Intelligent hierarchical-based power data security compliance management method and system

Abstract

The application relates to a power data security compliance management method and system based on intelligent grading, which comprises the following steps: S1: acquiring power multi-source data and preprocessing; S2: constructing a power security knowledge graph according to the preprocessed power multi-source data, and automatically extracting entities and their relationships from text data by using a model based on a Transformer; S3: analyzing cross-regional data by a federal learning model, predicting data sensitivity changes, using rules in the power security knowledge graph, combining real-time data for logical reasoning, and generating dynamic grading results; S4: using an MPNN-based user credit evaluation model to analyze user access behavior, evaluating user credit values, and generating dynamic access strategies; S5: based on the generated dynamic access strategy, collecting logs by a SIEM system, analyzing log content by using NLP technology, extracting abnormal behavior, and automatically isolating related accounts. The application significantly improves the accuracy and adaptability of data compliance management.

Description

Technical Field

[0001] This invention relates to the field of data management, and in particular to a method and system for power data security and compliance management based on intelligent hierarchical classification. Background Technology

[0002] Driven by the construction of new power systems, the power industry is accelerating its digital and intelligent transformation, and data is increasingly becoming a core production factor. The power system encompasses multiple stages, including power generation, transmission, distribution, and consumption, generating massive amounts of multi-source heterogeneous data (such as equipment operation data, user electricity consumption information, and grid topology data) with high value density. Simultaneously, various regulations have been introduced, imposing strict requirements on the classification, grading, protection, and compliant use of power data. Data security has become a crucial link in ensuring energy security and national security.

[0003] However, traditional power data management models face numerous challenges. On the one hand, data sources are diverse and formats vary, with structured, unstructured, and semi-structured data coexisting. Manual processing is inefficient and prone to errors, making it difficult to meet the requirements for real-time performance and accuracy. On the other hand, static data grading methods cannot adapt to the dynamic changes in power operations. For example, the sensitivity of real-time data generated during equipment failures increases significantly, and traditional grading standards cannot respond in a timely manner. Furthermore, cross-regional data collaborative analysis poses security risks, and traditional encrypted transmission and access control methods struggle to balance data sharing needs with privacy protection requirements. Summary of the Invention

[0004] To address the aforementioned issues, the present invention aims to provide a method and system for power data security compliance management based on intelligent hierarchical classification, which significantly improves the accuracy and adaptability of data compliance management.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] A power data security compliance management method based on intelligent hierarchical classification includes the following steps:

[0007] S1: Acquire multi-source power data, including structured data, unstructured data, and semi-structured data, and preprocess them;

[0008] S2: Based on the preprocessed multi-source power data, construct a power safety knowledge graph, use a Transformer-based model to automatically extract entities and relationships between entities from text data, and periodically crawl the latest regulations, automatically updating the regulatory nodes and relationships in the power safety knowledge graph through semantic matching;

[0009] S3: Based on real-time collected equipment operating status and user behavior logs, analyze cross-regional data through a federated learning model, predict changes in data sensitivity, and use the rules in the power safety knowledge graph, combined with real-time data, to perform logical reasoning and generate dynamic hierarchical results.

[0010] S4: Based on the dynamic hierarchical results, user behavior data, and permission rules in the knowledge graph, the user access behavior is analyzed using the MPNN-based user credit assessment model to evaluate the user credit value. Combined with the permission rules in the power safety knowledge graph and the user credit value, dynamic access policies are generated.

[0011] S5: Based on the generated dynamic access policy, logs are collected centrally through the SIEM system, and NLP technology is used to parse the log content, extract abnormal behaviors, and trigger emergency response rules in the power safety knowledge graph to automatically isolate related accounts.

[0012] Further preprocessing is performed as follows:

[0013] Structured data preprocessing: missing values ​​are interpolated using time series, Z-Score standardization is used to eliminate dimensional differences, and wavelet transform is used to filter out high-frequency noise; peak and valley power consumption and load fluctuation characteristics are extracted from user electricity consumption records to construct a time series feature matrix;

[0014] Unstructured data preprocessing, including text data and image data: Text data uses a pre-trained model to extract entities from fault reports, and combines a rule engine to extract time and location information; the equipment instruction manual text is converted into word vectors or sentence vectors;

[0015] Image data is used to identify device labels and abnormal regions using an object detection model, and to extract image features;

[0016] Semi-structured data preprocessing: Map the XML configuration of the protection device into key-value pairs, store them in a NoSQL database, parse the nodes and connections in the CIM / E file, and construct a graph-structured adjacency matrix;

[0017] Data anonymization was performed, as follows:

[0018] Using a BERT-based named entity recognition model, sensitive entities in text are identified, including user names, address text, ID card numbers, bank card numbers, and user electricity addresses.

[0019] For user name and address text information, random replacement is used for desensitization;

[0020] For ID card numbers and bank card numbers, the AES-256 symmetric encryption algorithm is used for encryption to ensure the security of data during storage and transmission.

[0021] For user electricity addresses, the detailed address will be generalized to the province and city level.

[0022] Furthermore, based on the preprocessed multi-source power data, a power security knowledge graph is constructed. A Transformer-based model is used to automatically extract entities and relationships between entities from the text data, as detailed below:

[0023] The entity types are defined as including five core entity types: equipment entities, user entities, regulatory entities, operational entities, and risk entities.

[0024] Relationships between entities are established through business logic and mathematical models, including equipment associations, regulatory constraints, and risk impacts.

[0025] The device associations describe the physical connections between devices, and the relationship weights are calculated using the Haversine formula to determine the geographical distance between devices.

[0026] Regulatory constraints indicate that data classification and access control comply with regulations.

[0027] Establish causal relationships between risk impacts and equipment failures, operational anomalies, and data security.

[0028] The attribute definitions include equipment entity attributes and regulatory entity attributes; the equipment entity attributes include numerical attributes, timestamp attributes, and spatial coordinate attributes; the regulatory entity attributes are text-based, recording the publication time, scope of application, and revision history of the regulations to ensure the accuracy of compliance checks;

[0029] Based on the defined entities, relationships, and attributes, entity relationship extraction is performed using BERT and GNN.

