are used to determine the changing trend of behavior patterns. For example, the frequency of data read operations should be kept within a certain reasonable range over a period of time. If the frequency of data read operations suddenly increases significantly and exceeds the normal change trend range, an intrusion detection alarm may be triggered.

[0074] Constructing a multi-target detection cost function: Constructing a multi-target detection cost function, including normal behavior matching items, abnormal behavior identification items, false positive penalty items, and false negative penalty items, and weighting each item through weighted coefficients. Assume that the normal behavior matching item is , the abnormal behavior identification item is The false positive penalty is , the omission penalty is , and the weighting coefficients are , , , , then the multi-target detection cost function for: The normal behavior matching item is used to measure the matching degree between the detection result and the normal behavior pattern; the abnormal behavior identification item is used to measure the accuracy of the abnormal behavior identification; the false positive penalty item is used to punish the situation where normal behavior is misjudged as abnormal behavior; the false negative penalty item is used to punish the situation where abnormal behavior is misjudged as normal behavior.

[0075] Optimize and solve the cost function of multi-target detection: The particle swarm optimization algorithm is used to optimize and solve the cost function of multi-target detection. In the particle swarm optimization algorithm, each particle represents a possible solution, that is, a combination of a set of behavioral features. The gradient of the cost function with respect to the behavioral features is calculated, and the optimal solution is found by updating the position and adjusting the speed of the particles. The particle position update formula is: , the speed update formula is: ,in It is a particle exist The location at the moment, It is a particle exist The speed of time, is the inertia weight, and is the learning factor, and is A random number between It is a particle The best position of your own experience, is the optimal position experienced by the entire particle swarm. The fitness function is used to evaluate the quality of particles. The fitness function can use the multi-target detection cost function The smaller the value, the better the particle. The optimal parameter combination is determined by backtracking search. When the optimal position of the particle swarm does not change or changes very little within a certain number of iterations, it is considered that the optimal solution has been found, that is, the optimal combination of behavioral features is obtained, which is used to accurately detect abnormal situations in data access behavior.

[0076] Embodiment 5: This embodiment describes in detail the specific process of the data recovery layer to achieve reliable data recovery based on redundant backup and fast recovery mechanism. When the data is lost or damaged, it can ensure that the data of the energy operation platform can be restored quickly and accurately, thereby ensuring the normal operation of the platform and the availability of data.

[0077] Establish a data redundancy backup model: Establish a data redundancy backup model, including full backup, incremental backup, and differential backup strategies. Full backup regularly backs up all data in full, for example, backs up all data of the energy operation platform at dawn every Sunday. The backup frequency can be adjusted according to the importance and change frequency of the data. Incremental backup only backs up data that has changed since the last backup. Assuming that the last backup was on Monday, when performing an incremental backup on Tuesday, only the data that has changed between Monday and Tuesday is backed up. Differential backup only backs up data that has changed since the last full backup. If the last full backup was on Sunday, when performing a differential backup on Wednesday, the data that has changed between Sunday and Wednesday is backed up. By combining these three backup strategies, you can reasonably control the amount of backup data and the backup time while ensuring data security.

[0078] Construct storage structure expression: Construct the data redundancy backup model into a storage structure expression. The storage vector of the storage structure expression includes backup data, backup time, backup type, and storage location. Assume that the storage vector is expressed as ,in Indicates backup data. Indicates the backup time. Indicates the backup type (full backup, incremental backup, or differential backup). Represents the storage location. The recovery vector includes the recovery time objective, recovery point objective, and data consistency requirements. Assume that the recovery vector is expressed as ,in Indicates the recovery time objective, which is the expected time to complete data recovery; Indicates the recovery point target, that is, the time point corresponding to the data state that needs to be restored; Indicates data consistency requirements to ensure that the restored data complies with business logic and data integrity requirements.

