A network security management system for new energy power plants

Abstract

The present invention discloses a network security management system for a new energy power plant, which relates to the technical field of network security of a power system. The system includes a security defense system, a blockchain module, a privacy protection module, a security reshaping module, an encryption channel and a hardware acceleration unit. The security defense system is based on a layered architecture, realizes real-time collection, behavior modeling, anomaly detection, security event recording and global situation awareness of CPU instruction execution context, and can be adaptively adjusted. The blockchain module ensures distributed recording and verifiable execution of key data with anti-tampering characteristics. The privacy protection module protects the privacy of key operations. The security reshaping module automatically performs security enhancement after detecting a security incident. The encryption channel ensures the security of data transmission between modules. The hardware acceleration unit meets the system's high-frequency real-time response requirements, realizes comprehensive, intelligent and adaptive security protection for the network system of the new energy power plant, and has the advantages of strong real-time performance, high security and good credibility.

Description

Technical Field

[0001] The present invention relates to the technical field of power system network security, and in particular to a network security management system for a new energy power plant. Background Art

[0002] With the rapid development and widespread application of information technology, network security issues are becoming increasingly prominent, especially for critical infrastructure such as new energy power plants. Once a network security incident occurs, it may cause serious economic losses or even endanger personal safety. Therefore, building an efficient, intelligent and reliable network security management system is crucial to ensuring the safe and stable operation of new energy power plants.

[0003] The specification of Chinese invention patent application CN114386809A discloses a nuclear power plant network security threat warning and disposal system. The system realizes the circulation of local network security threat warning and disposal work orders of nuclear power plants through the nuclear power plant network security situation awareness system, and forms a knowledge base of processing methods for local nuclear power plant network security threat warning and disposal work orders. It aims to realize the standardized process of nuclear power plant network security threat warning and disposal, and optimize the network security operation and management of nuclear power plants in an efficient and standardized manner. However, this design mainly focuses on the process management of threat warning and disposal and the construction of a knowledge base, but lacks the ability to deeply monitor and analyze the behavior of the underlying system, making it difficult to cope with increasingly complex and advanced threats targeting the instruction execution level.

[0004] The specification of Chinese invention patent CN113191917B discloses a method for classifying network security threats for power plant industrial control systems based on a radial basis function algorithm. This method monitors network security anomalies in the power plant industrial control system, classifies network security events using an RBF neural network, and blocks network security anomalies based on the classification results. This design uses a machine learning algorithm to classify and block network security threats, but its main focus is on analyzing anomalies at the network traffic level. It has limited detection capabilities for more subtle and in-depth threats that exploit instruction execution contexts. Furthermore, this design does not address advanced security features such as data integrity protection, privacy protection, and system adaptability and self-reshaping.

[0005] The above design has improved the power plant's cybersecurity protection capabilities to a certain extent by establishing a threat warning and disposal process, building a knowledge base, and using machine learning to classify threats. However, it still has certain limitations, such as the lack of real-time monitoring and analysis of the underlying instruction execution context, making it difficult to effectively respond to complex attacks such as advanced persistent threats (APTs); at the same time, it lacks consideration for the integrity of critical data, the privacy of operations, and the system's adaptability and self-recovery capabilities. Summary of the Invention

[0006] The purpose of the present invention is to overcome the deficiencies of the prior art and to propose a network security management system for a new energy power plant to solve the above-mentioned problems.

[0007] By analyzing the execution context of CPU instructions in real time, introducing blockchain technology to ensure data integrity, using zero-knowledge proof to protect privacy, achieving automatic reconstruction after security incidents, and hardware acceleration, the ability of new energy power plants to cope with various network security risks is improved.

[0008] The object of the present invention is achieved through the following technical solutions: A network security management system for a new energy power plant, comprising:

[0009] The security defense system, based on a layered architecture, implements real-time collection of CPU instruction execution context, behavior modeling, anomaly detection, security event recording, and global situational awareness, and can adaptively adjust.

[0010] The blockchain module enables distributed recording of key data with tamper-resistant characteristics, verifiable execution, and device status synchronization; the privacy protection module protects the privacy of key operations; the security reconstruction module automatically performs security enhancements and policy reconstruction after detecting a security incident; the encrypted channel ensures the confidentiality, integrity, and reliability of data transmission between modules; and the hardware acceleration unit meets the system's high-frequency, real-time response requirements.

[0011] The security defense system includes: a data acquisition module, including an instruction analyzer and a behavior modeling module, which are used to collect structured instruction execution context data and build and update normal behavior feature models or portraits respectively; a threat detection module, which receives data from the instruction analyzer and behavior modeling module, and uses the SVM and Isolation Forest algorithms to perform anomaly detection and risk assessment; an event response module, which records events and triggers predefined responses when the threat detection module detects high risks; a situational awareness module, which integrates data from the event response module, threat detection module and behavior modeling module to achieve security situation monitoring and trend analysis, and optimizes the parameters of the behavior modeling module and threat detection module through feedback; a trust engine, which builds a four-dimensional trust model, uses reinforcement learning to dynamically adjust weights, and combines semantic association and behavior prediction to achieve dynamic trusted authentication and trust accumulation; a policy weaving module, which realizes active response and automatic adjustment of security policies through differential policy evaluation and security grid optimization mechanism;

[0012] The context adaptation module standardizes device information into trust context and enables secure access to cross-manufacturer devices through a trust handshake protocol; the blockchain module includes a trusted execution environment and a chain synchronization module to ensure the integrity and traceability of key data; the hardware acceleration unit uses dedicated acceleration and multi-core parallel processing technology.

[0013] The instruction analyzer includes: an instruction acquisition unit for collecting CPU instruction execution context data in real time; an instruction preprocessing unit for preprocessing instruction data and parsing it into opcodes; a context extraction unit for extracting the context sequence of the target instruction and the associated register changes; an event record generation unit for structuring the processed data into an event record containing EventID, timestamp, running trajectory, PID, memory access address, register status and previous and next instruction information; and a data screening unit for eliminating redundant information.

