Inspection processing method and system for secondary security and protection equipment of plant station

Abstract

The invention provides an inspection processing method and system for secondary security and protection equipment of a plant station, and belongs to the technical field of inspection management, and the method specifically comprises the steps that an updating equipment obtaining module is responsible for determining updated security and protection equipment according to the protection strategy updating condition of the secondary security and protection equipment in a power supply line; the line equipment acquisition module is responsible for acquiring the composition data of the updated security equipment in the power supply line, and the inspection strategy determination module is responsible for determining the inspection processing strategy of the secondary security equipment in the power supply line according to the composition data of the updated security equipment in the power supply line, so that the inspection processing reliability of the secondary security equipment is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of patrol management, and particularly relates to a patrol processing method and system for secondary security protection equipment in substations and plants. Background Art

[0002] Secondary security protection equipment is special equipment used in the power system to ensure the security of the power production control network. Its core function is to prevent network attacks and data leakage, and ensure the stable operation of the power system.

[0003] In order to ensure the reliability of secondary security protection equipment, in the patent application for invention CN202211488707.2 "Intelligent Substation Automation and Network Security Protection Equipment Configuration Verification Method and System", the verification template in the equipment configuration constraint rule library is matched according to the equipment type, and the integrity and standardization verification of the target equipment configuration is completed based on the verification template, and a configuration verification result is generated. Thus, the efficiency and accuracy of the configuration verification and acceptance of network security protection equipment can be effectively improved, but there are the following technical problems: During the patrol processing of secondary security protection equipment, after the protection strategy of the secondary security protection equipment is updated, when facing the same external attack, due to problems such as the protection strategy, the power consumption of the secondary security protection equipment may change abnormally when facing external attacks, which will affect the power supply reliability of the secondary security protection equipment in the entire power supply line. Therefore, how to generate a differentiated patrol processing strategy according to the update situation of the protection strategy of the secondary security protection equipment in the same power supply line cannot ensure the operation reliability of the secondary security protection equipment.

[0004] To solve the above technical problems, the present application provides a patrol processing method and system for secondary security protection equipment in substations and plants. Summary of the Invention

[0005] To achieve the purpose of the present invention, the present invention adopts the following technical solutions: Specifically, in the first aspect, the present application provides a patrol processing system for secondary security protection equipment in substations and plants, which specifically includes: An updated equipment acquisition module, a line equipment acquisition module, and a patrol strategy determination module; Wherein the updated equipment acquisition module is responsible for determining the updated security protection equipment based on the update situation of the protection strategy of the secondary security protection equipment in the power supply line; The line equipment acquisition module is responsible for acquiring the composition data of the updated security protection equipment in the power supply line; The patrol strategy determination module is responsible for determining the patrol processing strategy of the secondary security protection equipment in the power supply line based on the composition data of the updated security protection equipment in the power supply line.

[0006] A further technical solution lies in that the updated security device is a secondary security device with a protection policy update.

[0007] A further technical solution lies in that the composition data of the updated security device in the power supply line includes the number of updated security devices in the power supply line.

[0008] A further technical solution lies in that the method for determining the inspection and processing strategy of the secondary security device in the power supply line is as follows: When the number of updated security devices in the power supply line is greater than the preset number of updated devices, the inspection and processing of the secondary security device in the risk power supply line is carried out according to the preset inspection strategy; When the number of updated security devices in the power supply line is not greater than the preset number of updated devices, only the power supply device of the secondary security device is inspected and processed.

[0009] In a second aspect, the present application provides an inspection and processing method for secondary security devices in a substation, which is applied to the above-mentioned inspection and processing system for secondary security devices in a substation, and specifically includes: S1 Obtain the setting data of the secondary security devices in different power supply lines, and determine the risk power supply lines in the power supply lines based on the analysis results of the setting data and the load data of the power supply lines; S2 Determine the updated security devices based on the protection policy update situation of the secondary security devices in the risk power supply lines, and determine the power consumption risk devices in the updated security devices based on the historical attack data corresponding to the updated protection policies of the updated security devices; S3 Obtain the composition data of the power consumption risk devices in the risk power supply lines, and combine the coincidence situation of the historical attack data corresponding to the updated protection policies of different power consumption risk devices in the risk power supply lines. When the inspection risk type of the secondary security devices in the risk power supply lines does not belong to the preset risk type, determine the inspection and processing strategies of different secondary security devices based on the historical attack data and the protection policy update situation of the secondary security devices in the risk power supply lines.

