Power grid enterprise power data storage security risk assessment system

Abstract

The invention, which relates to the technical field of data security, discloses a power grid enterprise power data storage security risk assessment system comprising the following components: a virtual environment monitoring module, a risk assessment and isolation module, an early warning and response module and a security policy management module. According to the invention, omnibearing real-time monitoring is carried out on a virtual server and a virtual network of a power grid enterprise data center through the virtual environment monitoring module, an abnormal behavior detection model is continuously optimized by using a machine learning algorithm, and high-precision identification of novel abnormal behaviors is realized. Meanwhile, the risk assessment and isolation module introduces a specific risk factor weight in combination with the unique characteristics of the power data of the power grid enterprise, ensures that an assessment result highly accurately reflects the actual safety risk of power data storage, and remarkably improves the safety and stability of power data storage of the power grid enterprise.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a power data storage security risk assessment system for a power grid enterprise. Background Art

[0002] In the daily operations of power grid companies, power data is a core resource, and its security and stability are of vital importance. These data are usually stored on a large scale in virtual servers and virtual networks in data centers for efficient management and quick access. However, with the widespread application of virtualization technology, the security challenges faced by virtual environments are becoming increasingly severe.

[0003] Traditional security assessment methods seem to be powerless when facing virtual environments. On the one hand, the dynamic and complex nature of virtual environments makes security vulnerabilities and abnormal behaviors more difficult to discover and respond to. On the other hand, existing security assessment methods often focus on static analysis and lack effective monitoring and response to real-time changes in virtual environments. Specifically, security vulnerabilities in virtual environments come from multiple aspects, such as defects in virtualization software, improper configuration of virtual machines, and security policy loopholes in virtual networks. Once these loopholes are maliciously exploited, they may lead to the leakage of power data, failure of system functions, and even cause large-scale system failures. In addition, abnormal behavior in virtual environments is also a major security risk. Due to the characteristics of virtualization technology, attackers can more easily migrate and hide between different virtual machines, thereby evading detection by traditional security systems. These abnormal behaviors may include unauthorized access, data tampering, and the spread of malware, all of which pose a serious threat to the power data storage of power grid companies.

[0004] In view of the above problems, it is necessary to optimize the existing power grid enterprise power data storage security risk assessment system, timely discover and respond to security vulnerabilities and abnormal behaviors by real-time monitoring of the dynamic changes of the virtual environment, and conduct accurate risk assessment based on the unique characteristics of power grid enterprise power data, and formulate corresponding security protection strategies. Therefore, it is of great significance to develop a power grid enterprise power data storage security risk assessment system that can comprehensively realize the above characteristics. Summary of the invention

[0005] The purpose of the present invention is to make up for the shortcomings of the existing technology and provide a power data storage security risk assessment system for power grid enterprises. It can realize all-round and high-precision monitoring of virtualized data center environments by introducing advanced machine learning algorithms and real-time threat intelligence sources. At the same time, combined with the unique characteristics of power data of power grid enterprises, the system can accurately assess security risks and automatically generate and adjust dynamic security policies to adapt to different security conditions. In addition, the present invention also adopts cutting-edge virtual isolation technology and early warning response mechanism to ensure rapid response when security vulnerabilities and abnormal behaviors are discovered, effectively preventing the spread of security issues.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a power data storage security risk assessment system for a power grid enterprise, the system comprising a virtual environment monitoring module, a risk assessment and isolation module, an early warning and response module and a security policy management module;

[0007] The virtual environment monitoring module is used to continuously collect virtual server and virtual network data, establish a connection with an external threat intelligence source, receive external threat intelligence in real time, and promptly record and send information to the risk assessment and isolation module when data anomalies are found;

[0008] The risk assessment and isolation module includes a risk assessment module, an isolation strategy formulation module and an isolation implementation and monitoring module;

[0009] The risk assessment module is used to receive data from the virtual environment monitoring module, assess the security risk of power data storage, and calculate the current risk value;

[0010] The isolation strategy formulation module formulates a virtual isolation strategy based on the risk assessment results and dynamically adjusts the isolation measures based on the feedback;

[0011] The isolation implementation and monitoring module establishes a secure isolation barrier between different virtual systems, implements it according to the established isolation strategy, and continuously monitors the effectiveness of the isolation barrier, while regularly verifying its effectiveness. When a problem with the isolation barrier is detected, the isolation self-healing mechanism is automatically started to quickly repair the isolation vulnerability.