[0030] The extracted entities, relations, and attributes are transformed into entity, relation, and entity triples, and attribute information is added to form the basic units of the knowledge graph. The triples are stored in the Neo4j graph database, and a network structure is constructed through node labels and relation types.

[0031] When the device location changes, the attention weight of node k to its neighbor node m is recalculated. When the new regulations k new When adding, calculate k new The similarity sim(q,k) with the existing operation node q new ), if sim(q,k new If )>τ, where τ is a preset threshold, then a constraint relationship is added;

[0032] Based on real-time statistical adjustments to conditional probabilities, update risk relationships:

[0033] ;

[0034] Where β is the smoothing factor and II is the indicator function; For the updated risk relationship; The risk relationships before the update; Event represents the risk-triggered event; This represents the change in data sensitivity.

[0035] Furthermore, based on the defined entities, relationships, and attributes, entity-relationship extraction is performed using BERT and GNN, as detailed below:

[0036] Input text data into the BERT model to generate context-sensitive word vector representations:

[0037] ;

[0038] Where, x i Let h be the i-th token in the text, n be the total number of tokens in the text, and h be the number of tokens in the text. i The corresponding hidden layer vectors are used to realize semantic modeling of professional terms in the power field;

[0039] A Conditional Random Field (CRF) is applied after the BERT output layer to model the dependencies between labels y and output the optimal entity label sequence. ;

[0040] CRF probability The formula for calculation is:

[0041] ;

[0042] Where, ψ i Z(H) represents the transition score between adjacent labels, Z(H) is the normalization factor, H is the output of the BERT output layer, and y represents the transition score between adjacent labels. i-1 y i These are the (i-1)th and ith labels in the sequence, respectively.

[0043] The entities identified by NER are paired to construct candidate pairs of relationships to be classified.

[0044] For each identified entity k, the text span is [s]. k ,e k ], its initial node embedding is :

[0045] ;

[0046] Among them, s k e k These represent the start and end positions of entity k in the text;

[0047] By aggregating features using a Graph Attention Network (GAT), the text is transformed into a dependency graph, with words as nodes and syntactic dependencies as edges. The updated GAT is as follows:

[0048] ;

[0049] in, W is the set of neighboring nodes of node k; (l) These are the trainable weights for the l-th layer; Let be the attention weight of node k to its neighbor node m; For activation functions; Output for node k at level l+1; Output for node m at layer l;

[0050] The attention weights between nodes are calculated using the Graph Attention Network (GAT). Aggregate entity context information:

[0051] ;

[0052] in, is the activation function; W is the weight matrix; h k h m Let represent the feature vectors of node k and node m respectively; 'a' represents the trainable weight vector used to calculate the attention score; and 'T' represents the transpose.

[0053] The aggregated entity features are input into a multilayer perceptron, and the softmax function is used to predict the relationship type.

[0054] ;

[0055] Among them, W r The weights of the multilayer perceptron; Represents a given entity The probability that the relationship between them is r; and Entities Embedded in the output of layer L; This indicates that two embedding vectors are concatenated.

[0056] Furthermore, the latest regulations are crawled periodically, and the regulatory nodes and relationships in the power safety knowledge graph are automatically updated through semantic matching, as follows:

[0057] We regularly obtain the latest regulations through web crawlers, and after NLP performs sentence segmentation, word segmentation, and part-of-speech tagging, we convert them into structured text to ensure the timeliness of the regulatory knowledge.

[0058] The Sentence-BERT model is used to generate sentence vectors of the regulatory text, and the cosine similarity is used to determine the degree of correlation between the old and new regulations, Sim(s1,s2).

[0059] ;

[0060] Where s1 and s2 represent the new and old regulations, respectively; SBERT(s1) and SBERT(s2) represent the sentence vectors of the new and old regulations generated using the Sentence-BERT model, respectively. Represents the Euclidean norm;

[0061] If Sim(s1,s2) exceeds the threshold, it is determined to be a relevant regulation, triggering the update process;

[0062] DBpedia Spotlight, an entity linking technology, matches entities in the new regulations with existing entities in the graph, automatically updating the rule nodes associated with entities in the new regulations, ensuring consistency between regulatory requirements and security policies.

[0063] Furthermore, based on real-time collected device operating status and user behavior logs, cross-regional data is analyzed using a federated learning model to predict changes in data sensitivity.

[0064] The federated learning model uses an LSTM neural network to process time-series data and employs fully connected layers to output sensitivity scores. The local training process is as follows:

[0065] Equipment state feature sequence X=[x1,x2,…,x t ,…,x T’ ], x t The device state at time t is represented by Y, where T' is the total timing sequence; the user behavior characteristic is represented by Y.

[0066] LSTM layer extracts temporal dependencies h t :h t =LSTM(h t-1 ,x t ),t=1,…,T'

[0067] The fully connected layer outputs the sensitivity prediction value of the i-th token. , representing the probability of data sensitivity;

[0068] The central server collects model parameters from each region and uses the FedAvg algorithm to perform a weighted average to obtain the model parameters. :

[0069]

[0070] in, For the first Model parameters for each region For the first Data volume for each region Total global data volume; For the number of regions;

[0071] The output of federated learning By combining sensitive historical events in the knowledge graph, a comprehensive sensitivity score is generated through a weighted fusion formula:

[0072]

[0073] in, and KG_RuleScore is the weighting coefficient, and KG_RuleScore is the knowledge graph rule matching score.

[0074] Using the Datalog language, data grading standards are transformed into executable rules for the knowledge graph. SPARQL is used to query the association between real-time data features and knowledge graph nodes, mapping them to levels 1-5 based on the comprehensive sensitivity score S.

[0075] ;

[0076] Based on predefined rules from the knowledge graph, sensitivity upgrade rules are triggered.

