A data application security protection method and device adapted to new power systems

Abstract

This application discloses a data application security protection method and device adapted to new power systems, relating to the field of new power system technology. The main technical solution of this application is as follows: First, this application utilizes a feature recognition model to perform preliminary identification, preliminary classification, redundancy removal, and catalog classification of a large number of interface communications between microservices. This is equivalent to preprocessing a large amount of interface communication data. Then, based on this, especially according to the tag classification and business data corresponding to the interface communications, the security information of the interface communications is analyzed to provide a security protection solution at the interface communication level.

Description

Technical Field

[0001] This application relates to the field of new power system technology, and in particular to a data application security protection method and device adapted to new power systems. Background Technology

[0002] To adapt to the complex business scenarios of the new power system and protect the data security of critical infrastructure, we are actively promoting the construction of data security protection, and realizing the unified management and dynamic allocation of various protection capabilities through the data security protection and control system.

[0003] Although new power systems can be configured with effective data security protection capabilities for different scenarios, the dynamic changes in data interaction, especially the increase in cross-regional and cross-domain interactions, make it difficult to achieve a balance between security, ease of use, and efficiency by simply allowing or prohibiting data. Static protection methods, such as simply adjusting permissions and policies, also have limitations. Therefore, how to improve data security protection capabilities in the face of changes and uncontrollable data interaction scale and risks is an urgent technical problem to be solved. Summary of the Invention

[0004] This application provides a data application security protection method and device adapted to new power systems. The main purpose is to first use a feature recognition model to perform preliminary identification, preliminary classification, redundancy removal and catalog classification of a large number of interface communications between microservices. This is equivalent to preprocessing a large number of interface communication data. Then, based on this, especially according to the tag classification and business data corresponding to the interface communication, the security information of the interface communication is analyzed to provide a security protection solution at the interface communication level.

[0005] To achieve the above objectives, this application mainly provides the following technical solutions:

[0006] The first aspect of this application provides a data application security protection method adapted to a new type of power system, the method comprising:

[0007] In the microservice architecture of the power system, each microservice is deployed on one or more servers. The microservice is a number of independent services obtained by splitting the power system business.

[0008] A feature recognition model corresponding to the business data interaction interface is constructed and applied to monitor the interface communication between servers corresponding to different microservices; the feature recognition model includes at least: a preliminary recognition module, a preliminary classification module, a redundancy processing module, and a directory classification module.

[0009] During the monitoring of interface communication between servers corresponding to different microservices, the preliminary identification module uses built-in identification rules to identify the data format processed by the interface communication.

[0010] Based on the data format of the interface communication, the preliminary classification module uses manual adjustment rules to match different interface communications to the built-in URL, wherein the data format of the interface communications matched by the same built-in URL is the same;

[0011] The redundancy processing module is used to process redundant information in the interface communication corresponding to the same built-in URL, so as to obtain the redundancy-processed business data for each interface communication.

[0012] The directory classification module uses built-in interface tag rules to tag the business data in the interface communication corresponding to each built-in URL one by one, and obtains the tag classification of the interface communication.

[0013] For each built-in URL that corresponds to a matching interface communication, an interface directory list corresponding to each built-in URL is generated based on the tag classification corresponding to the interface communication.

[0014] Based on the tag classification of different interface communications and the business data in the interface communications displayed in the interface directory list corresponding to each built-in URL, the security information corresponding to the interface communications is analyzed. The security information includes at least: interface activity, whether sensitive data is involved, and the interaction relationship between different interface communications.

[0015] A second aspect of this application provides a data application security protection device adapted to a new type of power system, the device comprising:

[0016] The deployment unit is used to deploy each microservice to one or more servers under the microservice architecture of the power system, wherein the microservice is a number of independent services obtained by splitting the power system business;

[0017] The construction unit is used to build a feature recognition model corresponding to the business data interaction interface, which is applied to monitor the interface communication between servers corresponding to different microservices; the feature recognition model includes at least: a preliminary recognition module, a preliminary classification module, a redundancy processing module, and a directory classification module.

[0018] The preliminary identification module is used to identify the data format processed by the interface communication using built-in identification rules during the process of monitoring the interface communication between servers corresponding to different microservices.

[0019] The preliminary classification module is used to match different interface communications to a built-in URL according to the data format of the interface communication processing using manually adjusted rules, wherein the data format of the interface communications matched by the same built-in URL is the same;

[0020] The redundancy processing module is used to process redundant information that appears in the interface communication corresponding to the same built-in URL, and obtain the redundancy-processed business data corresponding to each interface communication.

