Asset vulnerability assessment method and system of power monitoring system, equipment and medium

Abstract

The invention provides an asset vulnerability assessment method and system of an electric power monitoring system, equipment and a medium, and is applied to the technical field of safety assessment of the electric power monitoring system. The method comprises the following steps: constructing a multi-level asset vulnerability evaluation index system for the power monitoring system based on an analytic hierarchy process; determining an initial weight of the corresponding evaluation index based on the relative importance of each evaluation index in each index layer; determining a corresponding marginal contribution value based on the historical score data of each evaluation index of the power monitoring system; based on fusion processing of the initial weight and the marginal contribution value of each evaluation index of the power monitoring system, obtaining the index weight of each evaluation index of the power monitoring system; and performing asset vulnerability assessment on the power monitoring system based on the current expert score of each assessment index of the power monitoring system and the corresponding index weight. According to the invention, the problems that the safety assessment of the power monitoring system cannot comprehensively describe the overall performance of the system and the assessment accuracy and stability are poor are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of security assessment of electric power monitoring systems, and in particular to an asset vulnerability assessment method and system, equipment and medium for an electric power monitoring system. Background Art

[0002] With the rapid development of smart grids, automated monitoring and big data analysis, power monitoring systems have become an important infrastructure to ensure power supply security, improve system reliability and operating efficiency. Therefore, accurate assessment of asset vulnerability of power monitoring systems is of great significance for preventing potential threats to the system and ensuring safe operation of the system.

[0003] At present, the security assessment of power monitoring systems mostly focuses on a single technical performance indicator of the equipment, such as the number of vulnerabilities and intrusion detection rate, ignoring the mutual influence between assets and the system cascade effect, making it difficult for the assessment results to fully characterize the overall performance of the system. In traditional Internet asset vulnerability analysis, most of them are directly evaluated by expert scoring, which is greatly affected by the subjective and experience of experts, resulting in poor accuracy and stability of the results. Summary of the invention

[0004] In order to overcome the problem that the security assessment of the above-mentioned power monitoring system cannot fully characterize the overall performance of the system and the assessment accuracy and stability are poor, the present invention provides an asset vulnerability assessment method and system, equipment, and medium for a power monitoring system.

[0005] In one aspect, the present invention provides an asset vulnerability assessment method for an electric power monitoring system, comprising:

[0006] Based on the analytic hierarchy process, a multi-level asset vulnerability assessment index system for power monitoring systems is constructed;

[0007] For each indicator layer in the asset vulnerability assessment indicator system, based on the relative importance of each assessment indicator in each indicator layer, determine the initial weight of each assessment indicator in each indicator layer;

[0008] Considering the correlation between the evaluation indicators in the asset vulnerability evaluation indicator system, the marginal contribution value of each evaluation indicator is determined based on the historical scoring data of each evaluation indicator of the power monitoring system;

[0009] Based on the fusion processing of the initial weight and marginal contribution value of each evaluation indicator of the power monitoring system, the indicator weight of each evaluation indicator of the power monitoring system is obtained;

[0010] An asset vulnerability assessment is performed on the power monitoring system based on the acquired current expert scores of each assessment indicator of the power monitoring system and the corresponding indicator weights.

[0011] Optionally, the asset vulnerability assessment indicator system includes a target layer, a criterion layer, a sub-criterion layer and a solution layer from top to bottom; the indicator layer includes a criterion layer and a solution layer;

[0012] The target layer is used to determine the evaluation target;

[0013] The criteria layer includes a plurality of asset attribute indicators associated with asset vulnerability;

[0014] The sub-criteria layer is used to determine the level of each asset attribute indicator in the criterion layer;

[0015] The scheme layer includes multiple influencing factor indicators that cause the vulnerability of the power monitoring system;

[0016] Among them, each evaluation index of the power monitoring system includes multiple asset attribute indexes and multiple influencing factor indexes.

[0017] Optionally, the plurality of asset attribute indicators include an asset confidentiality indicator, an asset integrity indicator, an asset availability indicator, an asset business importance indicator, and an asset business carrying capacity indicator;

[0018] Multiple influencing factor indicators include user policy and permission indicators, exploitation cost indicators, software vulnerability indicators, network isolation degree indicators, communication protocol security indicators, data transmission encryption strength indicators and asset exposure degree indicators.

[0019] Optionally, determining the initial weight of each evaluation indicator in each indicator layer based on the relative importance of each evaluation indicator in each indicator layer includes:

[0020] Based on the relative importance of each evaluation indicator in each indicator layer, a comparison matrix corresponding to each evaluation indicator in each indicator layer is constructed;

[0021] For the comparison matrix corresponding to each evaluation indicator in each indicator layer, the quantization vector of the corresponding indicator layer is obtained by solving the eigenvector corresponding to the maximum eigenvalue of the comparison matrix;

[0022] The quantized vectors of each indicator layer are normalized to obtain the initial weights of each evaluation indicator in each indicator layer.

[0023] Optionally, constructing a comparison matrix corresponding to each evaluation indicator in each indicator layer based on the relative importance of each evaluation indicator in each indicator layer includes:

[0024] Based on each evaluation indicator in each indicator layer and the number of evaluation indicators in each indicator layer, a corresponding indicator blank sequence diagram is constructed;

[0025] Based on the relative importance of each evaluation indicator in each indicator layer, determine the comparison value of the corresponding vacancy in the corresponding indicator blank sequence diagram and use the comparison value to fill the corresponding vacancy to obtain the corresponding indicator sequence diagram;

[0026] The indicator sequence diagram is subjected to indicator fusion by row or column, and the importance of each evaluation indicator in the corresponding indicator layer is sorted and quantified based on the indicator fusion result;

[0027] Based on the ratio between the quantitative results of any two evaluation indicators in each indicator layer, a comparison matrix corresponding to each evaluation indicator in each indicator layer is constructed;

[0028] The rows and columns of the blank indicator sequence diagram correspond one-to-one to the evaluation indicators in the corresponding indicator layer.

[0029] Optionally, the step of fusing the indicators in the indicator sequence diagram by row or column, and ranking the importance of each evaluation indicator in the corresponding indicator layer based on the indicator fusion result, includes:

[0030] For each evaluation indicator with the same indicator fusion results, the importance of each evaluation indicator is ranked based on its relative importance.

[0031] Optionally, before the fusion processing based on the initial weights and marginal contribution values ​​of the evaluation indicators of the power monitoring system, the method further includes:

[0032] If the indicator layer is a solution layer, the transfer weight of the criterion layer is obtained based on the fusion processing of the initial weight of each evaluation indicator of the criterion layer and the current grade score of the sub-criterion layer corresponding to each evaluation indicator;

[0033] The initial weights of the evaluation indicators at the solution layer are adjusted based on the transfer weights at the criterion layer.

[0034] Optionally, considering the correlation between the evaluation indicators in the asset vulnerability evaluation indicator system and determining the marginal contribution value of each evaluation indicator based on the historical scoring data of each evaluation indicator of the power monitoring system includes:

[0035] Standardizing the historical scoring data of each evaluation indicator of the power monitoring system to obtain corresponding standardized scoring data;

[0036] Based on the Shapley value of each evaluation indicator in the standardized scoring data, a marginal contribution value of each evaluation indicator is determined.