[0012] The early warning and response module analyzes the best response strategy based on the security risk assessment results and historical response data and recommends it to the security management personnel. At the same time, it establishes a coordinated response mechanism with other security systems within the power grid enterprise to jointly respond to security incidents, evaluate the effects of response measures after execution, and analyze the effectiveness of response measures;

[0013] The security policy management module automatically generates dynamic security policies based on data feedback from the virtual environment monitoring module and the risk assessment and isolation module, and performs version control on the security policies so that the policy change history can be traced back. At the same time, it conducts regular compliance checks and provides security policy optimization directions to improve system security.

[0014] Furthermore, the virtual environment monitoring module utilizes a machine learning algorithm to train an abnormal behavior detection model with historical normal and abnormal behavior data, and uses the trained model to analyze real-time data, combining multi-dimensional data to comprehensively judge the security status of the virtual environment and detect anomalies.

[0015] Furthermore, the virtual environment monitoring module continuously collects virtual server and virtual network data, including system logs of the virtual server and virtual network, network traffic data, virtual resource usage data, and virtual network topology change data.

[0016] Furthermore, the virtual environment monitoring module uses a machine learning algorithm to continuously learn historical normal and abnormal behavior data, calculates the distance metric D(B, A) between the current data features and the known abnormal behavior patterns, and uses the formula Calculate the confidence of detecting abnormal behavior, where C ab It represents the confidence of detecting abnormal behavior, D(B,A) is the distance measure between the current data feature B and the known abnormal behavior pattern A, and σ is the adjustment parameter.

[0017] Furthermore, the virtual environment monitoring module uses the trained model to analyze the real-time data, combines the multi-dimensional data to comprehensively judge the virtual environment security status, and uses the formula Calculate the comprehensive security status score of the virtual environment, where S v Indicates the comprehensive security status score of the virtual environment, F i Indicates the security index scores of each dimension, including network traffic security score F1, system log security score F2, and virtual resource usage security score F3. i is the weight coefficient of each dimension, reflecting the importance of different dimensions in overall security, k i is an adjustment parameter used to avoid excessive impact on the overall score when the dimension score is too low, and p is a regulation parameter used to adjust the strength of fusion.

[0018] Furthermore, the risk assessment and isolation module receives data from the virtual environment monitoring module, assesses the security risk of power data storage according to the risk quantification model, and calculates the current risk value, and the calculation formula is: Among them, R indexrepresents the risk quantification comprehensive index of power data storage, r i is the value of each risk factor, including the number of vulnerabilities and the frequency of abnormal behavior. β is the adjustment parameter used to adjust the impact of risk factors. α is the weight coefficient of the risk factor part. j is the value of the isolation effect index, including the isolation success rate and the number of isolation vulnerabilities, δ is the adjustment parameter of the isolation effect index, and γ is the weight coefficient of the isolation effect part.

[0019] Furthermore, the risk assessment and isolation module formulates a virtual isolation strategy and makes dynamic adjustments based on the risk assessment results. The dynamic adjustment formula of the isolation strategy is: Among them, I strategy represents the adjusted isolation strategy strength, I0 is the initial isolation strategy strength, R index is the risk quantitative comprehensive index, R threshold is the preset risk threshold, θ is the adjustment coefficient, when R index More than R tresold The isolation strategy strength will be dynamically adjusted according to the risk level.

[0020] Furthermore, when the risk assessment and isolation module detects a problem with the isolation barrier, it automatically starts the isolation self-healing mechanism and quickly repairs the isolation vulnerability. Specifically, it detects abnormal conditions of the isolation barrier and triggers an alarm through multi-dimensional real-time monitoring means, determines the cause and specific location of the problem through data analysis and problem location, and automatically selects and executes repair strategies based on the nature of the problem, including software updates, configuration adjustments, and vulnerability patches. Verification and confirmation are performed after the repair, and if the effect is not ideal, the strategy is adjusted and repaired again. The entire process is automatically recorded and a report is generated.

