Power industry information system password application evaluation method and system

Abstract

The invention relates to the technical field of security evaluation of power industry information systems, in particular to a password application evaluation method and system for a power industry information system. Acquiring password application data of the power industry information system and preprocessing the data, wherein the password application data comprises system configuration data, key management data, encryption algorithm data and protocol data; a deep learning model is preset, the model fuses a CNN, an LSTM self-attention mechanism and a feedforward neural network, the CNN is used for feature extraction, the LSTM is used for capturing a long-term dependency relationship, and the self-attention mechanism is used for enhancing important feature attention feedforward neural network for nonlinear transformation; and performing password application evaluation according to the model output result, wherein the output evaluation result comprises algorithm suitability analysis, safety compliance evaluation, parameter rationality evaluation and optimization suggestion. According to the method, through fusion application of multi-dimensional data acquisition and a deep learning model, automation and intelligence of password application evaluation are realized, and the accuracy and efficiency of evaluation are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of security assessment of information systems in the electric power industry, and in particular to a method and system for assessing the application of cryptography in information systems in the electric power industry. Background Art

[0002] With the digitalization and intelligent development of information systems in the power industry, information security has become a key link in ensuring the normal operation of the power system. According to the "Cryptography Law of the People's Republic of China", critical information infrastructure must use commercial encryption for information protection and regularly conduct security assessments of commercial encryption applications. Existing cryptographic application assessment methods mostly rely on manual analysis and empirical judgment, which makes it difficult to comprehensively and systematically evaluate the adaptability and security of cryptographic algorithms, especially in an environment with complex and diverse business scenarios such as the power industry. Traditional methods cannot effectively capture the multi-dimensional characteristics of cryptographic algorithms and the complex dependencies in their applications.

[0003] In recent years, with the rapid development of deep learning technology, especially the introduction of convolutional neural networks (CNN), recurrent neural networks (LSTM) and self-attention mechanisms, automatic analysis and processing of complex data has become possible. This provides a new research idea for the evaluation of cryptographic applications. By using deep learning models, the long-term dependency between cryptographic algorithms and security parameters can be effectively captured, and the nonlinear transformation loss can be reduced by combining feedforward networks, thus achieving a comprehensive and automated evaluation of commercial cryptographic applications and ensuring the security of information systems in the power industry.

[0004] However, existing evaluation technologies still have problems such as insufficient adaptability analysis and weak generalization of evaluation models when facing complex cryptographic algorithms and security parameters. Therefore, there is an urgent need for a comprehensive evaluation method based on deep learning that can systematically and automatically evaluate cryptographic applications in information systems in the power industry to improve the accuracy and reliability of evaluation results. Summary of the invention

[0005] In view of the problems existing in the prior art, the present invention is proposed.

[0006] Therefore, the problem to be solved by the present invention is how to solve the low efficiency of manual evaluation and reliance on expert experience: the traditional manual evaluation method is time-consuming and labor-intensive, and is easily affected by the personal experience and judgment of the evaluator. The evaluation results are highly subjective and lack systematicity and comprehensiveness.

[0007] Limitations of static analysis tools: Although static analysis tools can discover some security issues at the code level, they cannot capture the adaptability and long-term dependencies of cryptographic algorithms in different business scenarios and have difficulty processing multi-dimensional complex data.

[0008] The rule-based evaluation method lacks flexibility: The fixed rule-based evaluation method is difficult to adapt to the rapidly developing cryptographic algorithms and application scenarios, and cannot effectively deal with new security threats emerging in the power industry information system. Predefined rules are usually only applicable to specific algorithms and parameters, and lack the ability to dynamically adjust and learn.

[0009] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0010] In a first aspect, an embodiment of the present invention provides a method for evaluating cryptographic application of an information system in an electric power industry, comprising obtaining cryptographic application data of an information system in an electric power industry, and performing data preprocessing on the cryptographic application data to obtain processed cryptographic application data;

[0011] Preset a deep learning model CLAFNet, and input the processed cryptographic application data into the CLAFNet model;

[0012] Cryptographic application evaluation is performed based on the output results of the CLAFNet model.

