Power system network security question and answer method and system based on network security knowledge base

Abstract

The invention relates to the technical field of power system network security, and discloses a power system network security question-answering method and system based on a network security knowledge base, and the network security question-answering method comprises the steps: receiving a power system security knowledge base and a target environment feature set, and carrying out the calculation to obtain a knowledge vulnerability matrix; based on the knowledge vulnerability matrix, generating a weakness map of the safety question-answering system of the power system; constructing an electric power system safety knowledge immune memory bank; generating immune response according to the activated immune memory unit, neutralizing potential safety weaknesses, and recording response process data to form an immune response execution report; and updating the defense capability of the system through the immunological enhancement kinetic equation to form an evolved defense capability vector. According to the method, a vulnerability function and an immunological enhancement kinetic model are established, so that the system can quantitatively evaluate the security vulnerability of different knowledge in different environments, and a defense strategy is dynamically adjusted according to the security vulnerability.

Description

Technical Field

[0001] The present invention relates to the technical field of power system network security, and more specifically, it relates to a power system network security question - answering method and system based on a network security knowledge base. Background Art

[0002] In a power system network security question - answering system, cross - scenario knowledge migration and security defense is an important technical field. When a power system network security question - answering system needs to migrate knowledge from one environment (such as a power plant network environment) to another environment (such as a transmission network environment), traditional technologies face two core contradictions: on the one hand, strengthening security defense measures often reduces the system's adaptability to the new environment; on the other hand, improving environmental adaptability may introduce new security vulnerabilities. Existing technologies cannot enhance security defense capabilities while ensuring cross - scenario adaptability, resulting in problems such as a decline in security performance during the migration process and the need for re - reinforcement. Summary of the Invention

[0003] The present invention provides a power system network security question - answering method and system based on a network security knowledge base, which solves the technical problem in related technologies that security defense capabilities cannot be enhanced while ensuring cross - scenario adaptability.

[0004] The first aspect of the present invention provides a power system network security question - answering method based on a network security knowledge base, including the following steps:

[0005] Step 100: Receive a power system security knowledge base and a target environment feature set, and calculate a knowledge vulnerability matrix through a knowledge vulnerability mapping algorithm;

[0006] Step 200: Based on the knowledge vulnerability matrix, use an adversarial sample generation function to actively expose the potential security weaknesses of the system in the new environment, and generate a weakness map of the power system network security question - answering system;

[0007] Step 300: Use the adversarial sample set to verify the security weaknesses in the weakness map, and construct an immune memory bank for power system security knowledge, where represents a diverse adversarial sample set generated for the j - th type of vulnerability;

[0008] Step 400: When an input similar to the trigger pattern recorded in the immune memory bank is detected, generate an immune response according to the activated immune memory unit, neutralize the potential security weaknesses, and record the response process data to form an immune response execution report;

[0009] Step 500: According to the immune response execution report, update the defense ability of the system through an immune enhancement kinetic equation to form an evolved defense ability vector;

[0010] Among them, the immune enhancement kinetic equation is as follows:

[0011]

[0012] Among them, represents the rate of change of the defense ability with respect to time, and p j (t) represents the defense ability of the j-th type of vulnerability, and V j (t) represents the vulnerability value of the j-th type of vulnerability, and E change (t) represents the environmental change rate, α is the enhancement coefficient, β is the attenuation coefficient, t represents the time variable, and j represents the index of the vulnerability type.

[0013] Furthermore, the knowledge vulnerability mapping algorithm calculates the knowledge vulnerability matrix through the following steps:

[0014] Represent each piece of knowledge in the knowledge base as a feature vector, including knowledge content features, usage frequency features, and security relevance features;

[0015] For each piece of knowledge, construct a vulnerability vector to represent the potential security vulnerability of this knowledge in the target environment;

[0016] Calculate the vulnerability vector value through the vulnerability function:

[0017]

[0018] Among them, represents a single piece of knowledge, and E target represents the target environment, w j is the weight coefficient, v j represents the vulnerability score, p j (t0) represents the initial defense ability, n represents the total number of vulnerability types, and t0 represents the initial moment; combine the vulnerability vectors of all knowledge to form a knowledge vulnerability matrix.