[0021] The directory classification module is used to tag the business data in the interface communication corresponding to each built-in URL one by one according to the built-in interface tag rules, so as to obtain the tag classification of the interface communication.

[0022] The generation unit is used to generate an interface directory list corresponding to each built-in URL based on the tag classification corresponding to each built-in URL and the matching interface communication.

[0023] The first analysis unit is used to analyze the security information corresponding to the interface communication based on the tag classification of different interface communications and the business data in the interface communication, as displayed in the interface directory list corresponding to each built-in URL. The security information includes at least: interface activity, whether sensitive data is involved, and the interaction relationship between different interface communications.

[0024] A third aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the data application security protection method adapted to the novel power system as described above.

[0025] A fourth aspect of this application provides an electronic device, the device including at least one processor, and at least one memory and bus connected to the processor;

[0026] The processor and the memory communicate with each other via the bus.

[0027] The processor is used to call program instructions in the memory to execute the data application security protection method adapted to the new power system as described above.

[0028] By employing the above-described technical solution, the technical solution provided in this application has at least the following advantages:

[0029] This application provides a data application security protection method and device adapted to a new type of power system. In the microservice architecture of the power system, each microservice is deployed on one or more servers, and data sharing between different microservices results in a large amount of data in the interface communication between servers. To address this, this application pre-constructs a feature recognition model corresponding to the business data interaction interface, including: a preliminary recognition module, a preliminary classification module, a redundancy processing module, and a directory classification module. The preliminary recognition model is used to initially identify the data formats processed by different interface communications. For the data formats processed by different interface communications, the preliminary classification module is used to perform preliminary classification of a large number of interface communications, so that interface communications processing the same data format are matched to the same built-in URL. The redundancy processing module is used to process the redundant information in the interface communications corresponding to each built-in URL one by one. The directory classification module is used to tag the business data in the interface communications matched by each built-in URL to obtain the tag classification of the interface communications. After obtaining the tag classification corresponding to the interface communication through the feature recognition model, this application generates an interface directory list corresponding to each built-in URL. Based on the tag classification corresponding to different interface communications and the business data in the interface communications displayed by the interface directory list, the security information of the interface communications, such as interface activity, whether sensitive data is involved, and the interaction relationship between different interface communications, is analyzed to provide a security protection solution at the interface communication level.

[0030] Compared to existing technologies that address the security protection requirements of complex business scenarios in new power systems, this application first utilizes a feature recognition model to perform preliminary identification, classification, redundancy removal, and cataloging of a large number of interface communications between microservices. This is equivalent to preprocessing a large amount of interface communication data. Then, based on this, especially according to the tag classification and business data corresponding to the interface communications, the security information of the interface communications is analyzed to provide a security protection solution at the interface communication level.

[0031] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0032] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0033] Figure 1A flowchart illustrating a data application security protection method adapted to a novel power system, as provided in this application embodiment;

[0034] Figure 2 A schematic diagram illustrating the workflow of a business data interaction interface feature recognition model provided in this application embodiment;

[0035] Figure 3 A schematic diagram of the evaluation process for a data interaction security risk assessment and evaluation model based on security indicator features, provided in an embodiment of this application;

[0036] Figure 4 A schematic diagram illustrating the hierarchical arrangement of indicators provided in this application embodiment;

[0037] Figure 5 The forward forming matrix M provided in the embodiments of this application;

[0038] Figure 6 A block diagram illustrating the composition of a data application security protection device adapted to a novel power system, as provided in this application embodiment;

[0039] Figure 7 A block diagram illustrating another data application security protection device adapted to a novel power system, provided as an embodiment of this application. Detailed Implementation

[0040] Exemplary embodiments of the present application will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this application will be thorough and complete, and will fully convey the scope of the present application to those skilled in the art.

[0041] This application provides a data application security protection method adapted to new power systems, such as... Figure 1 As shown, the following specific steps are provided in this embodiment of the invention:

[0042] 101. In the microservice architecture of the power system, each microservice is deployed on one or more servers. A microservice is a set of independent services obtained by splitting the power system business.

[0043] 102. Construct a feature recognition model corresponding to the business data interaction interface, and apply it to monitor the interface communication between servers corresponding to different microservices; the feature recognition model shall include at least: a preliminary recognition module, a preliminary classification module, a redundancy processing module, and a directory classification module.