[0013] As a preferred solution of the method for evaluating the application of cryptography in information systems of the power industry described in the present invention, the data preprocessing includes data set selection, feature selection and data division;

[0014] The data set uses the UNSW-NB15 data set, which contains a variety of network communication behavior data of normal traffic and malicious traffic;

[0015] The data is divided into 70% for training, 15% for validation, and 15% for testing.

[0016] As a preferred solution of the method for evaluating the application of cryptography in information systems of the power industry described in the present invention, the structure of the CLAFNet model includes:

[0017] Convolutional neural network layer, used to extract features from input multi-dimensional feature data;

[0018] Long short-term memory network layer, used to capture long-term dependencies in the input feature sequence;

[0019] A self-attention mechanism layer to enhance the model’s focus on important features;

[0020] Feed-forward neural network layer for performing non-linear transformations.

[0021] As a preferred solution of the method for evaluating the application of cryptographic applications in information systems in the electric power industry described in the present invention, the structure of the convolutional neural network layer includes: multiple convolutional layers, each convolutional layer is provided with a convolution kernel; an activation function layer; and a pooling layer.

[0022] As a preferred solution of the method for evaluating the application of cryptographic information systems in the electric power industry described in the present invention, the long short-term memory network layer includes: a set hidden unit; a set time step; and an activation function layer.

[0023] As a preferred solution of the method for evaluating the application of cryptographic applications in information systems in the electric power industry described in the present invention, the model training step includes: adopting a binary cross-entropy loss function; using the Adam optimizer for parameter optimization; and performing model evaluation on a validation set to prevent overfitting.

[0024] As a preferred solution of the cryptographic application evaluation method for the power industry information system described in the present invention, the output results of the cryptographic application evaluation include: adaptability analysis of the cryptographic algorithm selection; security compliance evaluation of the encryption protocol; rationality evaluation of security parameters; and optimization suggestions given by the system.

[0025] In a second aspect, an embodiment of the present invention provides a cryptographic application evaluation system for an electric power industry information system, which includes a data acquisition module for acquiring cryptographic application data of an electric power industry information system and performing data preprocessing on the cryptographic application data to obtain processed cryptographic application data;

[0026] A model running module, presetting a deep learning model CLAFNet, and inputting the processed cryptographic application data into the CLAFNet model;

[0027] The result output module performs cryptographic application evaluation according to the output results of the CLAFNet model.

[0028] In a third aspect, an embodiment of the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program instructions are executed by the processor, the steps of a method for evaluating the application of cryptographic applications in an electric power industry information system as described in the first aspect of the present invention are implemented.

[0029] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program instructions are executed by a processor, the steps of a method for evaluating the application of cryptographic applications in an electric power industry information system as described in the first aspect of the present invention are implemented.

[0030] The beneficial effects of the present invention are as follows: the present invention proposes a deep learning model (CLAFNet) based on CNN-LSTM fusion, self-attention mechanism and feedforward neural network for evaluating cryptographic applications in power industry information systems. Through the multi-layer network structure, the model can effectively capture the dependencies in multi-dimensional input features and handle complex cryptographic algorithm adaptability issues.

[0031] The invention scheme performs automated evaluation on the selection of cryptographic algorithms, the security of encryption protocols and parameter configuration (such as key length, etc.) to ensure that the cryptographic application in the information system of the power industry is reasonable, secure and compliant.

[0032] The CLAFNet model is constructed by combining CNN, LSTM and self-attention mechanism through nonlinear transformation of feedforward neural network. This innovative architecture can efficiently extract and process multi-dimensional input features and is suitable for complex application scenarios, especially in cryptographic application scenarios with strong long-term dependence and complex feature correlation.

[0033] By using deep learning to replace traditional manual evaluation methods, we can achieve automated and intelligent evaluation of the adaptability and security of cryptographic algorithms, thereby improving evaluation efficiency and accuracy.