[0077] Furthermore, the user credit assessment model based on MPNN is as follows:

[0078] Layered messaging:

[0079] Message generation: Node a sends message m to its neighbor node b. a,b Messages are generated based on node and edge attributes:

[0080] ;

[0081] Among them, v a W represents the feature vector of node a. m U m Δt is the trainable weight matrix; ReLU is the activation function; a,b This represents the edge characteristics between node a and its neighbor node b;

[0082] Message aggregation: Node a aggregates all neighbor messages {m a,b The mean pooling method is used to obtain the neighbor aggregated feature vector of node a. :

[0083] ;

[0084] Where N(a) is the set of neighbors of node a;

[0085] Node state update, obtaining the updated feature vector of node a. : ;

[0086] Among them, W u These are the weighting coefficients;

[0087] Global feature aggregation: A global representation g of the user behavior graph is obtained through graph pooling, and input into a fully connected layer to generate a credit value C∈[0,1]:

[0088] ;

[0089] Among them, W c and b c These are the weights and biases for the fully connected layer.

[0090] Furthermore, by combining the permission rules and user credit scores in the power security knowledge graph, a dynamic access policy is generated, as follows:

[0091] The knowledge graph predefined rules include hierarchical association rules and credit threshold rules, and the rules are formally represented using conditional expressions;

[0092] Access control strength (Control_Level) calculation:

[0093] Control_Level=W d ×DataRisk(d)+W c ×BehaviorRisk(u)

[0094] Where DataRisk(d) is the risk value corresponding to the data classification, and BehaviorRisk(u) is the user behavior risk value; W d W c These are the weights corresponding to data classification and user behavior, respectively.

[0095] Obtain the data d requested by user u and the data hierarchy L d ;

[0096] Credit Score Inquiry: Retrieves the user's current credit score C from a real-time database. u ;

[0097] Rule matching:

[0098] Examine the mandatory rules of d in the knowledge graph, calculate the control strength Control_Level, match the policy mapping table, and generate an access policy that includes authentication method, operation permissions, and time limit.

[0099] Furthermore, based on the generated dynamic access policy, logs are centrally collected through the SIEM system, and NLP technology is used to parse the log content, extract abnormal behaviors, and trigger emergency response rules in the power safety knowledge graph to automatically isolate relevant accounts, as follows:

[0100] The SIEM system detects an anomaly, generates an event ID, and calculates the risk level (Risk_Level) by combining the event type, data classification, and user credit score.

[0101] Risk_Level = Data Classification × L1 + Behavioral Risk Value × L2;

[0102] Where L1 and L2 are weighting coefficients;

[0103] If the risk level is ≥P, account isolation measures will be triggered. The account management system will be called via API to immediately isolate the risky user account.

[0104] Risk level = P-1, triggering access throttling, limiting the number of concurrent user accesses to 1, and limiting the amount of exported data to a preset value;

[0105] After the isolation operation is completed, update the current status of the user node in the knowledge graph to "isolated" and record the processing timestamp.

[0106] A power data security compliance management system based on intelligent hierarchical classification includes a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the power data security compliance management method based on intelligent hierarchical classification as described above.

[0107] The present invention has the following beneficial effects:

[0108] 1. This invention integrates structured, semi-structured and unstructured data in the power system, automatically constructs and updates knowledge graphs through the Transformer model, realizes efficient fusion and semantic understanding of multi-source heterogeneous data, and dynamically adjusts data classification by combining federated learning and real-time data analysis, which significantly improves the accuracy and adaptability of data management and provides a reliable data foundation for subsequent security strategies.

[0109] 2. This invention utilizes a message passing neural network (MPNN) and an LSTM model to achieve real-time analysis and credit assessment of user behavior, dynamically generating access policies (such as triggering multi-factor authentication or access restrictions). Combined with rule-based reasoning in a knowledge graph, the system can automatically respond to changes in data sensitivity and abnormal behavior (such as batch exporting outside of working hours), forming a closed-loop security mechanism from prediction to protection, significantly reducing human intervention costs and security risks.

[0110] 3. Based on SIEM system and NLP technology, this invention can quickly parse logs and identify key events (such as unauthorized access). It automatically isolates risky accounts through emergency rules in the knowledge graph. At the same time, by crawling the latest regulations and automatically updating the knowledge graph, it ensures that data classification and access policies always meet the requirements, taking into account both the real-time nature and compliance of security management, and providing a sustainable intelligent protection system for the power system. Attached Figure Description

[0111] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0112] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0113] refer to Figure 1 In this embodiment, a power data security compliance management method based on intelligent hierarchical classification is provided, including the following steps:

[0114] S1: Acquire multi-source power data, including structured data (real-time equipment operation data (voltage / current), user electricity consumption records, weather data), unstructured data (fault repair reports, equipment manuals, inspection photos, laws and regulations), and semi-structured data (protection device parameter configuration, network topology files), and preprocess it;

[0115] S2: Based on the preprocessed multi-source power data, construct a power safety knowledge graph, use a Transformer-based model to automatically extract entities and their relationships from text data, and periodically crawl the latest regulations, automatically updating the regulatory nodes and relationships in the power safety knowledge graph through semantic matching;

[0116] S3: Based on real-time collected equipment operating status and user behavior logs, analyze cross-regional data using a federated learning model to predict changes in data sensitivity. For example, real-time operating data during equipment failures is automatically upgraded to core data. Utilizing rules in the power safety knowledge graph (such as "core data must be transmitted encrypted"), combined with real-time data, perform logical reasoning to generate dynamic classification results; for example, when the knowledge graph detects that a certain type of data is associated with a high-risk scenario, it automatically adjusts the classification to obtain data classification results (levels 1-5).

[0117] S4: Based on the dynamic grading results, user behavior data, and permission rules in the knowledge graph, an MPNN-based user credit assessment model (message passing neural network model) is used to analyze user access behavior (such as login frequency and operation path) and evaluate user credit scores. For example, abnormally high-frequency access triggers a decrease in credit score, automatically restricting permissions. Combining permission rules in the power safety knowledge graph (such as "core data requires multi-factor authentication") and user credit scores, dynamic access policies are generated; for example, when the credit score is below a threshold, MFA is automatically triggered and the access scope is restricted.