[0079] Optimize the storage structure expression: Optimize the storage structure expression and calculate the trade-off between the backup data volume, storage cost, and recovery time. The backup data volume is related to the backup strategy. The full backup data volume is the largest, while the incremental backup and differential backup data volumes are relatively small. Storage costs include the purchase cost and maintenance cost of storage devices, which are related to the amount of stored data and storage time. The recovery time depends on the amount of backup data, the storage location, and the complexity of the recovery operation. Build an optimized backup storage strategy, for example, by analyzing historical data changes and recovery requirements, determine a reasonable backup frequency and backup type combination, and minimize storage costs and recovery time while meeting data recovery requirements. Assume that the backup data volume under different backup strategies is calculated , storage cost , recovery time , a multi-objective optimization algorithm (such as genetic algorithm) can be used to find the optimal backup strategy so that the comprehensive indicators of backup data volume, storage cost and recovery time are optimal.

[0080] Constructing a data recovery prediction cost function: Constructing a data recovery prediction cost function, including the recovery time term, data loss term, and recovery cost term, and weighting and combining each cost term through a weight matrix. Assume that the recovery time term is , the data loss item is , the restoration cost item is , the weight matrix is , then the data recovery prediction cost function for: The recovery time item is calculated based on the estimated time required for the recovery operation. For example, the recovery time is estimated based on the amount of backup data and network bandwidth. The data loss item is evaluated based on the value of the data loss. If the lost data has a significant impact on the business, the value of the data loss item is larger. The recovery cost item includes the cost of using storage devices, network transmission costs, etc.

[0081] Constructing recovery constraints: Constructing recovery constraints, including storage medium availability constraints, network bandwidth constraints, and data consistency constraints. Storage medium availability constraints ensure that the storage medium used to recover data (such as disk arrays, tape libraries, etc.) is in a normal and available state. For example, the remaining space of the storage medium should be sufficient to accommodate the data to be recovered. Network bandwidth constraints limit the data transmission speed during data recovery. Assume that the network bandwidth is , the amount of data required to be transmitted for data recovery is , then the theoretical minimum recovery time is . Data consistency constraints ensure that the restored data is logically consistent and complies with business rules and data integrity requirements. At the same time, recovery operation constraints are constructed, including backup data integrity check, recovery process sequence, and data verification mechanism. The backup data integrity check verifies whether the backup data is complete and has not been tampered with by means of checksums, hash values, etc.; the recovery process sequence is reasonably arranged according to the backup time sequence and backup type, for example, the most recent full backup is restored first, and then the subsequent incremental backups or differential backups are restored in sequence; the data verification mechanism performs a quality check on the restored data after data recovery to ensure data accuracy and availability.

[0082] Solve the linear programming problem: Convert the data recovery prediction cost function into the standard form of the linear programming problem, calculate the linear coefficients and constant terms, and construct the inequality constraint matrix and the equality constraint matrix. Assume that the data recovery prediction cost function The terms in are linear relationships, which can be converted into standard form ,in is the objective function value, is the linear coefficient vector, is the decision variable vector. Construct the inequality constraint matrix based on the recovery constraint conditions and the equality constraint matrix , and the corresponding constraint vector and . The simplex method is used to solve the linear programming problem. The simplex method transforms from one basic feasible solution to another better basic feasible solution through continuous iteration until the optimal solution is found. The optimal recovery strategy is obtained by solving the basic feasible solution, and the final recovery plan is determined based on the feasibility and optimality of the recovery strategy. For example, under the constraints of storage medium availability, network bandwidth, etc., a recovery strategy that minimizes the data recovery prediction cost function is selected, including selecting appropriate backup data for recovery and determining the order of recovery. After determining the recovery plan, the backup data is restored, and the restored data is checked and verified for consistency to ensure that the restored data is accurate and meets the business needs of the energy operation platform.

