Power generation enterprise threat information collection and management method and system based on multivariate threat intelligence
By building a system that integrates multi-source data and applies advanced mathematical model, the problem of insufficient adaptability and early warning accuracy of existing technologies in dynamic threat environments is solved, more efficient threat identification and response are achieved, and the security management capabilities of power generation enterprises are improved.
Patent Information
- Application Number
- CN202411574389.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-06
- Publication Date
- 2025-04-11
AI Technical Summary
The prior art has insufficient adaptability and early warning accuracy in dynamic threat environments, making it difficult to effectively correlate and analyze multi-source threat information.
Build a system covering multi-source data integration, advanced mathematical model applications, and a dynamic response mechanism based on threat level. Through data preprocessing, threat analysis model construction and threat level classification, identify and respond to single and compound threats.
It significantly improves the defense capabilities and response speed of power generation companies when facing multiple threats, achieves more accurate threat identification and evaluation, and can quickly adjust security policies based on real-time analysis results.
Smart Images
Figure CN119808069A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a method and system for collecting and managing threat information of power generation enterprises based on multi-dimensional threat intelligence. Background Art
[0002] In today's increasingly information-based and networked society, power generation companies, as important infrastructure, are increasingly subject to various threats in their safe operation. These threats include not only traditional physical security threats, such as equipment failures and natural disasters, but also network security threats, such as hacker attacks, malware intrusions, and data leaks. At the same time, market dynamics such as supply chain issues and energy price fluctuations may also affect the stable operation of power generation companies. With the advancement of technology, the integration and analysis of multiple threat intelligence has become a key means to improve the effectiveness of enterprise security management.
[0003] However, existing technologies usually have many shortcomings when processing this type of information. Existing threat information collection and analysis methods often treat network security, physical security and market dynamics information in isolation, and lack a comprehensive analysis framework to deal with cross-domain complex threats.
[0004] Existing threat intelligence processing technologies usually face the problem of data islands, making it difficult to achieve effective correlation analysis between data. At the same time, the adaptability and warning accuracy in dynamic threat environments are also unsatisfactory. The present invention proposes a new threat information collection and management method. By constructing a system covering multi-source data integration, advanced mathematical model application, and a dynamic response mechanism based on threat levels, it significantly improves the defense capabilities and response speed of power generation companies when facing multiple threats. Through this method, not only can single and compound threats be identified and evaluated more accurately, but security strategies can also be quickly adjusted based on real-time analysis results, providing power generation companies with a comprehensive and flexible security protection solution. Summary of the invention
[0005] In view of the above-mentioned problems, the present invention is proposed.
[0006] Therefore, the problem to be solved by the present invention is: how to solve the problem that the existing methods have insufficient adaptability and early warning accuracy in a dynamic threat environment.
[0007] To solve the above technical problems, the present invention provides the following technical solutions: a method for collecting and managing threat information of power generation enterprises based on multi-dimensional threat intelligence, comprising: collecting threat intelligence data, preprocessing the collected threat intelligence data, including data cleaning, format standardization and deduplication; constructing a threat analysis model to analyze the preprocessed data, and identifying potential threat patterns including single threats and compound threats; classifying threat levels according to the analysis results, and implementing security protection and emergency response measures based on the threat levels; and regularly updating and optimizing the threat analysis model.
[0008] As a preferred solution of the threat information collection and management method for power generation enterprises based on the multi-dimensional threat intelligence described in the present invention, the threat intelligence data includes network security data, physical security data and market dynamics data; the network security data includes intrusion detection system alarms, firewall logs, malware analysis reports, endpoint security solution event logs, network traffic and behavior analysis data; the physical security data includes access control system records, video surveillance records, security patrol logs and physical intrusion detection system alarms; the market dynamics data includes supply chain change information, market demand fluctuations and price change information.
[0009] As a preferred solution of the method for collecting and managing threat information of power generation enterprises of multi-dimensional threat intelligence of the present invention, the analysis of the pre-processed data includes performing a nonlinear transformation on the pre-processed threat intelligence data matrix, which is expressed as:
[0010]
[0011] Among them, Z is the threat intelligence data after nonlinear transformation, X is the preprocessed threat intelligence data matrix, A is the feature conversion matrix, and b is the bias vector. For the identification of a single threat, the indicator function is defined as:
[0012]
[0013] Among them, g(z) is a single threat indicator function, and z is the threat intelligence data in Z. For the identification of compound threats, the indicator function is defined as:
[0014]
[0015] Among them, h(Z) is the composite threat index function, n is the total number of data of Z, and Z i is the i-th data in the threat intelligence data after nonlinear transformation, Z j is the jth data in the threat intelligence data after nonlinear transformation.