[0118] S5: Based on the generated dynamic access policy, logs are collected centrally through the SIEM system, and NLP technology is used to parse the log content and extract abnormal behaviors (such as "unauthorized access" and "high-frequency data download" such as batch data export during non-working hours). Abnormal behaviors trigger emergency response rules in the power safety knowledge graph and automatically isolate related accounts.

[0119] In this embodiment, the structured data includes real-time device operation data, user electricity consumption records, and weather data;

[0120] Real-time equipment operation data: Data is acquired in real time using an edge computing gateway via the Modbus / TCP and IEC 61850 protocols of the SCADA system. Smart terminals are deployed in substations and distribution rooms to upload voltage, current, and other data to a time-series database (such as InfluxDB) at a frequency of seconds, ensuring the real-time nature and continuity of the data.

[0121] User electricity consumption records: User electricity consumption data, including electricity consumption and payment records, are periodically extracted from the relational database (such as MySQL or Oracle) of the electricity marketing system using ETL tools (such as Apache NiFi). The extraction frequency is set to hourly or daily according to business needs.

[0122] Weather data: Meteorological data, including temperature, humidity, and wind speed, is obtained through API interfaces (such as the China Meteorological Administration data interface and OpenWeatherMap). Scripts are written using Python's requests library to periodically call the API at a frequency of minutes and store the data in a relational database.

[0123] Unstructured data includes fault repair reports, equipment manuals, inspection photos, and laws and regulations, specifically:

[0124] Troubleshooting reports and equipment manuals: Obtain PDF and Word format files through a file management system (such as NAS storage) or enterprise document library. Use Python's PyPDF2 and python-docx libraries to read the file content, and combine OCR technology (such as Tesseract and Baidu AI Open Platform OCR) to recognize the text information in the scanned documents and convert it into processable text data.

[0125] Inspection photos: An image acquisition app is installed on mobile inspection terminals (such as smart safety helmets and handheld terminals) and uploaded to the data center in real time via a 5G network. A file naming convention (e.g., "device number_shooting time.jpg") is used to associate photos with the devices.

[0126] Laws and regulations: Use web scraping technology to crawl legal documents from government websites and legal databases (such as Peking University Law Database). Write a web crawler program using the Python Scrapy framework, and set up scheduled tasks (such as daily updates) to obtain the latest legal texts.

[0127] Semi-structured data includes protection device parameters and network topology files, specifically:

[0128] Protection device parameter configuration: Data is extracted from the protection device's configuration file (XML, JSON format). The XML file is parsed using Python's xml.etree.ElementTree library, and the JSON file is parsed using the json.loads() function, converting the configuration parameters into structured data for storage in the database.

[0129] Network topology file: Obtain network topology files (such as CIM format) from the power grid dispatch automation system, and convert them into a format recognizable by graph databases (such as Neo4j) using a dedicated parsing tool to construct the power grid topology relationships.

[0130] In this embodiment, the preprocessing is as follows:

[0131] Structured data preprocessing: missing values ​​are processed using time series interpolation (such as linear interpolation), Z-Score standardization is used to eliminate dimensional differences, and wavelet transform (such as Daubechies basis function) is used to filter out high-frequency noise; peak and valley power consumption and load fluctuation characteristics are extracted from user electricity consumption records to construct a time series feature matrix;

[0132] Unstructured data preprocessing includes text data and image data: Text data uses pre-trained models (such as BERT) to extract entities (such as faulty equipment number and fault type) from fault reports, and combines rule engines (such as regular expressions) to extract time and location information; the equipment instruction manual text is converted into word vectors (such as Word2Vec) or sentence vectors (such as Sentence-BERT).

[0133] Image data is used to identify equipment labels and abnormal areas (such as rust and cracks) using object detection models (such as YOLOv8) and to extract image features (such as ResNet-50).

[0134] Semi-structured data preprocessing: The XML configuration of the protection device is mapped into key-value pairs and stored in a NoSQL database. The nodes (such as substations and lines) and connection relationships in the CIM / E file are parsed to construct a graph-structured adjacency matrix.

[0135] Data anonymization was performed, as follows:

[0136] Using a BERT-based Named Entity Recognition (NER) model, sensitive entities in text are identified, including user names, address text, ID card numbers, bank card numbers, and user electricity addresses.

[0137] For user name and address text information, a random replacement method is used for desensitization, such as replacing "Zhang San" with "random name";

[0138] For ID card numbers and bank card numbers, the AES-256 symmetric encryption algorithm is used for encryption to ensure the security of data during storage and transmission.

[0139] For user electricity addresses, the detailed address is generalized to the province and city level, such as "No. XX, XX Road, Haidian District, Beijing" is generalized to "Beijing".

[0140] In this embodiment, a power security knowledge graph is constructed based on preprocessed multi-source power data. A Transformer-based model is used to automatically extract entities and their relationships from text data, as detailed below:

[0141] The entity types are defined as including five core entity types: equipment entities, user entities, regulatory entities, operational entities, and risk entities.

[0142] Equipment entities: covering power equipment such as transformers, circuit breakers, and insulators. The data comes from equipment ledgers and inspection reports, and includes attributes such as equipment model, rated voltage, and geographical location.

[0143] User entities include residential users and industrial users. The data comes from the electricity marketing system and is associated with user electricity consumption records, sensitive information, and other attributes.

[0144] Regulatory entities: including the Data Security Law and industry standards. Data is crawled from government websites and records attributes such as publication date, revision version, and scope of effectiveness.

[0145] Operational entities: These involve operations such as data access, encrypted transmission, and permission changes. The data originates from the log system and work order records, reflecting the data processing behavior trajectory.

[0146] Risk entities: such as data breaches, unauthorized access, and equipment failures. The data comes from risk assessment and audit reports and is used to identify potential security threats.

[0147] Relationships between entities are established through business logic and mathematical models, including equipment associations, regulatory constraints, and risk impacts.