[0044] The number of power system services involved in the new power system is enormous. Under the power system microservice architecture, microservices are multiple independent services obtained by decomposing power system services. Therefore, the number of microservices is also enormous, and each microservice is deployed on one or more servers. Consequently, the amount of data in the interface communication for data sharing or data transfer between microservices is also enormous. This application embodiment aims to achieve data security protection at the interface communication level. To cope with such a large amount of interface communication data, this application embodiment constructs a feature recognition model corresponding to the business data interaction interface, which is applied to monitor the interface communication between servers corresponding to different microservices. The feature recognition model is designed to include a preliminary recognition module, a preliminary classification module, a redundancy processing module, and a directory classification module. The purpose is to achieve a progressive data processing to process the large amount of interface communication data and extract important data information for security protection. The specific implementation steps of these modules are explained in detail below, as shown on pages 103-106.

[0045] 103. In the process of monitoring the interface communication between servers corresponding to different microservices, the preliminary identification module uses built-in identification rules to identify the data format of the interface communication processing.

[0046] In this embodiment of the application, the preliminary identification module operates in the built-in identification rule stage.

[0047] Core basis: Initial identification is based on the content-type of the interface and its own attributes; Identification objects: Focus on the data type of the interface, and can identify common types such as JSON (Lightweight Data Exchange Format, commonly used for front-end and back-end data transmission), HTML (Markup Language for building web page content), and XML (Extensible Markup Language, used for structured data storage and transmission), laying the foundation for subsequent processing.

[0048] 104. Based on the data format of the interface communication, use the preliminary classification module to manually adjust the rules to match different interface communications to the built-in URL. Among them, the data format of the interface communications matched by the same built-in URL is the same.

[0049] In this embodiment of the application, the preliminary classification module works as a manual rule adjustment stage.

[0050] Interface tagging: Based on the preliminary results of the built-in identification rules stage, URLs that match the built-in types (Uniform Resource Locators, which identify the network location of the interface) are tagged with interfaces to clarify their basic category.

[0051] Furthermore, redundant parameters can be initially cleaned up at this stage. For example, using built-in delimiters (such as specific characters to separate different parameter segments) or regular expression rules (to accurately match and filter parameters through regular expressions) can remove redundant parameters from the interface and simplify the interface data. Afterward, the interface can be identified again using built-in recognition rules, and redundant parameters can be cleaned up a second time using the same method (delimiters / regular expression rules) to further optimize the accuracy of the interface data.

[0052] 105. Use the redundancy processing module to process the redundant information that appears in the interface communication corresponding to the same built-in URL, and obtain the redundancy-processed business data corresponding to each interface communication.

[0053] In this embodiment, the redundant processing module operates as a redundant information removal phase. Multiple optimizations are implemented: firstly, manual verification and optimization, where interface data is manually checked and adjusted to ensure data quality; secondly, automatic redundancy removal, relying on the program to automatically clean up according to rules; and thirdly, the application of built-in interface tag rules to prepare for subsequent classification.

[0054] 106. Using the directory classification module, the built-in interface tag rules are used to tag the business data in the interface communication corresponding to each built-in URL one by one, so as to obtain the tag classification of the interface communication.

[0055] In this embodiment, the directory classification module is used to assist in the output interface directory stage.

[0056] Classification and Statistics: Through built-in interface tag rules, interfaces are classified into sensitive interfaces (involving sensitive data and requiring strict control), external interfaces (interacting with external systems), business interfaces (supporting business processes), and public interfaces (open to external calls), etc. After generating a directory list, the number of interfaces is counted, and interaction relationships (data transfer between interfaces, dependencies, etc.), type distribution, activity level (reflecting usage and load, identifying busy / idle interfaces, abnormal traffic activity), and whether they involve sensitive information are analyzed, helping to comprehensively understand interface assets and operational status.

[0057] For example, as shown in 101-106, embodiments of this application provide a schematic diagram of the workflow of a business data interaction interface feature recognition model, such as... Figure 2 As shown.

[0058] 107. For each built-in URL that corresponds to a matching interface communication, generate an interface directory list corresponding to each built-in URL based on the tag classification of the interface communication.

[0059] 108. Based on the tag classification and business data of different interface communications displayed in the interface directory list corresponding to each built-in URL, analyze the security information corresponding to the interface communications. The security information should include at least: interface activity, whether sensitive data is involved, and the interaction relationship between different interface communications.

[0060] As explained in sections 107-108 above, it should be noted that in the interface directory generation stage of this application embodiment, the process is based on the premise that the interface communication corresponding to each built-in URL is obtained from the preliminary classification module in section 104 above. It is evident that "each built-in URL" is equivalent to a category of "interface communication" corresponding to the preliminary classification. Therefore, after this "preliminary classification," the subsequent data processing operations in this application embodiment are essentially batch processing of each "preliminary classification," such as removing redundant information in section 105 and tagging and classifying interface communication under each "preliminary classification" in section 106, ultimately summarizing to obtain "a list of interface directories corresponding to each built-in URL." The above preprocessing of the original massive amount of interface communication data facilitates subsequent analysis of each interface communication, namely, by comprehensively considering the tag classification corresponding to the interface communication and the business data within that interface communication to analyze the security information corresponding to that interface communication. The security information includes at least: interface activity, whether sensitive data is involved, and the interaction relationships between different interface communications.

