Power network situation awareness system and method

Abstract

The invention provides a power network situation awareness system and method.The power network situation awareness system is connected with a front data end used for obtaining power network security data and further comprises a server, a client and a data reading unit arranged in the front data end; the data reading unit is used for reading the power network security data from the front data end; the server is connected with the data reading unit and is used for receiving the power network security data from the front data end and processing the power network security data to obtain processing result information; and the client is connected with the server and is used for receiving and displaying the processing result information sent by the server. According to the invention, the data reading unit in the front data end obtains the power network security data, the server processes the power network security data, and receives and displays the processing result information sent by the server, so that the real-time sensing of the power network security situation is realized.

Description

Technical Field

[0001] The present invention relates to the field of nuclear power technology, and in particular to a power grid situation awareness system and method. Background Art

[0002] With the development of the Internet, the destructiveness of cyberattacks has extended from the traditional virtual space to physical infrastructure, causing huge losses to the target system. If the power grid is highly interconnected, it is difficult to resist organized and premeditated cyberattacks simply by deploying security devices and security software. Therefore, there is an urgent need to build a comprehensive and efficient power grid security situation awareness system to real-time sense the power grid security situation. Summary of the Invention

[0003] This application provides a power grid situation awareness system and method to solve the problem that it is difficult to resist organized and premeditated cyberattacks simply by deploying security devices and security software.

[0004] This application provides a power grid situation awareness system, which is connected to a front-end data terminal for obtaining power grid security data, and further includes a server, a client, and a data reading unit provided in the front-end data terminal;

[0005] The data reading unit is used to read power grid security data from the front-end data terminal;

[0006] The server is connected to the data reading unit, and is used to receive the power grid security data from the front-end data terminal, and process the power grid security data to obtain processed result information;

[0007] The client is connected to the server, and is used to receive and display the processed result information sent by the server.

[0008] In one embodiment, the server is further used to perform a security status analysis and / or a security trend analysis on the power grid security data to obtain analysis result information;

[0009] The client is further used to receive and display the analysis result information sent by the server.

[0010] In one embodiment, the server includes a network security monitoring unit and a data storage unit;

[0011] The data storage unit is connected to the data reading unit, and is used to receive and store the power grid security data sent by the data reading unit;

[0012] The network security monitoring unit is connected to the data storage unit, and is used to perform the security status analysis on the power grid security data to obtain the analysis result information.

[0013] In one embodiment, the data storage unit includes an alarm event storage unit and a historical data storage unit;

[0014] The historical data storage unit is connected to the data reading unit and is configured to receive and store the power network security data sent by the data reading unit;

[0015] The network security monitoring unit is respectively connected to the historical data storage unit and the alarm event storage unit, and is configured to receive the power network security data from the historical data storage unit, and determine whether the power network security data meets the preset alarm status condition. If so, generate the analysis result information and send it to the alarm event storage unit.

[0016] In one embodiment, the server further includes an alarm information processing unit;

[0017] The alarm information processing unit is respectively connected to the alarm event storage unit and the client, and is configured to respond to the request of the client, obtain the analysis result information from the alarm event storage unit and send it to the client.

[0018] In one embodiment, the server further includes a web page unit;

[0019] The web page unit is respectively connected to the client and the alarm information processing unit, and is configured to respond to the request of the client, obtain the analysis result information from the alarm information processing unit and send it to the client in the form of a web page.

[0020] In one embodiment, the server further includes a graphics service unit;

[0021] The graphics service unit is respectively connected to the historical data storage unit and the web page unit, and is configured to obtain the power network security data in real time and generate visual graphic data; the client receives and displays the visual graphic data.

[0022] This application also provides a power network situation awareness method for the power network situation awareness system described in any one of the above, and the method includes:

[0023] Step S1: The data reading unit is configured to read the power network security data from the front-end data terminal;

[0024] Step S2: The server receives the power network security data from the front-end data terminal, and processes the power network security data to obtain processing result information;

[0025] Step S3: The client receives and displays the processing result information sent by the server.

[0026] In one embodiment, the power network security data includes one or more of user authentication records, operating system logs, boundary protection status, firewall logs, illegal media access, and intrusion attempt records.