[0014] The behavior modeling module includes: a behavior modeling unit, which uses data from the instruction analyzer to construct an initial normal behavior feature model or portrait through clustering, and adaptively updates the feature model or portrait during operation to form a multi-dimensional behavior model for threat detection.

[0015] The threat detection module includes: a feature selection unit, which is used to receive standard event records from the instruction analyzer and the behavior model data output by the behavior modeling module, and perform feature selection; a risk classification unit, which is used to use SVM to perform multi-level risk classification on the data; an anomaly screening unit, which is used to apply the Isolation Forest algorithm for rapid anomaly screening; and a risk assessment unit, which is used to establish a risk scoring system and output risk levels, event descriptions, and related data.

[0016] The event response module includes: an event triggering unit, which is used to automatically trigger event recording when the threat detection module detects a high risk; an event association unit, which is used to associate the triggered event with relevant information to form an event view; a log recording unit, which is used to record detailed event information in the security log; and a response triggering unit, which is used to automatically trigger predefined response measures according to the risk level.

[0017] The situation awareness module includes: a situation monitoring unit, which is used to monitor and analyze the overall security situation in real time. Its data comes from the event response module, threat detection module and behavior modeling module; a policy recommendation unit, which is used to integrate external threat intelligence to propose security policy optimization suggestions; a feedback optimization unit, which is used to feed back the monitoring results to the behavior modeling module and threat detection module in real time through feedback to optimize the behavior model and detection parameters.

[0018] Information is transmitted between modules using encrypted channels, with digital signatures and checksums attached.

[0019] The hardware acceleration unit includes: a high-frequency acquisition unit, which uses a dedicated monitoring chip or hardware accelerator in the data acquisition module to achieve high-frequency data acquisition; a parallel monitoring unit, which uses multi-core parallel processing technology to synchronously monitor multi-core CPU data; and an algorithm acceleration unit, which deploys machine learning acceleration units in the behavior modeling module and threat detection module to improve the computational efficiency of related algorithms.

[0020] The system optimization and data flow unit is used to optimize for new energy power plant scenarios, connect with the power plant control system and sensor interface, obtain operating status and environmental parameters in real time, dynamically adjust data collection frequency, detection sensitivity and response strategy, and generate security situation reports.

[0021] The trust engine includes: a trust model construction unit, which constructs a four-dimensional trust model. The temporal contextual credibility is embedded in time information based on a predefined event time series model; a trust assessment unit, which uses reinforcement learning to dynamically adjust the weights of each dimension and combines semantic associations to analyze resource access intent, achieving trust accumulation and behavior prediction;

[0022] The policy weaving module includes: a policy adjustment unit, which uses differential policy evaluation and security grid optimization mechanisms to achieve proactive security policy adjustments and behavioral recommendations;

[0023] The context adaptation module includes: a context processing unit, which is used to standardize device information into a trust context, verify consistency through a trust handshake protocol, and realize automatic adjustment of authentication processes and access rights.

[0024] The trusted execution environment of the blockchain module includes: an application packaging and signing unit, which is used to package key industrial control applications into verifiable execution modules and sign them on the blockchain for audit and traceability;

[0025] The chain synchronization module of the blockchain module includes: a data synchronization and verification unit for realizing multi-point backup and synchronization of key data, and an integrated privacy protection module to realize the verifiability of key operations;

[0026] The instruction interception module includes: an instruction review and interception unit that integrates a situational threat engine to review sensitive instructions in real time, suspending execution and triggering a response when potential risks are detected;

[0027] The Security Reshaping Module includes: a policy reshaping unit, which automatically performs policy self-correction and reconstruction based on security event data, and disseminates security enhancement measures through the blockchain consensus mechanism;

[0028] The blockchain module also includes: a participant management unit, which is used to allow system participants to dynamically join or exit the blockchain network based on security requirements.

[0029] The beneficial effects of the present invention are:

[0030] 1. By collecting and analyzing the CPU instruction execution context in real time, it can gain an in-depth understanding of the system's lowest-level operating behavior, effectively detect advanced threats such as malicious code and rootkits that are difficult to detect with traditional security measures, and achieve fine-grained monitoring of system behavior. Based on the normal instruction execution mode, a multi-dimensional behavior model is built to accurately identify abnormal activities that deviate from normal behavior, reduce false alarm rates, and improve the accuracy of threat detection. By integrating data from various security modules, it can achieve real-time monitoring and trend analysis of the network security situation of the entire new energy power plant, providing managers with a global security perspective and timely grasp of potential risks.

[0031] 2. The system can dynamically adjust security policies and model parameters according to changes in the actual environment and attack situation, improving its ability to respond to unknown and new threats. The policy weaving module can proactively adjust security policies based on risk assessment and threat intelligence, and make recommendations on security behaviors, transforming security protection from passive response to active defense. Through differential policy evaluation and security grid optimization mechanisms, it can achieve automated adjustment of security policies, reduce manual intervention, and improve the effectiveness of security policies.

[0032] 3. Utilize blockchain technology to provide tamper-resistant distributed storage and recording for key power plant operating data, security logs, and policy configurations, ensuring data integrity and credibility. Through a trusted execution environment, ensure that the source of key industrial control applications is trustworthy and has not been tampered with during execution. Dedicated encrypted channels are used for communication between modules within the system to ensure the confidentiality, integrity, and reliability of data transmission, prevent data leakage and tampering, and use privacy protection technologies such as zero-knowledge proof to protect sensitive information of the power plant during key operations and prevent risks brought by information leakage.

[0033] 4. The introduction of a hardware acceleration unit significantly improves the system's data acquisition, analysis, and processing speeds, meeting the stringent requirements of new energy power plants for high-frequency, real-time security monitoring and response. A dedicated machine learning acceleration unit improves the computational efficiency of key algorithms such as behavior modeling and threat detection, shortening analysis time and reducing resource consumption. The system is optimized for the unique scenarios of new energy power plants and can better adapt to their operating characteristics and safety requirements.