[0061] The data application security protection method for adapting to new power systems provided in this application embodiment, compared with the existing technology for security protection of complex business scenarios of new power systems, first uses a feature recognition model to preliminarily identify, classify, remove redundancy and establish a directory classification of a large number of interface communications between microservices. This is equivalent to preprocessing a large number of interface communication data. Then, based on this, especially according to the tag classification and business data corresponding to the interface communication, the security information of the interface communication is analyzed to provide a security protection solution at the interface communication level.

[0062] In some modified embodiments, in addition to the security protection solution provided at the interface communication level as described above, the embodiments of this application can further analyze the interface communication analysis results as described in 101-108 above, as follows:

[0063] Based on the interface activity level in the security information corresponding to the interface communication, the load situation corresponding to different interface communication is measured and detected; based on whether the security information corresponding to the interface communication involves sensitive data and the interaction relationship between different interface communication, the presence of abnormal activity or abnormal traffic is measured and detected.

[0064] Statistical information about accessed interfaces can be used to analyze interface activity. Interface activity reflects the usage and load of each network interface. By analyzing interface activity, we can identify which interfaces are the busiest, which are idle, and whether there is any abnormal activity or traffic.

[0065] In this embodiment of the application, the data source processed by the above "measurement and detection" is statistical information such as "number of calls, response time, and transmission traffic" collected by the interface access log and monitoring system.

[0066] The analytical value of such "measurement and testing" lies in the fact that it may include, but is not limited to, the following:

[0067] Resource scheduling: Differentiate between "busy interfaces" (high-frequency calls, requiring expansion / optimization) and "idle interfaces" (low-frequency or useless, considering decommissioning / merging), and allocate server resources reasonably.

[0068] Anomaly monitoring: Identify "abnormal activity / traffic" (such as a sudden surge / drop in call volume to a certain interface, which may be due to an attack or business failure) and provide timely warnings and investigations.

[0069] The preceding "interface identification, cleanup, and classification" provides a clear list of interface assets for "activity analysis" (knowing what interfaces exist and what types they are); while "activity analysis," in turn, completes the "operational quality dimension" of interface management—not only knowing "what interfaces exist," but also understanding "how these interfaces are being used," extending interface governance from "static classification" to "dynamic monitoring and optimization," forming a complete closed loop for the full lifecycle management of interfaces.

[0070] As can be seen, in this embodiment of the application, the interface is first "clarified" (identified, cleaned up, and classified), and then "understood" (resource status and abnormal risks) through activity analysis, so as to make interface management more refined and more valuable.

[0071] In some modified embodiments, the present application embodiments use the analysis and processing results of interface communication as described in 101-108 above, and can further perform statistical analysis on IP addresses and protocols, such as the following: for each built-in URL corresponding to the matched interface communication, obtain the parameter information corresponding to the source IP address;

[0072] Based on the access frequency in the parameter information corresponding to the source IP address, determine whether there is any potential attack behavior.

[0073] Source IP address statistics can reflect active IP addresses, determine whether there are malicious and frequent accesses, and identify potential attackers or abnormal behaviors, such as DoS attacks and malicious scanning.

[0074] Statistics on target IP addresses can reflect server activity levels, identify which servers are most likely to be targeted, and pinpoint potential security risks such as network vulnerabilities and unauthorized access.

[0075] Traffic protocol statistics can reflect the traffic distribution of different protocols, including TCP, UDP, and ICMP. By analyzing traffic protocol statistics, we can understand the usage and communication patterns of different protocols, helping to optimize network resources and security strategies.

[0076] In some modified embodiments, the present application embodiments use the analysis and processing results of interface communication as described in 101-108 above to evaluate data interaction security risks, such as the implementation steps including the following:

[0077] A1 constructs data interaction security indicators and their initial weights;

[0078] A2 constructs a comparison matrix corresponding to security indicators by pre-setting security decision rules. The comparison matrix compares any two security indicators and scores them.

[0079] A3 updates the initial weights corresponding to the security indicators based on the results of the comparison matrix to obtain the target weights corresponding to the security indicators.

[0080] For each built-in URL, A4 uses security metrics and target weights to assess the security risks of data interaction in the corresponding interface communication.

