A network security early warning method and system based on network port data

Abstract

The present application discloses a network security early warning method and system based on network port data, wherein the method includes: extracting fields from network port data in a distribution automation network to establish a mapping relationship table between source addresses and target addresses, performing time series analysis and feature extraction on the mapping relationship table to construct a network communication relationship map for communication between various communication terminals; analyzing the network communication relationship map to obtain communication frequency change characteristic values; analyzing the communication frequency change characteristic values ​​and the acquired data transmission abnormal fluctuation characteristic values ​​to obtain an abnormal communication extended behavior data set, and performing business logic rationality verification on the abnormal communication extended behavior data to obtain a risk communication data set; dividing the risk communication data set into diffusion risk levels, and performing real-time early warning of network port data based on the generated risk assessment table. The method of the present application improves the network security protection capability of distribution automation.

Description

Technical Field

[0001] The present application relates to the field of information technology, and in particular to a network security early warning method and system based on network port data. Background Art

[0002] With the rapid development of smart grids, the number and complexity of communication terminals (such as data acquisition devices and intelligent circuit breakers) in distribution automation networks have increased dramatically, leading to a diversification of network security threats. Traditional network security early warning methods are no longer able to meet the security needs of distribution automation networks.

[0003] Existing network security early warning methods mostly rely on manual experience and judgment, so the missed reporting rate increases significantly with the expansion of network scale, resulting in low accuracy of network security early warning.

[0004] Therefore, how to improve the existing network security early warning method to improve the accuracy of network security early warning has become a technical problem that needs to be solved urgently by those skilled in the art. Summary of the Invention

[0005] The present application provides a network security early warning method and system based on network port data to solve the technical problem of how to improve the existing network security early warning method to achieve the effect of improving the accuracy of network security early warning.

[0006] To solve the above technical problems, the present invention provides a network security early warning method based on network port data, including:

[0007] Performing field extraction on the acquired network port data between the communication terminals in the distribution automation network to obtain a first communication feature, where the first communication feature includes at least a source address and a destination address;

[0008] Establishing a mapping relationship table between the source address and the target address, performing time sequence analysis and feature extraction on the mapping relationship table, and constructing a network communication relationship map between each of the communication terminals based on the feature extraction results;

[0009] Performing a time interval analysis on the network communication relationship graph to obtain a communication frequency change characteristic value of the network port data; performing a fluctuation rate analysis on the total amount of data transmission of the network port data to obtain a data transmission abnormal fluctuation characteristic value;

[0010] The communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value are analyzed according to a weighted fusion method to obtain an abnormal communication extended behavior data set, and the business logic rationality of the abnormal communication extended behavior data set is verified based on a preset device role permission library to obtain a risk communication data set;

[0011] The risk communication data set is divided into diffusion risk levels based on a hierarchical clustering algorithm, a risk assessment table is generated according to the diffusion risk level division results, and an early warning log result is generated according to the comparison and analysis results.

[0012] As one preferred solution, establishing a mapping relationship table between the source address and the target address, performing time sequence analysis and feature extraction on the mapping relationship table, and constructing a network communication relationship map between the communication terminals based on the feature extraction results includes:

[0013] Establishing a mapping relationship between the source address and the target address based on a subnet mask address matching rule, and generating a mapping relationship table according to the mapping relationship;

[0014] Performing a time sequence analysis on the mapping relationship table according to a time window technology, and constructing a communication frequency matrix between each of the communication terminals according to the analysis result;

[0015] Performing dimensionality reduction processing on the communication frequency matrix based on a local linear embedding algorithm to obtain low-dimensional communication data, and calculating the cosine similarity between each of the communication terminals based on the low-dimensional communication data;

[0016] The network communication relationship graph is constructed with the communication terminals as nodes and the communication relationships between the communication terminals as edges, wherein the weights of the edges are determined based on the corresponding cosine similarities.

[0017] As one preferred solution, establishing a mapping relationship between the source address and the destination address based on a subnet mask address matching rule includes:

[0018] Analyze the preset subnet mask and determine the calculation rules of the subnet address;

[0019] Performing a bitwise AND operation on the source address and the destination address with the subnet mask based on the calculation rule to obtain a first subnet home address of the source address and a second subnet home address of the destination address;

[0020] If the first subnet home address is the same as the second subnet home address, a mapping relationship between the source address and the target address is established.

[0021] As one preferred solution, performing time interval analysis on the network communication relationship graph to obtain the communication frequency change characteristic value of the network port data includes:

[0022] Extracting communication timestamp information between each pair of source addresses and target addresses in the network communication relationship graph to construct a communication time sequence;

[0023] Calculating the time interval between two adjacent communications based on the communication time sequence to obtain a time interval sequence;

[0024] The mean, standard deviation and coefficient of variation of the time interval sequence are calculated respectively, and the communication frequency change characteristic value is constructed according to the mean, the standard deviation and the coefficient of variation.

[0025] As one of the preferred solutions, performing a fluctuation analysis on the total amount of data transmission of the network port data to obtain a data transmission abnormal fluctuation characteristic value includes:

[0026] Dividing the total amount of data transmission of the acquired network port data according to a preset time window to obtain a time series of the total amount of data transmission;

[0027] Smoothing the total amount of data transmission time series based on a moving average method to obtain a first total amount of data transmission time series;

[0028] Calculating the volatility of each time point in the first data transmission total amount time series according to the standard deviation method to obtain a volatility series;

[0029] The change rate of the volatility at two adjacent time points in the volatility sequence is calculated, and the data transmission abnormal fluctuation characteristic value is constructed according to the obtained volatility change rate sequence.

