Network security protection methods for power monitoring systems

Abstract

This invention discloses a network security protection method for power monitoring systems, relating to the field of power network security operation and maintenance technology. By constructing a risk command feature database, this invention can more effectively identify highly covert attacks that dynamically rename or exploit system vulnerabilities. It then performs multi-dimensional analysis of received network access requests, compensating for the shortcomings of existing systems in multi-dimensional command verification. For high-risk operations within benign processes, it introduces secondary biometric authentication and enables digital signature verification for file transfers, directly strengthening the system's inherent security barrier. Furthermore, it applies machine learning algorithms to analyze the compliance of command sequences and provides real-time risk warnings for command flows deviating from normal patterns, solving the problem of insufficient dynamic threat perception in existing systems. This significantly enhances the dynamic defense capabilities and full lifecycle security management level of power monitoring systems in complex network environments.

Description

Technical Field

[0001] This invention belongs to the field of power network security operation and maintenance technology, and specifically relates to a network security protection method for power monitoring systems. Background Technology

[0002] Against the backdrop of the intelligent and networked development of new power systems, the cybersecurity protection of existing power monitoring systems faces significant shortcomings in dealing with malicious processes and risky commands. In protecting against malicious processes, existing protection systems rely excessively on superficial information such as process names and static characteristics for detection, making it difficult to effectively identify highly covert attacks that dynamically rename processes or exploit system vulnerabilities. Vulnerabilities exist in the system's inherent security and supply chain management; supplier equipment firmware or software updates may carry malicious code, which can be easily used for command hijacking or man-in-the-middle attacks. It is clear that existing systems urgently need strengthening in areas such as dynamic threat perception, multi-dimensional command verification, and full lifecycle security management. Summary of the Invention

[0003] In view of the deficiencies in the prior art, the present invention provides a network security protection method for power monitoring systems to solve the above-mentioned technical problems.

[0004] A network security protection method for power monitoring systems includes the following steps:

[0005] A risk command feature database is constructed based on historical attack data. The risk command feature database includes malicious process signatures, abnormal protocol field patterns, and risk command fingerprints.

[0006] The received network access requests are analyzed from multiple dimensions to obtain the control command feature parameters in the access requests. Based on the control command feature parameters, risky processes are identified and blocked, while benign processes are blocked.

[0007] Secondary biometric authentication is initiated for maintenance operations involving modifications to system parameters during benign processes, and a digital signature verification mechanism is enabled for file transfer operations.

[0008] Machine learning algorithms are used to analyze the characteristic data of risky instructions, and risk warnings are generated in real time for instruction streams that deviate from the normal pattern.

[0009] Before performing secondary biometric authentication on operations and maintenance, all network access requests are associated with the structural characteristics of application service data units and transmission time sequence, and stored as operation instructions and device status change logs. This generates a timestamped chain of operational evidence, constructs a panoramic view of the operation context, and stores the evidence through an encrypted hash chain structure. Once the evidence is constructed, any modification will cause the hash value to break, which can effectively combat supply chain attacks or data forgery by insiders, providing evidence support for post-incident tracing.

[0010] Preferably, when obtaining the control instruction feature parameters in the access request, the specific steps include the following:

[0011] Real-time parsing of network access requests, extracting transport operation type identifiers and application service data units;

[0012] Extract the source IP address and target device identifier;

[0013] Capture control command characteristic parameters in the protocol payload.

[0014] Based on the real-time parsing mechanism, microsecond-level instruction feature extraction can be achieved at the protocol stack level, avoiding the response lag problem caused by protocol decoding delay in traditional deep packet inspection technology. At the same time, the modular design sampled in this solution can support extended parsing of various power protocols, solving the problem of poor adaptability of traditional solutions to non-standard protocols.

[0015] Preferably, when initiating secondary biometric authentication for maintenance operations involving modifications to system parameters during a benign process, the specific steps include:

[0016] The extracted instruction features are matched against a risk instruction feature database. If a match is found, a blocking instruction is triggered and the intrusion event is recorded.