[0021] Furthermore, the early warning and response module uses artificial intelligence algorithms to analyze the best response strategy based on the security risk assessment results and historical response data and recommends it to security managers. The best response strategy evaluation formula is: Among them, S response represents the evaluation score of the best response strategy, w ri is the weight coefficient of different response factors, including response time, resource consumption and effect persistence, C ri It is the score of each response factor. The higher the score, the better the response strategy.

[0022] Furthermore, the security policy management module provides security policy optimization direction based on big data analysis technology to improve system security. The security policy optimization direction formula is Among them, O directionIndicates the direction of security policy optimization. A positive value indicates that the security policy needs to be strengthened, and a negative value indicates that the security policy can be appropriately relaxed. si is the weight coefficient of different safety indicators, S target is the target safety status score, which is set according to the safety requirements of the power grid company. current It is the current security status score, which is calculated by comprehensively calculating the data from the virtual environment monitoring module and the risk assessment and isolation module.

[0023] Compared with the existing technology, the power grid enterprise power data storage security risk assessment system has the following beneficial effects:

[0024] 1. The present invention uses a virtual environment monitoring module to conduct all-round real-time monitoring of the virtual servers and virtual networks of the power grid enterprise data center, and uses a machine learning algorithm to continuously optimize the abnormal behavior detection model to achieve high-precision identification of new abnormal behaviors. At the same time, the risk assessment and isolation module combines the unique characteristics of the power data of the power grid enterprise and introduces specific risk factor weights to ensure that the assessment results highly accurately reflect the actual security risks of power data storage, significantly improving the security and stability of power data storage of the power grid enterprise.

[0025] 2. The present invention adopts virtual isolation means to build a strict security isolation barrier between different virtual systems, and intelligently adjusts the isolation strategy according to the risk assessment results, so as to achieve stricter isolation of high-risk virtual systems and moderately relaxed isolation of low-risk systems, thereby improving resource utilization. At the same time, the early warning and response module accurately recommends the best response strategy to security managers based on the security risk assessment results and rich historical response data, so as to achieve fast and efficient response. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a schematic diagram of the structure of the power data storage security risk assessment system for power grid enterprises;

[0027] Figure 2 Flowchart of the power data storage security risk assessment system for power grid enterprises. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present invention are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] Embodiment 1

[0030] This embodiment describes in detail the application of the power grid enterprise power data storage security risk assessment system in the data center of a large power grid enterprise, and aims to improve the security and stability of the power grid enterprise power data storage by introducing the present invention, thereby providing a strong guarantee for the reliable operation of the power grid.

[0031] like Figure 1 to Figure 2 As shown, this embodiment discloses a power data storage security risk assessment system for a power grid enterprise, which includes a virtual environment monitoring module, a risk assessment and isolation module, an early warning and response module, and a security policy management module.

[0032] During the data collection phase, the virtual environment monitoring module continuously collects system logs, network traffic data, virtual resource usage data (such as CPU, memory, storage usage, etc.) and virtual network topology change data of virtual servers and virtual networks. At the same time, it establishes a connection with external threat intelligence sources to receive external threat intelligence in real time. For example, it obtains network traffic data in real time through network monitoring tools, records changes in resource usage of virtual servers, and uses machine learning algorithms to train with historical normal and abnormal behavior data as training sets to continuously optimize the abnormal behavior detection model. Suppose the current data feature is B, and the known abnormal behavior pattern is A. By calculating a certain distance metric D(B,A) between the two, the formula is used Calculate the confidence C of the detected abnormal behavior ab , where σ is an adjustment parameter, which can be obtained by statistically analyzing the distance distribution of known abnormal behaviors and normal behaviors in historical data. In the present invention, data feature B is a multi-dimensional data feature vector, including network traffic features, system log features, virtual resource usage features, etc. When the calculated C ab When it exceeds the set threshold, it is determined to be abnormal behavior. The trained abnormal behavior detection model is used to analyze the real-time collected data to detect whether there is abnormal behavior. The security status of the virtual environment is comprehensively judged by combining multi-dimensional data. If an abnormality is found, it is immediately recorded and prepared to send information to the risk assessment and isolation module. For example, when the network traffic fluctuates abnormally, the distance measurement between it and the normal traffic pattern is calculated to obtain the confidence of the abnormal behavior. If the confidence is high, it is determined to be abnormal behavior and the relevant information is recorded. The formula Calculate the virtual environment's approximate security status score S v , where F i Indicates the security index scores of each dimension, such as network traffic security score F1, system log security score F2, virtual resource usage security score F3, etc. i is the weight coefficient of each dimension, which can be determined by expert evaluation method or hierarchical analysis method, reflecting the importance of different dimensions in overall safety. iis an adjustment parameter used to avoid excessive impact on the overall score when the score of a certain dimension is too low, and p is a regulation parameter that can adjust the strength of fusion as needed.

