Power plant network security quantitative analysis processing method and system based on big data

Abstract

The invention discloses a power plant network security quantitative analysis processing method and system based on big data, and relates to the technical field of data processing. Comprising the steps of collecting key parameters, forming an equipment communication behavior data set, and establishing a communication behavior reference model; according to the reference model, identifying a behavior in a normal mode, and marking the behavior as an abnormal communication behavior; performing classification analysis on the identified abnormal communication behaviors, and determining a potential risk level and a processing emergency degree of each abnormal behavior; and for the determined high-risk-level abnormal behavior, automatically triggering a safety response measure. According to the invention, detailed parameters such as inter-equipment communication frequency and communication content types are adopted for abnormal identification, and potential security threats in a power plant network can be detected more accurately.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a method and system for quantitative analysis and processing of power plant network security based on big data. Background Art

[0002] With the accelerated advancement of digitalization and intelligent construction of modern power plants, the widespread application of various intelligent devices and automated control systems in power plants has greatly improved the operating efficiency and safety of power plants. However, the complexity of the internal network environment of power plants has also increased, resulting in increasingly prominent network security issues. The network system of traditional power plants usually adopts a relatively independent architecture with limited informatization, so it is less exposed to network attacks.

[0003] In the prior art, the methods for detecting abnormal communication in power plant networks are mainly based on rule matching or simple statistical analysis models. These methods have certain practicality in small-scale network environments, but with the diversification of power plant equipment and communication protocols, their limitations are becoming increasingly apparent. Summary of the invention

[0004] In view of the problems existing in the above-mentioned background technology, a method and system for quantitative analysis and processing of power plant network security based on big data is proposed in the present invention.

[0005] Therefore, the problem to be solved by the present invention is how to more accurately detect potential security threats in a power plant network.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a method for quantitative analysis and processing of power plant network security based on big data, which includes collecting key parameters through communication record data of each device inside the power plant to form a data set of device communication behavior, and pre-processing the data and establishing a communication behavior baseline model according to different device types, communication protocols and communication contents; analyzing real-time communication data according to the baseline model using big data analysis technology, identifying normal mode behavior by comparing the real-time communication data with the baseline model, and marking it as abnormal communication behavior; classifying and analyzing the identified abnormal communication behavior, evaluating the abnormal behavior according to the severity of the abnormality, the scope of impact and the type of attack, and determining the potential risk level and processing urgency of each abnormal behavior by combining the operational criticality of the equipment and the network topology; and automatically triggering security response measures for determined high-risk abnormal behaviors.

[0008] As a preferred solution of the method for quantitative analysis and processing of power plant network security based on big data described in the present invention, the preprocessing of data and establishment of a communication behavior benchmark model according to different equipment types, communication protocols and communication contents includes the following steps: cleaning and standardizing the data in the equipment communication behavior data set to remove duplicate and erroneous data; after data cleaning, using a clustering algorithm based on weighted distance to process the equipment communication behavior data set; based on the clustering results, establishing a benchmark model of the communication behavior of the equipment for different equipment types, communication protocols and communication contents; introducing a time series analysis method to dynamically optimize the benchmark model, and combining the changing trend of the equipment operation period to form a benchmark model that adapts to dynamic changes.

[0009] As a preferred solution of the power plant network security quantitative analysis and processing method based on big data described in the present invention, the method of processing the equipment communication behavior data set using a clustering algorithm based on weighted distance includes: designing an improved clustering method to handle the heterogeneity between devices, and classifying the equipment communication mode based on the multi-dimensional characteristics of the communication behavior. The formula is as follows:

[0010]

[0011] Where δ(d1, d2) is the distance measure between device d1 and device d2 in the multidimensional feature space; M is the number of features used in cluster analysis; w i is the weight of feature i, reflecting the importance of this feature to the clustering result; d 1i and d 2i are the values ​​of device d1 and device d2 on the i-th feature dimension respectively.

[0012] As a preferred solution of the method for quantitative analysis and processing of power plant network security based on big data described in the present invention, the benchmark model includes: modeling the communication behavior of the equipment through a statistical learning method based on a Gaussian mixture model (GMM) to obtain a benchmark communication mode of the equipment. The specific formula is as follows:

[0013]

[0014] Where P(x) is the probability of communication behavior under device observation data x, π k is the weight of the kth Gaussian distribution, indicating the prior probability of the distribution; The mean is μ k , a Gaussian distribution with covariance ∑k, represents the statistical characteristics of the device communication behavior in the kth cluster; K is the number of distributions in the Gaussian mixture model.