[0148] The device association describes the physical connection between devices (such as the transformer connecting to the busbar), and the relationship weight is calculated using the Haversine formula to determine the geographical distance between devices;

[0149] Regulatory constraints indicate that data classification and access control comply with regulations (e.g., "data classification" complies with the "Power Industry Data Classification and Grading Specification").

[0150] Risk impact relationships: Establish causal links between equipment failure, operational anomalies, and data security (e.g., "equipment failure" leads to "increased data sensitivity").

[0151] The attribute definition includes equipment entity attributes and regulatory entity attributes. The equipment entity attributes include numerical attributes (rated voltage, operating temperature), timestamp attributes (commissioning time, maintenance time), and spatial coordinate attributes (geographical location). The regulatory entity attributes are text-based, recording the publication time, scope of application, and revision history of the regulations to ensure the accuracy of compliance checks.

[0152] Based on the defined entities, relationships, and attributes, entity relationship extraction is performed using BERT and GNN.

[0153] The extracted entities, relations, and attributes are transformed into entity, relation, and entity triples (e.g., "Transformer A - Connection - Bus B"), and attribute information (e.g., distance, voltage) is added to form the basic unit of the knowledge graph; the triples are stored in graph databases such as Neo4j, and a network structure is constructed through node labels and relation types;

[0154] When the device location changes, the attention weight of node k to its neighbor node m is recalculated. When the new regulations knew When adding, calculate k new The similarity sim(q,k) with the existing operation node q new ), if sim(q,k new If )>τ, where τ is a preset threshold, then a constraint relationship is added;

[0155] Based on real-time statistical adjustments to conditional probabilities, update risk relationships:

[0156] ;

[0157] Where β is the smoothing factor and II is the indicator function; For the updated risk relationship; The risk relationships before the update; Event represents the risk-triggered event; This represents the change in data sensitivity.

[0158] In this embodiment, entity-relationship extraction is performed based on BERT and GNN according to the defined entities, relationships, and attributes, as follows:

[0159] Input text data into the BERT model to generate context-sensitive word vector representations:

[0160] ;

[0161] Where, x i Let be the i-th token (character / word) in the text, n be the total number of tokens in the text, and h be the number of characters / words in the text. i The corresponding hidden layer vectors are used to realize semantic modeling of professional terms in the power field;

[0162] A Conditional Random Field (CRF) is applied after the BERT output layer. By modeling the dependencies between labels y (e.g., "device model" followed by "parameters"), the optimal entity label sequence is output. ;

[0163] CRF probability The formula for calculation is:

[0164] ;

[0165] Where, ψ i Z(H) represents the transition score between adjacent labels, Z(H) is the normalization factor to ensure the accuracy of entity recognition (e.g., distinguishing between "transformer model" and "transformer location"), and H is the output of the BERT output layer; y i-1 y i These are the (i-1)th and ith labels in the sequence, respectively.

[0166] The entities identified by NER are paired up (e.g., "Transformer A" and "Bus B") to construct candidate pairs of relationships to be classified.

[0167] For each identified entity k, the text span is [s]. k ,e k ], its initial node embedding is :

[0168] ;

[0169] Among them, s k e k These represent the start and end positions of entity k in the text;

[0170] By aggregating features using a Graph Attention Network (GAT), the text is transformed into a dependency graph, with words as nodes and syntactic dependencies as edges. The updated GAT is as follows:

[0171] ;

[0172] in, W is the set of neighboring nodes of node k; (l) These are the trainable weights for the l-th layer; Let be the attention weight of node k to its neighbor node m; For activation functions; Output for node k at level l+1; Output for node m at layer l;

[0173] The attention weights between nodes are calculated using the Graph Attention Network (GAT). Aggregate entity context information:

[0174] ;

[0175] in, is the activation function; W is the weight matrix; h k h m Let represent the feature vectors of node k and node m respectively; 'a' represents the trainable weight vector used to calculate the attention score; and 'T' represents the transpose.

[0176] The aggregated entity features are input into a multilayer perceptron, and the softmax function is used to predict the relationship type.

[0177] ;

[0178] Among them, W r The weights of the multilayer perceptron; Represents a given entity The probability that the relationship between them is r; and Entities Embedded in the output of layer L; This indicates concatenating two embedding vectors;

[0179] In this embodiment, the latest regulations are crawled periodically, and the regulatory nodes and their relationships in the power safety knowledge graph are automatically updated through semantic matching, as follows:

[0180] We regularly obtain the latest regulations (such as the revised clauses of the Data Security Law) through web crawlers, and then use NLP to perform sentence segmentation, word segmentation, and part-of-speech tagging to convert them into structured text, ensuring the timeliness of regulatory knowledge.

[0181] The Sentence-BERT model is used to generate sentence vectors of the regulatory text, and the cosine similarity is used to determine the degree of correlation between the old and new regulations, Sim(s1,s2).

[0182] ;

[0183] Where s1 and s2 represent the new and old regulations, respectively; SBERT(s1) and SBERT(s2) represent the sentence vectors of the new and old regulations generated using the Sentence-BERT model, respectively. Represents the Euclidean norm;

[0184] If Sim(s1,s2) exceeds the threshold (e.g., 0.8), it is determined to be a relevant regulation, triggering the update process;

[0185] DBpedia Spotlight, an entity linking technology, matches entities in the new regulations (such as "data classification standards") with existing entities in the graph, automatically updating their associated rule nodes (such as adjusting the judgment conditions for data classification), ensuring consistency between regulatory requirements and security policies.

[0186] In this embodiment, based on the real-time collected device operating status and user behavior logs, a federated learning model is used to analyze cross-regional data and predict changes in data sensitivity.

[0187] The federated learning model uses an LSTM neural network to process time-series data and employs fully connected layers to output sensitivity scores. The local training process is as follows:

[0188] Equipment state feature sequence X=[x1,x2,…,x t ,…,x T’ ], x t The device state at time t is represented by Y, where T' is the total time sequence; the user behavior characteristic is Y.

