Field operation and maintenance intelligent auditing method and system, electronic equipment and storage medium

Abstract

The invention discloses a field operation and maintenance intelligent auditing method and system, electronic equipment and a storage medium, and aims to solve the problem that the operation and maintenance cost corresponding to an existing information operation and maintenance auditing method is high due to the fact that an independent server needs to be established. The method comprises the following steps: acquiring an access instruction, and establishing a link with edge computer equipment; establishing an access permission based on a permission minimization principle; detecting access information of the target secondary equipment in the access authority, and performing abnormal behavior monitoring based on the access information; abnormal data obtained through abnormal behavior monitoring are sent to the service center and uploaded, and learning and analysis are performed based on the abnormal data so that tracing and statistics can be performed on abnormal events. According to the method, an independent server does not need to be established, only equipment needs to be accessed, so that field operation and maintenance of the corresponding edge equipment are carried out through configuration, a special server does not need to be established, operation and maintenance only need to be carried out aiming at the corresponding edge computer during operation and maintenance, and therefore the cost is saved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an on-site operation and maintenance intelligent audit method, system, electronic equipment and storage medium. Background Art

[0002] In recent years, with the development of Internet technology and corresponding Internet and services, people pay more and more attention to information security, and the corresponding management technology for on-site edge computer services has become more mature. Therefore, information operation and maintenance auditing for specific on-site computers has become a core research direction at present.

[0003] The existing information operation and maintenance audit method for on-site computers generally uses an independent server to conduct corresponding information review and security protection, and uses an independent server to input and output on-site information and perform corresponding judgment and screening. However, the existing information operation and maintenance audit method requires the establishment of an independent server, and operation and maintenance are required not only for on-site computers but also for servers, so the corresponding operation and maintenance costs are relatively high.

[0004] The "operation and maintenance audit device" disclosed in the Chinese patent literature, with the publication number CN217008207U, relates to an operation and maintenance audit device for protecting the data security of the operated equipment in the power monitoring system. The operation and maintenance audit device includes a signal acquisition module, a control module and a response module, wherein the signal acquisition module is used to collect the real-time data signal of the data port of the operated equipment according to the acquisition trigger signal; the control module is electrically connected to the signal acquisition module, and is used to determine whether data flow occurs according to the real-time data signal and the preset data signal, and generate an alarm signal and / or a protection signal when data flow occurs in the operated equipment; however, it does not propose a specific method and cannot solve the above-mentioned problem. Summary of the invention

[0005] The present invention solves the problem that the existing information operation and maintenance audit method has high corresponding operation and maintenance costs due to the need to establish an independent server, and proposes an on-site operation and maintenance intelligent audit method, system, electronic device and storage medium. Since the method of the present invention does not need to establish an independent server, it only needs to connect the device, so that the on-site operation and maintenance of the corresponding edge device can be performed through configuration. Since there is no need to establish a dedicated server, it is only necessary to perform operation and maintenance on the corresponding edge computer during operation and maintenance, thereby saving costs.

[0006] In order to achieve the above object, the present invention adopts the following technical solution: a method for intelligent auditing of on-site operation and maintenance, comprising the following steps: S1, obtain access instructions and establish a link with the edge computer device; S2, establish access rights based on the principle of minimum permissions, and the access rights are to allow access only to the target secondary devices required for work, and to other devices; S3, detecting access information of the target secondary device in the access permission, and performing abnormal behavior monitoring based on the access information; S4, sending the abnormal data obtained by abnormal behavior monitoring to the service center and uploading it, and conducting learning and analysis based on the abnormal data to facilitate the tracing and statistics of abnormal events.

[0007] In the present invention, a link is established with an edge computer device, access rights are established according to the principle of minimizing permissions, access information of the target secondary device in the access rights is detected, and abnormal behavior monitoring is performed based on the access information. Learning and analysis are performed based on abnormal data to facilitate tracing and statistics of abnormal events. The method of the present invention does not require the establishment of an independent server, saving operation and maintenance costs.