[0030] As one of the preferred solutions, the communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value are analyzed according to the weighted fusion method to obtain the abnormal communication extension behavior data set, including:

[0031] Performing a spatiotemporal alignment process on the communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value, wherein the spatiotemporal alignment process includes timestamp matching and communication endpoint matching;

[0032] Normalizing the communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value after the spatiotemporal alignment processing, and performing weighted fusion processing on the communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value after the normalization processing to obtain a comprehensive characteristic value of the network port data;

[0033] Based on a preset comprehensive feature threshold, the comprehensive feature value of each network port data is compared and screened, and an abnormal communication extended behavior data set is constructed based on the network port data whose comprehensive feature value is greater than the comprehensive feature threshold.

[0034] As one of the preferred solutions, based on the preset device role permission library, the business logic rationality verification of the abnormal communication extended behavior dataset is performed to obtain the risk communication dataset, including:

[0035] Mapping the source device and the target device in the abnormal communication extended behavior data set with the device role permission library to obtain a communication rule corresponding to each sample data in the abnormal communication extended behavior data set, wherein the communication rule includes a communication frequency rule, a communication time rule, and a communication data volume rule;

[0036] Verifying each of the sample data based on the communication frequency rule, the communication time rule, and the communication data volume rule, respectively, to obtain verification results in multiple dimensions, assigning different weights to the verification results in each dimension, and calculating a comprehensive verification value for each of the sample data;

[0037] The sample data whose comprehensive verification value is greater than a preset verification threshold is determined as risk sample data, and a risk communication data set is constructed based on the risk sample data.

[0038] As one preferred solution, the step of classifying the risk communication data set into diffusion risk levels based on a hierarchical clustering algorithm includes:

[0039] Calculating the distance between any two data points in the risk communication dataset and constructing a distance matrix, wherein the distance matrix records the similarity information between each pair of data points;

[0040] In the clustering process of the risk communication dataset, each data point in the risk communication dataset is regarded as a cluster, and according to the similarity information in the distance matrix, two clusters with the highest similarity are merged, and the distance matrix is ​​updated;

[0041] Repeating the clustering process until a preset number of clustering times is obtained, and constructing a hierarchical clustering tree based on the clustering results, wherein each node of the hierarchical clustering tree represents a cluster;

[0042] The hierarchical clustering tree is divided into different levels to classify the risk communication dataset into diffusion risk levels, wherein each level corresponds to a diffusion risk level.

[0043] As one of the preferred solutions, after generating the warning log result based on the comparison and analysis results, it also includes:

[0044] Building a historical database based on the network port data, the risk assessment table and the generated warning information;

[0045] The data in the historical database is analyzed based on data mining technology, and the changing trend of network security risks is predicted according to the analysis results.

[0046] Another embodiment of the present application provides a network security early warning system based on network port data, including:

[0047] an extraction module, configured to perform field extraction on the acquired network port data between the communication terminals in the distribution automation network to obtain a first communication feature, wherein the first communication feature includes at least a source address and a destination address;

[0048] A construction module is used to establish a mapping relationship table between the source address and the target address, perform time sequence analysis and feature extraction on the mapping relationship table, and construct a network communication relationship map between each of the communication terminals based on the feature extraction results;

[0049] An analysis module is configured to perform time interval analysis on the network communication relationship graph to obtain a characteristic value of a communication frequency change of the network port data; and perform a fluctuation rate analysis on the total amount of data transmission of the network port data to obtain a characteristic value of abnormal data transmission fluctuation;

[0050] a verification module, configured to analyze the communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value according to a weighted fusion method to obtain an abnormal communication extended behavior data set, and perform business logic rationality verification on the abnormal communication extended behavior data set based on a preset device role permission library to obtain a risk communication data set;

[0051] A classification module is used to classify the risk communication data set into diffusion risk levels based on a hierarchical clustering algorithm, and generate a risk assessment table according to the diffusion risk level classification results;

[0052] The early warning module is used to compare and analyze the acquired real-time network port data according to the risk assessment table, and generate early warning log results according to the comparison and analysis results. The early warning log results are used to achieve safe control of the distribution automation network.

[0053] Compared with the prior art, the embodiments of the present application have the following advantages:

[0054] 1) This application constructs a network communication relationship map covering all communication terminals by establishing a mapping table between source and destination addresses and performing time series analysis. This map not only visually displays normal communication links between devices but also quickly locates potential attack paths through abnormal communication frequencies or data volume fluctuations, providing a visual basis for accurately tracing security incidents.

[0055] 2) This application combines a weighted fusion algorithm with hierarchical clustering technology to simultaneously analyze multiple features, such as communication frequency and data volume fluctuations, and verifies the business legitimacy of abnormal behavior through a device role and permission library. The resulting diffusion risk level assessment table provides millisecond-level real-time warnings, helping operations and maintenance personnel prioritize high-risk incidents and significantly improving the active defense capabilities of the distribution automation network. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is a flow chart of a network security early warning method based on network port data in one embodiment of the present application;

[0057] Figure 2 This is a schematic diagram of a network security early warning system based on network port data in one embodiment of the present application. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. The purpose of providing these embodiments is to make the disclosure of this application more thorough and comprehensive. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0059] In the description of this application, the terms "first," "second," "third," etc. are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of the technical features indicated. Therefore, a feature specified as "first," "second," "third," etc. may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0060] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or an indirect connection through an intermediate medium, or it can be a communication between the two elements. The terms "vertical", "horizontal", "left", "right", "up", "down" and similar expressions used herein are for illustrative purposes only, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on this application. The term "and / or" used herein includes any and all combinations of one or more related listed items. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0061] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this application have the same meanings as those commonly understood by those skilled in the art. The terms used in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood by those skilled in the art in specific circumstances.