[0017] Virus signature scanning is performed on unmatched instruction features, and process behavior analysis is conducted in a sandbox environment to identify hidden malicious code;

[0018] Add the verified source IP address to the trusted address whitelist.

[0019] Traditional solutions often force two-factor authentication for all high-privilege operations. In contrast, this solution uses a pre-emptive risk filtering approach, initiating biometric authentication only when a potential anomaly is detected. For example, in practical applications, if the instruction signature does not match the risk database but the sandbox detects that a process is attempting to encrypt system logs, the system will only trigger authentication at this point, thus avoiding unnecessary disruption to normal operations caused by frequent two-factor authentication.

[0020] Preferably, when performing pattern matching between the extracted instruction features and the risk instruction feature database, the following steps are specifically included:

[0021] Based on the network access request, a first dataset containing protocol semantic features is generated, and the sampling feature encoder converts the first dataset into a vectorized instruction feature sequence.

[0022] Based on the vectorized instruction feature sequence, an initial neural network model is trained to generate a first risk instruction prediction model. A strong detection medium is deployed to perform in-depth analysis of network access requests, and a high-confidence risk judgment result output by the strong detection medium is obtained to generate a second dataset labeled with risk levels.

[0023] Based on the second dataset, the first risk instruction prediction model was initially transferred to the second prediction model. During the transfer process, a domain adaptive algorithm was used to align the feature space of the power industrial control protocol. The second prediction model was fine-tuned through an online learning mechanism to generate a risk identification model that integrates real-time threat intelligence.

[0024] The extracted instruction features are simultaneously input into the risk instruction feature database and the risk identification model for parallel matching. When any preset risk condition is met, a blocking instruction is triggered, and an audit log is generated for the session message of the blocked network access request.

[0025] The first risk instruction prediction model is used to identify known attack patterns, while the second prediction model can try to integrate new attack samples to enable the model to continuously evolve and detect complex covert attacks. In actual use, switching instructions such as "closing instructions" are generally dynamically associated with the actual switch status of the circuit breaker.

[0026] Preferably, when performing pattern matching between the extracted instruction features and the risk instruction feature database, the following steps are also included:

[0027] The difference rate between the risk identification model and the strong detection medium is calculated periodically. When the difference rate exceeds a preset threshold, the risk identification model is retrained.

[0028] During training, the blocking trigger threshold can be dynamically adjusted based on the current network situation and changes in conditions such as the frequency of scanning attacks and historical data on false positive rates. This allows the model to better adapt to scenarios such as protocol evolution and device upgrades, reducing training time and also filtering out false positives caused by over-reliance on historical rules.

[0029] Preferably, the preset risk condition is as follows:

[0030] The agreement field matches the abnormal patterns in the risk feature database more than the first threshold.

[0031] The risk score output by the predictive model exceeds the dynamically adjusted second threshold.

[0032] In actual use, during power grid fault recovery, the second threshold is automatically lowered to enhance sensitivity, while during peak business periods, the second threshold is appropriately raised to avoid erroneous blocking that could cause business interruption.

[0033] Preferably, the strong detection medium includes:

[0034] An anomaly field combination detection engine based on the IEC104 protocol specification;

[0035] Malware behavior signature matcher.

[0036] By parsing the logical constraints between protocol fields, it can identify semantic obfuscation attacks that are difficult for traditional rule engines to cover. It can effectively detect illegal field combinations obtained by attackers tampering with legal type identifiers, as well as parameter out-of-bounds injection where the object address exceeds the actual range of the device. It can detect advanced threats such as fileless attacks and supply chain poisoning. Compared with full traffic deep packet inspection, it can greatly reduce the load of invalid analysis.