[0015] As a preferred solution of the method for quantitative analysis and processing of power plant network security based on big data described in the present invention, the benchmark model adapted to dynamic changes is: dynamically adjusting the model according to the change trend of the historical communication behavior of the equipment, the formula is as follows:

[0016] P(t+1)=α×P(t)+(1-α)×P new (t)

[0017] Where P(t+1) is the update result of the device communication behavior benchmark model at time t+1; P(t) is the communication behavior benchmark model at the current time t; P new (t) is the baseline model updated based on the historical behavior data of the device; α is the smoothing factor.

[0018] As a preferred solution of the power plant network security quantitative analysis and processing method based on big data described in the present invention, wherein: the determination of the potential risk level and the urgency of handling each abnormal behavior in combination with the operation criticality and network topology of the equipment includes the following steps: evaluating the operation criticality according to the impact of the equipment on the power plant production; calculating the risk level of each abnormal behavior based on the criticality of the equipment operation, the importance of the network topology and the attack type, and determining the urgency of handling according to different levels; wherein the risk level formula is:

[0019] R total =ω1×R device +ω2×R topology +ω3×A type

[0020] Among them, R total is the total score of abnormal behavior, ω1~ω3 are weight factors, R device Score the criticality of the device, A type Score the severity of the attack type, R topology Score the importance of topological nodes; according to R total Numerical values ​​are used to classify different risk levels.

[0021] As a preferred solution of the method for quantitative analysis and processing of power plant network security based on big data described in the present invention, the automatic triggering of security response measures for determined high-risk level abnormal behaviors includes: when the risk level of the abnormal behavior exceeds a preset threshold, the security response measures are automatically triggered, including restricting the communication of the affected equipment, reallocating the communication path, or sending a security alarm notification; after the response measures are triggered, the network status is tracked through real-time monitoring to ensure that the abnormal behavior is effectively controlled and prevented from spreading.

[0022] In a second aspect, the present invention provides a power plant network security quantitative analysis and processing system based on big data, which includes:

[0023] The communication behavior data collection module is used to collect key parameters through the communication record data of each device in the power plant, form a data set of equipment communication behavior, and pre-process the data and establish a communication behavior benchmark model according to different equipment types, communication protocols and communication contents;

[0024] A real-time communication behavior analysis module is used to analyze the real-time communication data using big data analysis technology according to the benchmark model, identify normal mode behaviors by comparing the real-time communication data with the benchmark model, and mark them as abnormal communication behaviors;

[0025] The abnormal behavior classification and assessment module is used to classify and analyze the identified abnormal communication behaviors, and to prioritize the abnormal behaviors according to the severity, impact scope and attack type of the abnormalities. By combining the operation criticality of the equipment and the network topology, the potential risk level and urgency of handling of each abnormal behavior are determined;

[0026] The high-risk behavior response module is used to automatically trigger security response measures for determined high-risk level abnormal behaviors.

[0027] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program instructions are executed by the processor, the steps of the power plant network security quantitative analysis and processing method based on big data as described in the first aspect of the present invention are implemented.

[0028] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program instructions are executed by a processor, the steps of the power plant network security quantitative analysis and processing method based on big data as described in the first aspect of the present invention are implemented.

[0029] The beneficial effects of the present invention are as follows: the present invention distinguishes the communication behavior pattern between devices from the network traffic pattern, and uses refined parameters such as the communication frequency between devices and the communication content type for anomaly identification, which can more accurately detect potential security threats in the power plant network. Compared with the traditional general traffic analysis method, the present invention avoids possible false alarms and improves the effectiveness of security detection through the refined modeling of the communication characteristics between devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0031] Figure 1 The flowchart is a method for quantitative analysis and processing of power plant network security based on big data.