[0019] Furthermore, the adversarial sample generation function generates adversarial samples through the following steps:

[0020] According to the knowledge vulnerability matrix, identify the top k types of knowledge with the highest vulnerability scores;

[0021] For each type of highly vulnerable knowledge, construct an adversarial sample generation function;

[0022] Adopt a progressive perturbation method, starting from a legal input, gradually adjust the input in the direction that may trigger system vulnerabilities to generate adversarial samples;

[0023] For each type of vulnerability, generate a diverse set of adversarial samples

[0024] Furthermore, the steps for constructing the power system security knowledge immune memory bank include:

[0025] In a controlled test environment, input the adversarial sample set into the power system security Q&A model;

[0026] Record and analyze the model responses to confirm the effectiveness and impact level of each adversarial sample;

[0027] For each identified weakness, construct an immune memory unit IM weak that includes the weakness feature vector F and the defense strategy set D strategy ; i

[0028] Update the immune memory unit through the immune memory update equation:

[0029]

[0030] where IM i (t) represents the state of the immune memory unit, η is the learning rate, denotes the tensor outer product operation, F weak (t) represents the weakness feature vector, denotes the trigger pattern during the memory process, D efficacy (t) represents the defense strategy effectiveness score, and i represents the index of the immune memory unit.

[0031] Furthermore, the steps for generating an immune response include:

[0032] The system continuously monitors the input. When the similarity between the detected input and the trigger pattern recorded in the immune memory bank exceeds a preset threshold, activate the corresponding immune memory unit;

[0033] Based on the activated immune memory unit, automatically generate an immune response that includes an abnormal input recognizer, a response strategy selector, and an adaptive response regulator;

[0034] Calculate the specific response through the immune response generation equation:

[0035]

[0036] where R immune (t) represents the immune response, α i (t) represents the activation intensity, denotes the similarity between the input and the trigger pattern, m represents the total number of immune memory units, which is the upper limit of the summation, I t represents the system input at time t, ​Indicates the triggering mode of the i-th memory cell; Apply the calculated immune response to the system to neutralize potential security vulnerabilities.

[0037] Furthermore, the method further includes cross-scenario adaptability verification and loop optimization steps:

[0038] Deploy the evolved defense ability vector to multiple power system network environments;

[0039] Construct a cross-scenario test matrix that includes the differences in characteristics of different power system environments and the characteristics of security challenges;

[0040] Collect the question-and-answer accuracy rate, defense success rate, and environment adaptability metrics of the model in each environment;

[0041] Calculate the comprehensive performance index through the cross-scenario performance calculation formula;

[0042] Identify the weaknesses and defense strategies that need further optimization, and feedback them to the knowledge vulnerability assessment step to form a closed-loop optimization process.

[0043] Furthermore, the cross-scenario performance calculation formula is:

[0044] CPI = ω1·ACC + ω2·DR + ω3·EA;

[0045] Where, CPI represents the cross-scenario performance index, ACC represents the question-and-answer accuracy rate, DR represents the defense success rate, EA represents the environment adaptability, and ω1, ω2, ω3 are weight coefficients and satisfy ω1 + ω2 + ω3 = 1.

[0046] Furthermore, the positive feedback loop formed in the defense ability evolution step includes:

[0047] The system automatically extracts the data in the immune response execution report and evaluates the neutralization effect of each type of weakness;

[0048] Allocate more defense resources to the weaknesses with high vulnerability;

[0049] Execute the defense ability evolution algorithm that includes a knowledge transfer enhancement module, a defense strategy fusion module, and an adaptive resource allocation module;

[0050] Through continuous iteration, a vulnerability-driven positive feedback loop is formed, so that the areas with higher vulnerability obtain a greater enhancement amplitude.

[0051] Furthermore, the method is applied to the knowledge transfer scenario between power system network environments with the following characteristics:

[0052] There are significant differences between the source environment and the target environment in terms of network topology structure, security threat characteristics, business processes, or regulatory requirements;

[0053] The system needs to quickly adapt to the new environment while maintaining its security defense capabilities;

[0054] The system can utilize adversarial immune transfer learning to achieve the security self-enhancement effect of "transferring means strengthening".

[0055] The second aspect of the present invention provides a power system network security Q&A system based on a network security knowledge base, which is used to execute the above-mentioned power system network security Q&A method based on a network security knowledge base, and includes:

[0056] A knowledge vulnerability mapping module, which is used to receive a power system security knowledge base and a target environment feature set, and calculate a knowledge vulnerability matrix;

[0057] A security weakness active exposure module, which is used to generate adversarial samples based on the knowledge vulnerability matrix and expose the potential security weaknesses of the system;

[0058] An immune memory construction module, which is used to verify security weaknesses and construct a power system security knowledge immune memory library;

[0059] An immune response generation module, which is used to detect abnormal inputs, generate and execute targeted immune responses to neutralize security weaknesses;

[0060] A defense capability evolution module, which is used to update the system's defense capabilities through an immune enhancement kinetic equation according to the immune response execution report;

[0061] A cross-scenario adaptability verification module, which is used to verify the system's defense capabilities and adaptability in multiple power system network environments to achieve cyclic optimization.