[0016] As a preferred solution of the method for collecting and managing threat information of power generation enterprises of the multi-dimensional threat intelligence of the present invention, the identifying of potential threat patterns including single threats and compound threats includes setting a first single threshold value τ g and the second composite threshold τ h , if g(Z) is greater than the first single threshold τ g And the maximum value of h(Z) minus the minimum value of h(Z) is less than the second composite threshold τ h , then it is a single threat, if g(Z) is less than or equal to the first single threshold τ g And the maximum value of h(Z) minus the minimum value of h(Z) is greater than or equal to the second composite threshold τ h , then it is a composite threat, if g(z) is less than the first single threshold τ g And the maximum value of h(Z) minus the minimum value of h(Z) is less than the second composite threshold τ h , then it is an uncertain threat. If g(z) is greater than the first single threshold τ g And the maximum value of h(Z) minus the minimum value of h(Z) is greater than or equal to the second composite threshold τ h , then there is no threat.
[0017] As a preferred solution of the method for collecting and managing threat information of power generation enterprises of the multi-dimensional threat intelligence of the present invention, the identification of potential threat patterns including single threats and compound threats also includes evaluating uncertain threats using a function based on information entropy, which is expressed as:
[0018]
[0019] Among them, p i is the transformed data point Z i The normalized weight in the data set, S(Z) is the information entropy function of the uncertain threat; set the second single threshold and the second composite threshold, if g(z) is greater than the second single threshold and S(Z) is less than or equal to the second composite threshold, it is a single threat, if S(Z) is greater than the second composite threshold, it is a composite threat, if g(z) is less than or equal to the second single threshold and S(Z) is less than or equal to the second composite threshold, it is no threat.
[0020] As a preferred solution of the method for collecting and managing threat information of power generation enterprises of the multi-threat intelligence of the present invention, the threat level includes respectively calculating the threat level score of a single threat and the threat level score of a compound threat; the threat level score of a single threat is calculated by g(z) and S(Z), and is expressed as:
[0021]
[0022] Among them, L single is the threat level score of a single threat, τg ′ is the second single threshold, τ s ' is the second composite threshold; the threat level score of the composite threat is calculated by the first composite threshold and the second composite threshold, and is expressed as:
[0023]
[0024] Among them, L composite is the threat level score of the compound threat.
[0025] As a preferred solution of the method for collecting and managing threat information of power generation enterprises based on multiple threat intelligence of the present invention, wherein: the implementation of security protection and emergency response measures based on threat level includes setting a low threshold value L of the threat level of a single threat s1 and the high threshold of threat level L for a single threat s2 , the low threshold of the threat level of the compound threat is L c1 and the high threshold L of the threat level of the composite threat c2 ; For a single threat, if L single Less than or equal to the low threshold L of the threat level of a single threat s1 , it is a single threat low-level alert, regular monitoring and log review, update security patches and policies, if L single Greater than the low threshold L of the threat level of a single threat s1 And less than or equal to the high threshold L of the threat level of a single threat s2 , it is a single threat medium-level alarm, strengthen the monitoring of network intrusion detection, increase the review and monitoring of security personnel, if L single Greater than the high threshold L of the threat level of a single threat s2 , it is a single threat high-level alert, immediately isolate and review the affected network, initiate an emergency response and conduct a detailed investigation; for complex threats, if L composite Less than or equal to the low threshold L of the threat level of the composite threat c1 , it is a low-level composite threat alert, and the emergency response plan should be updated regularly. composite Greater than the low threshold L of the threat level of the composite threat c1 And less than or equal to the high threshold L of the threat level of the composite threat c2 , it is a medium-level composite threat alert, activating a cross-functional team to assess potential composite risks and adjust physical and network security measures. composite Greater than the high threshold L of the threat level of the composite threat c2 , it is a high-level alert for complex threats, and crisis management is fully initiated, security reviews and system shutdowns are performed; threat analysis models are regularly updated and optimized.
