A quantitative method for network security risk assessment of power monitoring system

Abstract

A method for quantifying network security risk assessment of an electric power monitoring system of the present invention comprises the following steps: obtaining multiple risks of the electric power monitoring system, calculating consequence values, probability values ​​and repair values ​​of the risks, wherein the risks include known risks, potential risks and external risks; respectively assigning and adjusting the consequence values, probability values ​​and repair values; constructing the consequence values, probability values ​​and repair values ​​after the multiple risks are assigned into a multidimensional matrix; calculating the rank of the multidimensional matrix, and obtaining the degree of correlation of multiple risks according to the rank. By obtaining multiple different types of risks, a comprehensive assessment of the security of the electric power monitoring system can be performed. When performing the assessment, not only a single risk is assessed, but the degree of correlation between at least two risks is calculated by constructing a multidimensional matrix and calculating the rank of the multidimensional matrix, so as to formulate different protective measures based on the degree of correlation to ensure the stable operation of the electric power system.

Description

Technical Field

[0001] The present invention relates to the technical field of power system management and control, and in particular to a method for quantifying network security risks assessment of a power monitoring system. Background Art

[0002] With the rapid development of smart grids and the continuous improvement of informatization, the power monitoring system, as a core component of power grid operation, its network security has become a key factor in ensuring national energy security and social stability. In daily operation, the power monitoring system will be subject to risk threats from multiple parties. If the threat cannot be effectively blocked and the threat invasion cannot be quickly restored, it will affect the normal use of the power system. When conducting risk assessment, the current power monitoring system mostly detects the risks contained in the system and takes corresponding protective measures, and does not divide the risks that affect the system. The risks from different sources have different impact areas and degrees on the power monitoring system, and there may be a certain degree of correlation between the multiple risks. When one of the risks occurs, if it is not repaired in time, it may cause other risks. If the risks cannot be reasonably divided and the degree of correlation cannot be assessed, the power monitoring system cannot be effectively and reasonably protected. Summary of the invention

[0003] In view of this, the present invention proposes a quantitative method for network security risk assessment of power monitoring system, which can obtain risks from multiple sources and determine the degree of correlation between different risks by constructing a matrix, so as to make reasonable protection strategies.

[0004] The technical solution of the present invention is achieved in this way:

[0005] A method for quantifying network security risk assessment of a power monitoring system comprises the following steps:

[0006] Step S1, obtaining various risks of the power monitoring system, and calculating the consequence value, probability value and repair value of the risks, wherein the risks include known risks, potential risks and external risks;

[0007] Step S2, respectively assigning and adjusting the consequence value, probability value and repair value;

[0008] Step S3, constructing the consequence values, probability values ​​and repair values ​​after assigning multiple risks into a multi-dimensional matrix;

[0009] Step S4: Calculate the rank of the multidimensional matrix, and obtain the correlation degree of various risks according to the rank.

[0010] Preferably, the specific steps of step S1 to obtain the known risks of the power monitoring system are:

[0011] Step S11, obtaining the power monitoring system database and searching for historical risks;

[0012] Step S12: Determine whether the historical risks have been resolved, and output the unresolved historical risks as known risks.

[0013] Preferably, the specific steps of obtaining the potential risks of the power monitoring system in step S1 are:

[0014] Step S13: Compare with the latest risk data of the same type of power monitoring system, and output the risks that have not appeared as potential risks;

[0015] Step S14: Perform penetration testing on the power monitoring system and obtain potential risks.

[0016] Preferably, the specific steps of obtaining the external risk of the power monitoring system in step S1 are:

[0017] Step S15: Obtain natural disasters and / or electromagnetic pulse attacks occurring in the area where the current power monitoring system is located, and output them as external risks.