[0083] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0084] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. Data security protection system for energy operation platform, characterized by: The system comprises: The data collection module is used to collect various types of data from multiple data sources of the energy operation platform, including energy production equipment sensors, user energy consumption recording terminals, and power grid operation monitoring systems; extract features from the collected data based on a multimodal feature extraction method to obtain a data feature set; input the data feature set into a pre-trained risk assessment model, which uses a deep convolutional neural network structure to assess the security risks faced by the data based on a risk assessment function and generate risk assessment parameters; A data processing module is used to construct a data security processing model according to the risk assessment parameters, wherein the data security processing model takes data confidentiality, integrity and availability as protection targets, and adopts a method combining fragmented encryption with dynamic access control to process data securely, wherein the fragmented encryption introduces a dynamic block strategy and a layered encryption mechanism based on chaotic mapping, divides the data into a plurality of logically associated encryption units, and each encryption unit independently generates a chaotic key and performs a multi-dimensional encryption transformation; and outputs securely processed data based on the data security processing model; A security protection module is used to establish a multi-level security protection system based on the security processed data, wherein the multi-level security protection system includes a boundary protection layer, an intrusion detection layer and a data recovery layer, wherein the boundary protection layer performs network boundary access control based on the risk assessment parameters, the intrusion detection layer performs real-time monitoring of data access behavior based on an abnormal behavior analysis algorithm, and the data recovery layer realizes reliable data recovery based on redundant backup and rapid recovery mechanism; the security of energy operation platform data is ensured through the multi-level security protection system.

2. The data security protection system for energy operation platform according to claim 1 is characterized in that: The data feature set is input into a pre-trained risk assessment model. The risk assessment model uses a deep convolutional neural network structure to assess the security risks faced by the data based on a risk assessment function. The generated risk assessment parameters include: Acquire the collected data, including energy production data, user energy consumption data, power grid operation status data, equipment failure information, and network traffic data; construct a feature space based on the data, and construct a feature vector based on the attributes, time series characteristics, and association relationships of the data; A multidimensional risk assessment function is constructed based on the feature space and the feature vector, wherein the multidimensional risk assessment function includes a data leakage risk item, a data tampering risk item, a system failure risk item, and a network attack risk item, wherein the data leakage risk item is calculated by abnormal changes in data access rights, the data tampering risk item is calculated by comparing changes in data hash values ​​with historical records, the system failure risk item is calculated by a comprehensive assessment of equipment failure frequency and impact range, and the network attack risk item is calculated by matching abnormal patterns of network traffic with known attack features; Constructing a deep convolutional neural network structure, the deep convolutional neural network structure includes an input layer, multiple convolutional layers, a pooling layer and a fully connected layer, the dimension of the input layer is the same as the dimension of the feature space, the convolutional layer uses convolution kernels of different sizes to extract data features, the pooling layer is used to reduce the data dimension, and the fully connected layer is used to integrate the extracted features; constructing a loss function based on the deep convolutional neural network structure, the loss function includes a mean square error term between the predicted risk and the actual risk; The deep convolutional neural network is trained by a stochastic gradient descent method, the training sample set is expanded by a data enhancement technique, random sampling is performed from the expanded training sample set for network training, wherein the network updates parameters in each round of training; risk assessment parameters are output based on the trained deep convolutional neural network, and the risk assessment parameters include a network weight matrix, a network bias vector, a feature normalization parameter, and a risk level classification parameter.