[0062] An embodiment of the present application provides a network security early warning method based on network port data. For details, see Figure 1 , Figure 1 The figure shows a flow chart of a network security early warning method based on network port data in one embodiment of the present application, which includes steps S1-S6:

[0063] S1: performing field extraction on the acquired network port data between the communication terminals in the distribution automation network to obtain a first communication feature, where the first communication feature includes at least a source address and a destination address;

[0064] Specifically, traffic collection devices (such as switch mirror ports and dedicated probes) deployed at key nodes in the distribution automation network can be used to capture raw network port data between communication terminals (such as RTUs, smart meters, and master station systems) in real time. These devices must support promiscuous mode capture of common distribution automation protocols, including: general protocols such as TCP / IP, ICMP, and ARP; power-specific protocols such as Modbus RTU / TCP, IEC 61850 MMS / GOOSE, and DNP3; and custom protocols such as local power company proprietary protocols (such as CDT and 101 / 104).

[0065] When processing the collected data, it is necessary to discard packets with checksum errors or abnormal lengths (such as jumbo frames and fragmented frames), and identify duplicate sessions based on the five-tuple (source IP, source port, destination IP, destination port, protocol).

[0066] S2: Establish a mapping relationship table between source addresses and destination addresses, perform time series analysis and feature extraction on the mapping relationship table, and construct a network communication relationship map between each communication terminal based on the feature extraction results;

[0067] Preferably, in one embodiment of the present application, a mapping relationship table between source addresses and target addresses is established, a time sequence analysis and feature extraction are performed on the mapping relationship table, and a network communication relationship map of communication between various communication terminals is constructed based on the feature extraction results, including:

[0068] A mapping relationship between the source address and the destination address is established based on the subnet mask address matching rule, and a mapping relationship table is generated according to the mapping relationship;

[0069] Perform timing analysis on the mapping relationship table using the time window technology, and construct a communication frequency matrix between each communication terminal based on the analysis results;

[0070] Performing dimensionality reduction processing on the communication frequency matrix based on a local linear embedding algorithm to obtain low-dimensional communication data, and calculating the cosine similarity between each communication terminal based on the low-dimensional communication data;

[0071] A network communication relationship graph is constructed with communication terminals as nodes and communication relationships between communication terminals as edges, where the weights of edges are determined based on the corresponding cosine similarity.

[0072] The subnet mask is used to distinguish the network bits from the host bits in the IP address. In this step, the preset subnet mask needs to be parsed to clarify the rules for calculating the subnet address. For example, the common subnet mask 255.255.255.0 corresponds to the binary form 11111111.111111111.11111111.00000000. This indicates that the first 24 bits are the network bits and the last 8 bits are the host bits. To calculate the subnet address, the IP address and the subnet mask are bitwise ANDed.

[0073] Preferably, in one embodiment of the present application, establishing a mapping relationship between a source address and a destination address based on a subnet mask address matching rule includes:

[0074] Analyze the preset subnet mask and determine the calculation rules of the subnet address;

[0075] Performing a bitwise AND operation on the source address and the destination address with the subnet mask based on the calculation rule to obtain the first subnet home address of the source address and the second subnet home address of the destination address;

[0076] If the first subnet home address is the same as the second subnet home address, a mapping relationship between the source address and the destination address is established.

[0077] Specifically, perform a bitwise AND operation on the source and destination addresses with the subnet mask. For example, if the source address is 192.168.1.100, the destination address is 192.168.1.200, and the subnet mask is 255.255.255.0, perform a bitwise AND operation on the source address 192.168.1.100 (binary: 11000000.10101000.00000001.01100100) and the subnet mask 255.255.255.0 (binary: 11111111.11111111.11111111.00000000) to obtain the first subnet address 192.168.1.0. Similarly, a bitwise AND operation is performed on the destination address 192.168.1.200 to obtain the second subnet home address which is also 192.168.1.0. If the first subnet home address and the second subnet home address are the same, a mapping relationship between the source address and the destination address is established.

[0078] Among them, time window technology divides time into several windows of fixed length. For example, time is divided into a window per hour. In one embodiment of the present application, the number of communications between the source address and the destination address is counted within each time window. By analyzing the communication situation within different time windows, it is possible to understand the temporal distribution pattern of communication, such as whether there are peak or low periods of communication. Based on the results of the timing analysis, a communication frequency matrix between each communication terminal is constructed. The rows and columns of the matrix represent different communication terminals, and the elements in the matrix represent the communication frequency between the corresponding two terminals within a certain period of time.

[0079] The Local Linear Embedding (LLE) algorithm is a nonlinear dimensionality reduction method. The communication frequency matrix may be high-dimensional and contain a large amount of data information, which increases computational complexity. In one embodiment of the present application, the LLE algorithm is used to reduce the dimensionality of the communication frequency matrix. This can convert high-dimensional data into low-dimensional data while preserving the key features of the data. This reduces the computational effort and improves the efficiency of subsequent calculations.

[0080] After obtaining the low-dimensional communication data, the cosine similarity between each communication terminal is calculated. Cosine similarity measures the cosine of the angle between two vectors; a value closer to 1 indicates greater similarity between the two vectors. In this scenario, the low-dimensional communication data of each communication terminal is treated as a vector. By calculating the cosine similarity between these vectors, the similarity of the communication patterns between the terminals can be determined. For example, if the communication frequencies of two communication terminals show similar trends over different time windows, their cosine similarity will be high.

[0081] A network communication relationship graph is constructed, using communication terminals as nodes and the communication relationships between them as edges. Edge weights are determined based on their corresponding cosine similarity. The higher the cosine similarity, the greater the edge weight, indicating a closer communication relationship between the two terminals. This network communication relationship graph provides a visual overview of the communication connections between each terminal, facilitating the detection of unusual communication relationships and potential security threats.

[0082] S3: Perform time interval analysis on the network communication relationship graph to obtain the communication frequency change characteristic value of the network port data; perform fluctuation analysis on the total amount of data transmission of the network port data to obtain the abnormal fluctuation characteristic value of the data transmission;

[0083] Preferably, in one embodiment of the present application, a time interval analysis is performed on the network communication relationship graph to obtain a communication frequency change characteristic value of the network port data, including:

[0084] Extract the communication timestamp information between each pair of source and destination addresses in the network communication relationship graph and construct a communication time series;

[0085] Calculate the time interval between two adjacent communications based on the communication time series to obtain a time interval sequence;

[0086] The mean, standard deviation and coefficient of variation of the time interval series are calculated respectively, and the characteristic value of communication frequency change is constructed based on the mean, standard deviation and coefficient of variation.