[0010] The beneficial effects of the present invention are as follows: Based on the component data of the power consumption risk devices in the risk power supply line and the coincidence situation of the historical attack data corresponding to the updated protection strategies of different power consumption risk devices in the risk power supply line, determine whether the inspection risk type of the secondary security protection devices in the risk power supply line belongs to the preset risk type. Fully considering the differences in the reliability of the power supply of the risk power supply line when the power consumption risk devices in the risk power supply line are subjected to external cyber attacks due to the differences in the number of power consumption risk devices and the coincidence situation, and then determine the inspection processing strategy targeted, ensuring the accuracy of the inspection processing results.

[0011] Determine the inspection processing strategies for different secondary security protection devices based on the historical attack data and the protection strategy update situation of the secondary security protection devices in the risk power supply line, which not only ensures the reliability of the inspection processing of the secondary security protection devices with a large number of historical attacks and the secondary security protection devices with protection strategy updates, but also adopts a differentiated inspection processing strategy for the secondary security protection devices that have not been updated and have a small number of historical attacks, ensuring the efficiency of the inspection processing.

[0012] A further technical solution is that the setting data of the secondary security protection devices includes the number of secondary security protection devices set in the power supply line.

[0013] A further technical solution is that the load data of the power supply line includes the remaining load capacity of the power supply line at different times.

[0014] A further technical solution is that the method for determining the risk power supply line in the power supply line is as follows: Based on the setting data, determine the number of secondary security protection devices set in the power supply line; Based on the analysis result of the load data of the power supply line, determine the average value of the remaining load capacity of the power supply line at different times, and use it as the average remaining capacity; Based on the set number and the average remaining capacity, determine whether the power supply line is a risk power supply line.

[0015] A further technical solution is that based on the set number and the average remaining capacity, determine whether the power supply line is a risk power supply line, specifically including: When the average remaining capacity in the power supply line is less than the preset capacity threshold and the number of secondary security protection devices set in the power supply line is within the preset device number range, it is determined that the power supply line is a risk power supply line.

[0016] A further technical solution lies in that when the power supply line does not belong to a risk power supply line, the inspection and processing strategies for different secondary security protection devices are determined by using the historical attack data of the secondary security protection devices in the power supply line and the update situation of the protection strategy.

[0017] A further technical solution lies in that the method for determining the inspection and processing strategy of the secondary security protection device is as follows: The inspection and processing strategies for different secondary security protection devices are determined by using the historical attack data of the secondary security protection devices in the risk power supply line and the update situation of the protection strategy When there is an update to the protection strategy of the secondary security protection device, the inspection and processing strategy of the secondary security protection device is determined by using the first inspection and processing strategy; When there is no update to the protection strategy of the secondary security protection device, based on the historical attack data of the secondary security protection device, the historical attack times of the secondary security protection device under different protection strategies are determined, and the inspection and processing strategy of the secondary security protection device is determined by using the historical attack times under different protection strategies.

[0018] A further technical solution lies in that the first inspection and processing strategy is based on the maximum value of the historical attack traffic corresponding to the protection strategy of the secondary security protection device, and simulation attack processing of the secondary security protection device under different protection strategies is carried out, and the power supply device of the secondary security protection device is inspected and processed.

[0019] A further technical solution lies in that determining the inspection and processing strategy of the secondary security protection device by using the historical attack times under different protection strategies specifically includes: When there is a protection strategy with historical attack times within a preset attack times range, only the power supply device of the secondary security protection device is inspected and processed; When there is a protection strategy with historical attack times within a preset attack times range, based on the maximum value of the historical attack traffic corresponding to the protection strategy with historical attack times within the preset attack times range, simulation attack processing of the secondary security protection device under the protection strategy with historical attack times within the preset attack times range is carried out, and the power supply device of the secondary security protection device is inspected and processed.

[0020] Other features and advantages will be described in the following description, and in part will be obvious from the description, or will be understood by implementing the present invention. The objectives and other advantages of the present invention are realized and obtained by the structures specifically pointed out in the description and the drawings.

[0021] To make the above objectives, features, and advantages of the present invention more obvious and understandable, the following specific preferred embodiments are given, and in conjunction with the accompanying drawings, the detailed description is as follows. Description of the Drawings

[0022] The above and other features and advantages of the present invention will become more apparent by describing its exemplary embodiments in detail with reference to the accompanying drawings.