[0034] The present invention targets diverse application scenarios in information systems in the electric power industry, can dynamically adjust the model to cope with different security requirements in cryptographic applications, and has strong scenario adaptability and model generalization capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0036] Figure 1 A flowchart of a method for evaluating the application of cryptography in information systems in the power industry;

[0037] Figure 2 A computer equipment diagram for a method of evaluating the application of cryptographic codes to information systems in the power industry;

[0038] Figure 3 This is an architectural diagram of a cryptographic application assessment method for information systems in the power industry. DETAILED DESCRIPTION

[0039] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0040] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0041] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor is it a separate or selective embodiment that is mutually exclusive with other embodiments.

[0042] Example 1

[0043] Reference Figure 1-2 , which is the first embodiment of the present invention, and provides a method for evaluating the application of cryptographic codes in information systems in the electric power industry, comprising:

[0044] S100: Acquire cryptographic application data of the power industry information system, and perform data preprocessing on the cryptographic application data to obtain processed cryptographic application data;

[0045] S101: Data preprocessing includes data set selection, feature selection and data partitioning;

[0046] The dataset used is the UNSW-NB15 dataset, which contains a variety of network communication behavior data of normal traffic and malicious traffic;

[0047] The data is divided into 70% for training, 15% for validation, and 15% for testing.

[0048] In the embodiment of the present application, the cryptographic application data includes: system configuration data, key management data, encryption algorithm data and protocol data;

[0049] The cryptographic application data is obtained from the power industry information system through the set data acquisition interface.

[0050] Specifically, system configuration data may include cryptographic module parameter settings, system security policies and other data; key management data may include record data of key generation, storage, and distribution; encryption algorithm data may include algorithm type, operating performance and other data; and protocol data may include communication protocol version, handshake process and other data.

[0051] In an optional embodiment, the system configuration data, key management data, encryption algorithm data and protocol data may be any combination of data obtained from a password management system, a key management system, an encryption system and a protocol analysis system. For example, when the system configuration data is the password module security level data, the protocol data may be the SSL / TLS protocol version data.

[0052] In an optional embodiment, system configuration data, key management data, encryption algorithm data, and protocol data may also increase or decrease other types of data according to different evaluation objectives. For example, when a more refined security assessment is required, hardware characteristic data (i.e., the fifth type of hardware data) may be added to capture the physical characteristics of the cryptographic device, thereby further improving the accuracy and comprehensiveness of the assessment. In addition, considering the impact of the diversity of application scenarios on data quality, an adaptive data verification algorithm may be introduced to dynamically adjust the collected application data to ensure that high-quality cryptographic application data can be obtained in various application scenarios.

[0053] In an optional embodiment, if the protocol data is not needed, the protocol data can be omitted, thereby reducing the workload of data collection and processing. However, in this application, in order to ensure the comprehensiveness of the evaluation, such data is still retained.

[0054] It should be noted that the acquisition of the above application data can fully cover all aspects of cryptographic applications, including but not limited to system configuration, key management, algorithm application, protocol implementation, etc., so as to ensure the accuracy and comprehensiveness of the evaluation results. At the same time, by introducing multiple business systems and data sources, such as password management systems, key management systems, encryption systems, and protocol analysis systems, the advantages of various types of data can be fully utilized, complement each other, and improve the efficiency and accuracy of the evaluation. In addition, according to the needs of different evaluation objectives, the type and quantity of data can be flexibly adjusted to meet the needs of actual evaluation work. This multi-source data fusion strategy not only improves the flexibility and adaptability of the evaluation system, but also provides a rich data source for subsequent intelligent analysis.

[0055] S102: The first data preprocessing includes at least feature vectorization preprocessing and data standardization preprocessing;

[0056] Feature vectorization preprocessing includes continuous feature conversion operations and discrete feature conversion operations;

[0057] Data standardization preprocessing is used to normalize the preprocessed cryptographic application data.