[0008] Preferably, the step S1 further includes the following steps: Build a diversified, integrated, and highly elastic power grid secondary equipment vulnerability feature library, obtain secondary equipment security protection technology, and build a corresponding defense system based on the secondary equipment vulnerability feature library and security protection technology.

[0009] In the present invention, a defense system is established by integrating a multi-faceted high-elasticity power grid secondary equipment vulnerability feature library and corresponding secondary equipment security protection technology, thereby accessing corresponding security devices and further improving the security performance of hardware and software.

[0010] Preferably, the step S1 comprises the following steps: S11, obtaining user identity information and building an access control system based on the user identity information, where the user identity information includes basic network, equipment, user, and application object; S12, after obtaining the corresponding physical device link instruction, a link with the edge computer device is established based on the access control system.

[0011] In the present invention, the link includes a physical link and a virtual link; there is no limitation on the specific edge computer device.

[0012] Preferably, after establishing access rights based on the principle of minimizing permissions, the method further includes the following steps: According to the access control strategy of real-time calculation, the identity information, permission information and environmental information of the access object are collected and calculated in real time to obtain the trust level of the access object, and the access rights of the access object are opened according to the trust level.

[0013] In the present invention, different permissions can be opened according to various information of the access object. The more corresponding functions are opened, the more comprehensive they are. Through the management of trust levels, the corresponding management effect is further improved and security is enhanced.

[0014] Preferably, the step S4 further includes the following steps: S51, obtaining emergency maintenance safety events in the edge area of ​​the multi-integrated high-elasticity power grid according to abnormal data; and performing situation analysis on the safety events represented by the sent abnormal data; S52, combines user feedback data and the processing capabilities of edge computer devices to perform a visual display of situation analysis.

[0015] In the present invention, situation analysis is performed by uploading data, thereby clearly displaying the status and security performance of the corresponding edge devices.

[0016] Preferably, the principle of minimizing permissions is that each program and system user has the minimum set of permissions required to complete a task.

[0017] In the present invention, the principle of minimizing permissions requires that each module of a specific abstraction layer in a computing environment can only access information or resources that are currently necessary.

[0018] An on-site operation and maintenance intelligent audit system is applicable to the above-mentioned on-site operation and maintenance intelligent audit method, including: The acquisition module is used to obtain access instructions and establish a link with the edge computer device Access rights module, used to establish access rights based on the principle of minimum permissions; A detection module is used to detect access information of target secondary devices in the access rights and monitor abnormal behavior based on the access information; The analysis module is used to send the abnormal data obtained by abnormal behavior monitoring to the service center and perform learning and analysis based on the abnormal data.

[0019] In the system of the present invention, the acquisition module, access permission module, detection module and analysis module respectively complete the establishment of links with edge computer devices, establish access permissions according to the principle of minimizing permissions, detect access information of target secondary devices in the access permissions, monitor abnormal behaviors based on the access information, and learn and analyze based on abnormal data to facilitate the tracing and statistics of abnormal events.

[0020] Preferably, the acquisition module is connected to the access permission module, the access permission module is connected to the detection module, and the detection module is connected to the analysis module.

[0021] In the present invention, the acquisition module, the access permission module, the detection module and the analysis module are connected in sequence to complete their corresponding processing steps.

[0022] An electronic device comprises: at least one processor and a memory; the memory stores computer-executable instructions; the at least one processor executes the computer-executable instructions stored in the memory, so that the electronic device executes any of the methods described above.

[0023] In the present invention, a processor and a memory are provided in the electronic device, and the processor can execute computer execution instructions to complete the on-site operation and maintenance intelligent audit method of the present invention.

[0024] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, any of the methods described above is implemented.

[0025] In the present invention, the storage medium stores a computer program, and the program can be executed to complete the above-mentioned on-site operation and maintenance intelligent audit method.