[0037] Preferably, the high-confidence risk assessment result output by the strong detection medium is:

[0038] Perform protocol semantic restoration on abnormal field combinations and extract their effective payload entropy value and field distribution pattern as negative samples;

[0039] Protocol session reassembly is performed on malware behavior to extract its covert channel characteristics and abnormal time intervals as positive samples.

[0040] By analyzing the actual business meaning of abnormal field combinations, the limitations of traditional regular expression matching can be overcome, thereby achieving the effect of identifying two types of advanced threats: encryption obfuscation attacks and abuse of legitimate protocols. At the same time, by reconstructing the complete session flow, it can detect covert communication by attackers transmitting control commands through specific message intervals, identify low-frequency but high-harm command injection, and effectively overcome the problem of traditional threshold detection being prone to missed detection due to excessively long sampling periods.

[0041] Preferably, when performing multi-dimensional parsing on the received network access request, the multi-dimensional aspects specifically include:

[0042] IEC104 protocol message transmission direction and frame sequence number continuity check;

[0043] Validation of the address of information objects in the application service data unit;

[0044] Causal correlation analysis between control commands and the current state of the device.

[0045] The transmission direction of IEC104 messages is generally as follows: the control area is only allowed to receive downlink commands, and the transition pattern of IEC104 protocol messages is generally determined based on continuously increasing or allowed packet loss thresholds.

[0046] Preferably, the secondary biometric authentication includes: binding and verification of the biometric features of maintenance personnel with digital certificates; comparison of the hardware fingerprint of the operating terminal with the list of authorized devices; and a two-factor authentication mechanism of dynamic password and physical key.

[0047] Even if attackers can steal digital certificates, they still cannot pass authentication due to the lack of biometric features such as 3D-printed fingerprints. Hardware fingerprints are unforgeable and can defend against IP spoofing or VPN tunneling attacks. Combined with dynamic passwords, they can further intercept phishing and replay attacks.

[0048] The beneficial effects of this invention are as follows: In this solution, by constructing a risk command feature database, it is possible to more effectively identify highly covert attacks that dynamically rename or exploit system vulnerabilities. Then, the received network access requests are analyzed from multiple dimensions, making up for the shortcomings of existing systems in multi-dimensional command verification. Secondary biometric authentication is introduced for high-risk operations in benign processes, and a digital signature verification mechanism is enabled for file transfers, directly strengthening the system's inherent security barrier. Machine learning algorithms are applied to analyze the compliance of command sequences, and real-time risk warnings are given for command flows that deviate from normal patterns. This solves the problem of insufficient dynamic threat perception in existing systems and significantly enhances the dynamic defense capabilities and full lifecycle security management level of the power monitoring system in complex network environments. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 A flowchart illustrating a network security protection method for a power monitoring system provided by the present invention;

[0051] Figure 2 This is a schematic diagram illustrating the process of pattern matching between extracted instruction features and a risk instruction feature database in a network security protection method for a power monitoring system provided by the present invention. Detailed Implementation

[0052] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0053] The following disclosure provides many different embodiments or examples for implementing different structures of the present invention. To simplify the disclosure of the present invention, the components and arrangements of specific examples are described below. Of course, these are merely examples and are not intended to limit the present invention.

[0054] The embodiments of the invention will now be described in detail with reference to the accompanying drawings.

[0055] like Figure 1 As shown, a network security protection method for a power monitoring system specifically includes the following steps:

[0056] A risk command feature database is constructed based on historical attack data. The risk command feature database includes malicious process signatures, abnormal protocol field patterns, and risk command fingerprints.

[0057] The received network access requests are analyzed from multiple dimensions to obtain the control command feature parameters in the access requests. Based on the control command feature parameters, risky processes are identified and blocked, while benign processes are blocked.

[0058] Secondary biometric authentication is initiated for maintenance operations involving modifications to system parameters during benign processes, and a digital signature verification mechanism is enabled for file transfer operations.

[0059] Machine learning algorithms are used to analyze the characteristic data of risky instructions, and risk warnings are generated in real time for instruction streams that deviate from the normal pattern.