[0037] Optionally, the calculation formula of the Shapley value of each evaluation indicator in the standardized scoring data is:

[0038]

[0039] In the formula, is the Shapley value of the i-th evaluation index, S is an arbitrary index subset that does not contain index i, |S| is the number of elements in any index subset S, ! represents the factorial, p is the total number of evaluation indicators, v(·) is the characteristic function, z kj is the score of the kth sample in the standardized scoring data on the jth evaluation indicator, and N is the number of samples corresponding to the historical scoring data.

[0040] Optionally, based on the fusion processing of the initial weight and marginal contribution value of each evaluation indicator of the power monitoring system, the indicator weight of each evaluation indicator of the power monitoring system is obtained, including:

[0041] Based on a preset allocation coefficient, the initial weight and marginal contribution value of each evaluation indicator of the power monitoring system are weighted and fused to obtain the indicator weight of each evaluation indicator of the power monitoring system.

[0042] On the other hand, the present invention also provides an asset vulnerability assessment system for a power monitoring system, comprising:

[0043] The indicator system construction module is used to construct a multi-level asset vulnerability assessment indicator system for the power monitoring system based on the hierarchical analysis method;

[0044] A weight determination module is used to determine the initial weight of each evaluation indicator in each indicator layer in the asset vulnerability assessment indicator system based on the relative importance of each evaluation indicator in each indicator layer; considering the correlation between each evaluation indicator in the asset vulnerability assessment indicator system, determine the marginal contribution value of each evaluation indicator based on the historical scoring data of each evaluation indicator of the power monitoring system; based on the fusion processing of the initial weight and marginal contribution value of each evaluation indicator of the power monitoring system, obtain the indicator weight of each evaluation indicator of the power monitoring system;

[0045] An evaluation module is used to perform asset vulnerability evaluation on the power monitoring system based on the acquired current expert scores of each evaluation indicator of the power monitoring system and the corresponding indicator weights.

[0046] Optionally, the asset vulnerability assessment indicator system includes a target layer, a criterion layer, a sub-criterion layer and a solution layer from top to bottom; the indicator layer includes a criterion layer and a solution layer;

[0047] The target layer is used to determine the evaluation target;

[0048] The criteria layer includes a plurality of asset attribute indicators associated with asset vulnerability;

[0049] The sub-criteria layer is used to determine the level of each asset attribute indicator in the criterion layer;

[0050] The scheme layer includes multiple influencing factor indicators that cause vulnerabilities in the power monitoring system;

[0051] Among them, each evaluation index of the power monitoring system includes multiple asset attribute indicators and multiple influencing factor indicators.

[0052] Optionally, the multiple asset attribute indicators include asset confidentiality indicators, asset integrity indicators, asset availability indicators, asset business importance indicators, and asset business bearing indicators;

[0053] The multiple influencing factor indicators include user policy and permission indicators, exploitation cost indicators, software vulnerability indicators, network isolation degree indicators, communication protocol security indicators, data transmission encryption strength indicators, and asset exposure degree indicators.

[0054] Optionally, the weight determination module includes an initial weight determination sub-module, and the initial weight determination sub-module includes:

[0055] A comparison matrix construction sub-unit, configured to construct a comparison matrix corresponding to each evaluation index within each index layer based on the relative importance of each evaluation index within each index layer;

[0056] An index quantization sub-unit, configured to, for the comparison matrix corresponding to each evaluation index within each index layer, obtain a quantization vector of the corresponding index layer by solving the eigenvector corresponding to the maximum eigenvalue of the comparison matrix;

[0057] A normalization sub-unit, configured to perform normalization processing on the quantization vector of each index layer to obtain the initial weight of each evaluation index within each index layer.

[0058] Optionally, the comparison matrix construction sub-unit is specifically configured to:

[0059] Based on each evaluation index within each index layer and the number of evaluation indexes within each index layer, construct a corresponding index blank order diagram;

[0060] Based on the relative importance of each evaluation index within each index layer, determine the comparison value of the corresponding empty position in the corresponding index blank order diagram and fill the corresponding empty position with the comparison value to obtain the corresponding index order diagram;

[0061] Perform index fusion on the index order diagram row by row or column by column, and perform importance ranking and quantization of each evaluation index within the corresponding index layer based on the index fusion result;

[0062] Based on the ratio between the quantization results of any two evaluation indexes within each index layer, construct a comparison matrix corresponding to each evaluation index within each index layer;

[0063] Among them, the rows and columns of the index blank order diagram correspond one by one to the evaluation indexes within the corresponding index layer.

[0064] Optionally, the comparison matrix construction subunit is further used for:

[0065] For each evaluation indicator with the same indicator fusion results, the importance of each evaluation indicator is ranked based on its relative importance.

[0066] Optionally, the initial weight determination submodule further includes a weight adjustment subunit, and the weight adjustment subunit is used to:

[0067] If the indicator layer is a solution layer, the transfer weight of the criterion layer is obtained based on the fusion processing of the initial weight of each evaluation indicator of the criterion layer and the current grade score of the sub-criterion layer corresponding to each evaluation indicator;

[0068] The initial weights of the evaluation indicators at the solution layer are adjusted based on the transfer weights at the criterion layer.

[0069] Optionally, the weight determination module includes a weight optimization submodule, and the weight optimization submodule includes:

[0070] A standardization subunit, used for standardizing the historical scoring data of each evaluation indicator of the power monitoring system to obtain corresponding standardized scoring data;

[0071] The marginal contribution determination subunit is used to determine the marginal contribution value of each evaluation indicator based on the Shapley value of each evaluation indicator in the standardized scoring data.

[0072] Optionally, the calculation formula of the Shapley value of each evaluation indicator in the standardized scoring data is:

[0073]

[0074] In the formula, is the Shapley value of the i-th evaluation index, S is an arbitrary index subset that does not contain index i, |S| is the number of elements in any index subset S, ! represents the factorial, p is the total number of evaluation indicators, v(·) is the characteristic function, z kj is the score of the kth sample in the standardized scoring data on the jth evaluation indicator, and N is the number of samples corresponding to the historical scoring data.

[0075] Optionally, the weight determination module includes:

[0076] The fusion submodule is used to perform weighted fusion on the initial weights and marginal contribution values ​​of the evaluation indicators of the power monitoring system based on a preset allocation coefficient to obtain the indicator weights of the evaluation indicators of the power monitoring system.

[0077] On the other hand, the present invention also provides an electronic device, comprising: at least one processor and a memory; the memory and the processor are connected via a bus;

[0078] The memory is used to store one or more programs;

[0079] When the one or more programs are executed by the at least one processor, any one of the above-mentioned asset vulnerability assessment methods for the power monitoring system is implemented.

[0080] On the other hand, the present invention also provides a readable storage medium having an execution program stored thereon, and when the execution program is executed, the asset vulnerability assessment method of the power monitoring system described in any one of the above items is implemented.