[0026] Another object of the present invention is to provide a system for threat information collection and management methods for power generation enterprises with multiple threat intelligence, which can solve the problem of threat information collection and management for power generation enterprises with multiple threat intelligence by constructing a threat information collection and management system for power generation enterprises.
[0027] To solve the above technical problems, the present invention provides the following technical solutions: a threat information collection and management system for power generation enterprises with multi-dimensional threat intelligence, including a data acquisition module, a threat analysis module, a processing module and an update module; the data acquisition module is used to collect threat intelligence data and pre-process the collected threat intelligence data, including data cleaning, format standardization and deduplication; the threat analysis module is used to construct a threat analysis model to analyze the pre-processed data and identify potential threat patterns including single threats and compound threats; the processing module is used to classify threat levels according to the analysis results, and implement security protection and emergency response measures based on the threat levels; the update module is used to regularly update and optimize the threat analysis model.
[0028] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the method for collecting and managing threat information of a power generation enterprise based on multiple threat intelligence are implemented.
[0029] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for collecting and managing threat information of a power generation enterprise based on multiple threat intelligence as described above.
[0030] The beneficial effects of the present invention are as follows: the threat information collection and management method for power generation enterprises with multiple threat intelligence provided by the present invention can accurately analyze and distinguish different threat patterns, and assign corresponding threat levels according to these patterns, thereby realizing highly customized security protection strategies. Single threats and compound threats can be accurately identified and classified, effectively improving the implementation efficiency of targeted protection measures, and also improving the response speed to potential complex threats, thereby greatly reducing the probability of safety accidents and possible economic losses, and being able to continuously adapt to new security threat environments, greatly improving the security management capabilities of power generation enterprises in the face of diversified threats and the overall stability of the system. BRIEF DESCRIPTION OF THE DRAWINGS
[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.
[0032] Figure 1A flowchart of a method for collecting and managing threat information of power generation enterprises based on multiple threat intelligence provided by the first embodiment of the present invention.
[0033] Figure 2 A structural diagram of a power generation enterprise threat information collection and management system for multiple threat intelligence provided by a second embodiment of the present invention. DETAILED DESCRIPTION
[0034] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.
[0035] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.
[0036] Example 1, reference Figure 1 , which is the first embodiment of the present invention, and provides a threat information collection and management method for power generation enterprises based on multi-dimensional threat intelligence, including: collecting threat intelligence data, preprocessing the collected threat intelligence data, including data cleaning, format standardization, and deduplication; building a threat analysis model to analyze the preprocessed data, and identifying potential threat patterns including single threats and compound threats; classifying threat levels according to the analysis results, and implementing security protection and emergency response measures based on the threat levels; and regularly updating and optimizing the threat analysis model.
[0037] S1. Collect threat intelligence data and pre-process the collected threat intelligence data, including data cleaning, format standardization, and deduplication.
[0038] Collect threat intelligence data from multiple fields such as network security, physical security, and market dynamics, including network security data, physical security data, and market dynamics data.
[0039] Network security data includes alerts from intrusion detection systems (IDS), firewall logs, malware analysis reports, event logs from endpoint security solutions, network traffic and behavioral analysis data, etc.
[0040] Physical security data includes access control system records, video surveillance records, security patrol logs, and physical intrusion detection system alarms.
[0041] Market dynamics data includes information on supply chain changes, market demand fluctuations, and price changes.
[0042] Pre-process the collected threat intelligence data, including data cleaning, format standardization, and deduplication.
[0043] S2. Construct a threat analysis model to analyze the preprocessed data and identify potential threat patterns including single threats and compound threats.
[0044] The preprocessed threat intelligence data matrix is transformed nonlinearly and expressed as:
[0045]
[0046] Among them, Z is the threat intelligence data after nonlinear transformation, X is the preprocessed threat intelligence data matrix, A is the feature conversion matrix, and b is the bias vector.
[0047] For the identification of a single threat, the indicator function is defined as:
[0048]
[0049] Among them, g(z) is a single threat indicator function, and z is the threat intelligence data in Z; it is used to measure the distribution concentration of a single sample after feature transformation, so as to determine whether there is a single threat. If the value of g(z) is high, it means that the data point is highly concentrated in the transformed feature space, which usually corresponds to the characteristics of a single threat. A single threat often manifests itself as an abnormal concentration of data features, which is different from the normal or threat-free data distribution.