[0032] Figure 2 This is a structural diagram of the power plant network security quantitative analysis and processing system based on big data. DETAILED DESCRIPTION

[0033] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0034] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0035] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0036] Example 1

[0037] Reference Figure 1-2 , which is the first embodiment of the present invention, and provides a method for quantitative analysis and processing of power plant network security based on big data, including:

[0038] S1: Through the communication record data of each device in the power plant, key parameters such as equipment communication frequency, communication period, and communication content are collected to form a data set of equipment communication behavior. According to different equipment types, communication protocols, and communication contents, the data is preprocessed and a communication behavior benchmark model is established.

[0039] S1.1: Extract key parameters from the communication records of each device in the power plant, including data items such as device communication frequency, communication period and communication content, and remove irrelevant data through data source filtering technology to form a device communication behavior data set.

[0040] S1.2: Apply data cleaning algorithms to clean and standardize the data in the device communication behavior dataset, remove duplicate and erroneous data, ensure the quality of the dataset, and use specific clustering algorithms to pre-process the communication data to identify the communication pattern characteristics between devices.

[0041] Preferably, after data cleaning, a clustering algorithm based on weighted distance is used to process the device communication behavior data set:

[0042] In order to deal with the heterogeneity between devices, an improved clustering method is designed to classify device communication modes based on the multi-dimensional characteristics of communication behavior. The formula is as follows:

[0043]

[0044] Where δ(d1, d2) is the distance measure between device d1 and device d2 in the multidimensional feature space; M is the number of features used in cluster analysis (such as communication frequency, packet size, time period, etc.); w i is the weight of feature i, reflecting the importance of this feature to the clustering result; d 1i and d 2i are the values ​​of device d1 and device d2 on the i-th feature dimension respectively.

[0045] By calculating the weighted distance between devices, the devices can be accurately clustered according to their multi-dimensional communication behavior characteristics, providing accurate grouping information for the construction of a communication behavior benchmark model.

[0046] S1.3: Based on the clustering results, a baseline model of the device's communication behavior is established for different device types, communication protocols, and communication contents. This baseline model draws the distribution of the device's communication behavior under normal conditions through a comprehensive analysis of the device's communication characteristics.

[0047] Preferably, the device communication behavior is modeled by a statistical learning method based on a Gaussian mixture model (GMM) to obtain a baseline communication mode of the device. The specific formula is as follows:

[0048]

[0049] Where P(x) is the probability of communication behavior under device observation data x, π k is the weight of the kth Gaussian distribution, indicating the prior probability of the distribution; The mean is μ k , a Gaussian distribution with covariance ∑k, represents the statistical characteristics of the device communication behavior in the kth cluster; K is the number of distributions in the Gaussian mixture model.

[0050] S1.4: Introduce time series analysis methods to dynamically optimize the benchmark model, and combine the changing trends of the equipment operation time to form a benchmark model that adapts to dynamic changes, which can cope with the fluctuations in the communication behavior of power plant equipment under different operating conditions.

[0051] Specifically, after the baseline model is established, a model update mechanism based on adaptive learning is introduced to dynamically adjust the model according to the change trend of the historical communication behavior of the device. The formula is as follows:

[0052] P(t+1)=α×P(t)+(1-α)×P new (t)

[0053] Where P(t+1) is the update result of the device communication behavior benchmark model at time t+1; P(t) is the communication behavior benchmark model at the current time t; P new (t) is the baseline model updated based on the historical behavior data of the device; α is the smoothing factor, which determines the sensitivity of the model update.

[0054] By dynamically adjusting the baseline model, the formula can effectively adapt to changes in device communication behavior and ensure that the model is consistent with the actual communication behavior.

[0055] S2: Based on the baseline model of step S1, the real-time communication data is analyzed using big data analysis technology. By comparing the real-time communication data with the baseline model, behaviors that deviate from the normal pattern, such as abnormal communication frequency, abnormal communication content, or a surge in communication volume between devices, are identified and marked as abnormal communication behaviors.

[0056] S2.1: Perform real-time streaming data processing on real-time communication data, compare the real-time data with the benchmark model established in step S1 through a big data analysis framework (such as Spark or Hadoop), and detect abnormal changes in communication frequency, communication time period, and communication content.

[0057] Among them, the stream data processing framework is used to collect and process the data streams generated by various equipment in the power plant in real time to ensure that the data is analyzed in a timely manner.