[0189] LSTM layer extracts temporal dependencies ht :h t =LSTM(h t-1 ,x t ),t=1,…,T';

[0190] The fully connected layer outputs the sensitivity prediction value of the i-th token. , representing the probability of data sensitivity;

[0191] The central server collects model parameters from each region and uses the FedAvg algorithm to perform a weighted average to obtain the model parameters. :

[0192] ;

[0193] in, For the first Model parameters for each region For the first Data volume for each region Total global data volume; For the number of regions;

[0194] The output of federated learning Combined with historical sensitive events in the knowledge graph (such as "data sensitivity probability increases by 40% when equipment malfunctions"), a comprehensive sensitivity score is generated through a weighted fusion formula:

[0195] ;

[0196] in, and β represents the weight coefficient (the weight is adjusted according to the business scenario; for the device failure scenario, β=0.6), and KG_RuleScore represents the knowledge graph rule matching score.

[0197] Using the Datalog language, data grading standards are transformed into executable rules for the knowledge graph. SPARQL is used to query the association between real-time data features and knowledge graph nodes, mapping them to levels 1-5 based on the comprehensive sensitivity score S.

[0198] ;

[0199] Based on predefined rules in the knowledge graph, trigger sensitivity upgrade rules; such as voltage fluctuation amplitude ΔV>20%×rated voltage and duration exceeding 10 minutes; user access frequency exceeding 3 times the historical average and operation involving core data fields (such as "user ID" and "meter reading").

[0200] In this embodiment, the user credit assessment model based on MPNN is as follows:

[0201] Layered messaging:

[0202] Message generation: Node a sends message m to its neighbor node b. a,b Messages are generated based on node and edge attributes:

[0203] ;

[0204] Among them, v a W represents the feature vector of node a. m U m Δt is the trainable weight matrix; ReLU is the activation function; a,b This represents the edge characteristics between node a and its neighbor node b;

[0205] Message aggregation: Node a aggregates all neighbor messages {m a,b The mean pooling method is used to obtain the neighbor aggregated feature vector of node a. :

[0206] ;

[0207] Where N(a) is the set of neighbors of node a, and the preorder and postorder operation nodes;

[0208] Node state update, obtaining the updated feature vector of node a. : ;

[0209] Among them, W u These are the weighting coefficients;

[0210] Global feature aggregation: A global representation g of the user behavior graph is obtained through graph pooling (such as SumPooling), and input into a fully connected layer to generate a credit value C∈[0,1]:

[0211] ;

[0212] Among them, W c and b c The weights and biases of the fully connected layer; a higher credit score indicates more trustworthy behavior, and vice versa (e.g., abnormally high frequency of access to core data will lower the credit score).

[0213] In this embodiment, a dynamic access policy is generated by combining the permission rules and user credit values ​​in the power security knowledge graph, as follows:

[0214] The knowledge graph predefined rules include hierarchical association rules, such as "core data (level 5) → MFA certification required" and "important data (level 4) → access requires approval"; and credit threshold rules, such as "credit value C < 0.6 → trigger MFA" and "C < 0.4 → export operation prohibited".

[0215] The rules are formalized using conditional expressions, for example: Need_MFA(u,d) ← DataLevel(d,5) ∨(UserCredit(u,C) ∧C<0.6)

[0216] This means that when user u accesses data d, if the data is level 5 or the credit score is below 0.6, MFA authentication is required.

[0217] Access control strength (Control_Level) calculation:

[0218] Control_Level=W d ×DataRisk(d)+W c ×BehaviorRisk(u)

[0219] Where DataRisk(d) is the risk value corresponding to the data level (level 5 = 1, level 4 = 0.8, and so on), and BehaviorRisk(u) is the user behavior risk value (1-C); W d W c These are the weights corresponding to data classification and user behavior, respectively.

[0220] Obtain the data d requested by user u and its hierarchy L d ;

[0221] Credit Score Inquiry: Retrieves the user's current credit score C from a real-time database. u ;

[0222] Rule matching:

[0223] Examine the mandatory rules of d in the knowledge graph (such as "Level 5 data must be MFA"), calculate the control strength Control_Level, match the policy mapping table, and generate an access policy that includes authentication method, operation permission, and time limit.

[0224] In this embodiment, based on the generated dynamic access policy, logs are centrally collected through the SIEM system, and NLP technology is used to parse the log content, extract abnormal behaviors, and trigger emergency response rules in the power safety knowledge graph to automatically isolate relevant accounts, as follows:

[0225] The SIEM system detects anomalies (such as LSTM-based time series anomaly detection, model architecture:).

[0226] Input layer: Encodes the log event sequence into a one-hot vector (e.g., "Login failed" = 001, "Data export" = 010).

[0227] LSTM layer: captures the temporal dependencies of event sequences, with the hidden layer dimension set to 128, and learns normal behavior patterns.

[0228] Reconstruction layer: Reconstructs the input sequence through an autoencoder and calculates the reconstruction error.

[0229] If the LSTM reconstruction error exceeds the threshold or the rule is successfully matched, it is considered abnormal, and an event ID (such as E20250528_001) is generated.

[0230] Calculate the risk level (Risk_Level) by combining event type, data classification, and user credit score:

[0231] Risk_Level = Data Classification × L1 + Behavioral Risk Value × L2;

[0232] Where L1 and L2 are weighting coefficients;

[0233] If the risk level is ≥4, account isolation measures will be triggered. The account management system will be called via API to immediately perform "isolation" measures on the risky user account (such as freezing, taking it offline, or revoking permissions).

[0234] Risk level = 3, triggering access throttling, limiting the user's concurrent access to 1 and the amount of exported data to a preset value;

[0235] After the isolation operation is completed, update the current status of the user node in the knowledge graph to "isolated" and record the processing timestamp.

[0236] A power data security compliance management system based on intelligent hierarchical classification includes a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the power data security compliance management method based on intelligent hierarchical classification as described above.