[0087] The network communication relationship map clearly shows the communication connections between various communication terminals, including the communication records between each pair of source and destination addresses. The timestamp information corresponding to the communication between each pair of source and destination addresses is extracted from the map.

[0088] The extracted timestamp information for each source-destination address pair is arranged in chronological order to construct a communication time series. For example, for a communication between source address A and destination address B, the timestamps are t1, t2, t3, etc. These timestamps are arranged in ascending order into a sequence like [t1, t2, t3, ...]. This sequence reflects the temporal order and rhythm of the communication between this pair of addresses.

[0089] After obtaining the communication time sequence, calculate the time interval between two adjacent communications. Specifically, for the communication time sequence [t1, t2, t3, ...], the time interval between two adjacent communications can be calculated by subtracting the previous timestamp from the next timestamp. That is, the first time interval Δt1 = t2 - t1, the second time interval Δt2 = t3 - t2, and so on. Arranging all the calculated time intervals in order forms a time interval sequence [Δt1, Δt2, Δt3, ...]. This sequence intuitively reflects the changes in the time interval between each pair of source-destination addresses.

[0090] The mean is the average value of a set of data and reflects the data's central tendency. The standard deviation measures the dispersion of the data, reflecting its dispersion relative to the mean. The coefficient of variation is the ratio of the standard deviation to the mean. It is a dimensionless statistic used to compare the dispersion of different data sets. In one embodiment of the present application, the calculated mean, standard deviation, and coefficient of variation are combined to construct a communication frequency variation characteristic value. This characteristic value comprehensively reflects the average level, fluctuation, and relative stability of the communication frequency between each source-destination address pair.

[0091] Preferably, in one embodiment of the present application, a fluctuation rate analysis is performed on the total amount of data transmission of the network port data to obtain a characteristic value of abnormal data transmission fluctuation, including:

[0092] The total amount of data transmission of the acquired network port data is divided according to the preset time window to obtain the total amount of data transmission time series;

[0093] Smoothing the total amount of data transmission time series based on a moving average method to obtain a first total amount of data transmission time series;

[0094] Calculate the volatility of each time point in the first data transmission total amount time series according to the standard deviation method to obtain a volatility series;

[0095] The rate of change of volatility at two adjacent time points in the volatility sequence is calculated, and the characteristic value of abnormal fluctuation of data transmission is constructed based on the obtained volatility change rate sequence.

[0096] Among them, the preset time window is a fixed time length set by humans, for example, it can be set to 1 minute, 5 minutes or 1 hour. The selection of this time window needs to be determined according to the specific analysis requirements and data characteristics. If you want to analyze short-term data fluctuations, you can choose a shorter time window; if you are concerned about long-term trend changes, you can choose a longer time window. In one embodiment of the present application, the total amount of data transmission of the acquired network port data is divided according to the preset time window.

[0097] Arranging the total data transfer volume corresponding to each time window in chronological order forms a data transfer volume time series. For example, if the total data transfer volume is T1, T2, T3, and so on, using a 5-minute time window, the total data transfer volume time series is [T1, T2, T3, ...]. This series reflects the changes in the total data transfer volume of the network port at different time points.

[0098] The moving average method is a commonly used method for smoothing data. It reduces random fluctuations in the data by calculating the average value of the data within a certain time range, thereby more clearly showing the data trend. In this step, the application uses the moving average method to process the total data transmission time series.

[0099] Specifically, the moving average window size is selected as n (n is a positive integer). For the total data transmission time series [T1, T2, T3, ⋯], the calculation formula for the moving average value Mi at the i-th time point is:

[0100] ,

[0101] Among them, when i < n, the average value of the existing data can be calculated only. By continuously moving this window and calculating the moving average value at each time point, a new time series, that is, the first total data transmission volume time series [M1, M2, M3, ⋯], is obtained. This series is smoother than the original series and can better reflect the long-term trend of the data.

[0102] The standard deviation is a statistic that measures the degree of data dispersion. In this step, the present application uses the standard deviation method to calculate the volatility at each time point in the first total data transmission volume time series. The volatility reflects the degree of fluctuation of the data relative to its average value at each time point.

[0103] Specifically, for the first total data transmission volume time series [M1, M2, M3, ⋯], the calculation formula for the volatility Vi at the i-th time point is:

[0104] ,

[0105] where M is the average value of the first total data transmission volume time series. By calculating the volatility at each time point, a volatility series [V1, V2, V3, ⋯] is obtained. This series reflects the fluctuation of the data at different time points. For the volatility series, calculate the change rate of the volatility between two adjacent time points. Combining the obtained volatility change rate series together constructs the eigenvalue of abnormal data transmission fluctuation. This eigenvalue comprehensively reflects the fluctuation change of the total network port data transmission volume at different time points.

[0106] S4: Analyze the communication frequency change eigenvalue and the abnormal data transmission fluctuation eigenvalue according to the weighted fusion method to obtain the abnormal communication expansion behavior data set, and based on the preset device role permission library, verify the business logic rationality of the abnormal communication expansion behavior data to obtain the risk communication data set;

[0107] Preferably, in an embodiment of the present application, analyzing the communication frequency change eigenvalue and the abnormal data transmission fluctuation eigenvalue according to the weighted fusion method to obtain the abnormal communication expansion behavior data set includes: [[ID=​​​​​​Based on the preset comprehensive feature threshold, the comprehensive feature value of each network port data is compared and screened, and the abnormal communication extension behavior data set is constructed based on the network port data whose comprehensive feature value is greater than the comprehensive feature threshold.