[0023] Figure 1 is a framework diagram of an inspection and processing system for secondary security equipment in a substation; Figure 2 is a flowchart of a method for inspecting and processing secondary security equipment in a substation; Figure 3 is a flowchart of a method for determining a risk power supply line in a power supply line; Figure 4 is a flowchart of a method for determining an equipment with power consumption risk in a security equipment to be updated; Figure 5 is a flowchart of a method for determining an inspection and processing strategy for secondary security equipment. Detailed Embodiments

[0024] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, the exemplary embodiments can be implemented in various forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. Like reference numerals in the figures denote like or similar structures, and thus their detailed description will be omitted.

[0025] The terms "a", "an", "the", and "said" are used to denote the presence of one or more elements / components / etc.; the terms "comprising" and "having" are used to mean an open inclusion and mean that there may be additional elements / components / etc. in addition to the listed elements / components / etc.

[0026] Example 1 To solve the above problems, according to one aspect of the present invention, as Figure 1 shown, there is provided an inspection and processing system for secondary security equipment in a substation, specifically including: an updated equipment acquisition module, a line equipment acquisition module, and an inspection strategy determination module; wherein the updated equipment acquisition module is responsible for determining the security equipment to be updated based on the update situation of the protection strategy of the secondary security equipment in the power supply line; the line equipment acquisition module is responsible for acquiring the composition data of the security equipment to be updated in the power supply line; the inspection strategy determination module is responsible for determining the inspection and processing strategy of the secondary security equipment in the power supply line based on the composition data of the security equipment to be updated in the power supply line.

[0027] Further, the updated security device is a secondary security device with a protection policy update.

[0028] Specifically, the composition data of the updated security device in the power supply line includes the number of updated security devices in the power supply line.

[0029] It should be noted that the method for determining the inspection and processing strategy of the secondary security device in the power supply line is as follows: When the number of updated security devices in the power supply line is greater than the preset number of updated devices, the inspection and processing of the secondary security device in the risk power supply line is carried out according to the preset inspection strategy; When the number of updated security devices in the power supply line is not greater than the preset number of updated devices, only the power supply device of the secondary security device is inspected.

[0030] Embodiment 2 In a second aspect, as Figure 2 shown, the present application provides an inspection and processing method for secondary security devices in a substation, which is applied to the above-mentioned inspection and processing system for secondary security devices in a substation, and specifically includes: S1 Obtain the setting data of the secondary security devices in different power supply lines, and determine the risk power supply lines in the power supply lines based on the analysis results of the setting data and the load data of the power supply lines; S2 Determine the updated security devices based on the update situation of the protection policies of the secondary security devices in the risk power supply lines, and determine the power consumption risk devices in the updated security devices based on the historical attack data corresponding to the updated protection policies of the updated security devices; S3 Obtain the composition data of the power consumption risk devices in the risk power supply lines, and combine the coincidence situation of the historical attack data corresponding to the updated protection policies of different power consumption risk devices in the risk power supply lines. When the inspection risk type of the secondary security devices in the risk power supply lines does not belong to the preset risk type, determine the inspection and processing strategies of different secondary security devices based on the historical attack data and the protection policy update situation of the secondary security devices in the risk power supply lines.

[0031] Further, the setting data of the secondary security device includes the set number of secondary security devices in the power supply line.

[0032] Specifically, the load data of the power supply line includes the remaining load capacity of the power supply line at different times.

[0033] Specifically, as Figure 3 shown, the method for determining the risk power supply lines in the power supply lines is as follows: Based on the said setting data, determine the number of secondary security devices set in the power supply line; Based on the analysis result of the load data of the power supply line, determine the average value of the remaining load capacity of the power supply line in different time periods, and use it as the average remaining capacity; Based on the said number of settings and the average remaining capacity, determine whether the power supply line is a risky power supply line.

[0034] Further, based on the said number of settings and the average remaining capacity, determining whether the power supply line is a risky power supply line specifically includes: When the average remaining capacity in the power supply line is less than the preset capacity threshold and the number of secondary security devices set in the power supply line is within the preset device number range, then determine that the power supply line is a risky power supply line.

[0035] In addition, it should be noted that when the power supply line does not belong to a risky power supply line, then use the historical attack data and protection strategy update situation of the secondary security devices in the power supply line to determine the inspection and processing strategies for different secondary security devices.