[0058] Furthermore, by comparing real-time data with historical patterns, potential deviations can be identified, specifically:

[0059] Compare the communication frequency of the device in the current period with the normal frequency value in the benchmark model. If the deviation between the current frequency and the benchmark model exceeds a predetermined threshold, it is marked as a potential anomaly.

[0060] Compare the device's communication frequency and quantity within a certain period of time to see if there are any abnormal fluctuations. For example, if the device originally did not communicate during a certain period of time, but suddenly began to communicate in large quantities, the behavior would be marked as abnormal;

[0061] Abnormal communication content means that the communication content of the device does not conform to the expected normal mode, such as the device sends an abnormal data packet, or the size or structure of the data packet changes abnormally.

[0062] By comparing the real-time data with the benchmark model, the real-time data points that deviate from the benchmark model can be identified in time and marked as suspected abnormal points. At this time, it no longer relies on simple threshold detection, but through multi-dimensional comparison and comprehensive analysis, it is judged whether the communication behavior is abnormal. Once potential abnormal communication behavior is detected, it will be further verified through the anomaly detection algorithm and the alarm mechanism will be triggered.

[0063] The above operations can efficiently and in real time process device communication data, accurately determine its deviation from normal behavior, and ensure that abnormal behavior can be discovered and responded to in a timely manner.

[0064] S2.2: Based on the marked suspected anomalies, further verify whether these suspected anomalies are real security threats through machine learning-based anomaly detection algorithms, such as the Isolation Forest algorithm.

[0065] Among them, the isolation forest algorithm verifies outliers based on the isolation of data. The following is the formula for outlier verification:

[0066]

[0067] in, is the abnormal score of the suspected sample point y, the higher the score, the more likely it is an abnormal point; h(y) is the path length required for the suspected sample point y to be isolated in the isolation tree; c(n) is the average path length under the number of nodes n, which can usually be calculated by randomly generating samples. Among them, the suspected sample point y is part of the observed data x.

[0068] When the anomaly score is greater than the preset threshold, the suspected sample point is determined to be an anomaly point, and the deviant behavior involved is marked.

[0069] The advantage of the Isolation Forest Algorithm is that it determines whether a data point is abnormal by the isolation of the path length, so it is suitable for real-time analysis of large-scale data streams. In practical applications, once the abnormal score is detected to exceed the set threshold, an alarm mechanism will be triggered to prompt managers to conduct further inspections and responses.

[0070] S3: Classify and analyze the abnormal communication behaviors identified in step S2, evaluate the abnormal behaviors according to the severity of the abnormalities, the scope of impact, and the possible attack types, and determine the potential risk level and handling urgency of each abnormal behavior by combining the operational criticality of the equipment and the network topology.

[0071] S3.1: Classify communication behaviors marked as abnormal, and make preliminary classifications based on the attack type (such as internal attack, external penetration) and the scope of its impact on device operation.

[0072] Among them, internal attacks refer to malicious behaviors initiated by equipment or users within the power plant, such as abnormal communication after the equipment is infected by malware, or internal personnel abusing their permissions to conduct unauthorized communications.

[0073] External penetration refers to attacks from outside the power plant, such as hackers invading the power plant control system through the network, data leakage, or attacks on external equipment.

[0074] Misoperation refers to abnormal communication behavior caused by non-malicious device failure or configuration error. This type of abnormal behavior usually does not involve security threats, but may affect the normal operation of the device.

[0075] Each abnormal communication behavior is classified into different categories based on factors such as communication content, source, target device, etc. For example, there may be categories such as "Insider Attack - Data Leakage" or "External Penetration - Command and Control Communication".

[0076] S3.2: Prioritize abnormal behaviors based on the operational criticality of the equipment (such as the impact of the equipment on power plant production) and the network topology (such as the importance of communication nodes) and determine the risk level of each type of abnormal behavior.

[0077] Specifically, after the classification is completed, each abnormal communication behavior will be prioritized and the risk level will be determined based on the operational criticality of the equipment and the network topology of the power plant.

[0078] The specific operation process is as follows:

[0079] The operation of each device is of different importance to the production of the power plant. Once the key equipment in the power plant (such as generators, transformers, control systems, etc.) is affected by abnormal behavior, it may cause equipment shutdown, system crash or larger-scale accidents. Therefore, it is necessary to evaluate the operational criticality of the equipment according to its impact on the production of the power plant. For example, if abnormal communication behavior occurs in the main control system or key power generation equipment, the risk level of the behavior will be assessed as high; if it occurs in auxiliary equipment (such as office computers or equipment that does not affect production), the risk level will be assessed as low.