[0018] Preferably, the specific steps of calculating the consequence value, probability value and repair value of the risk in step S1 are:

[0019] Step S16: Divide the functional areas of the power monitoring system to determine the functional areas affected by known risks, potential risks, and external risks;

[0020] Step S17: quantify the negative impact on business, finance, safety, etc. after the risk occurs, and obtain the consequence value;

[0021] Step S18: Evaluate the possibility of risk occurrence based on historical data and environmental factors, and obtain a probability value;

[0022] Step S19: Evaluate the time required for the functional area from the occurrence of risk to the restoration of the system to normal operation, and obtain a repair value.

[0023] Preferably, step S2 assigns different weights to the consequence value, probability value and repair value respectively, wherein the size of the weight is determined according to the importance of the functional area affected by the risk in the entire power monitoring system, and the importance of the functional area is determined according to its contribution to the stable operation of the entire power monitoring system.

[0024] Preferably, the specific steps of step S3 are:

[0025] Step S31, the consequence value, probability value and repair value of the same risk are combined into a column vector;

[0026] Step S32, obtaining a plurality of multi-dimensional matrices by arranging and combining the column vectors;

[0027] Preferably, the multi-dimensional matrix includes a 3*2 matrix and a 3*3 matrix.

[0028] Preferably, the specific steps of step S4 are:

[0029] Step S41, calculating the ranks of all 3*2 matrices, and determining the degree of association between two risks according to the size of the ranks;

[0030] Step S42: Calculate the rank of the 3*3 matrix, and determine the degree of association between the three risks according to the size of the rank.

[0031] Preferably, the smaller the rank of the multidimensional matrix is, the greater the degree of correlation between the risks represented is.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] The present invention provides a quantitative method for network security risk assessment of an electric power monitoring system. When obtaining the risk of the electric power monitoring system, the obtained risk is divided into known risk, potential risk and external risk. The consequence value, probability value and repair value are calculated based on each risk. Then, a multidimensional matrix for risk assessment of the electric power monitoring system can be constructed. According to the rank of the multidimensional matrix, the correlation degree of multiple risks can be obtained, including the correlation degree between any two risks and the correlation degree between three risks. The correlation degree can be determined based on the size of the rank, and the protection plan can be determined according to the correlation degree, so as to completely protect the electric power monitoring system and avoid affecting the normal transmission of electricity. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only preferred embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0035] Figure 1 A flowchart of a method for quantifying network security risk assessment of a power monitoring system according to the present invention;

[0036] Figure 2 This is a flowchart of step S1 of a method for quantifying network security risk assessment of a power monitoring system according to the present invention;

[0037] Figure 3 This is a flow chart of step S2 of a method for quantifying network security risk assessment of a power monitoring system according to the present invention;

[0038] Figure 4 This is a flow chart of step S4 of a method for quantifying network security risk assessment of a power monitoring system according to the present invention. DETAILED DESCRIPTION

[0039] In order to better understand the technical content of the present invention, a specific embodiment is provided below, and the present invention is further described in conjunction with the accompanying drawings.

[0040] See also Figures 1 to 4 The present invention provides a method for quantifying network security risk assessment of a power monitoring system, comprising the following steps:

[0041] Step S1, obtaining various risks of the power monitoring system, and calculating the consequence value, probability value and repair value of the risks, wherein the risks include known risks, potential risks and external risks;

[0042] Step S2, respectively assigning and adjusting the consequence value, probability value and repair value;

[0043] Step S3, constructing the consequence values, probability values ​​and repair values ​​after assigning multiple risks into a multi-dimensional matrix;

[0044] Step S4: Calculate the rank of the multidimensional matrix, and obtain the correlation degree of various risks according to the rank.

[0045] The power monitoring system is used in the power industry to collect data from power plants, substations, transmission lines, etc. in the power system, and determine whether there are any abnormalities in the facilities based on the collected data. The security of the power monitoring system determines the stability of the power system. If the power monitoring system is threatened by risks, it will not be able to monitor the facilities in the power system. When an abnormality occurs in the power facilities, the fault location and fault type cannot be quickly determined, resulting in prolonged facility recovery time and affecting the normal transmission of electricity.