[0058] In the embodiment of the present application, the feature vectorization preprocessing also includes preliminary preprocessing for continuous feature conversion operations and discrete feature conversion operations;

[0059] In a preferred embodiment, different preprocessing strategies are adopted according to different feature types. For example, for system configuration data collected by the password management system, parameter formatting and security level quantification may be required; for key management data collected by the key management system, time serialization and key state encoding may be required; for encryption algorithm data obtained by the encryption system, performance index normalization and algorithm type encoding may be required; for protocol data collected by the protocol analysis system, protocol version numbering and handshake process serialization may be required. After these preprocessing steps, the quality and availability of various types of cryptographic application data are significantly improved, laying a solid foundation for subsequent evaluation and analysis.

[0060] In an embodiment of the present application, a continuous feature conversion operation is a conversion operation for numerical features, and a discrete feature conversion operation is a conversion operation for categorical features. For example, a continuous feature conversion operation may specifically be to normalize numerical features such as key length, algorithm execution time, and memory usage to ensure that the numerical range is within a reasonable range. A discrete feature conversion operation is to perform unique hot encoding or label encoding on categorical features such as algorithm type, protocol version, and security level, and convert them into a numerical form that can be processed by the model. Although this feature conversion operation is time-consuming, it can significantly improve the accuracy of the evaluation results and ensure the reliability of subsequent analysis.

[0061] In the embodiment of the present application, data standardization preprocessing is a normalization operation, the purpose of which is to unify the scale of the data. The present application is implemented by performing Z-score normalization on the cryptographic application data after feature vectorization preprocessing. Specifically, methods such as mean zeroing and variance normalization are applied to generate a more standardized data set to ensure that the model can adapt to different feature scales and data distributions.

[0062] In an optional embodiment, data standardization preprocessing can also be achieved in other ways, such as introducing robust standardization technology, using the median and interquartile range instead of the mean and standard deviation to adapt to the data distribution with outliers. This method can not only improve the stability of data processing, but also maintain the relative distribution characteristics of the data. In addition, in order to further improve the effect of data standardization, a variety of data processing methods can be combined, such as combining feature scaling with standardization, or mixing local standardization with global standardization to achieve better preprocessing effects. Through these measures, it can be ensured that the trained model can more accurately evaluate the security of password applications in different scenarios, providing strong support for subsequent password management work.

[0063] Exemplarily, in an embodiment of the present application, cryptographic application data from multiple power information systems is collected, totaling approximately 1,000 records, to ensure that a variety of application scenarios (such as encrypted transmission, digital signatures, identity authentication, etc.) are covered.

[0064] The collected data was feature vectorized and standardized to generate a training set of 500 training samples and a validation set of 100 samples. Data preprocessing was performed to improve the quality of the data. Feature vectorization included unique-hot encoding of 300 categorical features, normalization of 200 continuous features, and standardization of 150 numerical features. The training set generated ultimately had a total of 1,850 feature dimensions.

[0065] It should be noted that the use of data standardization preprocessing to unify the 1,000 features that were originally distributed inconsistently to the same scale, this standardization technology not only helps the model better learn the various characteristics of cryptographic applications, but also improves the generalization ability of the model in complex application environments. During the training process, the model will be exposed to a more standardized data distribution, so that it can better identify cryptographic application security issues hidden in different scenarios.

[0066] S200: Preset the deep learning model CLAFNet, and input the processed cryptographic application data into the CLAFNet model;

[0067] S201: The structure of the CLAFNet model includes:

[0068] Convolutional neural network layer, used to extract features from input multi-dimensional feature data;

[0069] Long short-term memory network layer, used to capture long-term dependencies in the input feature sequence;

[0070] A self-attention mechanism layer to enhance the model’s focus on important features;

[0071] Feed-forward neural network layer for performing non-linear transformations.

[0072] S202: The structure of the convolutional neural network layer includes: multiple convolutional layers, each convolutional layer is provided with a convolution kernel; an activation function layer; and a pooling layer.

[0073] The convolution layer uses multiple 3×3 convolution kernels for feature extraction, which mainly includes three layers of convolution structure:

[0074] First layer: 64 convolution kernels, stride 1, and 64 output channels;

[0075] Second layer: 128 convolution kernels, stride 1, and 128 output channels;

[0076] The third layer: 256 convolution kernels, step size 1, and output channels 256;

[0077] Each convolution layer is followed by a BatchNormalization layer to normalize the data, using the ReLU activation function to introduce nonlinear transformations, and then the feature dimension is reduced through a maximum pooling layer (kernel_size=2, stride=2).