[0111] The communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value are calculated based on network port data at different stages, and their timestamps may not be completely consistent. To ensure that these two sets of characteristic values ​​can be compared and integrated on the same time dimension, timestamp matching is required.

[0112] In one embodiment of the present application, a unified time accuracy is first determined, such as accurate to seconds or minutes. Then, for each data point in the communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value, the corresponding point that is closest and matches in time is found. If there are data points with a time difference within an acceptable range (such as an error of no more than 1 second), they are considered to be matched. For example, the communication frequency change characteristic value has a record at time point t1, and the data transmission abnormal fluctuation characteristic value has a record at t1+0.5 seconds. If the acceptable error is set to 1 second, then the timestamps of the two records can be considered to match.

[0113] In addition to timestamps, communication endpoints (i.e., source and destination addresses) also need to be matched. This is because the communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value are derived from different analysis perspectives, but they are both related to specific communication endpoints. Ensure that these two sets of characteristic values ​​are for the same pair of communication endpoints. For each set of communication frequency change characteristic values ​​and data transmission abnormal fluctuation characteristic values, check whether the corresponding source and destination addresses are the same. Only when the source and destination addresses are completely consistent are the two sets of characteristic values ​​considered to match on the communication endpoints. For example, if the communication corresponding to the communication frequency change characteristic value is from address A to address B, then the communication endpoint matching condition is met only if the communication corresponding to the data transmission abnormal fluctuation characteristic value is also from address A to address B.

[0114] Because the communication frequency variation eigenvalues ​​and data transmission abnormality fluctuation eigenvalues ​​may have different dimensions and ranges, direct fusion can result in some eigenvalues ​​having an excessively large or insufficient impact on the results. Therefore, these two sets of eigenvalues ​​need to be normalized to the same scale. After normalization, the two sets of eigenvalues ​​are then weightedly fused. Each eigenvalue is assigned a weight, which reflects its importance in the comprehensive evaluation. Through weighted fusion, the two different eigenvalues ​​are combined into a single, comprehensive eigenvalue that more comprehensively reflects the abnormalities in the network port data.

[0115] Based on historical data and actual business needs, a comprehensive feature threshold is pre-set. This threshold serves as the critical value for determining whether network port data is abnormal. If the comprehensive feature value exceeds this threshold, it indicates that the network port data has significant anomalies in terms of communication frequency and data transmission fluctuations. The calculated comprehensive feature value of each network port data point is compared with the pre-set comprehensive feature threshold. Network port data with a comprehensive feature value greater than the comprehensive feature threshold is marked as abnormal data. All network port data marked as abnormal is collected to construct an abnormal communication extended behavior dataset.

[0116] Preferably, in one embodiment of the present application, based on a preset device role permission library, the business logic rationality verification is performed on the abnormal communication extended behavior dataset to obtain a risk communication dataset, including:

[0117] Map the source and target devices in the abnormal communication extended behavior dataset to the device role permission library to obtain the communication rules corresponding to each sample data in the abnormal communication extended behavior dataset, where the communication rules include communication frequency rules, communication time rules, and communication data volume rules;

[0118] Verify each sample data based on the communication frequency rule, communication time rule, and communication data volume rule, obtain verification results in multiple dimensions, assign different weights to the verification results in each dimension, and calculate the comprehensive verification value of each sample data;

[0119] The sample data whose comprehensive verification value is greater than the preset verification threshold is determined as risk sample data, and a risk communication dataset is constructed based on the risk sample data.

[0120] When verifying the rationality of business logic, the first step is to map the source and target devices in the abnormal communication extended behavior dataset to the preset device role permission library. The device role permission library is like a detailed device user manual, recording the various rules and restrictions on communication for different types of devices.

[0121] Specifically, in the power system's distribution automation network, for example, the master station typically has high authority, allowing it to send control commands to multiple communication terminals within a specific timeframe, with specific restrictions on communication frequency and data volume. Meanwhile, communication terminals, such as smart meters, have relatively low authority and are primarily responsible for uploading electricity usage data at a specified frequency.

[0122] When a sample data item is obtained from the abnormal communication extended behavior dataset, the source and target device types are first determined, and then the corresponding rules are searched in the device role permission library. For example, if the source device is a master station and the target device is a smart meter, the corresponding rules for communication frequency between the master station and the smart meter can be found (for example, a maximum of 10 control commands can be sent per hour), communication time (control command communication can only be carried out between 8:00 AM and 6:00 PM on weekdays), and communication data volume (the data volume of each control command cannot exceed 1KB).

[0123] Communication data is verified across multiple dimensions. First, for each piece of sample data, the number of communications between the source and target devices within a specific time window is counted and then compared against the communication frequency rule. For example, if the rule stipulates that the master station cannot send more than 10 control commands to the smart meter per hour, and the sample data shows that the master station sent control commands 15 times within a given hour, then the verification result for the communication frequency dimension of this sample data will not comply with the rule.

[0124] Secondly, check whether the communication time of the sample data is within the specified time range. If the master station can only send control commands to the smart meter between 8:00 AM and 6:00 PM on weekdays, and the sample data shows that communication occurs at 8:00 PM, then the verification result of the communication time dimension of the sample data does not meet the requirements.

[0125] Finally, the data volume of each communication in the sample data is calculated and compared with the communication data volume rule. If the rule stipulates that the data volume of each control command cannot exceed 1KB, and the data volume of a communication in the sample data reaches 1.5KB, then the verification result of the communication data volume dimension of the sample data does not meet the rule.

[0126] Different dimensions may have varying degrees of importance when determining whether communication behavior presents a risk. Therefore, it's necessary to assign different weights to the verification results for each dimension to arrive at a final, comprehensive verification value. A verification threshold, T, is preset to determine whether sample data is considered risky. The calculated comprehensive verification value, V, for each sample data point is compared with the preset verification threshold, T. If V > T, the sample data point violates communication rules in multiple dimensions and is identified as risky.