[0081] Compared with the prior art, the present invention has the following beneficial effects:

[0082] The present invention provides an asset vulnerability assessment method and system for an electric power monitoring system. By constructing a multi-level asset vulnerability assessment index system for an electric power monitoring system based on a hierarchical analysis method, the assessment process based on the multi-level index system takes into account the mutual influence between assets and the system cascade effect, so that the assessment result can comprehensively reflect the overall vulnerability of the electric power monitoring system. By comprehensively considering the relative importance of each assessment index in each index layer and the correlation between each assessment index in the asset vulnerability assessment index system, the index weight of each assessment index of the electric power monitoring system is determined, and the asset vulnerability assessment of the electric power monitoring system is performed based on the current expert scores and corresponding index weights of each assessment index of the electric power monitoring system, so as to fully consider the relative importance and correlation of each index at the index weight level, provide a more scientific weight distribution, correct the deviation introduced by human factors, and improve the accuracy and stability of the asset vulnerability assessment of the electric power monitoring system. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] Figure 1 A schematic diagram of a flow chart of an asset vulnerability assessment method for a power monitoring system of the present invention;

[0084] Figure 2 A schematic diagram of a multi-level asset vulnerability assessment index system for an electric power monitoring system constructed as an example of the present invention;

[0085] Figure 3 An indicator sequence diagram constructed for an example of the present invention;

[0086] Figure 4 A schematic diagram of an index ranking constructed for an example of the present invention;

[0087] Figure 5 A schematic diagram of a comparison matrix constructed for an example of the present invention;

[0088] Figure 6 This is a flow chart of an example of the quantification process of each indicator based on the indicator system of the present invention;

[0089] Figure 7 It is a schematic structural diagram of the electronic device of the present invention. DETAILED DESCRIPTION

[0090] The specific implementation modes of the present invention are further described in detail below with reference to the accompanying drawings.

[0091] Example 1

[0092] The present invention provides an asset vulnerability assessment method for a power monitoring system, as shown in the schematic diagram Figure 1 As shown, including:

[0093] Step S110, constructing a multi-level asset vulnerability assessment index system for the power monitoring system based on the analytic hierarchy process;

[0094] Step S120, for each indicator layer in the asset vulnerability assessment indicator system, based on the relative importance of each assessment indicator in each indicator layer, determining the initial weight of each assessment indicator in each indicator layer;

[0095] Step S130, considering the correlation between the evaluation indicators in the asset vulnerability evaluation indicator system, and determining the marginal contribution value of each evaluation indicator based on the historical scoring data of each evaluation indicator of the power monitoring system;

[0096] Step S140, obtaining the indicator weight of each evaluation indicator of the power monitoring system based on the fusion processing of the initial weight and marginal contribution value of each evaluation indicator of the power monitoring system;

[0097] Step S150: performing asset vulnerability assessment on the power monitoring system based on the acquired current expert scores of the assessment indicators of the power monitoring system and the corresponding indicator weights.

[0098] In this example implementation, the asset vulnerability of the power monitoring system refers to a security weakness or potential damage capability that various assets (such as equipment, hardware, software, network components, etc.) in the power monitoring system may expose when facing different risks or threats. The analysis of asset importance, risk factors and their interrelationships provides a basic framework and weight basis for building an index system. By identifying the importance and potential risks of various types of assets in the power monitoring system, the priority of different assets and their associated risks can be clarified, thereby providing a clear hierarchical division for the structural design of the analytic hierarchy process. The analytic hierarchy process (AHP) is used to decompose the elements related to asset vulnerability into levels such as goals, criteria, and schemes to construct a multi-level asset vulnerability assessment index system. Exemplarily, the asset vulnerability assessment index system includes a top-down target layer, a criterion layer, a sub-criterion layer, and a scheme layer; the target layer is used to determine the assessment target, such as determining that the assessment object is the vulnerability of the asset in the target layer, that is, the target layer is the asset vulnerability; the sub-criterion layer is used to determine the level of each asset attribute indicator in the criterion layer, such as the high, medium, and low levels corresponding to each asset attribute in the criterion layer. The indicator layer includes a criterion layer and a solution layer; the criterion layer covers asset attributes directly related to asset vulnerability, and the criterion layer includes multiple asset attribute indicators associated with asset vulnerability, such as business impact of assets, asset confidentiality, integrity, availability, etc. The solution layer includes multiple influencing factor indicators that cause the vulnerability of the power monitoring system. The historical scoring data of each evaluation indicator of the power monitoring system can be the scoring data of multiple experts on each evaluation indicator of the power monitoring system in different historical time periods (such as monthly / weekly in the past year). The result of the weighted summation of the current expert score and the corresponding indicator weight can be used as the asset vulnerability assessment result. The present invention aims to improve the diversity of asset measurement indicators, and can more comprehensively evaluate asset value and risks, especially when facing complex power monitoring system assets, it can effectively improve the accuracy of evaluation and the rationality of decision-making. By decomposing the evaluation problem into multiple levels, the relative importance of each indicator is analyzed layer by layer, thereby providing a more scientific weight distribution and avoiding human bias.

[0099] Exemplarily, the plurality of asset attribute indicators include an asset confidentiality indicator, an asset integrity indicator, an asset availability indicator, an asset business importance indicator, and an asset business carrying capacity indicator;

[0100] Multiple influencing factor indicators include user policy and permission indicators, exploitation cost indicators, software vulnerability indicators, network isolation degree indicators, communication protocol security indicators, data transmission encryption strength indicators and asset exposure degree indicators.

[0101] In this example implementation, the criteria layer includes five evaluation indicators, namely confidentiality indicator, integrity indicator, availability indicator, asset business importance indicator and asset business carrying capacity indicator. The solution layer includes seven evaluation indicators, namely user policy and authority indicator, exploitation cost indicator, software vulnerability indicator, network isolation degree indicator, communication protocol security indicator, data transmission encryption strength indicator and asset exposure degree indicator. Among them, the user policy and authority indicator refers to the indicator corresponding to how to define and manage the access rights and operation scope of system users. User policy indicators usually include assigning different permissions to different roles to ensure that users can only access data and functions related to their responsibilities; the cost of exploitation indicator refers to the resources, skills and time required for attackers or malicious users to exploit a vulnerability or weakness; the software vulnerability indicator refers to the design, implementation or configuration errors in the software, which attackers can use to perform malicious operations; the network isolation degree indicator refers to the degree of physical or logical isolation between different networks or subsystems in the power monitoring system; the communication protocol security indicator refers to whether the communication protocol used in the power monitoring system is secure and whether it is vulnerable to threats such as man-in-the-middle attacks, data tampering, and replay attacks; the data transmission encryption strength indicator refers to the security and strength of the encryption technology used to protect data transmission in the system; the asset exposure degree indicator refers to the degree to which various key assets (such as control equipment, databases, monitoring terminals, etc.) in the power monitoring system are exposed on the network or other public channels. Figure 2 As shown in FIG. 1 , a structure diagram of a multi-level asset vulnerability assessment indicator system for a power monitoring system constructed in this example is shown. The target layer is asset vulnerability, the criterion layer and the scheme layer include 5 and 7 corresponding assessment indicators, and the sub-criterion layer includes three levels of high, medium and low for each assessment indicator in the criterion layer. Each indicator and level in the criterion layer, the sub-criterion layer and the scheme layer may have a corresponding weight.

[0102] In some example implementations, the step S120 of determining the initial weight of each evaluation indicator in each indicator layer based on the relative importance of each evaluation indicator in each indicator layer includes:

[0103] Based on the relative importance of each evaluation indicator in each indicator layer, a comparison matrix corresponding to each evaluation indicator in each indicator layer is constructed;

[0104] For the comparison matrix corresponding to each evaluation indicator in each indicator layer, the quantization vector of the corresponding indicator layer is obtained by solving the eigenvector corresponding to the maximum eigenvalue of the comparison matrix;

[0105] The quantized vectors of each indicator layer are normalized to obtain the initial weights of each evaluation indicator in each indicator layer.