[0036] Optionally, the method for determining a risky power supply line in the power supply line is: S11 Based on the analysis result of the load data of the power supply line, determine the remaining load capacity of the power supply line in different time periods, and determine the available load factor in the power supply line based on the remaining load capacity in different time periods; S12 Based on the said setting data, determine the number of secondary security devices set in the power supply line, and combine the power consumption data of different secondary security devices during historical attacks to determine the power consumption risk factor of the secondary security devices in the power supply line; S13 Based on the ratio of the power consumption risk factor of the secondary security devices in the power supply line to the available load factor, determine the overload risk factor of the power supply line, and use the overload risk factor to determine whether the power supply line is a risky power supply line.

[0037] Further, when the overload risk factor is greater than the preset risk factor threshold, then determine that the power supply line is a risky power supply line.

[0038] Optionally, the above step S11 includes the following content: S111 Based on the analysis result of the load data of the power supply line, determine the remaining load capacity of the power supply line in different time periods. When the remaining load capacity of the power supply line in different time periods is greater than the preset load capacity threshold, it is determined that the power supply line does not belong to the risk power supply line. When there is a time period in which the remaining load capacity of the power supply line is not greater than the preset load capacity threshold, go to step S112; S112 Take the time period in which the remaining load capacity is not greater than the preset load capacity threshold as the high load time period. When the proportion of the number of high load time periods in the power supply line does not meet the requirements, it is determined that the power supply line belongs to the risk power supply line. When the proportion of the number of high load time periods in the power supply line meets the requirements, go to step S113; S113 Determine the available load factor in the power supply line based on the remaining load capacity in different time periods. When the available load factor is greater than the preset load factor threshold, it is determined that the power supply line does not belong to the risk power supply line. When the available load factor is not greater than the preset load factor threshold, go to step S114; S114 When the available load factor is within the preset load factor range, it is determined that the power supply line belongs to the risk power supply line. When the available load factor is not within the preset load factor range, go to step S12.

[0039] Optionally, the following content is included in the above step S12: S121 Based on the setting data, determine the number of secondary security devices set in the power supply line. When the number of secondary security devices set is greater than the preset number threshold, it is determined that the power supply line belongs to the risk power supply line. When the number of secondary security devices set is not greater than the preset number threshold, go to step S122; S122 Based on the power consumption data of different secondary security devices during historical attacks, when it is determined that there is a secondary security device with power consumption greater than the preset power consumption during the historical attack process, go to step S123. When there is no secondary security device with power consumption greater than the preset power consumption during the historical attack process, go to step S124; S123 When the number of secondary security devices with power consumption greater than the preset power consumption during the historical attack process does not meet the requirements, it is determined that the power supply line belongs to the risk power supply line. When the number of secondary security devices with power consumption greater than the preset power consumption during the historical attack process meets the requirements, go to step S124; S124 determines the power consumption risk coefficient of the secondary security devices in the power supply line by using the number of secondary security devices set in the power supply line and the power consumption data of different secondary security devices during historical attacks. When the power consumption risk coefficient of the secondary security devices in the power supply line is greater than the preset power consumption risk coefficient threshold, it is determined that the power supply line belongs to a risky power supply line. When the power consumption risk coefficient of the secondary security devices in the power supply line is not greater than the preset power consumption risk coefficient threshold, it proceeds to step S13.

[0040] Further, the updated protection policy is that there is an updated protection policy.

[0041] Specifically, as Figure 4 shown, the method for determining the power consumption risk devices in the updated security devices is as follows: Based on the historical attack data corresponding to the updated protection policy of the updated security devices, determine the historical attack times corresponding to the updated protection policy; Based on the power consumption of the updated security devices under different attack times, conduct historical attack times with power consumption greater than the set power consumption value, and determine the power consumption deviation attack times; According to the power consumption deviation attack times under different updated protection policies, determine whether the updated security devices are power consumption risk devices.

[0042] Further, when there is an updated protection policy with power consumption deviation attack times greater than the preset deviation attack times, it is determined that the updated security devices are power consumption risk devices.