[0127] By collecting all data identified as risk samples, we construct a risk communication dataset. This dataset contains data that clearly violates business logic rules in communication behavior. This data is likely to indicate security risks in the network, such as attacks, equipment failures, or illegal operations.

[0128] S5: Based on the hierarchical clustering algorithm, the risk communication dataset is divided into diffusion risk levels, and a risk assessment table is generated according to the diffusion risk level division results;

[0129] Preferably, in one embodiment of the present application, the risk communication dataset is classified into diffusion risk levels based on a hierarchical clustering algorithm, including:

[0130] Calculate the distance between any two data points in the risk communication dataset and construct a distance matrix, which records the similarity information between each pair of data points;

[0131] In the clustering process of the risk communication dataset, each data point in the risk communication dataset is regarded as a cluster. According to the similarity information in the distance matrix, the two clusters with the highest similarity are merged, and the distance matrix is ​​updated;

[0132] Repeat the clustering process until the preset number of clustering is obtained, and construct a hierarchical clustering tree based on the clustering results, where each node of the hierarchical clustering tree represents a cluster;

[0133] The hierarchical clustering tree is divided into different levels to classify the diffusion risk level of the risk communication dataset, where each level corresponds to a diffusion risk level.

[0134] In the risky communication dataset, each data point contains multiple features related to communication risk, such as changes in communication frequency, abnormal fluctuations in data transmission, communication duration, and data volume. To measure the similarity between any two data points, we need to calculate the distance between them. Common distance metrics include Euclidean distance and Manhattan distance. By calculating the distance for each pair of data points in the risky communication dataset, we can obtain similarity information between them. The smaller the distance, the more similar the two data points are.

[0135] The calculated distances between any two data points are organized into a matrix, the distance matrix. Assuming the risk communication dataset has m data points, the distance matrix is ​​an m×m square matrix, where the elements in the matrix represent the distance between the i-th data point and the j-th data point.

[0136] At the beginning of the clustering process, each data point in the risk communication dataset is treated as a separate cluster. Based on the similarity information recorded in the distance matrix, the two clusters with the smallest distance (i.e., the highest similarity) are found. These two clusters are merged into a new cluster. After merging the two clusters, the distance matrix needs to be updated. There are various ways to calculate the distance between the new cluster and other clusters, including the single linkage method (taking the minimum distance between all data points in the new cluster and data points in other clusters), the full linkage method (taking the maximum distance), and the average linkage method (taking the average distance). By updating the distance matrix, accurate similarity information is provided for the next round of clustering.

[0137] Repeat the above process of merging the clusters with the highest similarity and updating the distance matrix. Each clustering operation will reduce the number of clusters by one until the preset number of clusters is reached. The preset number of clusters can be determined based on actual needs and the characteristics of the dataset.

[0138] During the clustering process, each merged cluster forms a new node in the hierarchy. By connecting these nodes in the order of clustering, a hierarchical clustering tree is constructed. Each node in the hierarchical clustering tree represents a cluster. The leaf nodes of the tree are initially single data points. As the hierarchy rises, the clusters represented by the nodes contain more and more data points.

[0139] Divide the constructed hierarchical clustering tree into different levels. This division can be based on cluster depth, cluster size, or other risk-related indicators. For example, the tree can be divided into several layers based on cluster depth, with each layer corresponding to a diffusion risk level.

[0140] Each level corresponds to a level of diffusion risk. Generally speaking, deeper levels (i.e., greater degree of cluster merging) correspond to higher levels of diffusion risk. For example, clusters at lower levels may contain only a few similar data points, which may represent relatively low risk and a smaller diffusion range. Clusters at higher levels, on the other hand, contain more data points. These data points may be less similar, but together they reflect a broader risk pattern and have a higher diffusion risk level.

[0141] Based on the diffusion risk classification results, a risk assessment table is generated. This table should include a detailed description of each risk level, the corresponding cluster characteristics, and the potential impact. For example, for a high-risk level, the table might indicate that the cluster contains a large number of data points with high abnormal communication frequencies and large data transmission fluctuations, potentially posing a serious security threat to the entire distribution automation network.

[0142] Use risk assessment tables to provide real-time early warnings for network port data. When monitoring network port data in real time, new data points are compared with the clustering characteristics in the risk assessment table. If a new data point matches a high-risk cluster, the early warning mechanism is immediately triggered, notifying relevant personnel to take appropriate measures, such as strengthening network monitoring and conducting security inspections, to prevent further spread of the risk.

[0143] S6: performing a comparison analysis on the acquired real-time network port data according to the risk assessment table, and generating an early warning log result according to the comparison analysis result, wherein the early warning log result is used to implement safety control of the distribution automation network.

[0144] The extracted real-time communication features are compared and analyzed against the normal behavior baselines and thresholds in the risk assessment table. Based on the results of this comparison and analysis, a detailed early warning log is generated. This log contains a variety of important information, such as the specific time the anomaly occurred, accurate to the hour, minute, and second; the specific identifiers of the source and target devices involved, which may be the device's IP address, device number, etc.; the specific type of anomaly, in this case, the communication frequency exceeding the normal range; the severity of the anomaly, which is classified as mild, moderate, or severe based on the degree to which the threshold is exceeded and the potential impact on network security; and a detailed description of the anomaly, such as "The master station communicated with the terminal 65 times / minute between 10:00 and 11:00, exceeding the normal baseline frequency by 20%."

[0145] After the early warning log results are generated, they will be used to implement security control of the distribution automation network. If the early warning log shows a mild anomaly, some relatively mild measures may be taken, such as increasing the monitoring frequency of related equipment and communication links, and paying close attention to subsequent behavioral changes. If the severity of the anomaly reaches moderate, some restrictive measures may be triggered, such as imposing a certain degree of restriction on the communication traffic of related equipment, or suspending certain non-critical communication services. When the anomaly is severe, emergency measures must be taken immediately, such as cutting off the connection between the abnormal device and the network to prevent the further spread of the anomaly and avoid causing serious threats to the safety and stable operation of the entire distribution automation network. At the same time, after the security control measures are executed, the processing results will be tracked and evaluated, and the measures will be adjusted and optimized according to the actual situation to ensure the security of the network.