[0106] In this example implementation, the relative importance of each evaluation indicator in each indicator layer can be determined by multiple experts. The comparison matrix of each indicator layer can be constructed by comparing the importance of each two evaluation indicators in each indicator layer. For example, the comparison matrix is ​​constructed by assigning relative importance to each evaluation indicator. When two evaluation indicators are the same, the corresponding position in the comparison matrix is ​​assigned 1, and the more important indicator can be assigned a larger value. The eigenvector corresponding to the maximum eigenvalue of the comparison matrix obtained by solving can be used as the quantization vector of the corresponding indicator layer. Specifically, let the comparison matrix be P. When Pζ=λ is satisfied, max Find the maximum eigenvalue λ of P under the condition of ζ max , then calculate the eigenvector ζ corresponding to each eigenvalue based on the eigenvalue of the comparison matrix, and find the eigenvector corresponding to the maximum eigenvalue. The normalization process can be maximum-minimum value normalization, and the value of the quantization vector is normalized to the interval [0,1] by normalization, and the initial weight of each evaluation index in the corresponding index layer is obtained. Perform this step for each index of the criterion layer and the scheme layer respectively.

[0107] Exemplarily, the construction of a comparison matrix corresponding to each evaluation indicator in each indicator layer based on the relative importance of each evaluation indicator in each indicator layer includes:

[0108] Based on each evaluation indicator in each indicator layer and the number of evaluation indicators in each indicator layer, a corresponding indicator blank sequence diagram is constructed;

[0109] Based on the relative importance of each evaluation indicator in each indicator layer, determine the comparison value of the corresponding vacancy in the corresponding indicator blank sequence diagram and use the comparison value to fill the corresponding vacancy to obtain the corresponding indicator sequence diagram;

[0110] The indicator sequence diagram is subjected to indicator fusion by row or column, and the importance of each evaluation indicator in the corresponding indicator layer is sorted and quantified based on the indicator fusion result;

[0111] Based on the ratio between the quantitative results of any two evaluation indicators in each indicator layer, a comparison matrix corresponding to each evaluation indicator in each indicator layer is constructed;

[0112] In this example implementation, the rows and columns of the blank sequence diagram of indicators correspond to the evaluation indicators in the corresponding indicator layer. According to the number of evaluation indicators in each indicator layer, the number of indicators n involved in the comparison of each indicator layer can be determined (such as n is 7 for the scheme layer), and an n×n empty matrix diagram can be constructed. The empty matrix diagram is a matrix diagram with empty matrix elements. The evaluation indicators corresponding to the current row / column are marked on each row and each column of the empty matrix diagram, for example, the corresponding evaluation indicators are marked in sequence at the leftmost of the row and the top of the column; since the same indicator may not be compared in importance, the position on the main diagonal of the empty matrix diagram can be removed, for example, the squares on the main diagonal can be blackened, indicating that the squares do not need to be filled with values. After the above process, the blank sequence diagram of indicators corresponding to each indicator layer is obtained; specifically, a 5×5 matrix is ​​established for the evaluation indicators corresponding to the criterion layer, that is, the blank sequence diagram of indicators for the criterion layer, and a 7×7 matrix is ​​established for the evaluation indicators corresponding to the scheme layer, that is, the blank sequence diagram of indicators for the scheme layer.

[0113] For each blank indicator sequence diagram obtained, the importance of two evaluation indicators can be compared in rows or columns according to the actual situation of the power monitoring system. Each comparison can be based on experience or expert judgment. The row and column indicators corresponding to the unfilled squares (blanks) in the blank indicator sequence diagram are compared, and the comparison value is set to 1 or 0. The relatively important ones are recorded as 1, and the opposite is recorded as 0. Figure 3 As shown in the figure, the indicators of the solution layer are compared row by row. For example, the utilization cost is compared with the user strategy and permission. If the former is more important than the latter, the comparison value of the empty space in the first row and the second column is 1. Otherwise, the comparison value of the empty space in the second row and the first column is 0. The comparison value is filled in the corresponding empty space in the blank indicator sequence diagram to obtain the corresponding indicator sequence diagram. When all indicators in the blank indicator sequence diagram are compared, the indicator fusion (such as summing) of the values ​​of each row / column of the indicator sequence diagram can also be performed, and the sum of each row / column is placed in the corresponding position of the diagram, such as Figure 3 As shown in the figure, it is an indicator sequence diagram constructed for the 7 indicators of the solution layer. The indicators are compared by row, so it is necessary to sum the indicators by row and put the summed results behind each row to obtain the indicator sequence diagram after the evaluation of this layer is completed. Each evaluation indicator can be sorted based on the indicator fusion result. For example, the fusion result is arranged in descending order. The maximum value is the most important indicator in the diagram, and so on. After all indicators are sorted, each evaluation indicator is quantified from top to bottom. For example, each evaluation indicator is assigned a number between 1 and 9. The size of the number is used to represent the relative importance of the indicators. Suppose the evaluation indicator of the solution layer is A 1 ,A 2 ,…A 7 , then the results of ranking and quantifying the importance of each indicator are as follows Figure 4 As shown, Figure 4It can be considered as an indicator ranking table at the solution level. Based on the ratio between the quantitative results of any two evaluation indicators in each indicator layer, a comparison matrix corresponding to each evaluation indicator in each indicator layer is constructed. For example, based on Figure 3 and Figure 4 The comparison matrix constructed by the results in Figure 5 Specifically, construct the n-order pairwise comparison matrix P of the index hierarchy analysis, element A i′j′ Indicator A i′ and indicator A j′ The quantitative value of the relative importance of Among them, M i′ and M j′ They are respectively index A in the index sorting table i′ and indicator a j′ The corresponding quantitative results.

[0114] In other implementations, the indicator sequence diagram is subjected to indicator fusion by row or column, and the importance of each evaluation indicator in the corresponding indicator layer is sorted based on the indicator fusion result, including:

[0115] For each evaluation indicator with the same indicator fusion results, the importance of each evaluation indicator is ranked based on its relative importance.

[0116] In this example implementation, when forming the index ranking table, if there are multiple evaluation indexes with the same index fusion results, such as Figure 3 If the fusion results of the utilization cost, network isolation and communication protocol security are all 2, it is necessary to judge the relative importance of these indicators again. For example, if two or more fusion structures are equal, the indicators corresponding to these same fusion results are sorted in pairs. The pairwise sorting can be based on the expert scoring / judgment results when the indicator sequence diagram is formed. After the pairwise sorting is completed, the indicator sorting table is formed to complete the comprehensive indicator sorting.

[0117] For example, based on Figure 2 The quantification process of each indicator in the indicator system is as follows Figure 6 As shown, the indicator quantization starts from the top indicator layer and proceeds layer by layer. Enter an indicator layer and construct the corresponding blank indicator sequence diagram. The relative importance of the indicators in the sequence diagram is compared two by two. The blank spaces of the sequence diagram are filled based on the comparison results until the blank spaces of the sequence diagram are filled. The values ​​of each row are added and sorted, and the indicators are assigned according to the importance. An n-order comparison matrix is ​​constructed based on the assignment results. The quantization vector is obtained by solving the eigenvector of the maximum eigenvalue of the comparison matrix. The quantization vector is normalized to obtain the initial weights of each indicator in the current layer. It is determined whether the current layer is the bottom indicator layer. If so, the indicator quantization process is completed, otherwise it enters the next indicator layer to continue the above quantization process.