[0033] The risk assessment and isolation module includes the risk assessment module, the isolation strategy formulation phase module and the isolation implementation and monitoring phase module. The risk assessment phase module combines the characteristics of the power data of the power grid enterprise to determine the specific risk factor weights and Calculation of risk quantification comprehensive index R for power data storage index , where r i Yes The value of each risk factor, such as the number of vulnerabilities and the frequency of abnormal behavior, can be obtained by statistically analyzing the system's vulnerability scanning, abnormal behavior monitoring and other data. β is an adjustment parameter that can be determined through experiments or analysis of historical data to adjust the impact of risk factors. α is the weight coefficient of the risk factor part, which can be determined according to the degree of attention that the power grid company attaches to the risk factor. j It is the value of the isolation effect index, such as the isolation success rate, the number of isolation vulnerabilities, etc., which can be obtained through the monitoring and evaluation of the isolation measures. δ is the adjustment parameter of the isolation effect index, which can be determined by experiments or analysis of historical data. γ is the weight coefficient of the isolation effect part, which can be determined according to the degree of attention paid by the power grid company to the isolation effect. It receives data from the virtual environment monitoring module, evaluates the security risks of data storage, calculates the current risk value, and dynamically updates the risk assessment results to ensure consistency with the current system status.

[0034] The isolation policy formulation module formulates virtual isolation policies based on risk assessment results, determines stricter isolation measures for high-risk virtual systems, and appropriately relaxes isolation for low-risk systems to improve resource utilization. It applies micro-isolation technology to refine the isolation granularity to a single application or service level. For example, for critical business applications, they are identified as high-risk virtual systems, and stricter access control rules are formulated to allow access only to specific users or IP addresses.

[0035] The isolation implementation and monitoring module establishes a secure isolation barrier between different virtual systems, implements it according to the established isolation strategy, continuously monitors the effectiveness of the isolation barrier, and regularly verifies its effectiveness. When a problem with the isolation barrier is detected, the isolation self-healing mechanism is automatically started to quickly repair the isolation vulnerability. Adjust the isolation strategy strength I strategy , where I0 is the initial isolation strategy strength, which can be determined based on the enterprise's security strategy and historical experience, and R thresholdis a preset risk threshold, which can be determined according to the grid enterprise's tolerance for security risks. θ is an adjustment coefficient, which can be determined through experiments or analysis of historical data to control the extent of isolation policy adjustment. For example, different applications can be divided into different virtual networks using virtual network technology, and network access control lists (ACLs) can be used to strictly limit the ingress and egress of network traffic. When a vulnerability in the isolation barrier is detected, the repair program is automatically started, such as downloading and installing software patches, adjusting configuration parameters, etc.

[0036] The early warning and response module uses artificial intelligence algorithms to analyze the best response strategies in different situations based on security risk assessment results and historical response data. Calculate the evaluation score S of the best response strategy response , where w ri is the weight coefficient of different response factors, which can be determined according to the requirements of the power grid company for the response strategy. ri It is the score of each response factor, which can be obtained through the analysis and evaluation of historical response data, and recommends the best response strategy suitable for the current situation to security managers. At the same time, this module establishes a collaborative response mechanism with other security systems within the power grid enterprise, such as firewalls, intrusion detection systems, etc. When a security incident occurs, response measures are taken together to achieve integrated security protection. After the response measures are executed, the response effect is evaluated, the effectiveness of the response measures is analyzed, and lessons learned are summarized to provide a basis for optimizing the response strategy. For example, when a security incident is detected, it works with the firewall to prevent the further spread of the attack. After the response measures are executed, the scores of response factors such as response time and resource consumption are evaluated to optimize the response strategy.