[0046] Before conducting risk assessment and quantification, we first obtain various risks of the power monitoring system, among which various risks are mainly divided into known risks, potential risks and external risks. Known risks are risks that have been detected in the power safety system, which have not been repaired temporarily because of spare parts or small impact, while potential risks are risks that have not yet appeared in the power monitoring system but do exist. They will only appear in some specific circumstances, such as the introduction of emerging technologies, software upgrades or reduced protection capabilities, and external risks refer to abnormalities or failures in the power monitoring system caused by external factors. These three risks generally do not occur at the same time, but when one of the risks occurs, other risks may be caused in conjunction. For example, when a known risk continues to be unrepaired for too long, its failure continues to spread, resulting in a reduction in the protection capability of the power monitoring system or abnormal power supply, which will cause potential risks or external risks. Similarly, if external risks cause the protection capability of the power monitoring system to decline, it will also cause potential risks and known risks. There is a certain correlation between various risks. If the degree of correlation between risks is not evaluated in detail, an effective protection plan cannot be formulated.

[0047] After obtaining multiple risks, the consequence value, probability value and repair value of the risk are calculated. The consequence value refers to the consequence of the risk on the power monitoring system when the risk occurs, the probability value refers to the probability of a certain risk occurring in the power monitoring system, and the repair value refers to the repair time of the power monitoring system. Based on the above three data, the impact of the risk on the power monitoring system can be evaluated. After obtaining the consequence value, probability value and repair value of the risk, they are assigned and adjusted respectively to avoid large differences between the three values. Then the assigned consequence value, probability value and repair value are constructed into a multidimensional matrix. The multidimensional matrix is ​​used to evaluate the degree of correlation between risks. The degree of correlation can be evaluated by calculating the rank of the multidimensional matrix. Finally, a detailed protection plan can be implemented according to the degree of correlation, including the priority of risk repair and the repair strategy.

[0048] Preferably, the specific steps of step S1 to obtain the known risks of the power monitoring system are:

[0049] Step S11, obtaining the power monitoring system database and searching for historical risks;

[0050] Step S12: Determine whether the historical risks have been resolved, and output the unresolved historical risks as known risks.

[0051] Known risks are existing unresolved risks in the power monitoring system. Therefore, the database of the power monitoring system is obtained to find historical risks that have occurred in the power monitoring system, and then determine whether the historical risks have been resolved. If not, it means that the historical risks still exist, so they can be output as known risks.

[0052] Preferably, the specific steps of obtaining the potential risks of the power monitoring system in step S1 are:

[0053] Step S13: Compare with the latest risk data of the same type of power monitoring system, and output the risks that have not appeared as potential risks;

[0054] Step S14: Perform penetration testing on the power monitoring system and obtain potential risks.

[0055] Potential risks are risks that have not occurred in the power monitoring system but do exist. Their acquisition can be divided into subjective and objective levels. The subjective level is achieved by comparing the risks that occurred in the current power monitoring system with the same type of power monitoring system in the same recent period of time, and outputting the risks that occurred in the same type of power monitoring system but did not occur in the current power monitoring system as subjective potential risks. The objective potential risks are obtained by conducting penetration tests on the current power monitoring system. The penetration test can conduct an in-depth test of the protection capabilities of the power monitoring system, obtain the vulnerabilities and potential attack paths in the power monitoring system, and evaluate the protection capabilities of the power monitoring system. A comprehensive risk assessment can be carried out by obtaining subjective and objective potential risks.

[0056] Preferably, the specific steps of obtaining the external risk of the power monitoring system in step S1 are:

[0057] Step S15: Obtain natural disasters and / or electromagnetic pulse attacks occurring in the area where the current power monitoring system is located, and output them as external risks.