[0080] In addition, the network topology of the power plant determines the interconnection relationship between devices. Some devices may be located at key nodes of the network, and their communication anomalies may affect the operation of the entire system. If key nodes in the network topology (such as data centers, main control systems, communication hubs, etc.) have abnormal communication behavior, they need to be handled as a priority.

[0081] Therefore, the criticality of device operation, the importance of network topology and the type of attack are comprehensively considered to calculate the risk level of each abnormal behavior, and the urgency of handling is determined based on the level. The risk level formula is:

[0082] R total =ω1×R device +ω2×R topology +ω3×A type

[0083] Among them, R total is the total score of abnormal behavior, ω1~ω3 are weight factors, R device Score the criticality of the device, A type Score the severity of the attack type, R topology Score the importance of topological nodes.

[0084] According to R total The values ​​are divided into different risk levels. The higher the risk level of abnormal behavior, the more urgent it is to deal with, and the system will respond first. total When the value is greater than the preset abnormal threshold, it is considered to be a high risk level.

[0085] S4: Automatically trigger security response measures such as device communication restriction, communication path switching, or alarm notification for high-risk abnormal behaviors determined in step S3.

[0086] S4.1: When the risk level of abnormal behavior exceeds the preset threshold, the system automatically triggers security response measures, including but not limited to limiting the communication of the affected device, reallocating the communication path, or sending a security alert notification.

[0087] For example, if a device is detected to have potential malicious communications, the communication connection between the device and other devices can be immediately cut off to restrict it from sending or receiving data. Or in the network, some devices may communicate through specific paths. If a communication path has security risks or abnormal behavior, the communication path can be switched to bypass the affected area to ensure that the normal communication of other devices is not affected.

[0088] S4.2: After triggering response measures, track the network status through real-time monitoring to ensure that abnormal behavior is effectively controlled and prevented from spreading.

[0089] Specifically, the status of each device, node, and communication path in the power plant network is continuously monitored, especially the affected areas. By deploying real-time streaming data analysis and network topology monitoring, the status of all devices and communication channels can be updated in a timely manner and the handling of abnormal behaviors can be quickly reflected.

[0090] Through real-time monitoring, it is possible to identify whether abnormal behavior has spread to other devices or areas. For example, if a device is detected as abnormal and the communication path has been switched, it is possible to monitor whether abnormal traffic or signs of attack are still spreading to other devices. If monitoring finds signs of abnormal propagation, further response measures will be automatically initiated, such as further restricting or isolating the device.

[0091] This step ensures the security of the power plant network by setting warning thresholds and response rules to prevent abnormal behavior from expanding or causing larger-scale safety accidents.

[0092] Furthermore, this embodiment also provides a power plant network security quantitative analysis and processing system based on big data, including:

[0093] The communication behavior data collection module is used to collect key parameters through the communication record data of each device in the power plant, form a data set of equipment communication behavior, and pre-process the data and establish a communication behavior benchmark model according to different equipment types, communication protocols and communication contents;

[0094] A real-time communication behavior analysis module is used to analyze the real-time communication data using big data analysis technology according to the benchmark model, identify normal mode behaviors by comparing the real-time communication data with the benchmark model, and mark them as abnormal communication behaviors;

[0095] The abnormal behavior classification and assessment module is used to classify and analyze the identified abnormal communication behaviors, and to prioritize the abnormal behaviors according to the severity, impact scope and attack type of the abnormalities. By combining the operation criticality of the equipment and the network topology, the potential risk level and urgency of handling of each abnormal behavior are determined;

[0096] The high-risk behavior response module is used to automatically trigger security response measures for determined high-risk level abnormal behaviors.

[0097] This embodiment also provides a computer device, which is suitable for the case of a power plant network security quantitative analysis and processing method based on big data, including a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the power plant network security quantitative analysis and processing method based on big data as proposed in the above embodiment.

[0098] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0099] This embodiment also provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for quantitative analysis and processing of power plant network security based on big data as proposed in the above embodiment.