[0027] In one embodiment, the method further includes:

[0028] The server performs security status analysis and / or security trend analysis on the power network security data to obtain analysis result information;

[0029] The client receives and displays the analysis result information sent by the server.

[0030] Implementing the present invention has the following beneficial effects: The present application provides a power network situation awareness system and method. The power network situation awareness system is connected to a front-end data terminal for obtaining power network security data, and further includes a server, a client, and a data reading unit provided in the front-end data terminal; the data reading unit is used to read the power network security data from the front-end data terminal; the server is connected to the data reading unit and is used to receive the power network security data from the front-end data terminal and process the power network security data to obtain processing result information; the client is connected to the server and is used to receive and display the processing result information sent by the server. The present invention realizes real-time awareness of the power network security situation by obtaining the power network security data through the data reading unit in the front-end data terminal, processing the power network security data by the server, and receiving and displaying the processing result information sent by the server. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The present invention will be further described below in conjunction with the drawings and embodiments. In the drawings:

[0032] Figure 1 is a logic block diagram of the power network situation awareness system of the present invention;

[0033] Figure 2 is a structural block diagram of another embodiment of the power network situation awareness system of the present invention;

[0034] Figure 3 is a schematic flowchart of the power network situation awareness method of the present invention.

[0035] The reference numerals are as follows:

[0036] 10 - Front - end data terminal; 11 - Data reading unit; 20 - Server; 21 - Network security monitoring unit; 22 - Data storage unit; 23 - Alarm event storage unit; 24, Historical data storage unit; 25 - Alarm information processing unit; 26 - Web page unit; 27 - Graphics service unit; 30 - Client. Detailed implementation manners

[0037] The present application will be further described in detail below in conjunction with the accompanying drawings through specific implementation manners. Similar elements in different implementation manners use related similar element numbers. In the following implementation manners, many detailed descriptions are provided to enable a better understanding of the present application. However, those skilled in the art can easily recognize that some of the features can be omitted in different situations, or can be replaced by other elements, materials, or methods. In some cases, some operations related to the present application are not shown or described in the specification, which is to avoid the core part of the present application being overwhelmed by excessive descriptions. For those skilled in the art, it is not necessary to describe these related operations in detail, and they can fully understand the related operations based on the descriptions in the specification and general technical knowledge in the art.

[0038] As Figure 1 and Figure 2 shown, Figure 1 is the logic block diagram of the power network situation awareness system of the present application.

[0039] The technical solution adopted by the present application to solve its technical problems is: to provide a power network situation awareness system, which is connected to the front - end data terminal 10 for obtaining power network security data, and further includes a server 20, a client 30, and a data reading unit 11 disposed in the front - end data terminal 10;

[0040] The data reading unit 11 is used to read power network security data from the front - end data terminal 10;

[0041] The server 20 is connected to the data reading unit 11, and is used to receive power network security data from the front - end data terminal 10 and process the power network security data to obtain processed result information;

[0042] The client 30 is connected to the server 20, and is used to receive and display the processed result information sent by the server 20.

[0043] Specifically, this application provides a power network situation awareness system, which includes a front-end data terminal 10, a data reading unit 11, a server 20, and a client 30. The front-end data terminal 10 is used to obtain power network security data, which includes but is not limited to security logs, network traffic, terminal logs, business data, user behavior, and asset status, etc. The data reading unit 11 is arranged in the front-end data terminal 10 and is responsible for reading the power network security data from the front-end data terminal 10 to ensure the real-time and integrity of the data. The server 20 is connected to the data reading unit 11 and is used to receive the power network security data from the front-end data terminal 10 and process these data. The processing process includes but is not limited to data cleaning, feature extraction, and anomaly detection, etc., and finally obtains the processed result information. The client 30 is connected to the server 20 and is used to receive the processed result information sent by the server 20 and display it to the user in a visual way, facilitating the user to monitor the power network security situation in real time.

[0044] In an embodiment, the server 20 is further used to perform security status analysis and / or security trend analysis on the power network security data to obtain analysis result information;

[0045] The client 30 is further used to receive and display the analysis result information sent by the server 20.