3. The data security protection system for energy operation platform according to claim 2 is characterized in that: A data security processing model is constructed according to the risk assessment parameters. The data security processing model takes data confidentiality, integrity and availability as protection targets, and uses a method combining fragmented encryption and dynamic access control to process data securely. The securely processed data output based on the data security processing model includes: Constructing a multi-objective function for data security processing, the multi-objective function includes a confidentiality enhancement objective function, an integrity assurance objective function, and an availability maintenance objective function, wherein the confidentiality enhancement objective function is obtained by calculating the key dynamics of fragmented encryption and the depth of layered encryption, the integrity assurance objective function is obtained by calculating the data block hash chain verification and the topological constraints of the logical association graph, and the availability maintenance objective function is obtained by calculating the data block redundancy distribution and the recovery path optimization; Constructing data partitioning constraints based on the multi-objective function, wherein the data partitioning constraints include semantic relevance constraints, dynamic partitioning threshold constraints, and logical topology constraints, wherein the semantic relevance constraints are used to ensure that the segmented data blocks have resolvable semantic boundaries, the dynamic partitioning threshold constraints dynamically adjust the block size according to data sensitivity, and the logical topology constraints limit the dependencies between data blocks through a directed acyclic graph; The original data is segmented by a dynamic block strategy driven by chaotic mapping. Each data block generates a unique identifier and is associated with a logical position coordinate. The block parameters are generated based on the iterative equation of chaotic mapping. Construct a layered encryption mechanism, the layered encryption mechanism comprising: The first layer encryption unit: generates a chaotic initial key based on the data block identifier, generates a key sequence through Logistic mapping iteration, and performs bit-level XOR encryption on the data block; The second-layer encryption unit: constructs a permutation matrix based on the logical position coordinates, and permutes the byte positions of the encrypted data blocks through matrix transformation; The third-layer encryption unit: generates substitution rules based on the association relationship graph between data blocks, and performs byte substitution on the replaced data blocks through nonlinear S-boxes; A collaborative mechanism of dynamic access control and fragmented encryption is introduced. The data block access policy is generated through attribute-based encryption. The access policy is bound to the logical topology constraints of the data block. The decryption hierarchy is dynamically activated based on the attribute matching degree. When the access permission meets the first-layer attributes, only the first-layer encryption unit is decrypted, and the encryption is unlocked layer by layer until the full access permission is met.

4. The data security protection system for energy operation platform according to claim 1 is characterized in that: The border protection layer performs network border access control based on the risk assessment parameters, including: The network connection status is described by using state detection technology, and the network connection status is expressed as a function of connection parameters. The value range of the connection parameters is determined according to the network protocol and security policy. The network connection status includes the source IP address, the destination IP address, the port number, the protocol type and the connection time. The network connection state is described based on a directed acyclic graph, and the flow direction and dependency of the network connection are represented by the relationship between nodes and edges. The nodes of the directed acyclic graph are obtained by feature extraction of connection parameters, and the edges are determined by the conversion rules of the connection state. Constructing network access control constraints, which include source address constraints, destination address constraints, port constraints, protocol constraints, and time constraints. The source address constraints are used to limit the range of source IP addresses allowed to be accessed, the destination address constraints are used to limit the range of destination IP addresses allowed to be accessed, the port constraints are used to limit the range of port numbers allowed to be used, the protocol constraints are used to limit the types of network protocols allowed to pass, and the time constraints are used to limit the time period allowed to access. Constructing a global access control policy function, the global access control policy function including an access rule matching item, a risk assessment item, and a security policy priority item, and weighting and combining each item in the global access control policy function by a weighted coefficient; Discretize the network connection state interval into multiple connection segments, discretize the global access control policy function, and construct a global discretized policy function, wherein the global discretized policy function includes connection segment features, matching rules, and policy execution results; Iteratively optimize the global discretized policy function using a rule-based decision method, determine whether to allow access based on risk assessment results and security policy priorities by matching access rules with connection status, and update the access control list based on the decision results; The optimized network access control policy is subjected to consistency check and conflict resolution, and an effective network access control policy is generated by maintaining the consistency and coherence of the policy, and access to the network boundary is controlled based on the effective network access control policy.

5. The data security protection system for energy operation platform according to claim 1 is characterized in that: The intrusion detection layer monitors data access behavior in real time based on abnormal behavior analysis algorithms, including: A local monitoring window is constructed based on the time series, operation type and access path of the data access behavior, and the size of the local monitoring window is adaptively adjusted through the behavior complexity coefficient, so as to establish a positive correlation between the size of the local monitoring window and the complexity of the data access behavior; A behavior model is constructed using multi-source log data, the log data is preprocessed to obtain standardized behavior records, the probability distribution of the behavior pattern library is updated based on the behavior records, and the occurrence probability value of each behavior pattern is calculated using the Bayesian reasoning method; The hidden Markov model is used to model dynamic abnormal behaviors, and the next state of the behavior is predicted by the state transition probability. The predicted state is updated based on the observed data to obtain the potential pattern and development trend of the abnormal behavior. Construct an intrusion detection model, use the characteristic vector of data access behavior as a state variable, the state variable includes access time, access subject, access object and operation type, construct state constraints and behavior trend constraints, the state constraints are used to limit the value range of the state variables, and the behavior trend constraints are used to limit the change trend of the behavior pattern; Constructing a multi-target detection cost function, the multi-target detection cost function includes a normal behavior matching item, an abnormal behavior identification item, a false positive penalty item, and a false negative penalty item, and weighting and combining each item in the multi-target detection cost function by a weighting coefficient; The particle swarm optimization algorithm is used to optimize and solve the multi-target detection cost function, calculate the gradient of the cost function with respect to the behavior characteristics, find the optimal solution by updating the position and adjusting the speed of the particles, evaluate the quality of the particles by the fitness function, and determine the optimal parameter combination by backtracking search.