[0034] 5. When a high-risk security incident is detected, the system can automatically trigger predefined response measures, shorten response time, reduce manual intervention, and associate security incidents with related instructions, execution processes, and user information to form a complete event view, which helps security analysts understand the ins and outs of the incident. After a serious security incident occurs, the security reshaping module can automatically perform security enhancements and policy reconstruction to quickly restore the system security status and enhance system resilience.

[0035] 6. The context-adaptive module implements security context synchronization and secure access control across vendor devices, simplifies security management in heterogeneous environments, and improves overall security. The trust engine implements dynamic trusted authentication based on a multi-dimensional trust model, which can more accurately control access to key power plant resources and allow authorized system participants to dynamically join or exit the blockchain network based on security requirements, enhancing the system's flexibility and manageability.

[0036] 7. The instruction interception module can review sensitive instructions in real time at the instruction execution level to prevent potential malicious operations. The security reconstruction module can automatically self-correct and reconstruct strategies based on security event data, and disseminate security enhancement measures through the blockchain consensus mechanism, forming a defense system with self-evolution and continuous improvement capabilities. The situational awareness module can integrate external threat intelligence, provide suggestions for optimizing security strategies, and continuously enhance the system's defense capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 The system architecture of the present invention Figure 1 ;

[0038] Figure 2 The system architecture of the present invention Figure 2 . DETAILED DESCRIPTION

[0039] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0040] It is to be noted that the directions of "left", "right", "up", "down", "front", "back", "inside" and "outside" in the following schemes are all relative directions and are not listed here one by one.

[0041] Example 1:

[0042] like Figures 1 to 2 As shown, this embodiment describes the core architecture of a network security management system for a new energy power plant. The system is designed to provide comprehensive and adaptive security protection capabilities to cope with increasingly complex network threats and ensure the safe and stable operation of the power plant. The system adopts a layered architecture and integrates multiple advanced security technologies to achieve effective protection of the power plant's key information systems and equipment.

[0043] The core architecture of the cybersecurity management system consists of the following key modules, which work together to build the power plant's cybersecurity defense line:

[0044] The security defense system is based on a layered architecture design and focuses on real-time monitoring and analysis of the CPU instruction execution context during power plant operation. It is capable of behavioral modeling, anomaly detection, security event recording, and global situational awareness, and has the ability to dynamically adapt to the actual environment and attack situation.

[0045] The blockchain module uses blockchain technology to provide tamper-resistant distributed storage and recording for the power plant's key operating data, security logs, and policy configurations. It also supports verifiable execution processes and can synchronize status information between different devices to ensure data consistency and credibility.

[0046] The privacy protection module uses privacy protection technologies such as zero-knowledge proof to protect sensitive information of power plants during key operations (such as policy updates and configuration changes) and prevent information leakage.

[0047] The security reshaping module can automatically trigger the security enhancement and policy reconstruction process when the system detects a serious security incident. It uses a trusted consensus mechanism to deploy new security policies and defense measures throughout the system to achieve "self-evolution" of security.

[0048] The various modules within the system communicate with each other through a dedicated encrypted data channel. This channel not only encrypts the data, but also comes with a digital signature and integrity verification mechanism to ensure the confidentiality, integrity and reliability of the data during transmission, and prevent the data from being eavesdropped, tampered with or forged.

[0049] Hardware acceleration unit. In order to meet the needs of new energy power plants for high-frequency and real-time security response, the system integrates dedicated acceleration and multi-core parallel processing technology at the hardware level. This can significantly improve the speed of data collection, analysis and processing, ensuring that the system can detect and respond to security threats in a timely manner.

[0050] The internal modules of the security defense system are further divided into the following functional modules:

[0051] The data acquisition module is the data entry point of the security defense system and includes:

[0052] The instruction analyzer is responsible for collecting instruction execution context data from key servers and control system CPUs of new energy power plants in real time, such as register values ​​and memory addresses. It can perform in-depth analysis and structured conversion of the original machine code to extract meaningful security information.

[0053] The behavioral modeling module builds and updates the normal behavioral characteristic model or portrait of the power plant system in real time based on the data collected by the instruction analyzer. In the early stage of system deployment, it will establish an initial baseline model through learning, and dynamically adjust the model parameters through online adaptive algorithms (such as Kalman filtering) during operation to form a multi-dimensional behavioral model and baseline reference.

[0054] The threat detection module receives data from the instruction analyzer and behavior modeling modules, and uses machine learning algorithms (support vector machine (SVM) and isolation forest) to detect anomalies and conduct risk assessments on system behaviors. SVM is used to perform multi-level risk classification and determine the risk level of different behaviors; isolation forest is used to quickly identify and isolate abnormal behaviors and reduce the consumption of computing resources.

[0055] The event response module automatically triggers security event recording when the risk level detected by the threat detection module reaches the preset threshold, and associates the event with relevant instructions, execution processes, and user information to form a complete event view. At the same time, based on the risk level, the module can automatically trigger predefined response measures, such as isolating the affected process, blocking access by malicious users, or updating security policies.

[0056] The situational awareness module integrates data from the incident response module, threat detection module, and behavior modeling module to conduct real-time monitoring and trend analysis of the entire power plant's network security situation. It can provide an intuitive security dashboard to display the current risk status and potential threat trends, and through a feedback loop, it can feed back security logs, risk assessments, and anomaly detection results to the behavior modeling module and threat detection module in real time to continuously optimize the behavior model and detection parameters and improve detection accuracy and efficiency.

[0057] The trust engine builds a four-dimensional trust model, evaluating identity credibility, environmental security status credibility, resource access behavior credibility, and temporal context credibility (TRT). It uses a reinforcement learning algorithm to dynamically adjust the weights of each dimension, and combines semantic association and behavior prediction technology to achieve dynamic trusted authentication and trust accumulation for power plant users and equipment, thereby more accurately controlling resource access.

[0058] The policy weaving module compares the effectiveness of different security policies through differential policy evaluation (such as A / B testing) and uses the security grid optimization mechanism to collaboratively adjust the parameters of each policy. Its goal is to achieve proactive risk response and automated adjustment of security policies. It can also proactively propose safe behavior recommendations based on the current threat situation and system status, thereby improving the overall security defense capabilities of the power plant.