[0050] For the identification of compound threats, the indicator function is defined as:
[0051]
[0052] Among them, h(Z) is the composite threat index function, n is the total number of data of Z, and Z i is the i-th data in the threat intelligence data after nonlinear transformation, Z j is the jth data in the threat intelligence data after nonlinear transformation. The output of h(Z) is a normalized weighted average. If the weights of some components are significantly higher than other components, this may indicate the existence of a compound threat. Compound threats usually involve multiple different types of threat factors occurring simultaneously, resulting in increased data complexity.
[0053] Set the first single threshold τ g and the second composite threshold τ h , if g(z) is greater than the first single threshold τ g And the maximum value of h(Z) minus the minimum value of h(Z) is less than the second composite threshold τ h , then it is a single threat, if g(z) is less than or equal to the first single threshold τ g And the maximum value of h(Z) minus the minimum value of h(Z) is greater than or equal to the second composite threshold τ h, then it is a composite threat, if g(z) is less than the first single threshold τ g And the maximum value of h(Z) minus the minimum value of h(Z) is less than the second composite threshold τ h , then it is an uncertain threat. If g(z) is greater than the first single threshold τ g And the maximum value of h(Z) minus the minimum value of h(Z) is greater than or equal to the second composite threshold τ h , then there is no threat. The threshold is derived from historical data.
[0054] For uncertain threats, the function based on information entropy is used for evaluation, which is expressed as:
[0055]
[0056] Among them, p i is the transformed data point Z i The normalized weight in the data set, S(Z) is the information entropy function of the uncertain threat.
[0057] If the entropy value calculated by S(Z) is high, it indicates that the information in the data is very widely distributed or random, which may involve complex or diverse threat factors, or the data itself has a high degree of uncertainty. If the entropy value calculated by S(Z) is low, it indicates that the information in the data is highly concentrated, which may be a single threat or no obvious threat.
[0058] Set the second single threshold and the second composite threshold. If g(z) is greater than the second single threshold and S(Z) is less than or equal to the second composite threshold, it is a single threat. If S(Z) is greater than the second composite threshold, it is a composite threat. If g(z) is less than or equal to the second single threshold and S(Z) is less than or equal to the second composite threshold, it is no threat.
[0059] S3. Classify the threat level based on the analysis results and implement security protection and emergency response measures based on the threat level.
[0060] The threat level scores of single threats and compound threats are calculated separately.
[0061] The threat level score of the single threat is calculated by g(z) and S(Z), and is expressed as:
[0062]
[0063] Among them, L single is the threat level score of a single threat, τ g ′ is the second single threshold, τ s ' is the second composite threshold.
[0064] The threat level score of the composite threat is calculated by the first composite threshold and the second composite threshold, expressed as:
[0065]
[0066] Among them, L composite is the threat level score of the compound threat.
[0067] Set the low threshold L for the threat level of a single threat s1 and the high threshold of threat level L for a single threat s2 , the low threshold of the threat level of the compound threat is L c1 and the high threshold L of the threat level of the composite threat c2 .
[0068] For a single threat, if L single Less than or equal to the low threshold L of the threat level of a single threat s1 , it is a single threat low-level alert, regular monitoring and log review, update security patches and policies, if L single Greater than the low threshold L of the threat level of a single threat s1 And less than or equal to the high threshold L of the threat level of a single threat s2 , it is a single threat medium-level alarm, strengthen the monitoring of network intrusion detection, increase the review and monitoring of security personnel, if L single Greater than the high threshold L of the threat level of a single threat s2 , it is a single threat high-level alert, immediately isolates and reviews the affected network, and initiates an emergency response for a detailed investigation.
[0069] For a compound threat, if L composite Less than or equal to the low threshold L of the threat level of the composite threat c1 , it is a low-level alert for complex threats, enhance information sharing and collaboration, and regularly update emergency response plans. composite Greater than the low threshold L of the threat level of the composite threat c1 And less than or equal to the high threshold L of the threat level of the composite threat c2 , it is a medium-level composite threat alert, activating a cross-functional team to assess potential composite risks and adjust physical and network security measures. composite Greater than the high threshold L of the threat level of the composite threat c2 , it is a high-level alert for complex threats, and crisis management is fully initiated, with security reviews and system shutdowns.
[0070] S4. Regularly update and optimize threat analysis models.