[0060] In this solution, the constructed risk command feature database integrates malicious process signatures, abnormal protocol patterns, and risk command fingerprints. This multi-layered feature system can more effectively identify highly covert attacks that dynamically rename or exploit system vulnerabilities. By performing multi-dimensional analysis of received network access requests, the system strengthens command-level verification capabilities, addressing the shortcomings of existing systems in multi-dimensional command verification and improving the accuracy of malicious command identification. Crucially, secondary biometric authentication is introduced for high-risk operations within benign processes, and a digital signature verification mechanism is enabled for file transfers. This directly strengthens the system's inherent security barrier and effectively addresses vulnerabilities in supply chain management. Machine learning algorithms are applied to analyze the compliance of command sequences, providing real-time risk warnings for command flows deviating from normal patterns. This solves the problem of insufficient dynamic threat perception in existing systems and significantly enhances the dynamic defense capabilities and full lifecycle security management level of the power monitoring system in complex network environments.

[0061] More specifically, obtaining the control instruction characteristic parameters in the access request includes the following steps:

[0062] Real-time parsing of network access requests, extracting transport operation type identifiers and application service data units;

[0063] Extract the source IP address and target device identifier;

[0064] Capture control command characteristic parameters in the protocol payload.

[0065] More specifically, when initiating secondary biometric authentication for maintenance operations involving modifications to system parameters during a benign process, the following steps are included:

[0066] The extracted instruction features are matched against a risk instruction feature database. If a match is found, a blocking instruction is triggered and the intrusion event is recorded.

[0067] Virus signature scanning is performed on unmatched instruction features, and process behavior analysis is conducted in a sandbox environment to identify hidden malicious code;

[0068] Add the verified source IP address to the trusted address whitelist.

[0069] By employing real-time comparison of known attack patterns, high-confidence threats can be intercepted within milliseconds, avoiding the delays in the blocking process of traditional single biometric authentication mechanisms. Simultaneously, during virus scanning and sandbox analysis of unmatched commands, the system uses dynamic behavior detection to compensate for the shortcomings of traditional static signature database comparison in missing unknown malicious code, reducing the risk of false positives. Finally, by adding trusted IPs to the whitelist after verification, the system automates the trust accumulation mechanism, reduces the need for repeated authentication of verified security sources, and improves operational efficiency.

[0070] like Figure 2 As shown, more specifically, when performing pattern matching between the extracted instruction features and the risk instruction feature database, the following steps are included:

[0071] Based on the network access request, a first dataset containing protocol semantic features is generated, and the sampling feature encoder converts the first dataset into a vectorized instruction feature sequence.

[0072] Based on the vectorized instruction feature sequence, an initial neural network model is trained to generate a first risk instruction prediction model. A strong detection medium is deployed to perform in-depth analysis of network access requests, and a high-confidence risk judgment result output by the strong detection medium is obtained to generate a second dataset labeled with risk levels.

[0073] Based on the second dataset, the first risk instruction prediction model was initially transferred to the second prediction model. During the transfer process, a domain adaptive algorithm was used to align the feature space of the power industrial control protocol. The second prediction model was fine-tuned through an online learning mechanism to generate a risk identification model that integrates real-time threat intelligence.

[0074] The extracted instruction features are simultaneously input into the risk instruction feature database and the risk identification model for parallel matching. When any preset risk condition is met, a blocking instruction is triggered, and an audit log is generated for the session message of the blocked network access request for incremental model training.

[0075] In this scheme, the logical relationships between protocol fields are extracted through a feature encoder. Compared with traditional regular expression matching or keyword retrieval methods, it has fewer limitations and can effectively identify instructions that are semantically valid but logically abnormal. At the same time, through adversarial training, it can solve the problem of insufficient model generalization caused by protocol differences between cross-vendor devices, and can greatly leverage the feature library's efficient interception capability against known attacks.