[0059] The context adaptation module standardizes the configuration information, firmware versions, TLS configurations, security policies, etc. of various devices in the power plant into trust context information. Through the trust handshake protocol, the module can achieve automatic context synchronization and secure access control between devices across manufacturers, thereby simplifying security management and improving security in heterogeneous environments.

[0060] The security defense system is responsible for real-time monitoring and analysis of the operating status of key power plant systems, identifying potential security threats, and making preliminary responses and recording them. Its working principle is to establish normal behavior patterns through in-depth analysis of the details of CPU instruction execution. Once behavior deviating from the normal pattern is found, it is marked as an anomaly and further processed.

[0061] The blockchain module provides a secure, transparent and tamper-resistant data storage platform for recording important security-related information. Its working principle is to use distributed ledger technology to store data in a dispersed manner across multiple nodes. Any change to the data requires consensus from multiple nodes in the network to ensure the integrity and traceability of the data.

[0062] When performing sensitive operations, such as updating security policies or configuring key parameters, the privacy protection module ensures that the specific content of the operation is not disclosed to unauthorized third parties. It works by using cryptographic techniques such as zero-knowledge proof, allowing one party (the prover) to prove that it possesses certain knowledge without providing any useful information to the other party (the verifier).

[0063] After a serious security incident occurs, the security reshaping module can quickly adjust the system's security posture and enhance defense capabilities. Its working principle is based on predefined security policies and a trusted consensus mechanism, automatically deploying new security rules, isolating damaged systems, and even rolling back to a safe state to achieve rapid recovery and enhanced defense.

[0064] The encrypted channel ensures the security of communication between various modules within the system. Its working principle is to encrypt the transmitted data using an encryption algorithm to prevent the data from being eavesdropped during transmission; at the same time, through digital signatures and checksum mechanisms, it ensures the integrity of the data and prevents the data from being tampered with or forged.

[0065] The hardware acceleration unit improves the system's ability to process large amounts of real-time data through dedicated hardware accelerators and multi-core parallel processing technology. Its working principle is to use the parallel computing capabilities of the hardware to accelerate key tasks such as data acquisition, instruction analysis, and the execution of machine learning algorithms, thereby meeting the power plant's requirements for real-time safety monitoring and response.

[0066] Data processing flow:

[0067] Data collection,The instruction analyzer collects the CPU instruction execution context data of the key systems of the new energy power plant in real time.

[0068] Behavior Modeling,The behavior modeling module receives data from the instruction analyzer, and builds and updates the,normal behavior characteristic model or portrait of the system.

[0069] Threat Detection,The threat detection module receives the structured event records from the,instruction analyzer and the behavior model data output by the,behavior modeling module, performs feature selection, and uses the,SVM and Isolation Forest algorithms for anomaly detection and,risk assessment.

[0070] Incident Response,When the threat detection module detects a high risk, the incident response module records the,event, associates relevant information, and records the incident details to the,security log, while triggering predefined response measures based on the risk,level.

[0071] Situational Awareness and Feedback,The situational awareness module integrates data from the incident response module,,threat detection module and behavior modeling module to,perform security situation monitoring and trend analysis, and feeds back,the analysis results to the behavior modeling module and threat,detection module to optimize their parameters.

[0072] Trust evaluation and authentication: The trust engine builds a trust model based on the collected user, environment, behavior and time information, and performs dynamic evaluation and authentication.

[0073] Policy management,The policy weaving module realizes the active adjustment and update of security policies through,evaluation and optimization mechanisms.

[0074] Context synchronization and secure access,The context adaptation module standardizes device information and enables secure access to,devices across manufacturers through a trust handshake protocol.

[0075] Data storage and verification, the blockchain module is used to store key data and ensure the integrity and traceability of the data through the trusted execution environment and chain synchronization module.

[0076] Privacy Protection,The privacy protection module protects sensitive information during critical operations.

[0077] Security remodeling: When a security incident is detected, the security remodeling module automatically performs security enhancement and policy reconstruction.

[0078] Data transmission is secure, and data transmission between all modules is protected by encrypted channels.

[0079] By collecting and analyzing the execution context of CPU instructions in real time, the system can gain a deep understanding of the system's operating status and promptly detect potential malicious behavior, thus addressing the shortcomings of traditional security defenses. The system can dynamically adjust security policies and model parameters based on the actual environment and attack dynamics, improving its ability to respond to unknown threats. Leveraging blockchain technology, the system ensures that the plant's key operating data and security logs are tamper-resistant and traceable, providing a reliable basis for security incident analysis and accountability. Technologies such as zero-knowledge proofs are employed to protect sensitive information during security management operations and prevent the risks of information leakage. The security reconfiguration module rapidly strengthens security and reconfigures policies after detecting a serious security incident, shortening response time and minimizing losses. Encrypted channels ensure the confidentiality, integrity, and reliability of data transmission within the system, protecting data from malicious attacks during transmission. The introduction of hardware acceleration units significantly enhances the system's data processing capabilities, meeting the stringent real-time security monitoring and response requirements of new energy power plants. The context adaptation module enables cross-vendor device security context synchronization and secure access, simplifying security management in heterogeneous environments. The trust engine implements dynamic trusted authentication based on a multi-dimensional trust model, enabling more precise control of access to key plant resources.

[0080] In summary, the core architecture of the network security management system for new energy power plants described in this embodiment, by integrating multiple advanced security technologies and modular design, can provide power plants with a comprehensive, intelligent, and adaptive security solution, effectively improving the network security protection level of power plants and ensuring their safe and stable operation.

[0081] Example 2:

[0082] like Figures 1 to 2 As shown, based on the overall architecture described in Example 1, this embodiment focuses on the specific structure, function, working principle, data processing flow and beneficial effects of the instruction analyzer, behavior modeling module, threat detection module, event response module and situational awareness module within the security defense system. These modules are key components for achieving refined monitoring and response to the network security of new energy power plants.