[0118] In an example implementation, before the fusion processing of the initial weights and marginal contribution values ​​of the evaluation indicators of the power monitoring system in step S140, the method further includes:

[0119] If the indicator layer is a solution layer, the transfer weight of the criterion layer is obtained based on the fusion processing of the initial weight of each evaluation indicator of the criterion layer and the current grade score of the sub-criterion layer corresponding to each evaluation indicator;

[0120] The initial weights of the evaluation indicators at the solution layer are adjusted based on the transfer weights at the criterion layer.

[0121] In this example implementation, the initial weights of the weights that need to be transferred through the criterion layer and the sub-criterion layer at the solution layer are adjusted. Specifically, the initial weights obtained by quantifying each evaluation indicator of the criterion layer can be multiplied by the current grade score of its corresponding sub-criterion layer, that is, the weights after multiplying the five evaluation indicators by the corresponding grade score are added and summed to obtain the transfer weight of the criterion layer to complete the fusion process. The weights of the 7 indicators quantified at the solution layer are then multiplied by the transfer weights of the criterion layer to obtain the adjusted initial weights of the 7 evaluation indicators at the solution layer. The adjusted initial weights can then be used as the initial weights of the solution layer to determine the final corresponding indicator weights.

[0122] In an example implementation, the considering the correlation between the evaluation indicators in the asset vulnerability evaluation indicator system in step S130 and determining the marginal contribution value of each evaluation indicator based on the historical scoring data of each evaluation indicator of the power monitoring system includes:

[0123] Standardizing the historical scoring data of each evaluation indicator of the power monitoring system to obtain corresponding standardized scoring data;

[0124] Based on the Shapley value of each evaluation indicator in the standardized scoring data, a marginal contribution value of each evaluation indicator is determined.

[0125] In this example implementation, in the asset vulnerability assessment of the power monitoring system, there is an obvious correlation between the scores of different indicators. For example, the asset business carrying capacity score is directly related to the system load rate, and the communication protocol security and data transmission encryption strength complement each other. The historical scoring data can be the scores made by experts in the expert database for each evaluation indicator of the system in a historical time period, and the historical scoring data of each evaluation indicator is standardized. For example, the Z-score method is used for standardization to make the indicators at each level comparable. Suppose there are N groups of historical scoring data samples, and the system has p evaluation indicators (i.e., indicators at the criterion layer and the scheme layer). The original historical scoring data matrix is ​​X=[x kj ] N×p, the standardized processing uses the Z-score method as shown below:

[0126]

[0127] Among them, z kj is the score of the kth sample in the standardized scoring data on the jth evaluation indicator, that is, x kj Corresponding to the standardized result, x kj represents the score of the kth sample in the historical scoring data on the jth evaluation indicator, is the mean value of the jth indicator in the historical scoring data, s j is the standard deviation of the jth indicator in the historical scoring data.

[0128] Based on the standardized scoring matrix, the characteristic function v(S) is constructed to measure the contribution of the indicator combination to the asset vulnerability. For any indicator subset S, its characteristic function value is defined as:

[0129]

[0130] Where S is an arbitrary index subset that does not contain index i, |S| is the number of elements in any index subset S, ! represents factorial, v(·) is the characteristic function, z kj is the score of the kth sample in the standardized scoring data on the jth evaluation indicator, N is the number of samples corresponding to the historical scoring data, ∑ j∈S z kj It represents the sum of the standardized scores of all indicators of the kth sample in the subset S.

[0131] Asset vulnerability is often formed by the combined effect of multiple factors. For example, the combination of the cost of exploitation and the number of software vulnerabilities often determines the difficulty of attack. For any indicator i, the Shapley value of each indicator is calculated based on the characteristic function. The corresponding calculation formula is:

[0132]

[0133] In the formula, is the Shapley value of the ith evaluation indicator, and p is the total number of evaluation indicators. After obtaining the Shapley value, the Shapley value of each evaluation indicator can be normalized as the marginal contribution value to facilitate subsequent fusion processing. This example provides a weight optimization method for asset vulnerability indicators of a power monitoring system based on the Shapley value. There are multi-dimensional security features in the assets of the power monitoring system. For example, asset confidentiality will affect the formulation of user access control policies, the number of software vulnerabilities and the frequency of system patch updates are directly related to the cost of exploitation, and the degree of network isolation and the security of the communication protocol jointly determine the overall protection level of data transmission. The weight optimization method based on the Shapley value can effectively capture the correlation characteristics between indicators by calculating the marginal contribution of each indicator, improve the rationality of weight allocation on the basis of maintaining expert judgment, and provide more reliable support for the security protection decision-making of power monitoring system assets.

[0134] In an example implementation, the step S140 of obtaining the indicator weights of the evaluation indicators of the power monitoring system based on the fusion processing of the initial weights and marginal contribution values ​​of the evaluation indicators of the power monitoring system includes:

[0135] Based on a preset allocation coefficient, the initial weight and marginal contribution value of each evaluation indicator of the power monitoring system are weighted and fused to obtain the indicator weight of each evaluation indicator of the power monitoring system.

[0136] In this example implementation, the marginal contribution value obtained by normalizing the Shapley value is weightedly combined with the initial weight of each indicator (the solution layer may be the adjusted initial weight), and the combination method is:

[0137] W′=αW+(1-α)Shapley_val;

[0138] Among them, W' is the optimized weight, that is, the indicator weight of each evaluation indicator, W is the initial weight of each evaluation indicator, Shapley_val is the normalized Shapley value, that is, the marginal contribution value, and α is the allocation coefficient, which can be determined according to the actual situation. This optimization method combines expert experience judgment with the actual correlation between indicators, improving the accuracy of weight allocation.

[0139] After completing the indicator weight calculation, the vulnerability assessment score is obtained based on the weight. After obtaining the corresponding weights of each indicator at the solution level, scores are given (out of 100) according to the actual situation of each element of the system, and the scoring is completed by each expert. Each score is multiplied by the corresponding weight, and the total asset vulnerability score is finally calculated by adding them up. Based on the assessment score, the asset vulnerability level can be obtained. The vulnerability level classification is shown in Table 1:

[0140] Table 1

[0141] Fraction Vulnerability level 80 points or above high 60-80 minutes middle Below 60 points Low

[0142] When it is necessary to conduct asset vulnerability assessment of the power monitoring system, the present invention can obtain the expert scores in the current time period or in real time, that is, the current expert scores of each evaluation indicator of the power monitoring system, and then perform weighted summation with the current expert scores of each evaluation indicator and the indicator weights of each evaluation indicator to obtain the current asset vulnerability assessment score of the system.

[0143] At present, the construction of new power systems is accelerating, and the large-scale access of new power facilities such as distributed energy and energy storage equipment has made the power monitoring system present the technical characteristics of multi-system collaboration and multi-level coupling. As its core support, the deep integration of monitoring and data acquisition systems, energy management systems, and distribution automation systems constitutes a highly correlated information-physical system. In this process of evolution from traditional closed architecture to open interactive mode, the system faces multi-dimensional vulnerability challenges such as boundary expansion, equipment heterogeneity, and architecture reconstruction, especially in asset security assessment, risk prevention and control, and reliability assurance. Therefore, establishing a scientific and systematic asset vulnerability measurement and assessment system is of great significance for identifying system weaknesses, assessing potential threats, and improving system resilience.