[0046] Specifically, the server 20 performs security status analysis and security trend analysis on the power network security data, evaluates the network security status of the current power system, identifies potential security threats, and predicts possible future network security risks, and provides early warning information; the client 30 receives and displays the analysis result information sent by the server 20 to help the user understand the network security status and trend of the power system and take corresponding protection measures in a timely manner; through the real-time data collection of the front-end data terminal 10 and the data reading unit 11, the system can obtain the power network security data in real time to ensure the real-time monitoring of the power network security situation; the server 20 efficiently processes the power network security data, can quickly identify and analyze potential security threats, and improve the response speed of power network security protection; the client 30 displays the processed result information and the analysis result information in a visual way, enabling the user to intuitively understand the power network security situation and facilitating the timely adoption of corresponding protection measures; through the collection and analysis of multi-source data, the system can comprehensively perceive the power network security situation, effectively respond to organized and premeditated network attacks, and enhance the overall network security protection ability of the power system; through security trend analysis, the system can predict possible future network security risks, provide early warning information, help the user make protection preparations in advance, and reduce potential losses.

[0047] As Figure 2 shown, in an embodiment, the server 20 includes a network security monitoring unit 21 and a data storage unit 22;

[0048] The data storage unit 22 is connected to the data reading unit 11 and is used to receive and store the power network security data sent by the data reading unit 11;

[0049] The network security monitoring unit 21 is connected to the data storage unit 22 and is used to perform a security status analysis on the power network security data to obtain analysis result information.

[0050] Specifically, the network security monitoring unit 21 obtains the power network security data from the data storage unit 22, performs a security status analysis, evaluates the network security status of the current power system, and identifies potential security threats, thereby obtaining analysis result information. Finally, the client 30 receives the analysis result information sent by the server 20 and displays it to the user in a visual manner, helping the user intuitively understand the network security status of the power system, and taking corresponding protection measures in a timely manner to ensure the safe and stable operation of the power system.

[0051] In one embodiment, the data storage unit 22 includes an alarm event storage unit 23 and a historical data storage unit 24;

[0052] The historical data storage unit 24 is connected to the data reading unit 11 and is used to receive and store the power network security data sent by the data reading unit 11;

[0053] The network security monitoring unit 21 is respectively connected to the historical data storage unit 24 and the alarm event storage unit 23, and is used to receive the power network security data from the historical data storage unit 24, and determine whether the power network security data meets the preset alarm status condition. If it meets, it generates analysis result information and sends it to the alarm event storage unit 23.

[0054] Specifically, the data reading unit 11 transmits the obtained power network security data to the data storage unit 22 of the server 20 to achieve efficient data transfer. After receiving the data, the historical data storage unit 24 stores it for subsequent analysis and query. The network security monitoring unit 21 obtains the power network security data from the historical data storage unit 24, performs an in-depth security status analysis, evaluates the network security status of the current power system, and identifies potential security threats. If the power network security data meets the preset alarm status condition, the network security monitoring unit 21 will generate analysis result information and send it to the alarm event storage unit 23 for further processing and recording. Finally, the client 30 receives the analysis result information sent by the server 20 and displays it to the user in a visual manner, helping the user intuitively understand the network security status of the power system, and taking corresponding protection measures in a timely manner to ensure the safe and stable operation of the power system.

[0055] In one embodiment, the server 20 further includes an alarm information processing unit 25;

[0056] The alarm information processing unit 25 is respectively connected to the alarm event storage unit 23 and the client 30, and is configured to respond to the request of the client 30, obtain the analysis result information from the alarm event storage unit 23 and send it to the client 30.

[0057] Specifically, the alarm information processing unit 25 can promptly respond to the request of the client 30, obtain the analysis result information from the alarm event storage unit 23 and send it to the client 30, ensuring that users can promptly obtain alarm information and improving the response speed and user experience of the system.

[0058] In one embodiment, the server 20 further includes a web page unit 26;

[0059] The web page unit 26 is respectively connected to the client 30 and the alarm information processing unit 25, and is configured to respond to the request of the client 30, obtain the analysis result information from the alarm information processing unit 25 and send it to the client 30 in the form of a web page.