[0062] The beneficial effects of the present invention are as follows: The present invention proposes the principle of controlled vulnerability exposure. By actively exposing the potential weaknesses of the system and carrying out targeted strengthening, the traditional contradiction between "security and adaptability" is transformed into the driving force for system evolution; a weakness self-exposure-neutralization-strengthening cycle mechanism is constructed, enabling the system to not only adapt to the new environment during the migration process but also automatically identify and fill security loopholes; a vulnerability function and an immune enhancement kinetic model are established, enabling the system to quantitatively evaluate the security vulnerabilities of different knowledge in different environments and dynamically adjust the defense strategy accordingly. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 is the flowchart of the steps of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0064] The subject matter described herein will now be discussed with reference to example embodiments. It should be understood that discussing these embodiments is only to enable those skilled in the art to better understand and thus implement the subject matter described herein, and the functions and arrangements of the elements discussed can be changed without departing from the scope of protection of the content of this specification. Each example can omit, substitute, or add various processes or components as needed. Additionally, the features described in some examples can also be combined in other examples.

[0065] In at least one embodiment of the present invention, a power system network security Q&A method based on a network security knowledge base is disclosed. As Figure 1 shown, it includes the following steps:

[0066] Step 100: Receive the power system security knowledge base and the target environment feature set, and calculate the knowledge vulnerability matrix through the knowledge vulnerability mapping algorithm;

[0067] In this step, the power system security knowledge base K and the target environment feature set E target are received as inputs, and the knowledge vulnerability matrix VM is calculated through the knowledge vulnerability mapping algorithm.

[0068] Input data: Power system security knowledge base K, target environment feature set E target

[0069] Specific implementation process:

[0070] Each piece of knowledge in the knowledge base K is represented as a feature vector including knowledge content features, usage frequency features, and security relevance features;

[0071] For each piece of knowledge a vulnerability vector is constructed representing the potential security vulnerability of this knowledge in the target environment;

[0072] The vulnerability vector is calculated through the following formula:

[0073]

[0074] Wherein, represents the vulnerability function value of the knowledge in the target environment E target at the initial moment t0, w j is the weight coefficient of the j-th type of vulnerability, is the score of the knowledge regarding the j-th type of vulnerability in the target environment, and p j(t0) is the initial defense ability of the system against the j-th type of vulnerability. n represents the total number of vulnerability types, which is the upper limit of the summation, and j represents the index of the vulnerability type;

[0075] Output result: The knowledge vulnerability matrix VM, which contains the vulnerability scores and type distributions of each piece of knowledge in the knowledge base under the target environment, and is used to guide the subsequent process of actively exposing security weaknesses.

[0076] Step 200: Based on the knowledge vulnerability matrix, use the adversarial sample generation function to actively expose the potential security weaknesses of the system in the new environment, and generate the weakness map of the power system security Q&A system;

[0077] In this step, the knowledge vulnerability matrix VM and the power system security Q&A model M are input to generate the weakness map WM of the power system security Q&A system.

[0078] Input data: The knowledge vulnerability matrix VM, the power system security Q&A model M

[0079] Specific implementation process:

[0080] According to the knowledge vulnerability matrix VM, identify the top k types of knowledge with the highest vulnerability scores;

[0081] For each type of highly vulnerable knowledge, construct an adversarial sample generation function

[0082] The adversarial sample generation function adopts a progressive perturbation method, starting from a legal input and gradually adjusting in the direction that may trigger system weaknesses;

[0083] For each type of vulnerability, generate a diverse set of adversarial samples Among them, represents the diverse set of adversarial samples generated for the j-th type of vulnerability, represents the set of all sets of adversarial samples;

[0084] Output result: The weakness map WM of the power system security Q&A system, which is a data structure containing detailed descriptions, triggering conditions, and influence ranges of various security weaknesses, providing a basis for subsequent weakness verification and immune memory formation.

[0085] Step 300: Use the set of adversarial samples to verify the security weaknesses in the weakness map and construct an immune memory library for power system security knowledge;

[0086] Input the weakness map and the set of adversarial samples. In this step, an immune memory library for power system security knowledge is constructed to store various weaknesses identified by the system and their defense strategies.

[0087] Input data: The weakness map WM, the set of adversarial samples Power System Security Q&A Model M

[0088] Specific implementation process:

[0089] In a controlled test environment, input the adversarial sample set into the power system security Q&A model M;

[0090] Record and analyze the model response to confirm the effectiveness and impact degree of each adversarial sample;

[0091] For each confirmed weakness, construct an immune memory unit IM that includes the weakness feature vector F weak , trigger mode and the defense strategy set D strategy ; i ;

[0092] Update the immune memory unit through the immune memory update equation:

[0093]

[0094] where IM i (t) represents the state of the immune memory unit, η is the learning rate, represents the tensor outer product operation, F weak (t) represents the weakness feature vector, represents the trigger mode during the memory process, D efficacy (t) represents the effectiveness score of the defense strategy, and i represents the index of the immune memory unit;

[0095] Output result: The power system security knowledge immune memory bank IMB is a structured database that stores various weaknesses identified by the system and their corresponding defense strategies, providing a knowledge basis for subsequent immune response generation.