[0026] The present invention has the following beneficial effects: The present invention obtains access instructions and establishes a link with an edge computer device, establishes access rights based on the principle of minimizing permissions, detects access information of target secondary devices in the access rights, monitors abnormal behavior based on the access information, sends abnormal data obtained from abnormal behavior monitoring to a service center and uploads it, and performs learning and analysis based on the abnormal data to facilitate tracing and statistics of abnormal events. Compared with the current solutions, the on-site operation and maintenance intelligent audit method provided in the present invention does not require the establishment of an independent server, but only requires the device to be connected, so that on-site operation and maintenance of the corresponding edge device can be performed through configuration. Since there is no need to establish a dedicated server, operation and maintenance only needs to be performed on the corresponding edge computer, which greatly saves costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a flow chart of an on-site operation and maintenance intelligent audit method of the present invention; Figure 2 It is a flow chart of step S1 of a field operation and maintenance intelligent audit method of the present invention; Figure 3 It is a structural schematic diagram of an on-site operation and maintenance intelligent audit system of the present invention; Figure 4 It is a structural schematic diagram of an electronic device of the present invention; Among them, 1. Acquisition module 2. Access permission module 3. Detection module 4. Analysis module 101. Memory 102. Processor 103. Communication interface. DETAILED DESCRIPTION

[0028] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific implementation method described herein is only an optimal embodiment of the present invention, which is only used to explain the present invention and does not limit the scope of protection of the present invention. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0029] Embodiment 1: This embodiment proposes an on-site operation and maintenance intelligent audit method. Figure 1 , mainly includes the following steps.

[0030] Step S1, obtain access instructions and establish a link with the edge computer device; in this embodiment, the link includes a physical link and a virtual link; the access instruction is generally an action instruction sent by the user, and a corresponding link is established based on the action instruction to perform subsequent steps; the method of this embodiment is generally used for substations, distribution rooms, distribution cabinets, outdoor areas and edge terminals for secure access, which plays a role in efficient on-site operation and maintenance and protects the access security of the edge.

[0031] Step S1, that is, how to establish a link is described in detail, including the following sub-steps, for details, refer to Figure 2 .

[0032] Step S11, obtaining user identity information, and building an access control system based on the user identity information, the user identity information includes basic network, equipment, user and application object.

[0033] Step S12, after obtaining the corresponding physical device link instruction, a link with the edge computer device is established based on the access control system; in this embodiment, the specific type of the edge computer device is not limited here.

[0034] In addition, before step S1, the following steps are also included: constructing a multi-integrated high-elasticity power grid secondary equipment vulnerability feature library, obtaining secondary equipment security protection technology, and constructing a corresponding defense system based on the secondary equipment vulnerability feature library and security protection technology.

[0035] In this embodiment, a defense system is established by integrating a multi-faceted high-elasticity power grid secondary equipment vulnerability feature library and corresponding secondary equipment security protection technology, thereby accessing corresponding security devices and further improving the security performance of hardware and software. During use, users do not need to install any software or applications, and it is plug-and-play with fast response, realizing installation-free operation.

[0036] Step S2, establishing access rights based on the principle of minimizing permissions, the access rights only allowing access to target secondary devices required for work, and no access to other devices.

[0037] In more detail, the principle of minimizing permissions in the present invention is that each program and system user has the minimum set of permissions required to complete the task; it requires that each module of a specific abstract layer in the computing environment can only access the information or resources that are currently required; for the access request to the target secondary device and the corresponding received access information, this embodiment does not make specific limitations for the time being; in step S2, only access to the target secondary device required for the work is allowed, and once entering the boundary, access is unimpeded.

[0038] After step S2, the following steps are also included: according to the access control policy calculated in real time, the identity information, permission information and environment information of the access object are collected and calculated in real time to obtain the trust level of the access object, and the access rights of the access object are opened according to the trust level.

[0039] In this embodiment, there is no limitation on the specific trust level construction method; based on various information of the access object, different permissions can be opened, including but not limited to management, query and call; the higher the permission level, the more and more comprehensive the corresponding functions are opened; in this embodiment, through hierarchical management, the corresponding management effect is further improved and security is enhanced.