[0037] The application of the security policy management module automatically generates dynamic security policies that adapt to different security conditions based on the data feedback from the virtual environment monitoring module and the risk assessment and isolation module. At the same time, it performs version control on the security policy and records the content of each version of the security policy. When necessary, it can trace back to the previous policy version to understand the history of policy changes. At the same time, it regularly conducts compliance checks on the implementation of security policies to ensure compliance with relevant regulations and standards. Based on big data analysis and machine learning algorithms, it analyzes the implementation effect and potential risks of security policies, and provides security management personnel with security policy optimization suggestions to continuously improve the security of the system. Determine the direction of security policy optimization where w si is the weight coefficient of different safety indicators, which can be determined through reference to regulatory standards and enterprise strategy analysis. target is the target safety status score, which can be set according to the safety goals and requirements of the power grid enterprise. currentIt is the current security status score, which is calculated comprehensively based on the data from the virtual environment monitoring module and the risk assessment and isolation module. For example, according to the risk assessment results and changes in monitoring data, the security policy is automatically adjusted, corresponding access control rules and data encryption requirements are formulated for applications and services at different security levels, the compliance of security policies is regularly checked, and optimization suggestions are provided to security managers, such as strengthening the monitoring and protection of high-risk applications.

[0038] To sum up, the power grid enterprise power data storage security risk assessment system of the present invention is applied in the data center of a large power grid enterprise, and through the synergy of various modules, it effectively realizes comprehensive security protection of power data storage, significantly improves the security and stability of power grid enterprise power data storage, and provides a strong guarantee for the reliable operation of the power grid.

[0039] Embodiment 2

[0040] This embodiment describes in detail the application of the power grid enterprise power data storage security risk assessment system in the smart grid project, and the security of power data storage is guaranteed by the security risk assessment system of the present invention.

[0041] like Figure 1 to Figure 2 As shown, this embodiment discloses a power data storage security risk assessment system for a power grid enterprise, which includes a virtual environment monitoring module, a risk assessment and isolation module, an early warning and response module, and a security policy management module.

[0042] The virtual environment monitoring module continuously collects system logs, network traffic data, virtual resource usage data, and virtual network change data of virtual servers and virtual networks in the smart grid during the data collection phase. It uses professional network monitoring equipment and software to obtain network traffic information of each node in real time. At the same time, it monitors virtual servers and records resource usage such as CPU, memory, and storage utilization. It also maintains close connections with external threat intelligence sources to obtain new threat intelligence that the smart grid may face in a timely manner. In the model training phase, based on a large amount of historical normal and abnormal behavior data, machine learning methods are used for training. For known abnormal behavior patterns A, their features in terms of network traffic, system logs, etc. are collected and compared with the current data features B. The distance metric D(B,A) between the two is calculated. The formula Calculate the confidence C of the detected abnormal behavior ab, where σ is obtained by statistically analyzing the distance distribution between known abnormal behaviors and normal behaviors in historical data. The model parameters are continuously adjusted to improve the ability to identify new abnormal behaviors in the smart grid environment. In the monitoring and analysis stage, the trained abnormal behavior detection model is used to analyze the real-time collected data. When an abnormal peak value of network traffic is found, or frequent error messages appear in the system log, the distance measurement between it and the normal state is calculated, and the confidence of the abnormal behavior is obtained. If the confidence exceeds the set threshold, it is determined to be an abnormal behavior, and the relevant information is immediately recorded and prepared to be sent to the risk assessment and isolation module. At the same time, the formula Calculate the comprehensive security score S of the virtual environment v , where F i They represent the network traffic security score F1, the system log security score F2, the virtual resource usage security score F3, etc. For example, the network traffic security score is determined according to factors such as the stability of the network traffic and the number of abnormal fluctuations. The system log security score is determined according to the severity and frequency of error information in the system log. The virtual resource usage security score is determined according to the rationality of the virtual resource usage rate. i The weight coefficients of each dimension are determined through expert evaluation and analysis of smart grid security requirements, k i and p are adjusted according to actual conditions to ensure that the comprehensive security status score can accurately reflect the security status of the smart grid virtual environment.