[0146] Preferably, in one embodiment of the present application, after generating the warning log result according to the comparison and analysis result, the method further includes:

[0147] Build a historical database based on network port data, risk assessment tables, and generated warning information;

[0148] Analyze the data in the historical database based on data mining technology, and predict the changing trend of network security risks based on the analysis results.

[0149] Specifically, the prediction results can be based on the prediction of high-risk periods 24 hours in advance, dynamically adjust traffic monitoring strategies, identify seasonal risk patterns (such as the increase in attacks associated with summer load peaks), draw risk heat maps, and locate vulnerable subnets or device clusters.

[0150] Another embodiment of the present application provides a network security early warning system based on network port data. For details, see Figure 2 , Figure 2 A schematic diagram of a network security early warning system based on network port data in one embodiment of the present application is shown, which includes:

[0151] An extraction module 11 is configured to perform field extraction on the acquired network port data between the communication terminals in the distribution automation network to obtain a first communication feature, where the first communication feature includes at least a source address and a destination address;

[0152] A construction module 12 is used to establish a mapping relationship table between source addresses and target addresses, perform time sequence analysis and feature extraction on the mapping relationship table, and construct a network communication relationship map of communications between various communication terminals based on the feature extraction results;

[0153] The analysis module 13 is used to perform time interval analysis on the network communication relationship map to obtain the communication frequency change characteristic value of the network port data; perform fluctuation analysis on the total amount of data transmission of the network port data to obtain the abnormal fluctuation characteristic value of the data transmission;

[0154] Verification module 14 is used to analyze the communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value according to the weighted fusion method to obtain the abnormal communication extension behavior data set, and verify the business logic rationality of the abnormal communication extension behavior data based on the preset device role permission library to obtain the risk communication data set;

[0155] A classification module 15 is configured to classify the risk communication data set into diffusion risk levels based on a hierarchical clustering algorithm, and generate a risk assessment table according to the diffusion risk level classification results;

[0156] The early warning module 16 is used to compare and analyze the acquired real-time network port data according to the risk assessment table, and generate early warning log results according to the comparison and analysis results. The early warning log results are used to achieve safety control of the distribution automation network.

[0157] Compared with the prior art, the embodiments of the present application have the following advantages:

[0158] 1) This application constructs a network communication relationship map covering all communication terminals by establishing a mapping table between source and destination addresses and performing time series analysis. This map not only visually displays normal communication links between devices but also quickly locates potential attack paths through abnormal communication frequencies or data volume fluctuations, providing a visual basis for accurately tracing security incidents.

[0159] 2) This application combines a weighted fusion algorithm with hierarchical clustering technology to simultaneously analyze multiple features, such as communication frequency and data volume fluctuations, and verifies the business legitimacy of abnormal behavior through a device role and permission library. The resulting diffusion risk level assessment table provides millisecond-level real-time warnings, helping operations and maintenance personnel prioritize high-risk incidents and significantly improving the active defense capabilities of the distribution automation network.

[0160] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A network security early warning method based on network port data, characterized in that: include: Performing field extraction on the acquired network port data between the communication terminals in the distribution automation network to obtain a first communication feature, where the first communication feature includes at least a source address and a destination address; Establishing a mapping relationship table between the source address and the target address, performing time sequence analysis and feature extraction on the mapping relationship table, and constructing a network communication relationship map between each of the communication terminals based on the feature extraction results; Performing a time interval analysis on the network communication relationship graph to obtain a communication frequency change characteristic value of the network port data; performing a fluctuation rate analysis on the total amount of data transmission of the network port data to obtain a data transmission abnormal fluctuation characteristic value; The communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value are analyzed according to a weighted fusion method to obtain an abnormal communication extended behavior data set, and the business logic rationality of the abnormal communication extended behavior data set is verified based on a preset device role permission library to obtain a risk communication data set; Based on a hierarchical clustering algorithm, the risk communication data set is divided into diffusion risk levels, and a risk assessment table is generated according to the diffusion risk level division results; Comparing and analyzing the acquired real-time network port data according to the risk assessment table, and generating an early warning log result according to the comparison and analysis result, wherein the early warning log result is used to implement safety control of the distribution automation network; The establishing of a mapping relationship table between the source address and the target address, performing time sequence analysis and feature extraction on the mapping relationship table, and constructing a network communication relationship graph between the communication terminals according to the feature extraction results, includes: Establishing a mapping relationship between the source address and the target address based on a subnet mask address matching rule, and generating a mapping relationship table according to the mapping relationship; Performing a time sequence analysis on the mapping relationship table according to a time window technology, and constructing a communication frequency matrix between each of the communication terminals according to the analysis result; Performing dimensionality reduction processing on the communication frequency matrix based on a local linear embedding algorithm to obtain low-dimensional communication data, and calculating the cosine similarity between each of the communication terminals based on the low-dimensional communication data; The network communication relationship graph is constructed with the communication terminals as nodes and the communication relationships between the communication terminals as edges, wherein the weights of the edges are determined based on the corresponding cosine similarities.

2. The network security early warning method based on network port data according to claim 1, characterized in that: The establishing of a mapping relationship between the source address and the target address based on a subnet mask address matching rule includes: Analyze the preset subnet mask and determine the calculation rules of the subnet address; Performing a bitwise AND operation on the source address and the destination address with the subnet mask based on the calculation rule to obtain a first subnet home address of the source address and a second subnet home address of the destination address; If the first subnet home address is the same as the second subnet home address, a mapping relationship between the source address and the target address is established.