[0096] Step 400: When an input similar to the trigger mode recorded in the immune memory bank is detected, generate an immune response based on the activated immune memory unit to neutralize potential security weaknesses, and record the response process data to form an immune response execution report;

[0097] This step extracts defense knowledge from the immune memory bank IMB, combines the current system state and environmental change factors, and generates an immune response execution report RER.

[0098] Input data: Immune memory bank IMB, current system state S current , environmental change factor E change

[0099] Specific implementation process:

[0100] The system continuously monitors the input. When the detected input has a similarity exceeding the threshold θ with the trigger pattern recorded in the immune memory bank, the corresponding immune memory unit is activated;

[0101] According to the activated immune memory unit, an immune response R is automatically generated immune , including:

[0102] Abnormal input recognizer: used to quickly recognize input patterns similar to known weaknesses

[0103] Response strategy selector: selects the most suitable defense strategy from the set of defense strategies for the current environment

[0104] Adaptive response regulator: dynamically adjusts the response intensity according to environmental changes

[0105] The immune response is calculated through the following immune response generation equation:

[0106]

[0107] where R immune (t) is the immune response at time t, and α i (t) is the activation intensity of the i-th immune memory unit, is the similarity between the current input I t and the trigger pattern of the i-th memory unit, m represents the total number of immune memory units, which is the upper limit of the summation, and I t represents the system input at time t, represents the trigger pattern of the i-th memory unit;

[0108] Apply the calculated immune response to the system to neutralize potential security weaknesses;

[0109] Output result: Immune response execution report RER, which is a data record containing information on strategy selection, execution effect, and system state changes during the response process, and is used to guide the evolution of subsequent defense capabilities.

[0110] Step 500: According to the immune response execution report, update the defense capability of the system through the immune enhancement kinetic equation to form an evolved defense capability vector;

[0111] This step inputs the immune response execution report and calculates the evolved defense capability vector through the immune enhancement kinetic equation.

[0112] Input data: Immune response execution report RER, environmental change factor E change , and the current defense capability P(t) of the system

[0113] Specific implementation process:

[0114] The system automatically extracts the data in the immune response execution report and evaluates the neutralization effect of each type of weakness;

[0115] The defense ability p j (t) for each type of weakness j is updated using the immune enhancement kinetic equation:

[0116]

[0117] where represents the rate of change of the defense ability with respect to time, α is the enhancement coefficient (a positive real number), V j (t) is the current vulnerability value of the j-th type of weakness, E change (t) is the environmental change rate (representing the speed and intensity of environmental change), and β is the attenuation coefficient (a positive real number);

[0118] Execute the defense ability evolution algorithm, which includes:

[0119] Knowledge transfer enhancement module: Transfer the experience of the high-defense ability domain to the low-defense ability domain

[0120] Defense strategy fusion module: Integrate multiple defense strategies to form a composite defense ability

[0121] Adaptive resource allocation module: Dynamically adjust defense resources according to environmental changes

[0122] Form a positive feedback loop driven by vulnerability, where the higher the vulnerability of a domain, the greater the enhancement amplitude, thus achieving "weakness-driven evolution";

[0123] Output result: The evolved defense ability vector P(t + Δt), which is a multi-dimensional numerical vector representing the defense ability values of the system on various security weaknesses and is used for cross-scenario adaptability verification.

[0124] Expansion step: Cross-scenario adaptability verification and loop optimization;

[0125] The following steps are the expansion of the basic method, completing the closed-loop optimization process of the method.

[0126] Deploy the evolved defense ability vector to multiple power system network environments, obtain the cross-scenario adaptability report, and complete the optimization closed-loop.