[0237] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0238] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0239] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0240] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0241] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A power data security compliance management method based on intelligent hierarchical classification, characterized in that, Includes the following steps: S1: Acquire multi-source power data, including structured data, unstructured data, and semi-structured data, and preprocess them; S2: Based on the preprocessed multi-source power data, construct a power safety knowledge graph, use a Transformer-based model to automatically extract entities and relationships between entities from text data, and periodically crawl the latest regulations, automatically updating the regulatory nodes and relationships in the power safety knowledge graph through semantic matching; S3: Based on real-time collected equipment operating status and user behavior logs, analyze cross-regional data through a federated learning model, predict changes in data sensitivity, and use the rules in the power safety knowledge graph, combined with real-time data, to perform logical reasoning and generate dynamic hierarchical results. S4: Based on the dynamic hierarchical results, user behavior data, and permission rules in the knowledge graph, the user access behavior is analyzed using the MPNN-based user credit assessment model to evaluate the user credit value. Combined with the permission rules in the power safety knowledge graph and the user credit value, dynamic access policies are generated. S5: Based on the generated dynamic access policy, logs are centrally collected through the SIEM system, NLP technology is used to parse the log content, extract abnormal behaviors, and the abnormal behaviors trigger the emergency response rules in the power safety knowledge graph to automatically isolate the relevant accounts. The MPNN-based user credit assessment model is as follows: Layered messaging: Message generation: Node a sends message m to its neighbor node b. a,b Messages are generated based on node and edge attributes: m a,b= ReLU(W m *v a +U m *Δt a,b ) Among them, v a W represents the feature vector of node a. m U m Δt is the trainable weight matrix; ReLU is the activation function; a,b This represents the edge characteristics between node a and its neighbor node b; Message aggregation: Node a aggregates all neighbor messages {m a,b The mean pooling method is used to obtain the neighbor aggregated feature vector of node a. : ; Where N(a) is the set of neighbors of node a; Node state update, obtaining the updated feature vector of node a. : ； Among them, W u These are the weighting coefficients; Global feature aggregation: A global representation g of the user behavior graph is obtained through graph pooling, and input into a fully connected layer to generate a credit value C∈[0,1]: C=Softmax(W c *g+b c ) Among them, W c and b c These are the weights and biases for the fully connected layer.

2. The power data security and compliance management method based on intelligent hierarchical classification according to claim 1, characterized in that, The preprocessing is as follows: Structured data preprocessing: missing values ​​are interpolated using time series, Z-Score standardization is used to eliminate dimensional differences, and wavelet transform is used to filter out high-frequency noise; peak and valley power consumption and load fluctuation characteristics are extracted from user electricity consumption records to construct a time series feature matrix; Unstructured data preprocessing, including text data and image data: Text data uses a pre-trained model to extract entities from fault reports, and combines a rule engine to extract time and location information; Convert the equipment instruction manual text into word vectors or sentence vectors; Image data is used to identify device labels and abnormal regions using an object detection model, and to extract image features; Semi-structured data preprocessing: Map the XML configuration of the protection device into key-value pairs, store them in a NoSQL database, parse the nodes and connections in the CIM / E file, and construct a graph-structured adjacency matrix; Data anonymization was performed, as follows: Using a BERT-based named entity recognition model, sensitive entities in text are identified, including user names, address text, ID card numbers, bank card numbers, and user electricity addresses. For user name and address text information, random replacement is used for desensitization; For ID card numbers and bank card numbers, the AES-256 symmetric encryption algorithm is used for encryption to ensure the security of data during storage and transmission. For user electricity addresses, the detailed address will be generalized to the province and city level.

3. The power data security and compliance management method based on intelligent hierarchical classification according to claim 1, characterized in that, The process involves constructing a power security knowledge graph based on preprocessed multi-source power data, and automatically extracting entities and relationships between them from text data using a Transformer-based model, as detailed below: The entity types are defined as including five core entity types: equipment entities, user entities, regulatory entities, operational entities, and risk entities. Relationships between entities are established through business logic and mathematical models, including equipment associations, regulatory constraints, and risk impacts. The device associations describe the physical connections between devices, and the relationship weights are calculated using the Haversine formula to determine the geographical distance between devices. Regulatory constraints indicate that data classification and access control comply with regulations. Establish causal relationships between risk impacts and equipment failures, operational anomalies, and data security. The attribute definitions include equipment entity attributes and regulatory entity attributes; the equipment entity attributes include numerical attributes, timestamp attributes, and spatial coordinate attributes; the regulatory entity attributes are text-based, recording the publication time, scope of application, and revision history of the regulations to ensure the accuracy of compliance checks; Based on the defined entities, relationships, and attributes, entity relationship extraction is performed using BERT and GNN. The extracted entities, relations, and attributes are transformed into entity, relation, and entity triples, and attribute information is added to form the basic units of the knowledge graph. The Neo4j graph database is used to store triples, and a network structure is constructed using node labels and relation types. When the device location changes, the attention weight of node k to its neighbor node m is recalculated. When the new regulations k new When adding, calculate k new The similarity sim(q,k) with the existing operation node q new ), if sim(q,k new If )>τ, where τ is a preset threshold, then a constraint relationship is added; Based on real-time statistical adjustments to conditional probabilities, update risk relationships: ; Where β is the smoothing factor and II is the indicator function; The updated risk relationship; The risk relationships before the update; Event represents the risk-triggered event; This represents the change in data sensitivity.