[0076] More specifically, when performing pattern matching between the extracted instruction features and the risk instruction feature database, the following steps are also included:

[0077] The difference rate between the risk identification model and the strong detection medium is calculated periodically. When the difference rate exceeds a preset threshold, the risk identification model is retrained.

[0078] Traditional matching techniques typically rely on fixed cycles or human experience for model updates. This approach is prone to detection failures when attack patterns change abruptly. In contrast, this solution quantifies the decision differences between the risk identification model and the strong detection medium, enabling it to identify whether the monitoring model has experienced performance degradation or decreased environmental adaptability, thus effectively reflecting model defects.

[0079] More specifically, the preset risk conditions are as follows:

[0080] The agreement field matches the abnormal patterns in the risk feature database more than the first threshold.

[0081] The risk score output by the predictive model exceeds the dynamically adjusted second threshold.

[0082] The first threshold can quickly intercept attacks based on known malicious function codes, illegal register addresses, and other attack characteristics, effectively leveraging the efficiency of the rule engine. The second threshold can capture semantic anomalies such as temporal logic contradictions and parameter mutation correlations in protocol instructions through the model, compensating for the blind spots of the rule base for unknown attacks. By setting dual risk conditions for the first and second thresholds, it can detect APT attacks that utilize legitimate protocol fields but construct abnormal parameter combinations, which are easily missed by traditional single mechanisms.

[0083] More specifically, the strong detection medium includes:

[0084] An anomaly field combination detection engine based on the IEC104 protocol specification;

[0085] Malware behavior signature matcher.

[0086] The abnormal field combination detection engine can monitor the legality of the combination of type identifier and transmission reason, overcoming the problem of misjudgment caused by the lack of protocol semantic understanding in traditional methods. It forms a layered filtering mechanism, which greatly reduces the false alarm rate of IEC104 protocol attacks.

[0087] More specifically, the high-confidence risk assessment result output by the strong detection medium is:

[0088] Perform protocol semantic restoration on abnormal field combinations and extract their effective payload entropy value and field distribution pattern as negative samples;

[0089] Protocol session reassembly is performed on malware behavior to extract its covert channel characteristics and abnormal time intervals as positive samples.

[0090] By jointly inputting negative and positive samples into the detection model, an adversarial training environment can be constructed, enabling the model to learn both protocol compliance and behavioral legality simultaneously. Here, negative samples mostly represent abnormal protocol patterns, while positive samples mostly represent malicious behavior characteristics.

[0091] More specifically, when performing multi-dimensional analysis on received network access requests, the multi-dimensional aspects are:

[0092] IEC104 protocol message transmission direction and frame sequence number continuity check;

[0093] Validation of the address of information objects in the application service data unit;

[0094] Causal correlation analysis between control commands and the current state of the device.

[0095] By verifying the directional compliance of IEC104 messages and the pattern of frame sequence number jumps, attacks such as remote control commands initiated by non-scheduling terminals and confirmed S-frames that have been retransmitted can be identified. Furthermore, by setting up a dynamic whitelist, access control with business logic awareness can be achieved, and hidden register addresses added by exploiting device firmware vulnerabilities can be identified.

[0096] More specifically, the secondary biometric authentication includes: binding and verification of the biometrics of maintenance personnel with digital certificates; comparison of the hardware fingerprint of the operating terminal with the list of authorized devices; and a two-factor authentication mechanism of dynamic password and physical key.

[0097] By dynamically associating biometric information such as fingerprints / iris scans with key pairs of certificates, the system addresses the single risk of traditional biometric features being easily copied or certificate private keys being stolen. At the same time, it restricts the range of operating terminals at the physical layer, blocking unauthorized devices from accessing the system.