[0058] External risks refer to events that occur outside the power monitoring system and may have an impact on the power monitoring system. Common ones include natural disasters and electromagnetic pulses. Natural disasters include floods, heavy rains, earthquakes, and typhoons, while electromagnetic pulses may affect signal transmission, making it impossible to effectively obtain monitoring data from power facilities.

[0059] Preferably, the specific steps of calculating the consequence value, probability value and repair value of the risk in step S1 are:

[0060] Step S16: Divide the functional areas of the power monitoring system to determine the functional areas affected by known risks, potential risks, and external risks;

[0061] Step S17: quantify the negative impact on business, finance, safety, etc. after the risk occurs, and obtain the consequence value;

[0062] Step S18: Evaluate the possibility of risk occurrence based on historical data and environmental factors, and obtain a probability value;

[0063] Step S19: Evaluate the time required for the functional area from the occurrence of risk to the restoration of the system to normal operation, and obtain a repair value.

[0064] After obtaining known risks, potential risks and external risks, it is necessary to calculate the consequence value, probability value and repair value. For each risk, the area of ​​the power monitoring system affected is different. Therefore, the functional areas of the power monitoring system need to be divided, and then the functional areas affected by each risk can be determined. The consequence value is quantified based on the impact of the risk on the business, finance and security of the functional area, while the probability value is determined by manual evaluation with reference to historical data and environmental factors. For the repair value, it is necessary to determine the time from the occurrence of the risk to the system returning to normal operation. The evaluation method is to refer to the recovery time when the same type of risk occurs in the power monitoring system.

[0065] Preferably, step S2 assigns different weights to the consequence value, probability value and repair value respectively, wherein the size of the weight is determined according to the importance of the functional area affected by the risk in the entire power monitoring system, and the importance of the functional area is determined according to its contribution to the stable operation of the entire power monitoring system.

[0066] After obtaining the consequence value, probability value and repair value, since there are certain differences between the three values, they are adjusted by assigning values ​​to the three data, and the assigned weight is determined according to the importance of the functional area. If the importance of the functional area affected by a certain risk is higher, the assigned weight will be larger, and the importance of the functional area is determined according to the contribution of the functional area to the stable operation of the entire power monitoring system, so as to adjust the consequence values, probability values ​​and repair values ​​of different risks to a state with little difference.

[0067] Preferably, the specific steps of step S3 are:

[0068] Step S31, the consequence value, probability value and repair value of the same risk are combined into a column vector;

[0069] Step S32, after permuting and combining the column vectors, a plurality of multi-dimensional matrices are obtained, wherein the multi-dimensional matrices include a 3*2 matrix and a 3*3 matrix;

[0070] After assigning the consequence value, probability value and repair value, it is necessary to construct a multidimensional matrix for evaluating safety risks. The consequence value, probability value and repair value of the same risk can form a 3*1 column vector, a 3*2 matrix can be formed between two risks, and a 3*3 matrix can be formed between three risks. Since the same risk may include multiple risks, the number of 3*2 matrices and 3*3 matrices formed is multiple.

[0071] Preferably, the specific steps of step S4 are:

[0072] Step S41, calculating the ranks of all 3*2 matrices, and determining the degree of association between two risks according to the size of the ranks;

[0073] Step S42: Calculate the rank of the 3*3 matrix, and determine the degree of association between the three risks according to the size of the rank.

[0074] Preferably, the smaller the rank of the multidimensional matrix is, the greater the degree of correlation between the risks represented is.

[0075] After obtaining the 3*2 matrix and the 3*3 matrix, the ranks of the 3*2 matrix and the 3*3 matrix can be calculated. Since there are multiple 3*2 matrices and 3*3 matrices, the ranks of several matrices can be calculated. For the 3*2 matrix, the ranks of different matrices can be compared. The smaller the rank, the greater the correlation between the risks, that is, when one risk occurs, the possibility of another risk occurring will also increase. For the 3*3 matrix, the smaller the rank, the greater the correlation between the risks, that is, when one risk occurs, the probability of the other two risks occurring will also increase. Based on the ranks of different multidimensional matrices, the correlation degree of at least two risk combinations can be determined accordingly, so as to facilitate targeted protection and improve the protection capability of the power monitoring system.