[0043] Optionally, the method for determining the power consumption risk devices in the updated security devices is as follows: S21 Based on the historical attack data corresponding to the updated protection policy of the updated security devices, determine the historical attack times corresponding to the updated protection policy; S22 Based on the power consumption of the updated security devices under different attack times, determine the power consumption at the historical attack times corresponding to different updated protection policies, and determine the power consumption anomaly coefficients of different updated protection policies based on the power consumption at the historical attack times corresponding to different updated protection policies; S23 According to the power consumption anomaly coefficients of different updated protection policies, calculate the power consumption deviation of the updated security devices, and use the power consumption deviation to determine whether the updated security devices are power consumption risk devices.

[0044] Further, when the power consumption deviation is greater than the preset power consumption deviation threshold, it is determined that the updated security devices are power consumption risk devices.

[0045] Optionally, the following content is included in step S21 above: S211 Obtain the power consumption of the updated security device. When the power consumption of all the updated security devices is less than the preset power consumption threshold, it is determined that the updated security device does not belong to the power consumption risk device. When there is a period during which the power consumption of the updated security device is not less than the preset power consumption threshold, go to step S212; S212 Use the historical attack data corresponding to the updated protection strategy of the updated security device to determine the historical attack times corresponding to the updated protection strategy. When the sum of the historical attack times corresponding to different updated protection strategies of the updated security device does not meet the requirements, it is determined that the updated security device does not belong to the power consumption risk device. When the sum of the historical attack times corresponding to different updated protection strategies of the updated security device meets the requirements, go to step S213; S213 When it is determined that there is no updated protection strategy with a historical attack time greater than the preset attack time threshold based on the historical attack times corresponding to different updated protection strategies, go to step S22. When the updated security device has an updated protection strategy with a historical attack time greater than the preset attack time threshold, go to step S214; S214 When the number of updated protection strategies with a historical attack time greater than the preset attack time threshold does not meet the requirements, it is determined that the updated security device belongs to the power consumption risk device. When the number of updated protection strategies with a historical attack time greater than the preset attack time threshold meets the requirements, go to step S22.

[0046] Optionally, the following content is included in the above step S22: S221 Based on the power consumption of the updated security device under different attack times, determine the power consumption corresponding to the historical attack times of different updated protection strategies. Based on the power consumption of the updated security device under different attack times, conduct historical attack times with power consumption greater than the power consumption setting value to determine the power consumption deviation attack times; S222 When the power consumption deviation attack times of the updated security device do not meet the requirements, it is determined that the updated security device belongs to the power consumption risk device. When the power consumption deviation attack times of the updated security device meet the requirements, go to step S223; S223 When it is determined that there is an updated protection strategy with a power consumption deviation attack time greater than the preset deviation attack time based on the power consumption deviation attack times under different updated protection strategies, it is determined that the updated security device is a power consumption risk device. When there is no updated protection strategy with a power consumption deviation attack time greater than the preset deviation attack time, go to step S224; S224 determines the power consumption anomaly coefficients of different update protection policies based on the power consumption of the historical attack times corresponding to different update protection policies. When the number of update protection policies with power consumption anomaly coefficients within the preset power consumption anomaly coefficient range does not meet the requirements, it is determined that the update security device is a power consumption risk device. When the number of update protection policies with power consumption anomaly coefficients within the preset power consumption anomaly coefficient range meets the requirements, it proceeds to step S23.

[0047] It can be understood that the composition data of the power consumption risk devices in the risk power supply line includes the number of power consumption risk devices in the risk power supply line.

[0048] In one possible embodiment, determining that the inspection risk type of the secondary security device in the risk power supply line does not belong to the preset risk type specifically includes: Based on the composition data of the power consumption risk devices in the risk power supply line, determine the power consumption risk devices in the risk power supply line. Based on the historical attack data corresponding to the update protection policies of the power consumption risk devices, determine the historical attack time periods corresponding to the update protection policies of different power consumption risk time periods, and use them as matching attack time periods; Based on the coincidence of the matching attack time periods of different power consumption risk devices, determine the number of power consumption risk devices with historical attacks in different matching attack time periods. Use the matching attack time periods with the number of power consumption risk devices with historical attacks within the preset risk device number range as the screened attack time periods; Based on the number of screened attack time periods in the risk power supply line, determine whether the inspection risk type of the secondary security device in the risk power supply line belongs to the preset risk type.

[0049] Furthermore, when the number of screened attack time periods in the risk power supply line is greater than the preset screened time period number, it is determined that the inspection risk type of the secondary security device in the risk power supply line belongs to the preset risk type.