4. The power data security and compliance management method based on intelligent hierarchical classification according to claim 3, characterized in that, The entity-relation extraction process, based on BERT and GNN, is performed according to the defined entities, relationships, and attributes, as follows: Input text data into the BERT model to generate context-sensitive word vector representations: h i =BERT(x i ),i=1,⋯,n; Where, x i Let h be the i-th token in the text, n be the total number of tokens in the text, and h be the number of tokens in the text. i The corresponding hidden layer vectors are used to realize semantic modeling of professional terms in the power field; A Conditional Random Field (CRF) is applied after the BERT output layer to model the dependencies between labels y and output the optimal entity label sequence. ; CRF probability The formula for calculation is: ; Where, ψ i Z(H) represents the transition score between adjacent labels, Z(H) is the normalization factor, H is the output of the BERT output layer, and y represents the transition score between adjacent labels. i-1 y i These are the (i-1)th and ith labels in the sequence, respectively. The entities identified by NER are paired to construct candidate pairs of relationships to be classified. For each identified entity k, the text span is [s]. k ,e k ], the initial node of entity k is embedded as : ； Among them, s k e k These represent the start and end positions of entity k in the text; By aggregating features using a Graph Attention Network (GAT), the text is transformed into a dependency graph, with words as nodes and syntactic dependencies as edges. The updated GAT is as follows: ； in, W is the set of neighboring nodes of node k; (l) These are the trainable weights for the l-th layer; Let be the attention weight of node k to its neighbor node m; For activation functions; Output for node k at level l+1; Output for node m at layer l; The attention weights between nodes are calculated using the Graph Attention Network (GAT). Aggregate entity context information: ; in, is the activation function; W is the weight matrix; h k h m Let represent the feature vectors of node k and node m respectively; 'a' represents the trainable weight vector used to calculate the attention score; and 'T' represents the transpose. The aggregated entity features are input into a multilayer perceptron, and the softmax function is used to predict the relationship type. ； Among them, W r The weights of the multilayer perceptron; Represents a given entity The probability that the relationship between them is r; and Entities Embedded in the output of layer L; This indicates that two embedding vectors are concatenated.

5. The power data security and compliance management method based on intelligent hierarchical classification according to claim 4, characterized in that, The process involves periodically crawling the latest regulations and automatically updating the regulatory nodes and relationships in the power safety knowledge graph through semantic matching, as detailed below: We regularly obtain the latest regulations through web crawlers, and after NLP performs sentence segmentation, word segmentation, and part-of-speech tagging, we convert them into structured text to ensure the timeliness of the regulatory knowledge. The Sentence-BERT model is used to generate sentence vectors of the regulatory text, and the cosine similarity is used to determine the degree of correlation between the old and new regulations, Sim(s1,s2). ; Where s1 and s2 represent the new and old regulations, respectively; SBERT(s1) and SBERT(s2) represent the sentence vectors of the new and old regulations generated using the Sentence-BERT model, respectively. Represents the Euclidean norm; If Sim(s1,s2) exceeds the threshold, it is determined to be a relevant regulation, triggering the update process; DBpedia Spotlight, an entity linking technology, matches entities in the new regulations with existing entities in the graph, automatically updating the rule nodes associated with entities in the new regulations, ensuring consistency between regulatory requirements and security policies.

6. The power data security and compliance management method based on intelligent hierarchical classification according to claim 1, characterized in that, The method involves analyzing cross-regional data and predicting changes in data sensitivity based on real-time collected device operating status and user behavior logs using a federated learning model. The federated learning model uses an LSTM neural network to process time-series data and employs fully connected layers to output sensitivity scores. The local training process is as follows: Equipment state feature sequence X=[x1,x2,…,x t ,…,x T’ ], x t The device state at time t is represented by Y, where T' is the total timing sequence; the user behavior characteristic is represented by Y. LSTM layer extracts temporal dependencies h t :h t =LSTM(h t-1 ,x t ),t=1,…,T' The fully connected layer outputs the sensitivity prediction value of the i-th token. , representing the probability of data sensitivity; The central server collects model parameters from each region and uses the FedAvg algorithm to perform a weighted average to obtain the model parameters. : ; in, For the first Model parameters for each region For the first Data volume for each region Total global data volume; Number of regions; The output of federated learning By combining sensitive historical events in the knowledge graph, a comprehensive sensitivity score is generated through a weighted fusion formula: ; in, and KG_RuleScore is the weight coefficient, and KG_RuleScore is the knowledge graph rule matching score. Using the Datalog language, data grading standards are transformed into executable rules for the knowledge graph. SPARQL is used to query the association between real-time data features and knowledge graph nodes, mapping them to levels 1-5 based on the comprehensive sensitivity score S. ; Based on predefined rules from the knowledge graph, sensitivity upgrade rules are triggered.

7. The power data security and compliance management method based on intelligent hierarchical classification according to claim 1, characterized in that, The dynamic access policy is generated by combining the permission rules and user credit values ​​in the power security knowledge graph, as detailed below: The knowledge graph predefined rules include hierarchical association rules and credit threshold rules, and the rules are formally represented using conditional expressions; Access control strength (Control_Level) calculation: Control_Level=W d ×DataRisk(d)+W c ×BehaviorRisk(u) Where DataRisk(d) is the risk value corresponding to the data classification, and BehaviorRisk(u) is the user behavior risk value; W d W c These are the weights corresponding to data classification and user behavior, respectively. Obtain the data d requested by user u and the data hierarchy L d ; Credit Score Inquiry: Retrieves the user's current credit score C from a real-time database. u ; Rule matching: Examine the mandatory rules of d in the knowledge graph, calculate the control strength Control_Level, match the policy mapping table, and generate an access policy that includes authentication method, operation permissions, and time limit.

8. The power data security and compliance management method based on intelligent hierarchical classification according to claim 7, characterized in that, The generated dynamic access policy centrally collects logs through the SIEM system, uses NLP technology to parse the log content, extracts abnormal behaviors, and triggers emergency response rules in the power safety knowledge graph to automatically isolate relevant accounts, as detailed below: The SIEM system detects an anomaly, generates an event ID, and calculates the risk level (Risk_Level) by combining the event type, data classification, and user credit score. Risk_Level = Data Classification × L1 + Behavioral Risk Value × L2; Where L1 and L2 are weighting coefficients; If the risk level is ≥P, account isolation measures will be triggered. The account management system will be called via API to immediately isolate the risky user account. Risk level = P-1, triggering access throttling, limiting the number of concurrent user accesses to 1, and limiting the amount of exported data to a preset value; After the isolation operation is completed, update the current status of the user node in the knowledge graph to "isolated" and record the processing timestamp.

9. A power data security and compliance management system based on intelligent hierarchical classification, characterized in that, It includes a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the intelligent hierarchical power data security compliance management method as described in any one of claims 1-8.

Images