[0144] The vulnerability of power monitoring systems is becoming increasingly prominent. The unscientific asset measurement and evaluation system may bring many potential hazards. Incorrect evaluation results may lead to misjudgment of the status of power equipment and systems, affect the resource allocation of the power system and the operational decisions of power companies, and thus affect the security and stability of the entire system. Most of the existing evaluation methods focus on single technical performance indicators of equipment, such as the number of vulnerabilities and intrusion detection rates, but do not consider the overall factors such as the mutual influence between assets and the system cascade effect, making it difficult to fully characterize the overall vulnerability characteristics of the power monitoring system.

[0145] In view of the above problems, the present invention proposes an asset vulnerability assessment method for an electric power monitoring system based on the analytic hierarchy process. Through multi-level and multi-dimensional system analysis, the relative importance of different vulnerability indicators is comprehensively considered, which overcomes the limitations of single indicator assessment and makes the asset vulnerability assessment of the electric power monitoring system more scientific and accurate. Through quantitative and systematic vulnerability assessment indicators, the security situation of various assets in the electric power monitoring system can be more accurately portrayed, providing methodological support for the formulation and implementation of system security protection strategies. The present invention clarifies the goal of asset measurement, determines the scope of assets to be evaluated and the specific needs; selects and designs appropriate measurement indicators, which usually need to be combined with multiple dimensions such as the operating status of the equipment, environmental factors, and availability; conducts data collection, indicator quantification and analysis; determines the weight of each indicator, and conducts a comprehensive evaluation, and finally proposes optimization suggestions or decision-making basis based on the analysis results.

[0146] The present invention aims to improve the diversity of asset measurement indicators, and can more comprehensively evaluate asset value and risks, especially when facing complex power monitoring system assets, it can effectively improve the accuracy of evaluation and the rationality of decision-making. The simple hierarchical analysis method directly scores the indicators of each level to determine the weight, which ignores the correlation between the levels. The hierarchical analysis method based on the Moody chart of the present invention optimizes the quantitative method of indicator weights, and realizes layer-by-layer quantification starting from the top-level indicators. Specifically, for the indicators of each layer, the steps of constructing a blank sequence diagram, comparing the indicators two by two according to the sequence diagram and marking 0 or 1, adding the marked values ​​of each row, sorting the indicators according to the sum of the marked values ​​of each row, constructing a pairwise comparison matrix, solving the characteristic vector of the indicator and normalizing it, etc., are completed, and the indicator weight is finally determined. By decomposing the evaluation problem into multiple levels, the relative importance of each indicator is analyzed layer by layer, thereby providing a more scientific weight distribution and avoiding human bias. Compared with the traditional hierarchical method, the relative importance of each indicator in the improved hierarchical analysis method based on the Moody chart is clearer, less prone to confusion, and no consistency test is required, thereby improving the efficiency of indicator quantification.

[0147] The present invention also provides an indicator weight optimization method using Shapley value. The method is based on cooperative game theory and calculates the marginal contribution of each indicator in the evaluation process by analyzing expert scoring data, thereby optimizing and adjusting the weights obtained by the hierarchical analysis method. By introducing the Shapley value to analyze the mutual influence and combination effect between indicators, the final indicator weight distribution is made more comprehensive and accurate, and the asset vulnerability assessment indicator system of the power monitoring system is further improved.

[0148] Example 2

[0149] Based on the same inventive concept, the present invention also provides an asset vulnerability assessment system for a power monitoring system, the system comprising:

[0150] The indicator system construction module is used to construct a multi-level asset vulnerability assessment indicator system for the power monitoring system based on the hierarchical analysis method;

[0151] A weight determination module is used to determine the initial weight of each evaluation indicator in each indicator layer in the asset vulnerability assessment indicator system based on the relative importance of each evaluation indicator in each indicator layer; considering the correlation between each evaluation indicator in the asset vulnerability assessment indicator system, determine the marginal contribution value of each evaluation indicator based on the historical scoring data of each evaluation indicator of the power monitoring system; based on the fusion processing of the initial weight and marginal contribution value of each evaluation indicator of the power monitoring system, obtain the indicator weight of each evaluation indicator of the power monitoring system;

[0152] An evaluation module is used to perform asset vulnerability evaluation on the power monitoring system based on the acquired current expert scores of each evaluation indicator of the power monitoring system and the corresponding indicator weights.

[0153] In a possible implementation, the asset vulnerability assessment index system includes a target layer, a criterion layer, a sub-criterion layer and a solution layer from top to bottom; the index layer includes a criterion layer and a solution layer;

[0154] The target layer is used to determine the evaluation target;

[0155] The criteria layer includes a plurality of asset attribute indicators associated with asset vulnerability;

[0156] The sub-criteria layer is used to determine the level of each asset attribute indicator in the criterion layer;

[0157] The scheme layer includes multiple influencing factor indicators that cause the vulnerability of the power monitoring system;

[0158] Among them, each evaluation index of the power monitoring system includes multiple asset attribute indexes and multiple influencing factor indexes.

[0159] In a possible implementation, the plurality of asset attribute indicators include an asset confidentiality indicator, an asset integrity indicator, an asset availability indicator, an asset business importance indicator, and an asset business carrying capacity indicator;

[0160] Multiple influencing factor indicators include user policy and permission indicators, exploitation cost indicators, software vulnerability indicators, network isolation degree indicators, communication protocol security indicators, data transmission encryption strength indicators and asset exposure degree indicators.

[0161] In a possible implementation, the weight determination module includes an initial weight determination submodule, and the initial weight determination submodule includes:

[0162] A comparison matrix construction subunit is used to construct a comparison matrix corresponding to each evaluation indicator in each indicator layer based on the relative importance of each evaluation indicator in each indicator layer;

[0163] The indicator quantization subunit is used to obtain the quantization vector of the corresponding indicator layer by solving the eigenvector corresponding to the maximum eigenvalue of the comparison matrix corresponding to each evaluation indicator in each indicator layer;

[0164] The normalization subunit is used to normalize the quantization vector of each indicator layer to obtain the initial weight of each evaluation indicator in each indicator layer.

[0165] In a possible implementation manner, the comparison matrix construction subunit is specifically used for:

[0166] Based on each evaluation indicator in each indicator layer and the number of evaluation indicators in each indicator layer, a corresponding indicator blank sequence diagram is constructed;

[0167] Based on the relative importance of each evaluation indicator in each indicator layer, determine the comparison value of the corresponding vacancy in the corresponding indicator blank sequence diagram and use the comparison value to fill the corresponding vacancy to obtain the corresponding indicator sequence diagram;

[0168] The indicator sequence diagram is subjected to indicator fusion by row or column, and the importance of each evaluation indicator in the corresponding indicator layer is sorted and quantified based on the indicator fusion result;

[0169] Based on the ratio between the quantitative results of any two evaluation indicators in each indicator layer, a comparison matrix corresponding to each evaluation indicator in each indicator layer is constructed;

[0170] The rows and columns of the blank indicator sequence diagram correspond one-to-one to the evaluation indicators in the corresponding indicator layer.

[0171] In a possible implementation manner, the comparison matrix construction subunit is further specifically used for:

[0172] For each evaluation indicator with the same indicator fusion results, the importance of each evaluation indicator is ranked based on its relative importance.