[0100] In summary, the present invention distinguishes the communication behavior pattern between devices from the network traffic pattern, and uses detailed parameters such as the communication frequency between devices and the communication content type for anomaly identification, which can more accurately detect potential security threats in the power plant network. Compared with the traditional general traffic analysis method, the present invention avoids possible false alarms and improves the effectiveness of security detection through the detailed modeling of the communication characteristics between devices.

[0101] Example 2

[0102] Referring to Table 1, which is a second embodiment of the present invention, this embodiment provides a method for quantitative analysis and processing of power plant network security based on big data. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through simulation experiments.

[0103] In order to verify the effectiveness of the quantitative analysis and processing method of power plant network security based on big data, the actual operation data of a thermal power plant was selected as the experimental object.

[0104] The experimental equipment includes combustion control system (FCS), electrical control system (ECS), boiler control system (BCS) and monitoring system (SCADA). By collecting equipment communication record data, the equipment communication behavior data set is generated, and through data cleaning, cluster analysis and benchmark model construction, real-time anomaly detection and evaluation are further performed.

[0105] The communication record data for one week is obtained from the above devices, including communication frequency, communication time period, communication content, etc. The irrelevant data, such as broadcast messages and duplicate data, are removed through data source filtering technology. The collected data is cleaned by standardization and missing value filling methods. During the data cleaning process, the device communication mode is divided into five categories through the weighted distance clustering algorithm.

[0106] Based on the cleaned data, the Gaussian mixture model (GMM) is used to model the equipment communication behavior and obtain the equipment's baseline communication mode. For example, the normal communication frequency distribution of the boiler control system is (5 times / minute ± 0.5), and the communication content appears in a specific command format; while the communication mode of the combustion control system shows periodic fluctuation characteristics.

[0107] Using the stream data processing framework deployed in the laboratory, the real-time collected communication data is compared with the benchmark model to detect abnormalities in communication frequency and content.

[0108] The marked suspected abnormal points were further verified by applying the isolation forest algorithm, among which the points with anomaly scores higher than 0.85 were determined to be abnormal communication behaviors. Based on the abnormal impact range and network topology, combined with the criticality of the equipment, the potential risk level was evaluated. Some experimental data are shown in the following table:

[0109] Table 1 Experimental data

[0110]

[0111] From the above table we can see that:

[0112] Normal communication behavior shows clear periodic characteristics, and the communication frequency fluctuates within a small range. Abnormal communication behavior is mainly manifested in abnormal surges in communication frequency or abnormal communication content formats;

[0113] High-risk levels are mainly concentrated in boiler control systems (BCS) and combustion control systems (FCS). Since these systems directly affect the operational safety of power plants, their abnormal behavior may cause production interruption or equipment damage;

[0114] Through this experiment, the effectiveness of the power plant network communication anomaly detection method based on data clustering and benchmark models was verified, and the model's accuracy in identifying high-risk anomalies reached over 90%.

[0115] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for quantitative analysis and processing of power plant network security based on big data, characterized in that: include: By collecting key parameters through the communication record data of each device in the power plant, a data set of device communication behavior is formed. The data is pre-processed and a communication behavior benchmark model is established according to different device types, communication protocols and communication contents. According to the benchmark model, the real-time communication data is analyzed using big data analysis technology, and normal mode behaviors are identified by comparing the real-time communication data with the benchmark model, and marked as abnormal communication behaviors; Classify and analyze the identified abnormal communication behaviors, evaluate the abnormal behaviors according to the severity, impact scope and attack type of the abnormalities, and determine the potential risk level and urgency of handling each abnormal behavior by combining the operation criticality of the equipment and the network topology; Automatically trigger security response measures for identified high-risk abnormal behaviors.

2. The method for quantitative analysis and processing of power plant network security based on big data according to claim 1, characterized in that: The method of preprocessing data and establishing a communication behavior benchmark model according to different device types, communication protocols and communication contents includes the following steps: Clean and standardize the data in the device communication behavior dataset to remove duplicate and erroneous data; After data cleaning, a weighted distance-based clustering algorithm is used to process the device communication behavior dataset; Based on the clustering results, a baseline model of the communication behavior of devices is established for different device types, communication protocols, and communication contents. The time series analysis method is introduced to dynamically optimize the benchmark model, and combined with the changing trend of the equipment operation period, a benchmark model that adapts to dynamic changes is formed.