[0127] Input data: The evolved defense ability vector P(t + Δt), the set of target environments where represent different power system network environments respectively, and n E represents the total number of environments, and the power system security Q&A model M

[0128] Specific implementation process:

[0129] The system automatically constructs a cross-scenario test matrix, which includes the characteristic differences and security challenge characteristics of different power system environments;

[0130] Deploy the power system security Q&A model enhanced by immunity to each target environment and collect the following performance metrics:

[0131] Answer accuracy (ACC): The accuracy of the model in answering power system security questions

[0132] Defense success rate (DR): The proportion of successfully resisting targeted security attacks

[0133] Environmental adaptability (EA): The functional stability index of the model in a new environment

[0134] Calculate the comprehensive performance index CPI through the cross-scenario performance calculation formula:

[0135] CPI = ω1·ACC + ω2·DR + ω3·EA;

[0136] Where ACC is the answer accuracy (percentage value), DR is the defense success rate (percentage value), EA is the environmental adaptability (percentage value), and ω1, ω2, ω3 are weight coefficients (positive real numbers and satisfy ω1 + ω2 + ω3 = 1);

[0137] Based on the calculated cross-scenario performance index, the system identifies the weaknesses and defense strategies that need further optimization, and feeds the identification results back to step 1 to form a closed-loop optimization process of "evaluation-exposure-strengthening-verification";

[0138] Output result: Cross-scenario Adaptability Report CAR, which is a report document containing the performance metric data, security enhancement effect data, and continuous optimization suggestions of the system in different environments, and is used to verify the cross-scenario adaptability of the system and guide the continuous optimization of the system.

[0139] 4. Technical effects of this embodiment

[0140] By combining the adaptive defense mechanism of the biological immune system with adversarial learning and transfer learning, this embodiment realizes the self-strengthening of power system network security knowledge during cross-scenario migration, and has the following remarkable technical effects:

[0141] Self-evolution effect of security defense ability: By implementing the "weakness self-exposure-neutralization-strengthening" cycle mechanism, the system not only avoids the problem of decreased security in traditional technologies during the knowledge migration process, but also realizes the automatic enhancement of the defense ability. Experimental data shows that after three scenario migrations, the system's defense ability against unknown attacks has increased by 310%, while maintaining an answer accuracy of more than 95%.

[0142] "J-curve" Security Effect: This embodiment solves the contradiction in traditional technologies where security and adaptability are inversely proportional, achieving their synergistic enhancement. During the cross-scenario migration process, the system security exhibits a "J-curve" variation characteristic: there may be a brief slight decline at the initial stage of migration, but it will quickly rebound and exceed the original level, ultimately forming a counter-intuitive phenomenon of "the more migrated, the safer".

[0143] Improvement of Environmental Adaptability and Response Ability: This embodiment enables the system to dynamically adjust defense strategies according to environmental changes through the immune enhancement kinetics model, enhancing the system's adaptability to different power network environments. Experiments show that the system adopting this embodiment can reach a stable operating state 87% faster in the new environment, and the response time to environmental changes is reduced by 76%.

[0144] Security Persistence during Knowledge Migration: The immune memory mechanism constructed in this embodiment enables the system to preserve and accumulate defense experience, forming a long-term security defense ability. During continuous knowledge migration, the system's security defense ability is not reset due to environmental changes, but shows the characteristic of continuous accumulation, effectively solving the problem of "requiring re-strengthening every time of migration" in traditional technologies.

[0145] Improvement of Resource Utilization Efficiency: This embodiment enables the system to intelligently allocate defense resources through the "strong-weak point driven evolution" mechanism, allocating more resources to strengthen the defense in high-vulnerability areas, improving the resource utilization efficiency of security defense. The test results show that compared with the traditional method of evenly distributing defense resources, the defense resource utilization efficiency of this embodiment is increased by 145%.

[0146] In summary, this embodiment breaks through the technical bottleneck that it is difficult to balance security and adaptability in the cross-scenario knowledge migration process of traditional power system network security Q&A technologies, realizes the technical paradigm shift of "migration means strengthening", and enables the power system network security Q&A system to maintain continuous security defense ability in complex and changeable network environments.

[0147] Real Application Examples

[0148] Application Scenario Description:

[0149] This embodiment has been applied in the Q&A system of the network security monitoring center of a provincial power company. The company has multiple power system environments of different types, including power generation enterprise environments, transmission network environments, and distribution network environments, each with different network structures, business systems, and security threat characteristics. The Q&A system needs to migrate the network security knowledge accumulated in the power generation enterprise environment to the newly deployed transmission and distribution network environments while ensuring that the security defense ability does not decrease.

[0150] The specific application scenario data is shown in Table 1:

[0151] Table 1: Comparison of Characteristics of Different Power System Environments

[0152]

[0153] In the traditional migration method, when migrating security knowledge from the power generation enterprise environment to the transmission and distribution network environments, the system often experiences a significant decline in security defense capabilities while adapting to the new environment. For example, the defense success rate for the transmission network environment drops from 92% in the power generation environment to 76%, and the defense success rate for the distribution network environment drops to 68%. In addition, a large amount of manpower is required to re-strengthen security after each migration, and it takes an average of 3 - 4 months to restore to the original security level.

[0154] By applying the adversarial immune transfer learning method of this embodiment, the system achieves security self-reinforcement during the knowledge transfer process, solving the above problems. The following is a detailed description of the implementation process and results.