[0173] In a possible implementation manner, the initial weight determination submodule further includes a weight adjustment subunit, and the weight adjustment subunit is used to:

[0174] If the indicator layer is a solution layer, the transfer weight of the criterion layer is obtained based on the fusion processing of the initial weight of each evaluation indicator of the criterion layer and the current grade score of the sub-criterion layer corresponding to each evaluation indicator;

[0175] The initial weights of the evaluation indicators at the solution layer are adjusted based on the transfer weights at the criterion layer.

[0176] In a possible implementation, the weight determination module includes a weight optimization submodule, and the weight optimization submodule includes:

[0177] A standardization subunit, used for standardizing the historical scoring data of each evaluation indicator of the power monitoring system to obtain corresponding standardized scoring data;

[0178] The marginal contribution determination subunit is used to determine the marginal contribution value of each evaluation indicator based on the Shapley value of each evaluation indicator in the standardized scoring data.

[0179] In a possible implementation manner, the calculation formula of the Shapley value of each evaluation indicator in the standardized scoring data is:

[0180]

[0181] In the formula, is the Shapley value of the i-th evaluation index, S is an arbitrary index subset that does not contain index i, |S| is the number of elements in any index subset S, ! represents the factorial, p is the total number of evaluation indicators, v(·) is the characteristic function, z kj is the score of the kth sample in the standardized scoring data on the jth evaluation indicator, and N is the number of samples corresponding to the historical scoring data.

[0182] In a possible implementation, the weight determination module includes:

[0183] The fusion submodule is used to perform weighted fusion on the initial weights and marginal contribution values ​​of the evaluation indicators of the power monitoring system based on a preset allocation coefficient to obtain the indicator weights of the evaluation indicators of the power monitoring system.

[0184] Example 3

[0185] like Figure 7 As shown, the present invention also provides an electronic device, which may be a computer device, a single-chip device, an intelligent mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, the processor, and the transceiver component are connected via a bus; the memory may be used to store an execution program, and an exemplary execution program may include instructions; the processor is used to execute the instructions stored in the memory. The memory may also be used to store data, which may be called and / or modified when the instructions are executed.

[0186] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in a storage medium to implement the corresponding method flow or corresponding functions, so as to implement the steps of an asset vulnerability assessment method for an electric power monitoring system in the above-mentioned embodiment.

[0187] Example 4

[0188] Based on the same inventive concept, the present invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory), which is a memory device in an electronic device for storing programs and data. It can be understood that the storage medium here can include both built-in storage media in the electronic device and, of course, extended storage media supported by the electronic device. The storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by the processor are also stored in the storage space, and these instructions can be one or more execution programs (including program codes). It should be noted that the storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor loads and executes one or more instructions stored in the storage medium, which can implement the steps of an asset vulnerability assessment method for a power monitoring system in the above embodiment.

[0189] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0190] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0191] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0192] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0193] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit its protection scope. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that after reading the present invention, those skilled in the art can still make various changes, modifications or equivalent substitutions to the specific implementation methods of the application, but these changes, modifications or equivalent substitutions are all within the protection scope of the claims to be approved.

Claims

1. A method for assessing asset vulnerability of a power monitoring system, characterized in that: include: Based on the analytic hierarchy process, a multi-level asset vulnerability assessment index system for power monitoring systems is constructed; For each indicator layer in the asset vulnerability assessment indicator system, based on the relative importance of each assessment indicator in each indicator layer, determine the initial weight of each assessment indicator in each indicator layer; Considering the correlation between the evaluation indicators in the asset vulnerability evaluation indicator system, the marginal contribution value of each evaluation indicator is determined based on the historical scoring data of each evaluation indicator of the power monitoring system; Based on the fusion processing of the initial weight and marginal contribution value of each evaluation indicator of the power monitoring system, the indicator weight of each evaluation indicator of the power monitoring system is obtained; An asset vulnerability assessment is performed on the power monitoring system based on the acquired current expert scores of each assessment indicator of the power monitoring system and the corresponding indicator weights.

2. The method according to claim 1, characterized in that The asset vulnerability assessment index system includes a target layer, a criterion layer, a sub-criterion layer and a scheme layer from top to bottom; the index layer includes a criterion layer and a scheme layer; The target layer is used to determine the evaluation target; The criteria layer includes a plurality of asset attribute indicators associated with asset vulnerability; The sub-criteria layer is used to determine the level of each asset attribute indicator in the criterion layer; The scheme layer includes multiple influencing factor indicators that cause the vulnerability of the power monitoring system; Among them, each evaluation index of the power monitoring system includes multiple asset attribute indexes and multiple influencing factor indexes.

3. The method according to claim 2, characterized in that Multiple asset attribute indicators include asset confidentiality indicator, asset integrity indicator, asset availability indicator, asset business importance indicator and asset business carrying capacity indicator; Multiple influencing factor indicators include user policy and permission indicators, exploitation cost indicators, software vulnerability indicators, network isolation degree indicators, communication protocol security indicators, data transmission encryption strength indicators and asset exposure degree indicators.

4. The method according to claim 3, characterized in that Determining the initial weight of each evaluation indicator in each indicator layer based on the relative importance of each evaluation indicator in each indicator layer includes: Based on the relative importance of each evaluation indicator in each indicator layer, a comparison matrix corresponding to each evaluation indicator in each indicator layer is constructed; For the comparison matrix corresponding to each evaluation indicator in each indicator layer, the quantization vector of the corresponding indicator layer is obtained by solving the eigenvector corresponding to the maximum eigenvalue of the comparison matrix; The quantized vectors of each indicator layer are normalized to obtain the initial weights of each evaluation indicator in each indicator layer.

5. The method according to claim 4, characterized in that Based on the relative importance of each evaluation indicator in each indicator layer, a comparison matrix corresponding to each evaluation indicator in each indicator layer is constructed, including: Based on each evaluation indicator in each indicator layer and the number of evaluation indicators in each indicator layer, a corresponding indicator blank sequence diagram is constructed; Based on the relative importance of each evaluation indicator in each indicator layer, determine the comparison value of the corresponding vacancy in the corresponding indicator blank sequence diagram and use the comparison value to fill the corresponding vacancy to obtain the corresponding indicator sequence diagram; The indicator sequence diagram is subjected to indicator fusion by row or column, and the importance of each evaluation indicator in the corresponding indicator layer is sorted and quantified based on the indicator fusion result; Based on the ratio between the quantitative results of any two evaluation indicators in each indicator layer, a comparison matrix corresponding to each evaluation indicator in each indicator layer is constructed; The rows and columns of the blank indicator sequence diagram correspond one-to-one to the evaluation indicators in the corresponding indicator layer.

6. The method according to claim 5, characterized in that The step of fusing the indicators in the indicator sequence diagram by row or column, and ranking the importance of each evaluation indicator in the corresponding indicator layer based on the indicator fusion result, includes: For each evaluation indicator with the same indicator fusion results, the importance of each evaluation indicator is ranked based on its relative importance.

7. The method according to claim 4, characterized in that Before the fusion processing of the initial weights and marginal contribution values ​​of the evaluation indicators of the power monitoring system, the method further includes: If the indicator layer is a solution layer, the transfer weight of the criterion layer is obtained based on the fusion processing of the initial weight of each evaluation indicator of the criterion layer and the current grade score of the sub-criterion layer corresponding to each evaluation indicator; The initial weights of the evaluation indicators at the solution layer are adjusted based on the transfer weights at the criterion layer.