[0040] Step S3, detect the access information of the target secondary device in the access permission, and monitor abnormal behavior based on the access information; for this step, in this embodiment, the specific abnormal behavior monitoring method is not limited. Generally, by fully considering the secondary maintenance operation process, a portable operation and maintenance audit device prototype with computing and storage units that integrates secure access, access control, and behavior auditing is developed, which is easy to use and flexible. The device prototype's own protection is studied, a threat model is established, and its security risks are evaluated.

[0041] Step S4, the abnormal data obtained by abnormal behavior monitoring is sent to the service center and uploaded, and learning and analysis based on the abnormal data facilitates the tracing and statistics of abnormal events; in this embodiment, the tracing and statistical methods of specific abnormal events and the corresponding analysis methods are not specifically limited; for the service center, it can be an online cloud server established based on cloud technology services.

[0042] After step S4, step S5 is also included, which specifically includes the following steps: Step S51, obtaining a multi-integrated high-elasticity power grid edge area emergency maintenance safety event based on the abnormal data; and performing a situation analysis on the safety event represented by the sent abnormal data.

[0043] Step S52: Combining user feedback data and the processing capability of edge computer devices, a visual display of situation analysis is performed.

[0044] In this embodiment, situation analysis is performed by uploading data to clearly display the status and security performance of the corresponding edge device; in addition, the method of this embodiment can also be based on having a timely local alarm function to timely discover abnormal operation and maintenance operations and meaningless operation and maintenance computer virus propagation, and realize local alarm.

[0045] In the method of this embodiment, a link is established with an edge computer device, access rights are established according to the principle of minimizing permissions, access information of the target secondary device in the access rights is detected, and abnormal behavior monitoring is performed based on the access information. Learning and analysis are performed based on abnormal data to facilitate tracing and statistics of abnormal events. The method of the present invention does not require the establishment of an independent server, saving operation and maintenance costs.

[0046] This embodiment also proposes an on-site operation and maintenance intelligent audit system, which is applicable to the above-mentioned on-site operation and maintenance intelligent audit method. Figure 3 ,include: Acquisition module 1, used to obtain access instructions and establish a link with the edge computer device Access permission module 2, used to establish access permissions based on the principle of minimum permissions; Detection module 3, used to detect access information of target secondary devices in access rights, and monitor abnormal behavior based on the access information; The analysis module 4 is used to send the abnormal data obtained by abnormal behavior monitoring to the service center and perform learning and analysis based on the abnormal data.

[0047] In the system of the present invention, the links with the edge computer devices are established in the acquisition module, access permission module, detection module and analysis module respectively, access permissions are established according to the principle of minimizing permissions, access information of the target secondary devices in the access permissions is detected, and abnormal behavior monitoring is performed based on the access information, and learning and analysis are performed based on abnormal data to facilitate the tracing and statistics of abnormal events; for the beneficial effects that the system of the present invention can bring, refer to the above description of a field operation and maintenance intelligent audit method.

[0048] refer to Figure 3 The acquisition module is connected to the access permission module, the access permission module is connected to the detection module, and the detection module is connected to the analysis module. The acquisition module, the access permission module, the detection module and the analysis module are connected in sequence to complete their corresponding processing steps.

[0049] refer to Figure 4This embodiment also proposes an electronic device, including: at least one processor 101, a memory 102; the memory stores computer execution instructions; at least one processor executes the computer execution instructions stored in the memory, so that the electronic device executes the above-mentioned on-site operation and maintenance intelligent audit method.

[0050] In this embodiment, more specifically, the electronic device includes a memory, a processor and a communication interface 103, and the memory, processor and communication interface are electrically connected to each other directly or indirectly to realize data transmission or interaction. For example, these components can be electrically connected to each other through one or more communication buses or signal lines. The memory is used to store software programs and modules, such as a program instruction module corresponding to a field operation and maintenance intelligent audit system provided in an embodiment of the present application. The processor executes various functional applications and data processing by executing software programs and modules stored in the memory. The communication interface is used to communicate signaling or data with other node devices.