3. The method for quantitative analysis and processing of power plant network security based on big data according to claim 2, characterized in that: The method of processing the device communication behavior data set using a weighted distance-based clustering algorithm includes: In order to deal with the heterogeneity between devices, an improved clustering method is designed to classify device communication modes based on the multi-dimensional characteristics of communication behavior. The formula is as follows: Where δ(d1, d2) is the distance measure between device d1 and device d2 in the multidimensional feature space; M is the number of features used in cluster analysis; w i is the weight of feature i, reflecting the importance of this feature to the clustering results; and d 2i are the values ​​of device d1 and device d2 on the i-th feature dimension respectively.

4. The method for quantitative analysis and processing of power plant network security based on big data according to claim 3, characterized in that: The benchmark model includes: The device communication behavior is modeled by a statistical learning method based on a Gaussian mixture model (GMM) to obtain the device's baseline communication mode. The specific formula is as follows: Where P(x) is the probability of communication behavior under device observation data x, π k is the weight of the kth Gaussian distribution, indicating the prior probability of the distribution; The mean is μ k , a Gaussian distribution with covariance ∑k, represents the statistical characteristics of the device communication behavior in the kth cluster; K is the number of distributions in the Gaussian mixture model.

5. The method for quantitative analysis and processing of power plant network security based on big data according to claim 3, characterized in that: The benchmark model adapted to dynamic changes is: The model is dynamically adjusted based on the historical communication behavior change trend of the device. The formula is as follows: P(t+1)=α×P(t)+(1-α)×P new (t) Where P(t+1) is the update result of the device communication behavior benchmark model at time t+1; P(t) is the communication behavior benchmark model at the current time t; P new (t) is the baseline model updated based on the historical behavior data of the device; α is the smoothing factor.

6. The method for quantitative analysis and processing of power plant network security based on big data according to claim 1, characterized in that: Determining the potential risk level and handling urgency of each abnormal behavior by combining the operation criticality of the device and the network topology includes the following steps: Assessing operational criticality based on the equipment’s impact on plant production; The criticality of device operation, the importance of network topology, and the type of attack are comprehensively considered to calculate the risk level of each abnormal behavior and determine the urgency of handling according to different levels; The risk level formula is: R total =ω1×R device +ω2×R topology +ω3×A type Among them, R total is the total score of abnormal behavior, ω1~ω3 are weight factors, R device Score the criticality of the device, A type Score the severity of the attack type, R topology Score the importance of topological nodes; According to R total Numerical values ​​are used to classify different risk levels.

7. The method for quantitative analysis and processing of power plant network security based on big data according to claim 1, characterized in that: The automatically triggered security response measures for the determined high-risk abnormal behavior include: When the risk level of abnormal behavior exceeds the preset threshold, security response measures are automatically triggered, including limiting the communication of the affected device, reallocating the communication path, or sending a security alert notification; After the response measures are triggered, the network status is tracked through real-time monitoring to ensure that abnormal behavior is effectively controlled and prevented from spreading.

8. A power plant network security quantitative analysis and processing system based on big data, based on the power plant network security quantitative analysis and processing method based on big data according to any one of claims 1 to 7, characterized in that: Also includes: The communication behavior data collection module is used to collect key parameters through the communication record data of each device in the power plant, form a data set of equipment communication behavior, and pre-process the data and establish a communication behavior benchmark model according to different equipment types, communication protocols and communication contents; A real-time communication behavior analysis module is used to analyze the real-time communication data using big data analysis technology according to the benchmark model, identify normal mode behaviors by comparing the real-time communication data with the benchmark model, and mark them as abnormal communication behaviors; The abnormal behavior classification and assessment module is used to classify and analyze the identified abnormal communication behaviors, and to prioritize the abnormal behaviors according to the severity, impact scope and attack type of the abnormalities. By combining the operation criticality of the equipment and the network topology, the potential risk level and urgency of handling of each abnormal behavior are determined; The high-risk behavior response module is used to automatically trigger security response measures for determined high-risk level abnormal behaviors.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the power plant network security quantitative analysis and processing method based on big data according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the power plant network security quantitative analysis and processing method based on big data according to any one of claims 1 to 7 are implemented.

Images