8. The method according to claim 3, characterized in that The considering the correlation between the evaluation indicators in the asset vulnerability evaluation indicator system and determining the marginal contribution value of each evaluation indicator based on the historical scoring data of each evaluation indicator of the power monitoring system includes: Standardizing the historical scoring data of each evaluation indicator of the power monitoring system to obtain corresponding standardized scoring data; Based on the Shapley value of each evaluation indicator in the standardized scoring data, a marginal contribution value of each evaluation indicator is determined.

9. The method according to claim 8, characterized in that The calculation formula of the Shapley value of each evaluation indicator in the standardized scoring data is: In the formula, is the Shapley value of the i-th evaluation index, S is an arbitrary index subset that does not contain index i, |S| is the number of elements in any index subset S, ! represents the factorial, p is the total number of evaluation indicators, v(·) is the characteristic function, z kj is the score of the kth sample in the standardized scoring data on the jth evaluation indicator, and N is the number of samples corresponding to the historical scoring data.

10. The method according to any one of claims 1 to 9, characterized in that: Based on the fusion processing of the initial weight and marginal contribution value of each evaluation indicator of the power monitoring system, the indicator weight of each evaluation indicator of the power monitoring system is obtained, including: Based on a preset allocation coefficient, the initial weight and marginal contribution value of each evaluation indicator of the power monitoring system are weighted and fused to obtain the indicator weight of each evaluation indicator of the power monitoring system.

11. An asset vulnerability assessment system for an electric power monitoring system, characterized in that: include: The indicator system construction module is used to construct a multi-level asset vulnerability assessment indicator system for the power monitoring system based on the hierarchical analysis method; A weight determination module, for determining, for each indicator layer in the asset vulnerability assessment indicator system, an initial weight of each assessment indicator in each indicator layer based on the relative importance of each assessment indicator in each indicator layer; Considering the correlation between the evaluation indicators in the asset vulnerability evaluation indicator system, the marginal contribution value of each evaluation indicator is determined based on the historical scoring data of each evaluation indicator of the power monitoring system; Based on the fusion processing of the initial weight and marginal contribution value of each evaluation indicator of the power monitoring system, the indicator weight of each evaluation indicator of the power monitoring system is obtained; An evaluation module is used to perform asset vulnerability evaluation on the power monitoring system based on the acquired current expert scores of each evaluation indicator of the power monitoring system and the corresponding indicator weights.

12. The system according to claim 11, characterized in that The asset vulnerability assessment index system includes a target layer, a criterion layer, a sub-criterion layer and a scheme layer from top to bottom; the index layer includes a criterion layer and a scheme layer; The target layer is used to determine the evaluation target; The criteria layer includes a plurality of asset attribute indicators associated with asset vulnerability; The sub-criteria layer is used to determine the level of each asset attribute indicator in the criterion layer; The scheme layer includes multiple influencing factor indicators that cause the vulnerability of the power monitoring system; Among them, each evaluation index of the power monitoring system includes multiple asset attribute indexes and multiple influencing factor indexes.

13. The system according to claim 12, characterized in that Multiple asset attribute indicators include asset confidentiality indicator, asset integrity indicator, asset availability indicator, asset business importance indicator and asset business carrying capacity indicator; Multiple influencing factor indicators include user policy and permission indicators, exploitation cost indicators, software vulnerability indicators, network isolation degree indicators, communication protocol security indicators, data transmission encryption strength indicators and asset exposure degree indicators.

14. The system according to claim 13, characterized in that The weight determination module includes an initial weight determination submodule, and the initial weight determination submodule includes: A comparison matrix construction subunit is used to construct a comparison matrix corresponding to each evaluation indicator in each indicator layer based on the relative importance of each evaluation indicator in each indicator layer; The indicator quantization subunit is used to obtain the quantization vector of the corresponding indicator layer by solving the eigenvector corresponding to the maximum eigenvalue of the comparison matrix corresponding to each evaluation indicator in each indicator layer; The normalization subunit is used to normalize the quantization vector of each indicator layer to obtain the initial weight of each evaluation indicator in each indicator layer.

15. The system according to claim 14, characterized in that The comparison matrix construction subunit is specifically used for: Based on each evaluation indicator in each indicator layer and the number of evaluation indicators in each indicator layer, a corresponding indicator blank sequence diagram is constructed; Based on the relative importance of each evaluation indicator in each indicator layer, determine the comparison value of the corresponding vacancy in the corresponding indicator blank sequence diagram and use the comparison value to fill the corresponding vacancy to obtain the corresponding indicator sequence diagram; The indicator sequence diagram is subjected to indicator fusion by row or column, and the importance of each evaluation indicator in the corresponding indicator layer is sorted and quantified based on the indicator fusion result; Based on the ratio between the quantitative results of any two evaluation indicators in each indicator layer, a comparison matrix corresponding to each evaluation indicator in each indicator layer is constructed; The rows and columns of the blank indicator sequence diagram correspond one-to-one to the evaluation indicators in the corresponding indicator layer.

16. The system according to claim 15, characterized in that The comparison matrix construction subunit is also specifically used for: For each evaluation indicator with the same indicator fusion results, the importance of each evaluation indicator is ranked based on its relative importance.

17. The system according to claim 14, characterized in that The initial weight determination submodule further includes a weight adjustment subunit, which is used to: If the indicator layer is a solution layer, the transfer weight of the criterion layer is obtained based on the fusion processing of the initial weight of each evaluation indicator of the criterion layer and the current grade score of the sub-criterion layer corresponding to each evaluation indicator; The initial weights of the evaluation indicators at the solution layer are adjusted based on the transfer weights at the criterion layer.

18. The system according to claim 13, characterized in that The weight determination module includes a weight optimization submodule, and the weight optimization submodule includes: A standardization subunit, used for standardizing the historical scoring data of each evaluation indicator of the power monitoring system to obtain corresponding standardized scoring data; The marginal contribution determination subunit is used to determine the marginal contribution value of each evaluation indicator based on the Shapley value of each evaluation indicator in the standardized scoring data.

19. The system according to claim 18, characterized in that The calculation formula of the Shapley value of each evaluation indicator in the standardized scoring data is: In the formula, is the Shapley value of the i-th evaluation index, S is an arbitrary index subset that does not contain index i, |S| is the number of elements in any index subset S, ! represents the factorial, p is the total number of evaluation indicators, v(·) is the characteristic function, z kj is the score of the kth sample in the standardized scoring data on the jth evaluation indicator, and N is the number of samples corresponding to the historical scoring data.

20. The system according to any one of claims 11 to 19, characterized in that: The weight determination module comprises: The fusion submodule is used to perform weighted fusion on the initial weights and marginal contribution values ​​of the evaluation indicators of the power monitoring system based on a preset allocation coefficient to obtain the indicator weights of the evaluation indicators of the power monitoring system.

21. An electronic device, characterized in that: include: at least one processor and memory; The memory and the processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the asset vulnerability assessment method for the power monitoring system according to any one of claims 1 to 10 is implemented.

22. A readable storage medium, characterized in that: An execution program is stored thereon, and when the execution program is executed, the asset vulnerability assessment method of the power monitoring system as described in any one of claims 1 to 10 is implemented.

Images