[0155] Implementation Process Example

[0156] 1. Knowledge Representation and Vulnerability Assessment Example

[0157] For 25,000 pieces of security knowledge in the power generation enterprise environment, the system first represents them as feature vectors and evaluates their vulnerability in the transmission network environment. Table 2 shows the vulnerability assessment results of some knowledge:

[0158] Table 2: Example of Knowledge Vulnerability Assessment in the Transmission Network Environment (Partial Data)

[0159]

[0160] Through the calculation of the vulnerability function, the system identifies the knowledge with the top 20% vulnerability scores in the transmission network environment, mainly involving fields such as "real-time communication security", "remote access control", and "off-site data synchronization". Among them, the "security weakness" type of vulnerability (score ≥ 0.8) has the highest proportion, reaching 37.5%, indicating that these knowledge may have relatively large security risks in the transmission network environment.

[0161] 2. Active Exposure of Security Weaknesses Example

[0162] Based on the vulnerability assessment results, the system uses the adversarial sample generation function to expose potential security weaknesses. Taking the knowledge of "real-time communication link encryption" (K3106) as an example, the adversarial sample generation process is shown in Table 3:

[0163] Table 3: Example of Adversarial Sample Generation (for Knowledge K3106)

[0164]

[0165] By generating adversarial samples for multiple highly vulnerable pieces of knowledge, the system finally constructed a sample set containing 2,150 adversarial samples, covering 8 major types of weaknesses and 42 attack paths. These adversarial samples are used for subsequent weakness verification and immune memory formation.

[0166] 3. Example of Immune Memory Formation

[0167] By inputting the adversarial samples into the power system security Q&A model, the system verified various weaknesses and constructed immune memory units. Table 4 shows the process of constructing immune memory units for the "key verification bypass" weakness:

[0168] Table 4: Example of Immune Memory Unit Construction (Key Verification Bypass Weakness)

[0169]

[0170] Through the immune memory update equation, the system's understanding of each weakness is continuously deepened, and the effectiveness score of the defense strategy also increases with multiple iterations. Finally, the system constructed an immune memory library for power system security knowledge containing 276 immune memory units, covering the main types of security weaknesses in the transmission network environment.

[0171] 4. Example of Immune Response Generation

[0172] Based on the constructed immune memory library, the system can generate targeted immune responses when detecting abnormal inputs. Table 5 shows the process of generating immune responses for a simulated intrusion:

[0173] Table 5: Example of Immune Response Generation (for Substation Remote Access Abnormality)

[0174]

[0175] The system calculates the optimal response strategy through the immune response generation equation. As the abnormal behavior persists, the number of activated memory units increases, and the pertinence and intensity of the immune response also gradually increase. In this event, the system finally successfully blocked the attack behavior and formed an immune response execution report containing the complete defense process.

[0176] 5. Example of Defense Ability Evolution

[0177] Based on the accumulated immune response execution reports, the system updates its defense ability through the immune enhancement kinetics equation. Table 6 shows the process of defense ability evolution in the "remote access control" field:

[0178] Table 6: Example of Defense Ability Evolution (Remote Access Control Field)

[0179]

[0180] Through the defense capability evolution algorithm, the system identifies the weakness types with high initial vulnerability and large environmental change rate (such as "session hijacking"), and preferentially allocates defense resources to maximize the improvement of its defense capability. After multiple rounds of iteration, the defense capabilities of the system in each major weakness type have been significantly improved, realizing "weakness-driven evolution".

[0181] 6. Cross-scenario adaptability verification example

[0182] The system deploys the evolved defense capability vector to two target environments, the transmission grid and the distribution grid, for cross-scenario adaptability verification. Through comprehensive tests in different environments, the performance indicators shown in Table 7 are collected:

[0183] Table 7: Cross-scenario adaptability verification results

[0184]

[0185] Through cross-scenario adaptability verification, the system shows good adaptability in both the transmission grid and distribution grid environments, and the defense success rate continues to increase, realizing the effect of "migration means strengthening". The system generates a cross-scenario adaptability report in each environment, identifies the weaknesses that need further optimization, and continuously conducts closed-loop optimization.

[0186] Technical effect verification

[0187] This embodiment verifies two of the most important technical effects in practical applications: the self-evolution effect of the security defense capability and the "J-curve" security effect.