[0043] The risk assessment and isolation module fully considers the characteristics of smart grid power data in the risk assessment stage, determines the weights of specific risk factors, and uses the formula Calculation of risk quantification comprehensive index R for power data storage index , where r i The risk factors, including the number of vulnerabilities and the frequency of abnormal behaviors in the smart grid, are obtained through regular vulnerability scanning and monitoring of abnormal behaviors. β is determined through analysis and experiments of historical data to adjust the impact of risk factors. α determines the weight coefficient according to the importance of different risk factors in the smart grid. q jThe values ​​representing the isolation effect indicators, such as the isolation success rate and the number of isolation vulnerabilities, are obtained through continuous monitoring and evaluation of the isolation measures. δ is also determined through experiments and data analysis to adjust the degree of influence of the isolation effect indicators. γ determines the weight coefficient according to the importance that the smart grid attaches to the isolation effect. It receives data from the virtual environment monitoring module, conducts accurate security risk assessment on the power data storage in the smart grid, and dynamically updates the risk assessment results to ensure consistency with the current system status. In the isolation strategy formulation stage, a virtual isolation strategy suitable for the smart grid is formulated based on the risk assessment results. For high-risk virtual systems involving key user data and core businesses, more stringent isolation measures are determined. For example, only specific authorized devices are allowed to access the virtual server that stores user electricity usage information, and encrypted communication is used. Micro-isolation technology is applied to refine the isolation granularity to a single At the application or service level, for some auxiliary services, isolation can be appropriately relaxed to improve resource utilization, but basic security requirements must still be guaranteed. During the isolation implementation and monitoring stage, a secure isolation barrier is established between different virtual systems of the smart grid. Software-defined networking (SDN) technology is used to achieve fine control of network traffic. The isolation strategy is implemented according to the established isolation policy, and the effectiveness of the isolation barrier is continuously monitored. Effectiveness verification is performed regularly. For example, by simulating attacks and vulnerability scanning, it is checked whether the isolation barrier can effectively prevent unauthorized access and data leakage. When a problem with the isolation barrier is detected, the isolation self-healing mechanism is automatically started. If a vulnerability is found in the isolation of a virtual system, the emergency response program is immediately started, and the relevant security patches are automatically downloaded and installed. The network configuration is adjusted to quickly repair the isolation vulnerability and prevent the spread of security issues.

[0044] The application of the early warning and response module is based on the security risk assessment results and historical response data, using artificial intelligence algorithms to analyze the best response strategies in different situations. Calculate the evaluation score S of the best response strategy response , where w ri The weight coefficient is determined according to the importance that the smart grid attaches to different response factors. For example, if the smart grid has extremely high requirements for response time, then a higher weight coefficient is given to the response time factor. riIt is the score of each response factor, which is obtained by analyzing and evaluating the historical response data. For example, the score of the response factor is determined according to the length of response time and the amount of resource consumption in previous security incidents, and the best response strategy suitable for the current situation is recommended to security managers to improve the response efficiency and accuracy. At the same time, this module establishes a collaborative response mechanism with other security systems within the smart grid, such as firewalls, intrusion detection systems, etc. When a security incident occurs, response measures are taken together to achieve integrated security protection. For example, when a network attack is detected, the early warning and response module immediately works with the firewall to adjust the firewall rules to block the entry of attack traffic, and the intrusion detection system conducts an in-depth analysis of the attack behavior to provide more detailed information for subsequent response measures. After the response measures are executed, the response effect is evaluated, the effectiveness of the response measures is analyzed, and lessons learned are summarized to provide a basis for optimizing the response strategy. For example, it is evaluated whether the response time reaches the expected goal, whether the resource consumption is within an acceptable range, and whether the security incident is effectively controlled. According to the evaluation results, the response strategy is adjusted to improve the smart grid's ability to respond to security incidents.