[0051] Among them, the memory can be, but is not limited to, random access memory (RAM), read only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable read-only memory (EEPROM), etc.

[0052] The processor can be an integrated circuit chip with signal processing capabilities. The processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0053] also, Figure 4 The structure shown is for illustration only. The electronic device may also include Figure 4More or fewer components as shown, or with Figure 4 Different configurations shown; Figure 4 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0054] This embodiment also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the computer program implements the above-mentioned on-site operation and maintenance intelligent audit method. In this embodiment, the storage medium stores a computer program, and the program can be executed to complete the above-mentioned on-site operation and maintenance intelligent audit method.

Claims

1. A method for intelligent auditing of on-site operation and maintenance, characterized in that: The following steps are involved: S1, obtain access instructions and establish a link with the edge computer device; S2, establish access rights based on the principle of minimum permissions, and the access rights are to allow access only to the target secondary devices required for work, and to other devices; S3, detecting access information of the target secondary device in the access permission, and performing abnormal behavior monitoring based on the access information; S4, sending the abnormal data obtained by abnormal behavior monitoring to the service center and uploading it, and conducting learning and analysis based on the abnormal data to facilitate the tracing and statistics of abnormal events.

2. According to claim 1, a method for intelligent auditing of on-site operation and maintenance is characterized in that: The step S1 also includes the following steps: Build a diversified, integrated, and highly elastic power grid secondary equipment vulnerability feature library, obtain secondary equipment security protection technology, and build a corresponding defense system based on the secondary equipment vulnerability feature library and security protection technology.

3. According to the on-site operation and maintenance intelligent audit method of claim 1 or 2, it is characterized in that: The step S1 comprises the following steps: S11, obtaining user identity information and building an access control system based on the user identity information, where the user identity information includes basic network, equipment, user, and application object; S12, after obtaining the corresponding physical device link instruction, a link with the edge computer device is established based on the access control system.

4. According to claim 3, a method for intelligent auditing of on-site operation and maintenance is characterized in that: After establishing access rights based on the principle of minimum permissions, the following steps are also included: According to the access control strategy of real-time calculation, the identity information, permission information and environmental information of the access object are collected and calculated in real time to obtain the trust level of the access object, and the access rights of the access object are opened according to the trust level.

5. According to the on-site operation and maintenance intelligent audit method of claim 1, 2 or 4, it is characterized in that: The step S4 further includes the following steps: S51, obtaining emergency maintenance safety events in the edge area of ​​the multi-integrated high-elasticity power grid according to abnormal data; and performing situation analysis on the safety events represented by the sent abnormal data; S52, combines user feedback data and the processing capabilities of edge computer devices to perform a visual display of situation analysis.

6. According to a method for intelligent on-site operation and maintenance audit according to claim 1, 2 or 4, it is characterized in that: The principle of minimizing permissions is that each program and system user has the minimum set of permissions required to complete the task.

7. An on-site operation and maintenance intelligent audit system, applicable to an on-site operation and maintenance intelligent audit method according to any one of claims 1 to 6, characterized in that: include The acquisition module is used to obtain access instructions and establish a link with the edge computer device Access rights module, used to establish access rights based on the principle of minimum permissions; A detection module is used to detect access information of target secondary devices in the access rights and monitor abnormal behavior based on the access information; The analysis module is used to send the abnormal data obtained by abnormal behavior monitoring to the service center and perform learning and analysis based on the abnormal data.

8. The on-site operation and maintenance intelligent audit system according to claim 7 is characterized in that: The acquisition module is connected to the access permission module, the access permission module is connected to the detection module, and the detection module is connected to the analysis module.

9. An electronic device, characterized in that: include: at least one processor and memory; The memory stores computer-executable instructions; the at least one processor executes the computer-executable instructions stored in the memory, so that the electronic device executes the method according to any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images