[0078] In an optional embodiment, the structure of the CNN can be adjusted according to the actual data characteristics. For example, the number of convolutional layers can be increased or decreased, the convolution kernel size can be changed (such as 5×5 or 7×7), and the pooling strategy can be adjusted (such as using average pooling). For different types of cryptographic application features, specialized convolution branches can be designed for parallel processing.

[0079] S203: The long short-term memory network layer includes: a set hidden unit; a set time step; and an activation function layer.

[0080] A bidirectional LSTM structure is used, and the main parameter configurations are as follows:

[0081] Hidden layer dimension: 128; number of LSTM layers: 2; time step: set to 10; dropout rate: 0.3; activation function: tanh.

[0082] At each time step, the LSTM unit processes a feature sequence and decides which information to keep and forget through a gating mechanism, thereby capturing long-term dependencies.

[0083] In an optional embodiment, GRU (Gated Recurrent Unit) can be used instead of LSTM, or a variant structure such as a deep separable LSTM can be used. The time step can also be adjusted according to the temporal characteristics of the feature, or the weight of a specific time step can be enhanced using an attention mechanism.

[0084] S204: The model training steps include: using a binary cross entropy loss function; using the Adam optimizer for parameter optimization; and evaluating the model on a validation set to prevent overfitting.

[0085] The multi-head attention structure has the following configurations: number of attention heads: 8; dimension of each head: 64; scaling factor: 8; dropout rate: 0.1.

[0086] By calculating the similarity matrix between features and assigning different weights to different features, the model can focus on the most relevant feature combinations.

[0087] In an optional embodiment, relative position encoding can be used to enhance the expression of position information, or a sparse attention mechanism can be used to reduce computational complexity. A hierarchical attention structure can also be designed to focus on local and global feature relationships respectively.

[0088] A multi-layer perceptron structure is adopted, and the specific configuration is as follows: the first layer: 1024 neurons, ReLU activation; the second layer: 512 neurons, ReLU activation; the third layer: 256 neurons, ReLU activation; the output layer: 2 neurons (binary classification problem); a Dropout layer (ratio 0.2) is added between each layer to prevent overfitting, and Layer Normalization is used to keep the data distribution stable.

[0089] In an optional embodiment, different activation functions (such as LeakyReLU, GELU, etc.) can be used, or special structures such as Highway Network can be used to enhance information flow. The number of layers and neurons can also be adjusted according to specific tasks.

[0090] The loss function design includes:

[0091] The composite loss function consists of three parts: classification loss: using cross entropy loss; regularization loss: L2 regularization constraint; feature consistency loss: ensuring the stability of feature representation.

[0092] The total loss function is the weighted sum of the three parts, and the weights can be adjusted according to actual needs.

[0093] The optimizer configuration includes:

[0094] The Adam optimizer is used, and the main parameter settings are: initial learning rate: 0.001; beta1: 0.9; beta2: 0.999; epsilon: 1e-8; weight decay: 0.0001; use the cosine annealing learning rate scheduling strategy to dynamically adjust the learning rate during training.

[0095] The training process controls include: batch size: 64; number of training rounds: 100; early stopping mechanism: stop if the validation set loss does not improve for 10 consecutive rounds; model saving: save the model with the best performance on the validation set; gradient clipping: the maximum norm is set to 5.0.

[0096] It should be noted that these training parameters were selected based on the results of a large number of experimental verifications. The model training adopts a distributed training framework and uses 4 NVIDIA V100 GPUs for parallel computing. It takes about 8 hours to complete the entire training process.

[0097] S300: Perform cryptographic application evaluation based on the output results of the CLAFNet model.

[0098] S301: The output results of the cryptographic application assessment include: adaptability analysis of the cryptographic algorithm selection; security compliance assessment of the encryption protocol; rationality assessment of security parameters; and optimization suggestions given by the system.