[0083] The instruction analyzer is the core component of the data acquisition module and includes the following functional units:

[0084] The instruction acquisition unit, as the front end of data acquisition, is responsible for capturing the instruction stream executed by the CPU of the key servers and control system of the new energy power plant in real time, and extracting its context information, including program counters, register values, memory addresses, operands, etc.

[0085] The instruction preprocessing unit performs preprocessing operations such as cleaning and formatting on the collected raw instruction data, parsing complex machine codes into opcode forms that are easier to understand and analyze, laying the foundation for subsequent analysis and modeling.

[0086] Within a preset time window, the context extraction unit extracts the sequence of instructions executed continuously before and after a specific target instruction and records the changes in related registers, thereby constructing the execution context of the instruction and revealing the logical relationship between instructions and the potential behavioral intentions.

[0087] The event record generation unit structures and formats the pre-processed and context-extracted instruction data into standard event records. Each record usually contains a unique event ID, occurrence timestamp, program execution trajectory, system process ID (PID), memory access address, status of key registers, and information about several instructions before and after the target instruction.

[0088] The data screening unit filters and selects the generated event records to remove low-precision, redundant or irrelevant information for security analysis, so as to reduce the amount of data for subsequent processing and improve analysis efficiency.

[0089] The function of the instruction analyzer is to deeply explore the underlying operating behavior of the system and convert the CPU instruction execution into data that can be used for security analysis. Its working principle is to use hardware or software Hook technology to monitor the execution process of CPU instructions in real time without affecting the normal operation of the system, and to parse and analyze the execution process to extract key information that can reflect the system behavior.

[0090] It can monitor system behavior from the lowest instruction level, discover malicious code and abnormal operations that are difficult to detect with traditional security measures, extract the context of instruction execution, and help understand the complete process and potential impact of attack behavior. The generated standardized event records provide a structured, high-quality data source for behavior modeling and threat detection.

[0091] The behavior modeling module includes the core functional units:

[0092] The behavior modeling unit is responsible for building and maintaining the system's normal behavior feature model or portrait. During the system deployment phase, it uses historical data from the instruction analyzer to learn the system's normal instruction execution mode through clustering algorithms such as K-Means to build an initial baseline model. During system operation, it uses online adaptive algorithms (such as Kalman filtering) to dynamically update the feature model or portrait to adapt to changes in the system's operating status. At the same time, the unit will normalize the various parameters of the feature model or portrait to form a multi-dimensional behavior model and baseline reference.

[0093] The role of the behavior modeling module is to learn and understand the normal behavior patterns of the system, provide a benchmark for subsequent anomaly detection, use machine learning algorithms to analyze a large amount of normal behavior data, extract features that can characterize the normal operating status of the system, and establish a corresponding mathematical model.

[0094] Data processing flow: Standardized event records from the command analyzer ~ behavior modeling unit (initial feature model or profile construction, online adaptive update, normalization processing) ~ multi-dimensional behavior model output to the threat detection module.

[0095] It can accurately characterize the normal operating status of the system and provide a reliable basis for identifying abnormal behavior.

[0096] Dynamically adapt to system changes: Through online adaptive updates, it can cope with behavioral pattern changes caused by changes in system configuration, load, etc., reduce false alarm rates, and the generated multi-dimensional behavioral model can more comprehensively reflect the behavioral characteristics of the system and improve the accuracy of anomaly detection.

[0097] The threat detection module includes the following functional units:

[0098] The feature selection unit receives the standard event records from the instruction analyzer and the behavior model data output by the behavior modeling module, and selects the most effective features for anomaly detection, reduces data noise, and improves detection efficiency.

[0099] The risk classification unit uses the support vector machine (SVM) algorithm to perform multi-level risk classification on feature-selected data, dividing different abnormal behaviors into different risk levels, thereby achieving more refined threat management.

[0100] The anomaly screening unit uses the Isolation Forest algorithm to quickly screen data for anomalies. This algorithm can efficiently detect potential malicious behaviors by isolating anomalies and reduce overall computing resource usage.

[0101] Based on the results of risk classification and anomaly screening, the risk assessment unit establishes a risk scoring system, conducts a comprehensive assessment of the detected anomalies, and ultimately outputs the risk level, event description, and related instructions and feature data.

[0102] Function and working principle The function of the threat detection module is to identify abnormal behaviors and potential security threats in the system. Its working principle is to use machine learning algorithms to analyze the system's behavioral data, compare it with the normal behavior model, and determine whether there are any anomalies based on preset rules and thresholds.

[0103] Combining the SVM and Isolation Forest algorithms can achieve multi-level risk classification and rapid anomaly screening, improving detection accuracy and efficiency. The application of the Isolation Forest algorithm helps reduce computing resource usage and is suitable for resource-constrained industrial control environments. The output risk level, event description, and related data provide important information support for subsequent incident response and security analysis.

[0104] The event response module includes the following functional units:

[0105] The event trigger unit monitors the output of the threat detection module and automatically triggers the event recording process when the detected risk level reaches the preset threshold.

[0106] The event correlation unit associates the triggered events with related instructions, execution processes, user information, and contextual data to form a complete event view, helping security analysts understand the ins and outs of the events.

[0107] The logging unit records detailed information about events (including timestamp, event type, risk level, participation instructions, user information, and contextual data) in the security log, providing a basis for subsequent security audits and analysis.

[0108] The response trigger unit automatically triggers predefined response measures based on the risk level of the incident, such as isolating the affected process, blocking access by malicious users, updating firewall rules, or initiating other security policies.

[0109] The function of the incident response module is to take appropriate measures to mitigate or eliminate the impact of security threats after detecting them. Its working principle is based on preset response strategies and rules, and automatically performs corresponding operations according to different risk levels.

[0110] It can automatically execute response measures according to preset strategies, shorten response time, reduce the need for manual intervention, and associate events with relevant information, which helps security analysts fully understand the scope of impact and root causes of events. The recorded detailed event information provides valuable data for subsequent security audits and analysis.