[0050] It can be understood that when the inspection risk type of the secondary security device in the risk power supply line belongs to the preset risk type, the inspection process of the secondary security device in the risk power supply line is performed according to the preset inspection strategy.

[0051] Furthermore, the preset inspection strategy is based on the maximum value of the historical attack traffic corresponding to the protection policies of different secondary security devices, and at the same time, perform the simulated attack process on the secondary security devices and monitor the load situation of the risk power supply line in real time.

[0052] In another possible embodiment, determining that the inspection risk type of the secondary security device in the risk power supply line does not belong to the preset risk type specifically includes: Determine the number of power consumption risk devices in the risk power supply line according to the composition data of the power consumption risk devices in the risk power supply line. When the number of power consumption risk devices in the risk power supply line does not meet the requirements, determine that the inspection risk type of the secondary security protection device in the risk power supply line belongs to the preset risk type; When the number of power consumption risk devices in the risk power supply line meets the requirements: Based on the historical attack data corresponding to the updated protection strategy of the power consumption risk device, when it is determined that the total number of historical attacks corresponding to the updated protection strategy of the power consumption risk device in the risk power supply line does not meet the requirements, determine that the inspection risk type of the secondary security protection device in the risk power supply line belongs to the preset risk type; When it is determined that the total number of historical attacks corresponding to the updated protection strategy of the power consumption risk device in the risk power supply line meets the requirements: Based on the historical attack data corresponding to the updated protection strategy of the power consumption risk device, determine the historical attack time periods corresponding to the updated protection strategies for different power consumption risk time periods, and use them as matching attack time periods; Based on the coincidence of the matching attack time periods of different power consumption risk devices, determine the number of power consumption risk devices with historical attacks in different matching attack time periods. Use the matching attack time periods in which the number of power consumption risk devices with historical attacks is within the preset risk device number range as the screened attack time periods. When the number of screened attack time periods in the risk power supply line does not meet the requirements, determine that the inspection risk type of the secondary security protection device in the risk power supply line belongs to the preset risk type; When the number of screened attack time periods in the risk power supply line meets the requirements: Based on the coincidence of the historical matching attack time periods of different power consumption risk devices, and in combination with the power consumption of different power consumption devices during the historical attack, determine the attack power consumption risk coefficient of the risk power supply line, and use the attack power consumption risk coefficient to determine whether the inspection risk type of the secondary security protection device in the risk power supply line belongs to the preset risk type.

[0053] Furthermore, when the attack power consumption risk coefficient is greater than the preset attack power consumption risk coefficient threshold, determine that the inspection risk type of the secondary security protection device in the risk power supply line belongs to the preset risk type.

[0054] Specifically, as Figure 5 shown, the method for determining the inspection processing strategy of the secondary security protection device is: Determine the inspection processing strategies of different secondary security protection devices based on the historical attack data and the protection strategy update situation of the secondary security protection devices in the risk power supply line When there is an update to the protection policy of the secondary security device, the inspection and processing policy of the secondary security device is determined using the first inspection and processing policy; When there is no update to the protection policy of the secondary security device, the historical attack times of the secondary security device under different protection policies are determined based on the historical attack data of the secondary security device, and the inspection and processing policy of the secondary security device is determined using the historical attack times under different protection policies.

[0055] Further, the first inspection and processing policy is to perform simulated attack processing on the secondary security device under different protection policies based on the maximum value of the historical attack traffic corresponding to the protection policy of the secondary security device, and perform inspection and processing on the power supply device of the secondary security device.

[0056] Specifically, determining the inspection and processing policy of the secondary security device using the historical attack times under different protection policies specifically includes: When there is a protection policy with historical attack times within a preset attack times range, only the power supply device of the secondary security device is inspected and processed; When there is a protection policy with historical attack times within a preset attack times range, based on the maximum value of the historical attack traffic corresponding to the protection policy with historical attack times within the preset attack times range, perform simulated attack processing on the secondary security device under the protection policy with historical attack times within the preset attack times range, and perform inspection and processing on the power supply device of the secondary security device.