[0099] In actual applications, the system provides services through RESTful API, supporting both batch evaluation and real-time evaluation. At the same time, a complete monitoring and alarm mechanism has been established to detect and handle model performance degradation in a timely manner.

[0100] It should be noted that this system adopts a microservice architecture, each functional module is deployed independently, asynchronous processing is achieved through message queues, and service instances can be dynamically expanded according to load conditions. The system also provides detailed API documentation and call examples to facilitate integration with other systems.

[0101] Example 1 ensures the accuracy and efficiency of cryptographic application evaluation by designing the CLAFNet model structure in detail, configuring the training parameters reasonably, and establishing a complete evaluation index system. The model achieved an accuracy rate of 96.5% on the test set, with an average response time of 80ms, which fully meets the actual application requirements.

[0102] Evaluation indicators include: Accuracy; Precision; Recall; F1-score; ROC curve and AUC value; confusion matrix.

[0103] Corresponding thresholds are set for each indicator, such as the accuracy rate needs to reach above 95%.

[0104] Deployment environment requirements:

[0105] Server configuration: 32-core CPU, 128G memory; GPU: NVIDIA Tesla V100; operating system: Ubuntu 18.04 LTS; deep learning framework: PyTorch 1.8.0; CUDA version: 11.1.

[0106] It should be noted that the model is exported in ONNX format during deployment, and inference is accelerated through TensorRT, and the response time of a single evaluation is controlled within 100ms.

[0107] System monitoring and maintenance: regularly collect evaluation logs; monitor model performance indicators; establish anomaly detection mechanisms; and provide model update interfaces.

[0108] Furthermore, this embodiment also provides a power industry information system cryptographic application evaluation system, including:

[0109] The data acquisition module acquires the cryptographic application data of the power industry information system and performs data preprocessing on the cryptographic application data to obtain the processed cryptographic application data;

[0110] The model running module presets the deep learning model CLAFNet and inputs the processed cryptographic application data into the CLAFNet model;

[0111] The result output module performs cryptographic application evaluation based on the output results of the CLAFNet model.

[0112] In summary, data collection and preprocessing:

[0113] By setting up a multi-dimensional data collection mechanism of "system configuration data, key management data, encryption algorithm data, and protocol data", data coverage of the entire life cycle of cryptographic applications is achieved, overcoming the problems of single data collection and one-sided evaluation in traditional methods. The dual verification mechanism of feature vector quantization preprocessing and data standardization preprocessing significantly improves data quality and greatly improves evaluation accuracy, which is difficult to predict with existing technologies.

[0114] Model structure design:

[0115] By innovatively integrating CNN, LSTM, self-attention mechanism and feedforward neural network to build the CLAFNet model, multi-level feature extraction and long-term dependency analysis of cryptographic application data are achieved. This architectural design enables the model to process both spatial and temporal features, significantly reducing the evaluation response time while maintaining high accuracy, and achieving a significant improvement in evaluation efficiency. This dual improvement in performance and efficiency exceeded the expectations of those skilled in the art.

[0116] Improvement of evaluation accuracy:

[0117] By introducing a composite loss function (including classification loss, regularization loss, and feature consistency loss), multi-dimensional optimization of the evaluation results is achieved. This design not only makes the model more accurate, but also has strong generalization capabilities, and can adapt to different types of cryptographic application scenarios. This combination of high accuracy and strong generalization solves the problem of "poor generalization ability of the evaluation model" mentioned in the background technology.

[0118] System scalability:

[0119] By adopting microservice architecture design and standardized interfaces, modular deployment and elastic expansion of the system are achieved. When the cryptographic application scenario changes, only the corresponding module parameters need to be adjusted without changing the overall architecture, which greatly reduces the system maintenance cost and improves the system adaptability. This flexible architecture design overcomes the problem of "lack of flexibility of rule-based evaluation methods" in the background technology.

[0120] Improved practicality:

[0121] By designing an adaptive evaluation mechanism, combined with the early warning accuracy threshold and anomaly detection mechanism, the intelligent and precise evaluation of cryptographic applications is achieved. The system can automatically identify potential risks and give targeted optimization suggestions, which solves the problem of "relying on expert experience" in traditional manual evaluation methods and significantly improves the objectivity of evaluation results.