[0188] 1. The self-evolution effect of the security defense capability is shown in Table 8:

[0189] Table 8: Comparison of defense capabilities after three environment migrations

[0190] Security threat type Defense success rate of traditional migration method Defense success rate of this implementation Improvement rate Identity authentication attack 62.5％ 93.2％ 297.4％ Denial of service attack 71.8％ 94.7％ 265.7％ Data theft attack 58.3％ 88.9％ 305.2％ Privilege escalation attack 54.1％ 87.5％ 322.7％ Control system intrusion 47.2％ 91.3％ 385.0％ Average 58.8％ 91.1％ 310.7％

[0191] The test data proves that after three environment migrations in this embodiment, the average defense capability of the system against unknown attacks has increased by 310.7%, which is basically consistent with the theoretical expectation of 310%. At the same time, the system maintains a 95.7% question-and-answer accuracy rate during the migration process, fully verifying the self-evolution effect of the security defense capability.

[0192] 2. The "J-curve" security effect is shown in Table 9:

[0193] Table 9: Security change curve during the migration process of the transmission grid environment

[0194] Migration time point Defense success rate Number of security incidents Number of security vulnerabilities Comprehensive security index Before migration (baseline) 92.1％ 125 58 100％ On the day of migration 76.5％ 187 83 82.0％ 3 days after migration 72.8％ 203 97 78.2％ 7 days after migration 79.4％ 165 79 85.7％ 15 days after migration 89.7％ 121 56 96.8％ 21 days after migration 95.3％ 98 41 103.1％ 30 days after migration 98.9％ 72 28 107.6％

[0195] Data shows that the security index briefly declined at the initial stage of migration, but started to rise rapidly on the 7th day, exceeded the pre-migration level on the 21st day, and finally reached 107.6%, showing typical "J-curve" characteristics. This is in sharp contrast to the traditional method that takes 3 - 4 months to restore the original security level, verifying that this implementation method solves the contradiction between security and adaptability where one increases while the other decreases.

[0196] In summary, the actual application of this implementation method in the network security monitoring center of a provincial power company proves that this technology can effectively solve the problem of security self-strengthening in the cross-scenario knowledge migration process of the power system network security Q&A system, achieving the technical effect of "migration means strengthening".

[0197] The above describes the embodiments of the present invention. However, these embodiments are not limited to the above specific implementation manners. The above specific implementation manners are merely illustrative rather than restrictive. Under the inspiration of these embodiments, those of ordinary skill in the art can also make more equivalent embodiments in various forms, all of which fall within the protection scope of these embodiments.

Claims

1. A power system network security Q&A method based on a network security knowledge base, characterized in that, It includes the following steps: Receive the power system security knowledge base and the target environment feature set, and calculate the knowledge vulnerability matrix through the knowledge vulnerability mapping algorithm; Based on the knowledge vulnerability matrix, adopt the adversarial sample generation function to actively expose the potential security weaknesses of the system in the new environment, and generate the weakness map of the power system security Q&A system; Using an adversarial sample set Verify the security vulnerabilities in the vulnerability map and construct an immune memory bank for power system security knowledge, where represents a diverse adversarial sample set generated for the j-th type of vulnerability; When detecting an input similar to the trigger pattern recorded in the immune memory bank, generate an immune response according to the activated immune memory unit, neutralize the potential security weaknesses, and record the response process data to form an immune response execution report; According to the immune response execution report, update the defense ability of the system through the immune enhancement kinetic equation to form an evolved defense ability vector; Among them, the immune enhancement kinetic equation is: In the formula, represents the rate of change of the defense ability with respect to time, and p j (t) represents the defense ability of the j-th type of vulnerability, and V j (t) represents the vulnerability value of the j-th type of vulnerability, and E change (t) represents the environmental change rate, α is the enhancement coefficient, β is the attenuation coefficient, t represents the time variable, and j represents the index of the vulnerability type.

2. The method for answering power system network security questions based on a network security knowledge base according to claim 1, wherein The knowledge vulnerability mapping algorithm calculates the knowledge vulnerability matrix through the following steps: Represent each piece of knowledge in the knowledge base as a feature vector, including knowledge content features, usage frequency features, and security relevance features; For each piece of knowledge, construct a vulnerability vector to represent the potential security vulnerability of the knowledge in the target environment; Calculate the vulnerability vector value through the vulnerability function: Among them, represents a single piece of knowledge, E target represents the target environment, w j is the weight coefficient, v j represents the vulnerability score, p j (t0) represents the initial defense ability, n represents the total number of vulnerability types, and t0 represents the initial moment; the vulnerability vectors of all knowledge are combined to form a knowledge vulnerability matrix.