[0045] The security policy management module automatically generates dynamic security policies that adapt to different security conditions of the smart grid based on the data feedback from the virtual environment monitoring module and the risk assessment and isolation module. For example, when frequent abnormal behaviors of virtual servers in a certain area of ​​the smart grid are detected, the security policy management module automatically adjusts the access control policy of the area to strengthen the protection of key data. The module also performs version control on the security policy and records the content of each version of the security policy. When necessary, it can go back to the previous policy version to understand the history of policy changes. For example, if a problem is found in the current security policy after a security incident, it can go back to the previous version and analyze the reasons for the policy change in order to better adjust the policy. In addition, the implementation of the security policy is regularly checked for compliance to ensure compliance with relevant regulations and standards. For example, it checks whether the security policy of the smart grid meets the national safety standards of the power industry and the requirements of data protection regulations. Based on big data analysis and machine learning algorithms, it analyzes the execution effect and potential risks of the security policy, and provides security management personnel with security policy optimization suggestions to continuously improve the security of the system. Through formula O direction =sign(∑ n w si ×(S target -S current )) Determine the direction of security policy optimization, where w si is the weight coefficient of different safety indicators, which can be determined through reference to regulatory standards and enterprise strategy analysis. target is the target security status score set according to the security requirements of the smart grid, S cwrrentIt is the current security status score calculated by comprehensively calculating the data from the virtual environment monitoring module and the risk assessment and isolation module. For example, if the current security status score is lower than the target security status score, the security policy management module will recommend strengthening certain security measures, such as increasing the monitoring frequency of key equipment and improving the strictness of access control.

[0046] To sum up, in the smart grid project, the power data storage security risk assessment system of the present invention provides comprehensive and efficient security protection for the data storage of the smart grid through the close collaboration of various modules, improves the security and stability of the smart grid data storage, and strongly supports the reliable operation of the smart grid.

[0047] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A power data storage security risk assessment system for power grid enterprises, characterized by: The system includes a virtual environment monitoring module, a risk assessment and isolation module, an early warning and response module, and a security policy management module; The virtual environment monitoring module is used to continuously collect virtual server and virtual network data, establish a connection with an external threat intelligence source, receive external threat intelligence in real time, and promptly record and send information to the risk assessment and isolation module when data anomalies are found; The risk assessment and isolation module includes a risk assessment module, an isolation strategy formulation module and an isolation implementation and monitoring module; The risk assessment module is used to receive data from the virtual environment monitoring module, assess the security risk of power data storage, and calculate the current risk value; The isolation strategy formulation module is used to formulate a virtual isolation strategy based on risk assessment results and dynamically adjust isolation measures based on feedback; The isolation implementation and monitoring module is used to establish a secure isolation barrier between different virtual systems, implement it according to the established isolation strategy, and continuously monitor the effectiveness of the isolation barrier, while regularly verifying the effectiveness. When a problem with the isolation barrier is detected, the isolation self-healing mechanism is automatically started to quickly repair the isolation vulnerability; The early warning and response module analyzes the best response strategy based on the security risk assessment results and historical response data and recommends it to the security management personnel. At the same time, it establishes a coordinated response mechanism with other security systems within the power grid enterprise to jointly respond to security incidents, evaluate the effects of response measures after execution, and analyze the effectiveness of response measures; The security policy management module automatically generates dynamic security policies based on data feedback from the virtual environment monitoring module and the risk assessment and isolation module, and performs version control on the security policies so that the policy change history can be traced back. At the same time, it conducts regular compliance checks and provides security policy optimization directions to improve system security.

2. The power grid enterprise power data storage security risk assessment system according to claim 1 is characterized in that The virtual environment monitoring module uses a machine learning algorithm to train an abnormal behavior detection model with historical normal and abnormal behavior data, and uses the trained model to analyze real-time data, combining multi-dimensional data to comprehensively judge the security status of the virtual environment and detect anomalies.

3. The power grid enterprise power data storage security risk assessment system according to claim 1 or 2, characterized in that: The virtual environment monitoring module continuously collects virtual server and virtual network data, including system logs of the virtual server and virtual network, network traffic data, virtual resource usage data, and virtual network topology change data.