[0057] Each embodiment in this specification is described in a progressive manner. The same or similar parts among the embodiments can be referred to each other, and the key point of each embodiment is to illustrate the differences from other embodiments. In particular, for the embodiments of the device, equipment, and non-volatile computer storage medium, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0058] The above describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order than in the embodiments and still achieve the desired result. Additionally, the processes depicted in the figures do not necessarily require the specific order or sequential order shown to achieve the desired result. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0059] The above are only one or more embodiments of this specification and are not used to limit this specification. For those skilled in the art, various changes and modifications can be made to one or more embodiments of this specification. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of one or more embodiments of this specification shall be included within the scope of the claims of this specification.

Claims

1. A patrol inspection processing system for secondary security protection equipment in a substation, characterized in that Specifically include: An updated device acquisition module, a line device acquisition module, and an inspection strategy determination module; Among them, the updated device acquisition module is responsible for determining the updated security device based on the update situation of the protection strategy of the secondary security device in the power supply line; The line device acquisition module is responsible for acquiring the composition data of the updated security device in the power supply line; The inspection strategy determination module is responsible for determining the inspection processing strategy of the secondary security device in the power supply line based on the composition data of the updated security device in the power supply line.

2. The inspection processing system for secondary security protection equipment of a substation as described in claim 1, wherein The updated security device is a secondary security device with a protection strategy update.

3. The inspection and processing system for secondary security equipment of a plant substation according to claim 1, characterized in that, The composition data of the updated security device in the power supply line includes the quantity of the updated security device in the power supply line.

4. The inspection and processing system for secondary security protection equipment in a plant substation according to claim 1, characterized in that, The method for determining the inspection processing strategy of the secondary security device in the power supply line is as follows: When the quantity of the updated security device in the power supply line is greater than the preset quantity of updated devices, the inspection of the secondary security device in the risky power supply line is processed according to the preset inspection strategy; When the quantity of the updated security device in the power supply line is not greater than the preset quantity of updated devices, only the power supply device of the secondary security device is inspected.

5. A patrol inspection processing method for secondary security protection equipment in a substation, which is applied to a patrol inspection processing system for secondary security protection equipment described in any one of claims 1-4, and is characterized in that, Specifically include: Obtain the setting data of the secondary security device in different power supply lines, and determine the risky power supply lines in the power supply lines based on the analysis results of the setting data and the load data of the power supply lines; Determine the updated security device based on the update situation of the protection strategy of the secondary security device in the risky power supply line, and determine the power consumption risk device in the updated security device based on the historical attack data corresponding to the updated protection strategy of the updated security device; Obtain the composition data of the power consumption risk device in the risky power supply line, and combine the coincidence situation of the historical attack data corresponding to the updated protection strategies of different power consumption risk devices in the risky power supply line. When the inspection risk type of the secondary security device in the risky power supply line does not belong to the preset risk type, determine the inspection processing strategies of different secondary security devices based on the historical attack data and the protection strategy update situation of the secondary security device in the risky power supply line.

6. The inspection and processing method for secondary security protection equipment of a substation as described in claim 5, characterized in that The setting data of the secondary security device includes the set quantity of the secondary security device in the power supply line.

7. The inspection and processing method for secondary security protection equipment of a substation as described in claim 5, characterized in that, The load data of the power supply line includes the remaining load capacity of the power supply line at different times.

8. The inspection and processing method for secondary security protection equipment of a substation as described in claim 5, characterized in that, The method for determining the risky power supply lines in the power supply line is as follows: Based on the setting data, determine the set quantity of the secondary security device in the power supply line; Based on the analysis result of the load data of the power supply line, determine the average value of the remaining load capacity of the power supply line at different times, and use it as the average remaining capacity; Based on the set quantity and the average remaining capacity, determine whether the power supply line is a risky power supply line.

9. The inspection and processing method for secondary security protection equipment of a substation as described in claim 5, characterized in that, The method for determining the inspection processing strategy of the secondary security device is as follows: When the secondary security device has a protection strategy update, use the first inspection processing strategy to determine the inspection processing strategy of the secondary security device; When there is no update of the protection policy for the secondary security device, determine the historical attack times of the secondary security device under different protection policies based on the historical attack data of the secondary security device, and determine the patrol processing policy of the secondary security device by using the historical attack times under different protection policies.

10. The inspection and processing method for secondary security protection equipment in a substation as claimed in claim 9, wherein, The first patrol processing policy is to perform simulated attack processing on the secondary security device under different protection policies based on the maximum value of the historical attack traffic corresponding to the protection policy of the secondary security device, and perform patrol processing on the power supply device of the secondary security device.

Images