[0111] The situational awareness module includes the following functional units:

[0112] The situation monitoring unit integrates data from the incident response module, threat detection module and behavior modeling module to monitor and display the network security situation of the entire new energy power plant in real time, conduct long-term trend analysis, and predict future security risks.

[0113] The strategy recommendation unit integrates external threat intelligence information, such as the latest vulnerability information and attack trends, and combines it with the current system security situation to provide suggestions for optimizing security strategies and help power plants improve their overall defense capabilities.

[0114] The feedback optimization unit uses a feedback loop to feed back the security logs, risk assessment results, and anomaly detection results collected by the situation monitoring unit to the behavior modeling module and threat detection module in real time. This is used to continuously optimize the behavior model and detection parameters, improve the accuracy and efficiency of detection, and form a closed-loop self-optimization system.

[0115] Function and working principle The function of the situational awareness module is to provide power plant managers with a global security perspective, helping them understand the current safety status, predict future risks, and guide the formulation and optimization of safety strategies. Its working principle is to form a comprehensive understanding of the overall safety situation by collecting, analyzing and visualizing data from various safety modules.

[0116] It provides a comprehensive understanding of the network security status of the entire power plant, helping managers to grasp risks in a timely manner. It combines external threat intelligence and the system's own status to provide targeted security strategy optimization suggestions, optimizes behavioral models and detection parameters through feedback loops, and continuously improves the system's detection accuracy and efficiency.

[0117] Through the above detailed description, Example 2, based on Example 1, deeply reveals the specific implementation method of the key modules within the security defense system and its important role in the network security management system of new energy power plants, further reflecting the technical details and innovation of the invention.

[0118] Example 3:

[0119] like Figures 1 to 2 As shown, based on Example 1 and Example 2, this embodiment further describes in detail the key enhanced functions and trusted mechanisms in the system for improving security and reliability, including encrypted communication between modules, detailed implementation of hardware acceleration units, internal operations of trust and authentication enhancement units, and collaborative work between blockchain modules and active defense mechanisms.

[0120] Encrypted channel: Dedicated encrypted data channels are established between all modules in the system (including various sub-modules within the security defense system, as well as the security defense system and blockchain modules, privacy protection modules, security reconstruction modules, etc.). Each channel is isolated from other channels at the physical or logical level to ensure the exclusivity of data transmission.

[0121] The main function of the encryption channel is to ensure the confidentiality, integrity and reliability of data transmission within the system. Its working principles include: Data encryption: Use advanced encryption algorithms (such as AES, RSA, etc.) to encrypt the transmitted data to prevent unauthorized third parties from eavesdropping on the data content; Digital signature: The sender digitally signs the data to be sent, and the receiver confirms the source of the data by verifying the signature to prevent the data from being forged; Check code: Add a check code (such as CRC, SHA, etc.) during the data transmission process, and the receiver uses the check code to detect whether the data has errors or has been tampered with during the transmission process.

[0122] Data processing flow: When one module needs to send data to another module, the data is first encrypted, then attached with the sender's digital signature and check code, and transmitted to the receiver through a dedicated encrypted channel. After receiving the data, the receiver first verifies the check code to confirm the data integrity; then verifies the digital signature to confirm the source of the data; finally, uses the corresponding key to decrypt the data to obtain the original information.

[0123] To prevent data leakage, encryption ensures that even if the data is intercepted, it cannot be understood by unauthorized parties, preventing data tampering. Digital signatures and checksums ensure the integrity of the data. Any modification to the data will be detected to ensure the reliability of the data source. Digital signatures can verify the sender of the data and prevent malicious modules from disguising their identities and sending false information.

[0124] The hardware acceleration unit is integrated at the bottom layer of the system, providing high-performance computing support for key modules. It includes the following components: The high-frequency acquisition unit uses a dedicated monitoring chip or hardware accelerator (such as FPGA) in the instruction analyzer of the data acquisition module to achieve high-speed and accurate acquisition of the CPU instruction stream to meet the high-frequency operation requirements of the new energy power plant control system.

[0125] The parallel monitoring unit uses multi-core parallel processing technology (such as multi-core CPU, GPU, etc.) to achieve synchronous monitoring and preliminary processing of multiple CPU core data, significantly improving data processing throughput.

[0126] The algorithm acceleration unit deploys dedicated machine learning acceleration units (such as GPUs, TPUs, etc.) in the behavior modeling module and threat detection module to optimize the computational efficiency of machine learning algorithms such as K-Means clustering, Kalman filtering, SVM, and Isolation Forest, shortening the time for model training and anomaly detection.

[0127] The system optimization and data flow unit is responsible for optimizing for special scenarios of new energy power plants. For example, it connects with the power plant's SCADA system, PLC, sensors and other interfaces to obtain the power plant's operating status and environmental parameters in real time. At the same time, the unit dynamically adjusts the data collection frequency, anomaly detection sensitivity and response strategy according to the operating characteristics of on-site equipment, and is responsible for generating detailed security situation reports for reference in management decisions.

[0128] The role of the hardware acceleration unit is to improve the performance of the system, enabling it to promptly process and analyze the large amount of real-time data generated by new energy power plants and quickly respond to security threats. Its working principle is to use the parallel computing capabilities and dedicated optimization of the hardware to accelerate key data processing and computing-intensive tasks.

[0129] The hardware acceleration unit is involved in multiple links such as data collection, behavior modeling, and threat detection. It improves the processing speed of each link through hardware acceleration, and ultimately speeds up the response speed and analysis efficiency of the entire system.

[0130] It meets the high-frequency, real-time data processing needs of new energy power plants, shortens the time for behavior modeling and threat detection, and enables faster discovery and response to security threats. Hardware acceleration reduces the burden on the CPU, improves the overall operating efficiency and stability of the system, and can be customized and optimized according to the characteristics of new energy power plants, improving the applicability and effectiveness of the system.

[0131] The trust and authentication enhancement unit is composed of a trust engine, a policy weaving module, and a context adaptation module, and is designed to improve the trust of the system and the security of the authentication mechanism.