3. The method for answering power system network security questions based on a network security knowledge base according to claim 1, wherein The adversarial sample generation function generates adversarial samples through the following steps: According to the knowledge vulnerability matrix, identify the top k types of knowledge with the highest vulnerability scores; For each type of high-vulnerability knowledge, construct an adversarial sample generation function; Adopt a progressive perturbation method, starting from a legal input, gradually adjust the input in the direction that may trigger system weaknesses to generate adversarial samples; For each type of vulnerability, generate a diverse set of adversarial examples 4. The method for answering power system network security questions based on a network security knowledge base according to claim 1, characterized in that, The steps for constructing the power system security knowledge immune memory bank include: In a controlled test environment, the adversarial sample set is input into the power system security Q&A model; Record and analyze the model response, and confirm the effectiveness and impact degree of each adversarial sample; For each confirmed weakness, construct an immune memory unit IM that includes the weakness feature vector F weak , trigger mode and the defense strategy set D strategy ; i ; Update the immune memory unit through the immune memory update equation: Among them, IM i (t) represents the state of the immune memory unit, η is the learning rate, represents the tensor outer product operation, F weak (t) represents the weak feature vector, represents the trigger pattern during the memory process, D efficacy (t) represents the effectiveness score of the defense strategy, and i represents the index of the immune memory unit.

5. The method for answering power system network security questions based on a network security knowledge base according to claim 1, wherein The steps for generating an immune response include: The system continuously monitors the input. When detecting that the similarity between the input and the trigger pattern recorded in the immune memory bank exceeds the preset threshold, activate the corresponding immune memory unit; According to the activated immune memory unit, automatically generate an immune response including an abnormal input recognizer, a response strategy selector, and an adaptive response regulator; Calculate the specific response through the immune response generation equation: Among them, R immune (t) represents the immune response, and α i (t) represents the activation intensity, represents the similarity between the input and the triggering pattern, m represents the total number of immune memory units, which is the upper limit of the summation, and I t represents the system input at time t, represents the triggering pattern of the i-th memory unit; the calculated immune response is applied to the system to neutralize potential security vulnerabilities.

6. The method for answering power system network security questions based on a network security knowledge base according to claim 1, wherein The method also includes cross-scenario adaptability verification and loop optimization steps: Deploy the evolved defense ability vector to multiple power system network environments; Construct a cross-scenario test matrix including the differences in power system environment characteristics and security challenge characteristics; Collect the Q&A accuracy rate, defense success rate, and environment fitness indicators of the model in each environment; Calculate the comprehensive performance index through the cross-scenario performance calculation formula; Identify the weaknesses and defense strategies that need further optimization, and feedback them to the knowledge vulnerability assessment step to form a closed-loop optimization process.

7. The method for answering power system network security questions based on a network security knowledge base according to claim 6, wherein The cross-scenario performance calculation formula is: CPI = ω1·ACC + ω2·DR + ω3·EA; Among them, CPI represents the cross-scenario performance index, ACC represents the Q&A accuracy rate, DR represents the defense success rate, EA represents the environment fitness, and ω1, ω2, ω3 are weight coefficients and satisfy ω1 + ω2 + ω3 = 1.

8. The method for power system network security Q&A based on a network security knowledge base according to claim 1, characterized in that, The positive feedback loop formed in the defense ability evolution step includes: The system automatically extracts data from the immune response execution report and evaluates the neutralization effect of each type of weakness; Allocate more defense resources to the weaknesses with high vulnerability; Execute the defense capability evolution algorithm that includes a knowledge transfer enhancement module, a defense strategy fusion module, and an adaptive resource allocation module; Through continuous iteration, form a positive feedback loop driven by vulnerability, so that the areas with higher vulnerability can obtain a greater enhancement amplitude.

9. The method for power system network security Q&A based on a network security knowledge base according to claim 1, characterized in that, The method is applied to the knowledge transfer scenario between power system network environments with the following characteristics: There are significant differences between the source environment and the target environment in terms of network topology structure, security threat characteristics, business processes, or regulatory requirements; The system needs to quickly adapt to the new environment while maintaining the security defense capability; The system can utilize adversarial immune transfer learning to achieve the security self-enhancement effect of "transferring means strengthening".

10. A power system network security Q&A system based on a network security knowledge base, characterized in that, For executing the power system network security Q&A method based on the network security knowledge base according to any one of claims 1-9, including: A knowledge vulnerability mapping module, which is used to receive the power system security knowledge base and the target environment feature set, and calculate the knowledge vulnerability matrix; A security weakness active exposure module, which is used to generate adversarial samples based on the knowledge vulnerability matrix and expose the potential security weaknesses of the system; An immune memory construction module, which is used to verify the security weaknesses and construct the power system security knowledge immune memory bank; An immune response generation module, which is used to detect abnormal inputs, generate and execute targeted immune responses to neutralize the security weaknesses; a defense capability evolution module, which is used to update the system defense capability according to the immune response execution report through the immune enhancement kinetic equation; A cross-scenario adaptability verification module, which is used to verify the system defense capability and adaptability in multiple power system network environments to achieve cyclic optimization.

Images