[0060] Specifically, the web page unit 26 responds to the request of the client 30, obtains the analysis result information from the alarm information processing unit 25, and sends it to the client 30 in the form of a web page, facilitating users to view the analysis results through a browser. The client 30 receives the analysis result information sent by the server 20 and displays it to the user in a visual manner, helping the user understand the network security status of the power system and promptly take corresponding protection measures.

[0061] In one embodiment, the server 20 further includes a graphics service unit 27.

[0062] The graphics service unit 27 is respectively connected to the historical data storage unit 24 and the web page unit 26, and is configured to obtain power network security data in real time and generate visual graphic data; the client 30 receives and displays the visual graphic data.

[0063] Specifically, the graphics service unit 27 obtains power network security data in real time and generates visual graphic data. The web page unit 26 responds to the request of the client 30, obtains the analysis result information from the alarm information processing unit 25, and sends it to the client 30 in the form of a web page, facilitating users to view the analysis results through a browser. The client 30 receives the analysis result information and the visual graphic data sent by the server 20 and displays them to the user in a visual manner, helping the user understand the network security status of the power system and promptly take corresponding protection measures.

[0064] As Figure 3 shown, the present application further provides a power network situation awareness method for any of the above power network situation awareness systems, and the method includes:

[0065] Step S1: The data reading unit 11 is used to read the power network security data from the front-end data terminal 10.

[0066] In this step, it should be noted that the data reading unit 11 reads the power network security data from the front-end data terminal 10 to ensure the real-time and integrity of the data. These data include but are not limited to security logs, network traffic, terminal logs, business data, user behavior, asset status, etc.

[0067] Step S2: The server 20 receives the power network security data from the front-end data terminal 10 and processes the power network security data to obtain the processed result information.

[0068] In this step, it should be noted that the server 20 receives the power network security data from the front-end data terminal 10 and processes these data to obtain the processed result information. The processing process includes but is not limited to data cleaning, feature extraction, anomaly detection, etc. Through these processing steps, the server 20 can quickly identify and analyze potential security threats and improve the response speed of power network security protection.

[0069] Step S3: The client 30 receives and displays the processed result information sent by the server 20.

[0070] In this step, it should be noted that the client 30 receives the processed result information sent by the server 20 and displays it to the user in a visual way. The client 30 converts the complex processed result information into intuitive charts, graphs, etc. through a graphical interface to help the user understand the network security status of the power system and facilitate timely adoption of corresponding protection measures.

[0071] Furthermore, the power network security data includes one or more of user authentication records, operating system logs, boundary protection status, firewall logs, illegal media access, and intrusion attempt records.

[0072] Furthermore, the method further includes:

[0073] The server 20 performs a security status analysis and / or a security trend analysis on the power network security data to obtain the analysis result information.

[0074] The client 30 receives and displays the analysis result information sent by the server 20.

[0075] Specifically, the server 20 performs a security status analysis and / or a security trend analysis on the power network security data to obtain the analysis result information. The security status analysis is used to evaluate the network security status of the current power system and identify potential security threats; the security trend analysis is used to predict possible future network security risks and provide early warning information.

[0076] In the power grid situation awareness system, the data reading unit 11 is responsible for reading the power grid data received by the situation awareness device. These data cover multiple aspects, specifically including user authentication records (recording users' login attempts, successful and failed authentications, etc.), operating system logs (recording system events, user activities, application errors, etc.), boundary protection status (monitoring the status and configuration of boundary protection devices), firewall logs (recording the access control policies of the firewall, rule matching situations, blocked IPs, etc.), illegal media access (including the access of illegal external hard drives, USB flash drives, etc.), and intrusion attempt records (recording all suspicious network behaviors). The data storage unit 22 receives and stores the power grid data sent by the data reading unit 11. At the same time, it also receives and stores the alarm event information sent by the network security monitoring unit 21. The network security monitoring unit 21 obtains the power grid data from the data storage unit 22, calculates and judges the network security status and trends. If the alarm conditions are met, such as user login failures, illegal media access, illegal network access, etc., it sends the alarm events to the alarm event storage unit 23. The alarm information processing unit 25 responds to the request of the web page unit 26, obtains the data from the data storage unit 22 and sends it to the web page unit 26. The graphic service unit 27 includes the power grid security situation awareness system diagram. It receives the data of the situation awareness device in real time, generates graphic information, and sends this graphic information to the web page unit 26 for updating. The web page unit 26 embeds the power grid security situation awareness system diagram on the web page, and displays the power grid security status and network security monitoring data in real time. The specific network security status includes suspicious user logins, illegal media access, illegal network access, etc., and responds to the operations of the client.