[0132] Trust Engine: The trust model building unit constructs a four-dimensional trust model, including identity trustworthiness (based on identity authentication and authorization information), environmental security status trustworthiness (based on system vulnerability scanning, configuration compliance, and other assessments), resource access behavior trustworthiness (based on historical access records and behavior pattern analysis), and time context trustworthiness (TRT). TRT relies on a predefined event time series model to embed time information into the trust assessment, such as increasing the security alert level during critical operation time periods.

[0133] The trust assessment unit introduces an impact weight coefficient and uses a reinforcement learning algorithm to dynamically adjust the weights of each dimension to adapt to the ever-changing security situation. At the same time, it combines the semantic association module to perform natural language analysis on the user's resource access intention, distinguish between authorized access and potential malicious access, and accumulate trust and predict behavior based on historical data, providing a basis for dynamic trusted authentication.

[0134] Policy Weaving Module: The policy adjustment unit uses Differential Strategy Evaluation (DSE) to compare the effectiveness of different defense strategies through methods such as A / B testing, and uses the Security Mesh Optimization (SMO) mechanism to collaboratively adjust the parameters of each strategy to achieve proactive risk response and automated security policy adjustment. The unit can also proactively make security behavior recommendations based on current threat intelligence and system status, such as forcing users to undergo secondary authentication and restricting certain high-risk operations.

[0135] Context Adaptation Module: The context processing unit standardizes the configuration information, firmware version, TLS configuration, installed security component information, and manufacturer's security policies of various devices in the new energy power plant into trust context metadata. Through the Trust Handshake Protocol (TBEDP), the unit can verify the consistency of the device context and automatically adjust the authentication process and access rights based on the device's trust level and current security posture. In addition, the unit also supports federated learning-based security policy sharing to achieve common protection across different trust domains.

[0136] This unit implements dynamic, fine-grained trust management and access control by comprehensively evaluating multiple factors. Its working principle is to improve the security and availability of the system by utilizing a multi-dimensional trust model, intelligent policy adjustment mechanism and flexible context-aware capabilities.

[0137] The trust engine receives identity, environment, behavior, and time information from each module, performs trust evaluation, and uses the results for policy weaving and context adaptation modules to adjust policies and control access. The policy weaving module adjusts security policies based on evaluation results and external intelligence, while the context adaptation module adjusts authentication and access rights based on device context and trust level.

[0138] Based on multi-dimensional trust assessment, dynamic and fine-grained access control is achieved to reduce the risk of unauthorized access. The policy weaving module can proactively adjust security policies based on risk and threat intelligence to improve the system's defense capabilities. The context adaptation module enables secure interoperability and unified management of devices across manufacturers. Automated policy adjustment and context synchronization reduce the need for manual intervention.

[0139] Trusted execution environment of blockchain module: Application packaging and signing unit packages key industrial control applications of new energy power plants into verifiable execution modules and obtains digital signatures from authoritative organizations on the blockchain. This ensures that the source of the application is trustworthy and has not been tampered with during execution.

[0140] The chain synchronization module of the blockchain module: a data synchronization and verification unit, which realizes multi-point backup and synchronization of key industrial control data and security logs, preventing single point failure from causing data loss or malicious tampering. At the same time, this unit integrates the zero-knowledge proof protocol provided by the privacy protection module to achieve transparent verifiability of key operations without leaking sensitive information.

[0141] Instruction interception module: The instruction review and interception unit is integrated with the situational awareness threat engine (CATE, which is not explicitly listed in the previous claims but is described here as an enhanced function) to intercept and review sensitive instructions such as writing critical system resources in real time. If a potentially destructive operation is detected, the execution of the instruction is terminated and the corresponding response measures are triggered.

[0142] Security Reshaping Module: The policy reshaping unit is based on historical security event data. This unit can automatically self-correct and reconstruct security policies. Through the trusted consensus mechanism of blockchain, it can spread new security enhancement measures and updated policies to the entire system, forming a defense system with self-evolution and continuous improvement capabilities.

[0143] Participant management unit of the blockchain module: The participant management unit allows authorized system participants (such as power plant operation and maintenance personnel, security administrators, etc.) to dynamically join or exit the blockchain network according to security requirements, realizing a dynamic blockchain participation mechanism and enhancing the flexibility and manageability of the system.

[0144] This part uses blockchain technology to provide a trusted data storage and execution environment, combined with real-time interception at the instruction level and automated security policy reshaping to build an active defense and self-evolving security system.

[0145] Key industrial control applications are packaged and signed through a trusted execution environment. Key data and security logs are backed up and synchronized on the blockchain through the chain synchronization module. The instruction interception module monitors instruction execution in real time. The security reconstruction module updates security policies based on event data and blockchain consensus.

[0146] Blockchain technology ensures that data is not tampered with and can trace the source and history of data. Through a trusted execution environment, it ensures the security of key industrial control applications. The instruction interception module can prevent potential attacks at the instruction execution level. The security reconstruction module enables the system to automatically recover and enhance its defense capabilities after an attack. The dynamic blockchain participation mechanism enables the system to adapt to different security needs.

[0147] Through the above detailed description, Example 3, based on Example 1 and Example 2, further elaborates on the enhanced functions and implementation details of the system in terms of security, performance and reliability, fully demonstrating the innovation and practicality of the invention in the field of network security management of new energy power plants.

[0148] The above description is only a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the form disclosed herein and should not be regarded as excluding other embodiments. Instead, it can be used in various other combinations, modifications and environments, and can be modified within the scope of the concept described herein through the above teachings or technology or knowledge in related fields. The changes and modifications made by those skilled in the art do not depart from the spirit and scope of the present invention and should be within the scope of protection of the claims attached to the present invention.