3. The network security early warning method based on network port data according to claim 1, characterized in that: The performing time interval analysis on the network communication relationship graph to obtain the communication frequency change characteristic value of the network port data includes: Extracting communication timestamp information between each pair of source addresses and target addresses in the network communication relationship graph to construct a communication time sequence; Calculating the time interval between two adjacent communications based on the communication time sequence to obtain a time interval sequence; The mean, standard deviation and coefficient of variation of the time interval sequence are calculated respectively, and the communication frequency change characteristic value is constructed according to the mean, the standard deviation and the coefficient of variation.

4. The network security early warning method based on network port data according to claim 1, characterized in that: The fluctuation rate analysis of the total amount of data transmission of the network port data to obtain the abnormal data transmission fluctuation characteristic value includes: Dividing the total amount of data transmission of the acquired network port data according to a preset time window to obtain a time series of the total amount of data transmission; Smoothing the total amount of data transmission time series based on a moving average method to obtain a first total amount of data transmission time series; Calculating the volatility of each time point in the first data transmission total amount time series according to the standard deviation method to obtain a volatility series; The change rate of the volatility at two adjacent time points in the volatility sequence is calculated, and the data transmission abnormal fluctuation characteristic value is constructed according to the obtained volatility change rate sequence.

5. The network security early warning method based on network port data according to claim 1, characterized in that: The analysis of the communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value according to the weighted fusion method to obtain the abnormal communication extension behavior data set includes: Performing a spatiotemporal alignment process on the communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value, wherein the spatiotemporal alignment process includes timestamp matching and communication endpoint matching; Normalizing the communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value after the spatiotemporal alignment processing, and performing weighted fusion processing on the communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value after the normalization processing to obtain a comprehensive characteristic value of the network port data; Based on a preset comprehensive feature threshold, the comprehensive feature value of each network port data is compared and screened, and an abnormal communication extended behavior data set is constructed based on the network port data whose comprehensive feature value is greater than the comprehensive feature threshold.

6. The network security early warning method based on network port data according to claim 1, characterized in that: The process of performing business logic rationality verification on the abnormal communication extended behavior dataset based on the preset device role authority library to obtain a risk communication dataset includes: Mapping the source device and the target device in the abnormal communication extended behavior data set with the device role permission library to obtain a communication rule corresponding to each sample data in the abnormal communication extended behavior data set, wherein the communication rule includes a communication frequency rule, a communication time rule, and a communication data volume rule; Verifying each of the sample data based on the communication frequency rule, the communication time rule, and the communication data volume rule, respectively, to obtain verification results in multiple dimensions, assigning different weights to the verification results in each dimension, and calculating a comprehensive verification value for each of the sample data; The sample data whose comprehensive verification value is greater than a preset verification threshold is determined as risk sample data, and a risk communication data set is constructed based on the risk sample data.

7. The network security early warning method based on network port data according to claim 1, characterized in that: The step of classifying the risk communication data set into diffusion risk levels based on a hierarchical clustering algorithm includes: Calculating the distance between any two data points in the risk communication dataset and constructing a distance matrix, wherein the distance matrix records the similarity information between each pair of data points; In the clustering process of the risk communication dataset, each data point in the risk communication dataset is regarded as a cluster, and according to the similarity information in the distance matrix, two clusters with the highest similarity are merged, and the distance matrix is ​​updated; Repeating the clustering process until a preset number of clustering times is obtained, and constructing a hierarchical clustering tree based on the clustering results, wherein each node of the hierarchical clustering tree represents a cluster; The hierarchical clustering tree is divided into different levels to classify the risk communication dataset into diffusion risk levels, wherein each level corresponds to a diffusion risk level.

8. The network security early warning method based on network port data according to claim 1, characterized in that: After generating the warning log results based on the comparison and analysis results, it also includes: Building a historical database based on the network port data, the risk assessment table and the generated warning information; The data in the historical database is analyzed based on data mining technology, and the changing trend of network security risks is predicted according to the analysis results.

9. A network security early warning system based on network port data, characterized in that: include: an extraction module, configured to perform field extraction on the acquired network port data between the communication terminals in the distribution automation network to obtain a first communication feature, wherein the first communication feature includes at least a source address and a destination address; A construction module is used to establish a mapping relationship table between the source address and the target address, perform time sequence analysis and feature extraction on the mapping relationship table, and construct a network communication relationship map between each of the communication terminals based on the feature extraction results, including: Establishing a mapping relationship between the source address and the target address based on a subnet mask address matching rule, and generating a mapping relationship table according to the mapping relationship; Performing a time sequence analysis on the mapping relationship table according to a time window technology, and constructing a communication frequency matrix between each of the communication terminals according to the analysis result; Performing dimensionality reduction processing on the communication frequency matrix based on a local linear embedding algorithm to obtain low-dimensional communication data, and calculating the cosine similarity between each of the communication terminals based on the low-dimensional communication data; The network communication relationship graph is constructed by taking the communication terminals as nodes and the communication relationships between the communication terminals as edges, wherein the weights of the edges are determined based on the corresponding cosine similarities; An analysis module is configured to perform time interval analysis on the network communication relationship graph to obtain a characteristic value of a communication frequency change of the network port data; and perform a fluctuation rate analysis on the total amount of data transmission of the network port data to obtain a characteristic value of abnormal data transmission fluctuation; a verification module, configured to analyze the communication frequency change characteristic value and the data transmission abnormal fluctuation characteristic value according to a weighted fusion method to obtain an abnormal communication extended behavior data set, and perform business logic rationality verification on the abnormal communication extended behavior data set based on a preset device role permission library to obtain a risk communication data set; A classification module is used to classify the risk communication data set into diffusion risk levels based on a hierarchical clustering algorithm, and generate a risk assessment table according to the diffusion risk level classification results; The early warning module is used to compare and analyze the acquired real-time network port data according to the risk assessment table, and generate early warning log results according to the comparison and analysis results. The early warning log results are used to achieve safe control of the distribution automation network.

Images