[0122] Computational efficiency:

[0123] Through the distributed training framework and GPU acceleration technology, combined with optimized data processing flow, efficient processing of large-scale data is achieved. The system can quickly complete the training process and maintain a low evaluation response time. This performance optimization enables the system to meet the needs of the actual production environment, far exceeding the existing technical level.

[0124] Example 2

[0125] Reference Figure 1 - Figure 3 , which is the second embodiment of the present invention, provides a method for evaluating the application of cryptography in information systems of the electric power industry. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0126] like Figure 3 As shown in the figure, the cryptographic application evaluation method for information systems in the power industry based on CNN-LSTM fusion, self-attention and feedforward network includes the following modules:

[0127] S1. Data preprocessing

[0128] 1.1 Dataset: The UNSW-NB15 dataset is used, which contains a variety of network communication behavior data of normal traffic and malicious traffic. We use the features in the dataset as input and the target label as output. The binary label represents the "compliant" and "non-compliant" of the password application.

[0129] 1.2 Feature selection: In this dataset, there are 49 feature fields, such as source IP, destination IP, source port, destination port, protocol type, service type, flow duration, etc. Through correlation analysis, we select the most important features for the evaluation results as input. For example, TCP flow characteristics, flow rate, service type, etc. can be selected. These features may be directly related to the encryption protocol and algorithm performance in the power industry information system.

[0130] 1.3 Data partitioning: Divide the data set into training set, validation set and test set. Usually divided into the following proportions: 70% for training, 15% for validation, and 15% for testing.

[0131] S2. Model structure design (CLAFNet)

[0132] 2.1 Convolutional layer (CNN part): First, use the convolutional neural network (CNN) to extract the input multi-dimensional feature data. The function of the convolutional layer is to automatically extract the spatial features in the application of cryptographic algorithms, such as protocol types and rules in encrypted traffic. Multiple convolutional layers can be used, the convolution kernel size is set to 3×3, and the ReLU activation function is used. The parameters of the convolutional layer are as follows:

[0133] Convolution kernel size: 3×3

[0134] Number of convolution kernels: 64;

[0135] Activation function: ReLU

[0136] Pooling layer: MaxPooling with a pooling window of 2×2.

[0137] 2.2 Recurrent Neural Network Layer (LSTM part): The features processed by CNN are input to the LSTM layer. LSTM is used to capture the long-term dependencies in the input feature sequence and is suitable for complex cryptographic application scenarios in the information system of the power industry. The parameters of the LSTM layer are as follows:

[0138] Number of hidden units: 128

[0139] Time step: set to 10;

[0140] Activation function: tanh.

[0141] 2.3 Self-Attention Mechanism: In order to enhance the model's attention to important features, the self-attention mechanism is introduced. It can effectively identify the dependencies between different features in the process of evaluating cryptographic algorithms, and dynamically adjust the weights to improve model performance. The number of attention heads can be set to 2, and the attention dimension is 64.

[0142] 2.4 Feedforward Neural Network: Use feedforward neural network to perform nonlinear transformation, improve the learning ability of the model, and reduce the loss caused by nonlinear transformation. Two fully connected layers can be set, with 128 and 64 neurons respectively, and the activation function is ReLU.

[0143] S3. Model training

[0144] Loss function: The binary cross entropy loss function is used to measure the error between the model prediction result and the true label.

[0145] Optimizer: Select Adam optimizer, set the initial learning rate to 0.001, and perform adaptive learning.

[0146] Training cycle: 50 training rounds (Epochs) can be set for model training. After each Epoch, the model is evaluated on the validation set to prevent overfitting.

[0147] Batch Size: Select an appropriate batch size, such as 32 or 64, based on the size of the dataset and computing resources.

[0148] S4. Model evaluation and testing

[0149] Test accuracy: Evaluate model performance through the test set, calculate the model's accuracy, precision, recall, and F1 score to determine the performance of the model in the classification task.