Claims

1. A network security management system for a new energy power plant, characterized in that: include: The security defense system, based on a layered architecture, implements real-time collection of CPU instruction execution context, behavior modeling, anomaly detection, security event recording, and global situational awareness, and can adaptively adjust. The blockchain module enables distributed recording of key data with tamper-resistant characteristics, verifiable execution, and device status synchronization; the privacy protection module protects the privacy of key operations; The security remodeling module automatically performs security enhancements and policy reconstruction after detecting a security incident; Encrypted channel to ensure the confidentiality, integrity and reliability of data transmission in each module; Hardware acceleration unit to meet the system's high-frequency and real-time response requirements; The security defense system includes: a data acquisition module, including an instruction analyzer and a behavior modeling module, which are respectively used to collect structured instruction execution context data and build and update normal behavior feature models or portraits; a threat detection module, which receives data from the instruction analyzer and the behavior modeling module, and uses the SVM and Isolation Forest algorithms to perform anomaly detection and risk assessment; an event response module, which records events and triggers predefined responses when the threat detection module detects high risks; a situation awareness module, which integrates data from the event response module, the threat detection module, and the behavior modeling module to achieve security situation monitoring and trend analysis, and optimizes the parameters of the behavior modeling module and the threat detection module through feedback; a trust engine, which builds a four-dimensional trust model, uses reinforcement learning to dynamically adjust weights, and combines semantic association and behavior prediction to achieve dynamic trusted authentication and trust accumulation; a policy weaving module, which realizes active response and automatic adjustment of security policies through differential policy evaluation and security grid optimization mechanism; and an instruction interception module. The context adaptation module standardizes device information into a trust context and enables secure access to cross-vendor devices through a trust handshake protocol. The blockchain module includes a trusted execution environment and a chain synchronization module to ensure the integrity and traceability of key data. The hardware acceleration unit uses dedicated acceleration and multi-core parallel processing technology.

2. A network security management system for a new energy power plant according to claim 1, characterized in that: The instruction analyzer includes: an instruction acquisition unit for collecting CPU instruction execution context data in real time; an instruction preprocessing unit for preprocessing instruction data and parsing it into operation codes; a context extraction unit for extracting the context sequence of the target instruction and the associated register changes; an event record generation unit for structuring the processed data into an event record containing EventID, timestamp, operation trajectory, PID, memory access address, register status and previous and next instruction information; and a data screening unit for eliminating redundant information. The behavior modeling module includes: a behavior modeling unit, which uses the data from the instruction analyzer to construct an initial normal behavior feature model or portrait through clustering, and adaptively updates the feature model or portrait during operation to form a multi-dimensional behavior model for threat detection.

3. A network security management system for a new energy power plant according to claim 2, characterized in that: The threat detection module includes: a feature selection unit for receiving standard event records from the instruction analyzer and the behavior model data output by the behavior modeling module, and performing feature selection; a risk classification unit for performing multi-level risk classification of data using SVM; an anomaly screening unit for performing rapid anomaly screening using the Isolation Forest algorithm; and a risk assessment unit for establishing a risk scoring system and outputting risk levels, event descriptions, and related data.

4. A network security management system for a new energy power plant according to claim 3, characterized in that: The event response module includes: an event triggering unit, which is used to automatically trigger event recording when the threat detection module detects a high risk; an event association unit, which is used to associate the triggered event with relevant information to form an event view; a log recording unit, which is used to record detailed event information in the security log; and a response triggering unit, which is used to automatically trigger predefined response measures according to the risk level.

5. A network security management system for a new energy power plant according to claim 2, characterized in that: The situation awareness module includes: a situation monitoring unit, which is used to monitor and analyze the overall security situation in real time, and its data comes from the event response module, threat detection module and behavior modeling module; a policy recommendation unit, which is used to integrate external threat intelligence to propose security policy optimization suggestions; a feedback optimization unit, which is used to feed back the monitoring results to the behavior modeling module and threat detection module in real time through feedback to optimize the behavior model and detection parameters.

6. A network security management system for a new energy power plant according to claim 1, characterized in that: The modules transmit information via encrypted channels, with digital signatures and checksums.

7. The network security management system for a new energy power plant according to claim 1, characterized in that: The hardware acceleration unit includes: a high-frequency acquisition unit for implementing high-frequency data acquisition using a dedicated monitoring chip or hardware accelerator in the data acquisition module; a parallel monitoring unit for synchronously monitoring multi-core CPU data using multi-core parallel processing technology; and an algorithm acceleration unit for deploying a machine learning acceleration unit in the behavior modeling module and threat detection module to improve the computational efficiency of related algorithms. The system optimization and data flow unit is used to optimize for new energy power plant scenarios, connect with the power plant control system and sensor interface, obtain operating status and environmental parameters in real time, dynamically adjust data collection frequency, detection sensitivity and response strategy, and generate security situation reports.

8. The network security management system for a new energy power plant according to claim 1, characterized in that: The trust engine includes: a trust model construction unit for constructing a four-dimensional trust model, wherein the time context credibility is embedded in time information based on a predefined event time series model; a trust evaluation unit for dynamically adjusting the weights of each dimension using reinforcement learning, combining semantic association to analyze resource access intentions, and achieving trust accumulation and behavior prediction; The policy weaving module includes: a policy adjustment unit for implementing active security policy adjustment and behavior recommendations using differential policy evaluation and security grid optimization mechanisms; The context adaptation module includes: a context processing unit, which is used to standardize device information into a trust context, verify consistency through a trust handshake protocol, and realize automatic adjustment of authentication process and access rights.

9. The network security management system for a new energy power plant according to claim 1, characterized in that: The trusted execution environment of the blockchain module includes: an application packaging and signing unit, which is used to package key industrial control applications into verifiable execution modules and sign them on the blockchain to achieve audit and traceability; The chain synchronization module of the blockchain module includes: a data synchronization and verification unit for realizing multi-point backup and synchronization of key data, and an integrated privacy protection module for realizing the verifiability of key operations; The instruction interception module includes: an instruction review and interception unit for integrating a situational threat engine, reviewing sensitive instructions in real time, and suspending execution and triggering a response when potential risks are detected; The security reshaping module includes: a policy reshaping unit for automatically performing policy self-correction and reconstruction based on security event data, and disseminating security enhancement measures through the blockchain consensus mechanism; The blockchain module also includes: a participant management unit, which is used to allow system participants to dynamically join or exit the blockchain network according to security requirements.

Images