[0077] The present invention effectively reduces the procurement and maintenance costs of data acquisition devices by directly obtaining data from the front-end data terminal 10 of the situation awareness system. At the same time, by using the web page unit 26 for publishing in the form of a web page, the hardware device requirements for the user terminal are significantly reduced. Users only need to access through the Web address and port number to perform operations, without the need to install and maintain the system client 30 software, thus improving the convenience and accessibility of the system.

[0078] It can be understood that the above embodiments only represent the preferred implementation modes of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the patent of the present invention; it should be pointed out that for those of ordinary skill in the art, without departing from the concept of the present invention, the above technical features can be freely combined, and several deformations and improvements can also be made, and these all belong to the protection scope of the present invention; therefore, all equivalent transformations and modifications made to the scope of the claims of the present invention should fall within the scope covered by the claims of the present invention.

Claims

1. A power network situation awareness system, connected to a front-end data terminal for acquiring power network security data, characterized in that: It also includes a server, a client, and a data reading unit arranged in the front data terminal; The data reading unit is used to read the power network security data from the front data terminal; The server is connected to the data reading unit, and is used to receive the power network security data from the front data terminal, and process the power network security data to obtain processing result information; The client is connected to the server and is used to receive and display the processing result information sent by the server.

2. The power network situation awareness system according to claim 1, characterized in that: The server is also used to perform security status analysis and / or security trend analysis on the power network security data to obtain analysis result information; The client is also used to receive and display the analysis result information sent by the server.

3. The power network situation awareness system according to claim 2, characterized in that: The server includes a network security monitoring unit and a data storage unit; The data storage unit is connected to the data reading unit and is used to receive and store the power network security data sent by the data reading unit; The network security monitoring unit is connected to the data storage unit and is used to perform the security status analysis on the power network security data to obtain the analysis result information.

4. The power network situation awareness system according to claim 3, characterized in that: The data storage unit includes an alarm event storage unit and a historical data storage unit; The historical data security unit is connected to the data reading unit and is used to receive and store the power network security data sent by the data reading unit; The network security monitoring unit is connected to the historical data storage unit and the alarm event storage unit respectively, and is used to receive the power network security data from the historical data storage unit, and determine whether the power network security data meets the preset alarm status conditions. If so, generate the analysis result information and send it to the alarm event storage unit.

5. The power network situation awareness system according to claim 4, characterized in that: The server also includes an alarm information processing unit; The alarm information processing unit is connected to the alarm event storage unit and the client, respectively, and is used to respond to a request from the client, obtain the analysis result information from the alarm event storage unit, and send the information to the client.

6. The power network situation awareness system according to claim 5, characterized in that: The server also includes a web page unit; The web page unit is connected to the client and the alarm information processing unit respectively, and is used to respond to the request of the client, obtain the analysis result information from the alarm information processing unit and send it to the client in the form of a web page.

7. The power network situation awareness system according to claim 6, characterized in that: The server also includes a graphics service unit; The graphic service unit is connected to the historical data storage unit and the web page unit respectively, and is used to obtain power network security data in real time and generate visual graphic data; the client receives and displays the visual graphic data.

8. A method for power network situation awareness, used in the power network situation awareness system according to any one of claims 1 to 7, characterized in that: The method comprises: Step S1: the data reading unit is used to read the power network security data from the front data terminal; Step S2: the server receives the power network security data from the front-end data terminal, and processes the power network security data to obtain processing result information; Step S3: The client receives and displays the processing result information sent by the server.

9. The method for electric power network situation awareness according to claim 8, characterized in that: The power network security data includes one or more of user identity authentication records, operating system logs, boundary protection status, firewall logs, illegal media access and intrusion attempt records.

10. The method for electric power network situation awareness according to claim 8, characterized in that: The method further comprises: The server performs a security status analysis and / or a security trend analysis on the power network security data to obtain analysis result information; The client receives and displays the analysis result information sent by the server.

Images