[0071] Example 2, reference Figure 2, which is the second embodiment of the present invention, is different from the previous embodiment in that it provides a threat information collection and management system for power generation enterprises with multiple threat intelligence, including: a data collection module, a threat analysis module, a processing module and an update module.
[0072] The data collection module is used to collect threat intelligence data and pre-process the collected threat intelligence data, including data cleaning, format standardization, and deduplication.
[0073] The threat analysis module is used to build a threat analysis model to analyze the preprocessed data and identify potential threat patterns including single threats and compound threats.
[0074] The processing module is used to classify the threat level according to the analysis results and implement security protection and emergency response measures based on the threat level.
[0075] The update module is used to regularly update and optimize threat analysis models.
[0076] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.
[0077] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.
[0078] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.
[0079] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.
[0080] Embodiment 3 is the third embodiment of the present invention. It is different from the first two embodiments in that it is used to verify the technical effects adopted in the present invention so as to verify the real effects of the method.
[0081] Real-world operational data from multiple power generation companies, including cybersecurity logs, physical security records, and market dynamics data. The simulation spans 12 months.
[0082] Threat identification accuracy, response time, threat level classification accuracy, system stability, and economic loss reduction are evaluated.
[0083] Traditional methods refer to existing isolated threat intelligence processing methods, which usually handle network security, physical security and market dynamics information separately without a comprehensive analysis framework. Specifically, they include:
[0084] Network security: Use independent intrusion detection systems (IDS) and firewall log analysis.
[0085] Physical security: Relies on independent analysis of access control systems and video surveillance systems.
[0086] Market Dynamics: Based on a separate analysis of market data, without correlation with other threat information.
[0087] This embodiment uses the traditional method and the method of the present invention to perform detection simultaneously, and the detection comparison results are shown in the following Table 1:
[0088] Table 1 Comparison table between traditional method and method of the present invention
[0089] index Traditional methods Method of the present invention Threat identification accuracy (%) 75 92 Average response time (minutes) 30 10 Threat level classification accuracy (%) 70 88 System stability (%) 85 95
[0090] Through the above data comparison, it can be clearly seen that the method of the present invention is significantly superior to the traditional method in terms of threat identification accuracy, response time, threat level classification accuracy and system stability, which proves the beneficial effects of the present invention.
[0091] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.
Claims
1. A method for collecting and managing threat information of power generation enterprises based on multi-dimensional threat intelligence, characterized by: include, Collect threat intelligence data and pre-process the collected threat intelligence data, including data cleaning, format standardization, and deduplication; Construct a threat analysis model to analyze the pre-processed data and identify potential threat patterns including single threats and compound threats; According to the analysis results, the threat level is classified and security protection and emergency response measures are implemented based on the threat level; Regularly update and optimize threat analysis models.
2. The method for collecting and managing threat information of power generation enterprises based on multiple threat intelligence as claimed in claim 1, characterized in that: The threat intelligence data includes network security data, physical security data and market dynamics data; The network security data includes intrusion detection system alerts, firewall logs, malware analysis reports, endpoint security solution event logs, network traffic and behavioral analysis data; The physical security data includes access control system records, video surveillance records, security patrol logs, and physical intrusion detection system alarms; The market dynamics data includes supply chain change information, market demand fluctuations and price change information.
3. The method for collecting and managing threat information of power generation enterprises based on multiple threat intelligence as claimed in claim 2, characterized in that: The analysis of the preprocessed data includes performing a nonlinear transformation on the preprocessed threat intelligence data matrix, which is expressed as: Among them, Z is the threat intelligence data after nonlinear transformation, X is the preprocessed threat intelligence data matrix, A is the feature conversion matrix, and b is the bias vector; For the identification of a single threat, the indicator function is defined as: Among them, g(z) is a single threat indicator function, and z is the threat intelligence data in Z; For the identification of compound threats, the indicator function is defined as: Among them, h(Z) is the composite threat index function, n is the total number of data of Z, and Z i is the i-th data in the threat intelligence data after nonlinear transformation, Z j is the jth data in the threat intelligence data after nonlinear transformation.