[0076] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A quantitative method for network security risk assessment of power monitoring system, characterized in that: The following steps are involved: Step S1, obtaining various risks of the power monitoring system, and calculating the consequence value, probability value and repair value of the risks, wherein the risks include known risks, potential risks and external risks; Step S2, respectively assigning and adjusting the consequence value, probability value and repair value; Step S3, constructing the consequence values, probability values ​​and repair values ​​after assigning multiple risks into a multi-dimensional matrix; Step S4: Calculate the rank of the multidimensional matrix, and obtain the correlation degree of various risks according to the rank.

2. According to claim 1, a method for quantifying network security risk assessment of a power monitoring system is characterized in that: The specific steps of step S1 to obtain the known risks of the power monitoring system are: Step S11, obtaining the power monitoring system database and searching for historical risks; Step S12: Determine whether the historical risks have been resolved, and output the unresolved historical risks as known risks.

3. According to claim 1, a method for quantifying network security risk assessment of a power monitoring system is characterized in that: The specific steps of step S1 to obtain the potential risks of the power monitoring system are: Step S13: Compare with the latest risk data of the same type of power monitoring system, and output the risks that have not appeared as potential risks; Step S14: Perform penetration testing on the power monitoring system and obtain potential risks.

4. According to claim 1, a method for quantifying network security risk assessment of a power monitoring system is characterized in that: The specific steps of step S1 to obtain the external risks of the power monitoring system are: Step S15: Obtain natural disasters and / or electromagnetic pulse attacks occurring in the area where the current power monitoring system is located, and output them as external risks.

5. According to claim 1, a method for quantifying network security risk assessment of a power monitoring system is characterized in that: The specific steps of calculating the consequence value, probability value and repair value of the risk in step S1 are as follows: Step S16: Divide the functional areas of the power monitoring system to determine the functional areas affected by known risks, potential risks, and external risks; Step S17: quantify the negative impact on business, finance, safety, etc. after the risk occurs, and obtain the consequence value; Step S18: Evaluate the possibility of risk occurrence based on historical data and environmental factors, and obtain a probability value; Step S19: Evaluate the time required for the functional area from the occurrence of risk to the restoration of the system to normal operation, and obtain a repair value.

6. A method for quantifying network security risk assessment of a power monitoring system according to claim 5, characterized in that: The step S2 assigns different weights to the consequence value, probability value and repair value respectively, wherein the size of the weight is determined according to the importance of the functional area affected by the risk in the entire power monitoring system, and the importance of the functional area is determined according to its contribution to the stable operation of the entire power monitoring system.

7. A method for quantifying network security risk assessment of a power monitoring system according to claim 1, characterized in that: The specific steps of step S3 are: Step S31, the consequence value, probability value and repair value of the same risk are combined into a column vector; Step S32: Arrange and combine the column vectors to obtain a plurality of multi-dimensional matrices.

8. A method for quantifying network security risk assessment of a power monitoring system according to claim 1 or 7, characterized in that: The multi-dimensional matrix includes a 3*2 matrix and a 3*3 matrix.

9. A method for quantifying network security risk assessment of a power monitoring system according to claim 8, characterized in that: The specific steps of step S4 are: Step S41, calculating the ranks of all 3*2 matrices, and determining the degree of association between two risks according to the size of the ranks; Step S42: Calculate the rank of the 3*3 matrix, and determine the degree of association between the three risks according to the size of the rank.

10. A method for quantifying network security risk assessment of a power monitoring system according to claim 9, characterized in that: The smaller the rank of the multidimensional matrix is, the greater the correlation between the risks is.

Images