6. The data security protection system for energy operation platform according to claim 1 is characterized in that: The data recovery layer implements reliable data recovery based on redundant backup and fast recovery mechanisms, including: Establish a data redundancy backup model, which includes full backup, incremental backup and differential backup strategies. The full backup regularly backs up all data in full, the incremental backup only backs up data that has changed since the last backup, and the differential backup only backs up data that has changed since the last full backup; The data redundancy backup model is constructed as a storage structure expression, wherein the storage vector of the storage structure expression includes backup data, backup time, backup type and storage location, and the recovery vector of the storage structure expression includes recovery time objective, recovery point objective and data consistency requirement; Optimizing the storage structure expression, calculating the trade-off between the backup data volume, storage cost, and recovery time, and constructing an optimized backup storage strategy; Constructing a data recovery prediction cost function, wherein the prediction cost function includes a recovery time term, a data loss term, and a recovery cost term, and weighting and combining each cost term through a weight matrix; Constructing recovery constraints, including storage medium availability constraints, network bandwidth constraints, and data consistency constraints, and constructing recovery operation constraints, including backup data integrity check, recovery process sequence, and data verification mechanism; Converting the prediction cost function into a standard form of a linear programming problem, calculating linear coefficients and constant terms, and constructing an inequality constraint matrix and an equality constraint matrix; The simplex method is used to solve the linear programming problem, and the optimal recovery strategy is obtained by solving the basic feasible solution. The final recovery plan is determined based on the feasibility and optimality of the recovery strategy, the backup data is restored, and the restored data is checked and verified for consistency.

7. A fragmented encryption method for an energy operation platform, applied to the data security protection system of claim 1, characterized in that: include: Dividing the data to be encrypted into a plurality of data blocks, each data block having a unique identifier; Generate an initial key fragment based on the content and position information of the data block, wherein the initial key fragment is calculated by combining a hash value of the data block and a position index; The chaotic mapping algorithm is used to perform chaotic encryption on the initial key fragment, wherein the chaotic mapping algorithm performs nonlinear transformation on the key fragment through an iterative function to generate a chaotically encrypted key fragment; Constructing an association relationship graph between data blocks, wherein the association relationship graph uses data blocks as nodes and semantic associations or logical dependencies between data blocks as edges; Based on the association relationship graph, the chaotically encrypted key fragments are diffused, and the diffused key fragments are generated by propagating and mixing the key fragments in the association relationship graph; The data blocks are classified according to their importance and access frequency. The classification method determines the categories of the data blocks by defining importance indexes and access frequency thresholds. For data blocks of different categories, different encryption transformations are used to perform secondary encryption on the diffused key fragments. The key fragment after the secondary encryption is merged with the corresponding data block, and the fusion method is realized by XOR operation or other bit operations; fragmented encrypted data is generated based on the merged data block, and the fragmented encrypted data is output.

8. The fragmentation encryption method according to claim 7, characterized in that: Using the chaotic mapping algorithm to perform chaotic encryption on the initial key fragment includes: The initial key fragment is used as the input of the chaotic mapping function, and the chaotic mapping function is iteratively calculated to obtain a chaotic sequence; the chaotic sequence is quantized, and the continuous value of the chaotic sequence is mapped to the discrete key fragment space to generate the chaotic encrypted key fragment.

9. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to perform the operation of the system described in any one of claims 1 to 6.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the functions of the system according to any one of claims 1 to 6 are realized.

Images