4. The method for collecting and managing threat information of power generation enterprises based on multiple threat intelligence as claimed in claim 3, characterized in that: The identifying of potential threat patterns including single threats and compound threats includes setting a first single threshold τ g and the second composite threshold τ h , if g(z) is greater than the first single threshold τ g And the maximum value of h(Z) minus the minimum value of h(Z) is less than the second composite threshold τ h , then it is a single threat, if g(z) is less than or equal to the first single threshold τ g And the maximum value of h(Z) minus the minimum value of h(Z) is greater than or equal to the second composite threshold τ h , then it is a composite threat, if g(z) is less than the first single threshold τ g And the maximum value of h(Z) minus the minimum value of h(Z) is less than the second composite threshold τ h , then it is an uncertain threat. If g(z) is greater than the first single threshold τ g And the maximum value of h(Z) minus the minimum value of h(Z) is greater than or equal to the second composite threshold τ h , then there is no threat.
5. The method for collecting and managing threat information of power generation enterprises based on multiple threat intelligence as claimed in claim 4, characterized in that: The identification of potential threat patterns including single threats and compound threats also includes evaluating uncertain threats using a function based on information entropy, expressed as: Among them, p i is the transformed data point Z i The normalized weight in the data set, S(Z) is the information entropy function of the uncertain threat; Set the second single threshold and the second composite threshold. If g(z) is greater than the second single threshold and S(Z) is less than or equal to the second composite threshold, it is a single threat. If S(Z) is greater than the second composite threshold, it is a composite threat. If g(z) is less than or equal to the second single threshold and S(Z) is less than or equal to the second composite threshold, it is no threat.
6. The method for collecting and managing threat information of power generation enterprises based on multiple threat intelligence as claimed in claim 5, characterized in that: The threat level includes calculating the threat level score of a single threat and the threat level score of a compound threat respectively; The threat level score of the single threat is calculated by g(z) and S(Z), expressed as, Among them, L single is the threat level score of a single threat, τ g ′ is the second single threshold, τ s ' is the second composite threshold; The threat level score of the composite threat is calculated by the first composite threshold and the second composite threshold, and is expressed as: Among them, L composite is the threat level score of the compound threat.
7. The method for collecting and managing threat information of power generation enterprises based on multiple threat intelligence as claimed in claim 6, characterized in that: The implementation of security protection and emergency response measures based on threat level includes setting a low threshold value L of the threat level of a single threat. s1 and the high threshold of threat level L for a single threat s2 , the low threshold of the threat level of the compound threat is L c1 and the high threshold L of the threat level of the composite threat c2 ; For a single threat, if L single Less than or equal to the low threshold L of the threat level of a single threat s1 , it is a single threat low-level alert, regular monitoring and log review, update security patches and policies, if L single Greater than the low threshold L of the threat level of a single threat s1 And less than or equal to the high threshold L of the threat level of a single threat s2 , it is a single threat medium-level alarm, strengthen the monitoring of network intrusion detection, increase the review and monitoring of security personnel, if L single Greater than the high threshold L of the threat level of a single threat s2 , it is a single threat high-level alert, immediately isolate and review the affected network, and initiate an emergency response for detailed investigation; For a compound threat, if L composite Less than or equal to the low threshold L of the threat level of the composite threat c1 , it is a low-level composite threat alert, and the emergency response plan should be updated regularly. composite Greater than the low threshold L of the threat level of the composite threat c1 And less than or equal to the high threshold L of the threat level of the composite threat c2 , it is a medium-level composite threat alert, activating a cross-functional team to assess potential composite risks and adjust physical and network security measures. composite Greater than the high threshold L of the threat level of the composite threat c2 , it is a high-level alert for complex threats, and crisis management is fully initiated, with security reviews and system shutdowns; Regularly update and optimize threat analysis models.
8. A system for collecting and managing threat information of power generation enterprises using the multi-dimensional threat intelligence method according to any one of claims 1 to 7, characterized in that: Including data collection module, threat analysis module, processing module and update module; The data collection module is used to collect threat intelligence data and pre-process the collected threat intelligence data, including data cleaning, format standardization and deduplication; The threat analysis module is used to construct a threat analysis model to analyze the preprocessed data and identify potential threat patterns including single threats and compound threats; The processing module is used to classify the threat level according to the analysis results, and implement security protection and emergency response measures based on the threat level; The updating module is used to regularly update and optimize the threat analysis model.
9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for collecting and managing threat information of power generation enterprises based on multiple threat intelligence as described in any one of claims 1 to 7 are implemented.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for collecting and managing threat information of power generation enterprises based on multiple threat intelligence according to any one of claims 1 to 7 are implemented.