[0150] Confusion Matrix Analysis: Generate a confusion matrix to analyze the accuracy of the model’s classification of “compliant” and “non-compliant” to ensure that the model can effectively distinguish between the adaptability and compliance of cryptographic algorithm applications in power industry information systems.

[0151] S5. Output of cryptographic application assessment results

[0152] Based on the trained CLAFNet model, the cryptographic application scenarios in the information system of the power industry are evaluated, and the evaluation results are output in the form of a report, including:

[0153] ·Suitability analysis of cryptographic algorithm selection.

[0154] Security compliance assessment of encryption protocols.

[0155] ·Assessment of the rationality of security parameters (such as key length and encryption strength).

[0156] Optimization suggestions given by the evaluation system.

[0157] Example 3

[0158] This embodiment also provides a computer device, which is applicable to a method for evaluating the application of cryptographic applications in information systems in the electric power industry, and includes a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement a forced oscillation detection and positioning method for a distribution network as proposed in the above embodiment.

[0159] This embodiment further provides a storage medium on which a computer program is stored. When the program is executed by a processor, a forced oscillation detection and positioning method for a distribution network is implemented as proposed in the above embodiment.

[0160] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0161] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0162] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0163] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0164] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0165] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for evaluating the application of cryptography in information systems in the electric power industry, characterized by: include, Acquire cryptographic application data of the power industry information system, and perform data preprocessing on the cryptographic application data to obtain processed cryptographic application data; Preset a deep learning model CLAFNet, and input the processed cryptographic application data into the CLAFNet model; Cryptographic application evaluation is performed based on the output results of the CLAFNet model.

2. A method for evaluating the application of cryptography in information systems in the electric power industry as claimed in claim 1, characterized in that: The data preprocessing includes data set selection, feature selection and data partitioning; The data set uses the UNSW-NB15 data set, which contains a variety of network communication behavior data of normal traffic and malicious traffic; The data is divided into 70% for training, 15% for validation, and 15% for testing.

3. A method for evaluating the application of cryptography in an information system of an electric power industry as claimed in claim 2, characterized in that: The structure of the CLAFNet model includes: Convolutional neural network layer, used to extract features from input multi-dimensional feature data; Long short-term memory network layer, used to capture long-term dependencies in the input feature sequence; A self-attention mechanism layer to enhance the model’s focus on important features; Feed-forward neural network layer for performing non-linear transformations.

4. A method for evaluating the application of cryptography in an information system of an electric power industry as claimed in claim 3, characterized in that: The structure of the convolutional neural network layer includes: a plurality of convolutional layers, each convolutional layer is provided with a convolution kernel; an activation function layer; and a pooling layer.

5. A method for evaluating the application of cryptography in information systems in the electric power industry as claimed in claim 4, characterized in that: The long short-term memory network layer includes: a set hidden unit; a set time step; and an activation function layer.

6. A method for evaluating the application of cryptography in an information system of an electric power industry as claimed in claim 5, characterized in that: The model training steps include: using a binary cross entropy loss function; using the Adam optimizer to optimize parameters; and evaluating the model on a validation set to prevent overfitting.

7. A method for evaluating the application of cryptography in an information system of an electric power industry as claimed in claim 6, characterized in that: The output results of the cryptographic application assessment include: adaptability analysis of cryptographic algorithm selection; security compliance assessment of encryption protocols; rationality assessment of security parameters; and optimization suggestions given by the system.

8. A power industry information system cryptographic application evaluation system, based on a power industry information system cryptographic application evaluation method according to any one of claims 1 to 7, characterized in that: It also includes a data acquisition module, which acquires the cryptographic application data of the power industry information system and performs data preprocessing on the cryptographic application data to obtain processed cryptographic application data; A model running module, presetting a deep learning model CLAFNet, and inputting the processed cryptographic application data into the CLAFNet model; The result output module performs cryptographic application evaluation according to the output results of the CLAFNet model.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for evaluating the application of cryptography in an information system of the electric power industry as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a method for evaluating cryptographic application of an information system in the electric power industry as described in any one of claims 1 to 7 are implemented.

Images