4. The power grid enterprise power data storage security risk assessment system according to claim 2 is characterized by: The virtual environment monitoring module uses machine learning algorithms to continuously learn historical normal and abnormal behavior data, calculates the distance metric D(B, A) between the current data features and the known abnormal behavior patterns, and uses the formula Calculate the confidence of detecting abnormal behavior, where C ab It represents the confidence of detecting abnormal behavior, D(B,A) is the distance measure between the current data feature B and the known abnormal behavior pattern A, and σ is the adjustment parameter.

5. The power grid enterprise power data storage security risk assessment system according to claim 2 is characterized by: The virtual environment monitoring module uses the trained model to analyze the real-time data, combines multi-dimensional data to comprehensively judge the virtual environment security status, and uses the formula Calculate the comprehensive security status score of the virtual environment, where S v Indicates the comprehensive security status score of the virtual environment, F i Indicates the security index scores of each dimension, including network traffic security score F1, system log security score F2, and virtual resource usage security score F3. i is the weight coefficient of each dimension, reflecting the importance of different dimensions in overall security, k i is an adjustment parameter used to avoid excessive impact on the overall score when the dimension score is too low, and p is a regulation parameter used to adjust the strength of fusion.

6. The power grid enterprise power data storage security risk assessment system according to claim 1 is characterized by: The risk assessment and isolation module receives data from the virtual environment monitoring module, assesses the security risk of power data storage according to the risk quantification model, and calculates the current risk value, and the calculation formula is: Among them, R index represents the risk quantification comprehensive index of power data storage, r i is the value of each risk factor, including the number of vulnerabilities and the frequency of abnormal behavior. β is the adjustment parameter used to adjust the impact of risk factors. α is the weight coefficient of the risk factor part. j is the value of the isolation effect index, including the isolation success rate and the number of isolation vulnerabilities, δ is the adjustment parameter of the isolation effect index, and γ is the weight coefficient of the isolation effect part.

7. The power grid enterprise power data storage security risk assessment system according to claim 1 is characterized in that: The risk assessment and isolation module formulates a virtual isolation strategy and makes dynamic adjustments based on the risk assessment results. The dynamic adjustment formula of the isolation strategy is: Among them, I strategy represents the adjusted isolation strategy strength, I0 is the initial isolation strategy strength, R index is the risk quantitative comprehensive index, R threshold is the preset risk threshold, θ is the adjustment coefficient, when R index More than R tresold The isolation strategy strength will be dynamically adjusted according to the risk level.

8. The power grid enterprise power data storage security risk assessment system according to claim 1 is characterized in that: When the risk assessment and isolation module detects a problem with the isolation barrier, it automatically starts the isolation self-healing mechanism. The method for quickly repairing the isolation vulnerability is as follows: detect abnormal conditions of the isolation barrier and trigger an alarm through multi-dimensional real-time monitoring means, determine the cause and specific location of the problem through data analysis and problem location, and automatically select and execute a repair strategy based on the nature of the problem, including software updates, configuration adjustments, and vulnerability patches. Verification and confirmation are performed after the repair, and if the effect is not ideal, the strategy is adjusted and repaired again. The entire process is automatically recorded and a report is generated.

9. The power grid enterprise power data storage security risk assessment system according to claim 1 is characterized in that: The early warning and response module analyzes the best response strategy based on the security risk assessment results and historical response data and recommends it to the security management personnel. The best response strategy evaluation formula is: Among them, S response represents the evaluation score of the best response strategy, w ri is the weight coefficient of different response factors, including response time, resource consumption and effect persistence, C ri It is the score of each response factor. The higher the score, the better the response strategy.

10. The power grid enterprise power data storage security risk assessment system according to claim 1, characterized in that: The security policy management module provides security policy optimization direction to improve system security. The security policy optimization direction formula is Among them, O direction Indicates the direction of security policy optimization. A positive value indicates that the security policy needs to be strengthened, and a negative value indicates that the security policy can be appropriately relaxed. si is the weight coefficient of different safety indicators, S target is the target safety status score, which is set according to the safety requirements of the power grid company. current It is the current security status score, which is calculated by comprehensively calculating the data from the virtual environment monitoring module and the risk assessment and isolation module.

Images