[0098] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A network security protection method for a power monitoring system, characterized in that, Includes the following steps: A risk command feature database is constructed based on historical attack data. The risk command feature database includes malicious process signatures, abnormal protocol field patterns, and risk command fingerprints. The received network access requests are analyzed from multiple dimensions to obtain the control command feature parameters in the access requests. Based on the control command feature parameters, risky processes are identified and blocked, while benign processes are blocked. Secondary biometric authentication is initiated for maintenance operations involving modifications to system parameters during benign processes, and a digital signature verification mechanism is enabled for file transfer operations. Machine learning algorithms are used to analyze the characteristic data of risky instructions, and risk warnings are generated in real time for instruction streams that deviate from the normal pattern. When retrieving control instruction characteristic parameters from an access request, the specific steps include: Real-time parsing of network access requests, extracting transport operation type identifiers and application service data units; Extract the source IP address and target device identifier; Capture control command characteristic parameters in the protocol payload; When initiating secondary biometric authentication for maintenance operations involving system parameter modifications during benign processes, secondary biometric authentication is introduced for high-risk operations, specifically including the following steps: The extracted instruction features are matched against a risk instruction feature database. If a match is found, a blocking instruction is triggered and the intrusion event is recorded. Virus signature scanning is performed on unmatched instruction features, and process behavior analysis is conducted in a sandbox environment to identify hidden malicious code; Add the verified source IP address to the trusted address whitelist.

2. The network security protection method for a power monitoring system according to claim 1, characterized in that, When performing pattern matching between the extracted instruction features and the risk instruction feature database, the specific steps include the following: Based on the network access request, a first dataset containing protocol semantic features is generated, and the sampling feature encoder converts the first dataset into a vectorized instruction feature sequence. Based on the vectorized instruction feature sequence, an initial neural network model is trained to generate a first risk instruction prediction model. A strong detection medium is deployed to perform in-depth analysis of network access requests, and a high-confidence risk judgment result output by the strong detection medium is obtained to generate a second dataset labeled with risk levels. The robust detection medium includes: an abnormal field combination detection engine generated based on the IEC104 protocol specification, and a malware behavior feature matcher; Based on the second dataset, the first risk instruction prediction model was initially transferred to the second prediction model. During the transfer process, a domain adaptive algorithm was used to align the feature space of the power industrial control protocol. The second prediction model was fine-tuned through an online learning mechanism to generate a risk identification model. The extracted instruction features are simultaneously input into the risk instruction feature database and the risk identification model for parallel matching. When any preset risk condition is met, a blocking instruction is triggered, and an audit log is generated for the session message of the blocked network access request.

3. The network security protection method for a power monitoring system according to claim 2, characterized in that, When performing pattern matching between the extracted instruction features and the risk instruction feature database, the following steps are also included: The difference rate between the risk identification model and the strong detection medium is calculated periodically. When the difference rate exceeds a preset threshold, the risk identification model is retrained.

4. The network security protection method for a power monitoring system according to claim 2, characterized in that, The preset risk conditions are specifically as follows: The agreement field matches the abnormal patterns in the risk feature database more than the first threshold. The risk score output by the predictive model exceeds the dynamically adjusted second threshold.

5. The network security protection method for a power monitoring system according to claim 2, characterized in that, The high-confidence risk assessment result output by the strong detection medium is: Perform protocol semantic restoration on abnormal field combinations and extract their effective payload entropy value and field distribution pattern as negative samples; Protocol session reassembly is performed on malware behavior to extract its covert channel characteristics and abnormal time intervals as positive samples.

6. The network security protection method for a power monitoring system according to claim 1, characterized in that, When performing multi-dimensional parsing on received network access requests, the multi-dimensional aspects specifically include: IEC104 protocol message transmission direction and frame sequence number continuity check; Validation of the address of information objects in the application service data unit; Causal correlation analysis between control commands and the current state of the device.

7. The network security protection method for a power monitoring system according to claim 1, characterized in that, The secondary biometric authentication includes: binding and verification of the biometrics of maintenance personnel with digital certificates; comparison of the hardware fingerprint of the operating terminal with the list of authorized devices; and a two-factor authentication mechanism of dynamic password and physical key.

Images