[0081] This application embodiment utilizes the implementation steps A1-A4 above to essentially implement a data interaction security risk assessment and evaluation model based on security indicator characteristics, such as... Figure 3 As shown below, in conjunction with Figure 3 The corresponding safety risk assessment process has been implemented. The details of the process are explained in detail below (1)-(5).

[0082] (1) Weights of data interaction security indicators based on the analytic hierarchy process

[0083] The risk assessment of data interaction security in new power systems involves multiple factors, each exhibiting different key characteristics for data interaction security. Therefore, it is crucial to scientifically determine the importance of each factor and quantify its importance to assign a weight to each factor in the evaluation. This ensures a more scientific score for the assessment and analysis of data interaction security. The reasonableness of the weight assignment plays a vital role in the scientific rigor of the data security assessment. Based on practical considerations, the Analytic Hierarchy Process (AHP) was employed to calculate the weights of relevant factors through subjective assignment.

[0084] (2) Hierarchical Analysis Structure Model

[0085] The importance of factors related to data interaction security is somewhat subjective. Considering this issue from the perspective of security and stability versus operational efficiency will yield completely opposite results. For example, from a security and stability perspective, abnormal network traffic, abnormal paths, and sudden increases in business volume have high priority, while from an operational efficiency perspective, network latency, latency variations, and packet loss rate are of paramount importance. Therefore, in establishing this data interaction security evaluation model, the more subjective Analytic Hierarchy Process (AHP) was introduced to calculate the weights of each factor indicator.

[0086] Following the basic principles of the Analytic Hierarchy Process (AHP) algorithm, the objectives, considered factors, and decision objects are divided into an objective layer and a criterion layer based on their relationships. The criteria include abnormal business access relationships, data network congestion risk, high-risk port scanning, abnormal IP paths, abnormal IP traffic, packet loss rate, latency, and latency variation factors. The parameters for the criterion layer are provided by the business data flow collection method, including information such as interface activity, IP access frequency, and business application access. The objective layer focuses on business data flow security. The stratification of indicators is as follows... Figure 4 As shown.

[0087] A comparison matrix is ​​constructed using the security decision-making system to compare data interaction security indicators pairwise, assigning scores based on their relative importance. The security decision-making system scores, from 1 to 9, represent the increasing importance of different indicators within the same dimension. The meanings of the numerical scales are described in Table 1.

[0088] Table 1

[0089]

[0090] The scoring table for the security decision-making system is shown in Table 2.

[0091]

[0092]

[0093] The above security assessment table is simplified to construct an N×N comparison matrix A. Through consistency verification, the score of each element can be calculated using the arithmetic mean method, ultimately yielding the weight values, as shown in Table 3, the weight results table for the analytic hierarchy process.

[0094]

[0095] (3) Data security risk assessment based on the TOPSIS superior-inferior solution distance method

[0096] The purpose of the TOPSIS (Top-Side Distance Method) is to describe the difference between the target data and the ideal optimal and worst values. In other words, the optimal value is the score at which data interaction security reaches a perfect state.

[0097] The scores for each indicator layer are known. The optimal and worst solutions among these evaluation objects are identified. Then, the distance between each evaluation object and the optimal and worst solutions is calculated; the closer the object is to the optimal solution, the higher the score. The TOPSIS method mainly includes matrix normalization and matrix standardization. Normalization results in a matrix M as follows: Figure 5 exhibit.

[0098] After obtaining the normalized matrix, standardization is performed to give different indicators the same scale. The final result is data that follows a standard normal distribution.

[0099] (4) Model evaluation score

[0100] First, calculate the maximum and minimum values ​​in the standardized matrix. Then, calculate the distance between the evaluation object and the maximum and minimum values, and perform normalization processing based on this.

[0101] (5) Data interaction security evaluation based on fuzzy comprehensive evaluation

[0102] The TOPSIS (Top-and-Bottom Distance Method) can obtain a comprehensive quantitative value of the data security parameter, the ideal optimal value, and the worst value, and describe the data interaction security trend based on the corresponding data. However, the TOPSIS method cannot qualitatively evaluate the comprehensive evaluation data. The fuzzy comprehensive evaluation method and the TOPSIS method complement each other to obtain a final evaluation result that is both quantitative and qualitative.

[0103] Fuzzy comprehensive evaluation is a comprehensive evaluation method based on fuzzy mathematics. This method transforms qualitative evaluation into quantitative evaluation based on the membership theory of fuzzy mathematics, using fuzzy mathematics to make an overall evaluation of things or objects constrained by multiple factors. It features clear results and strong systematicity, and can effectively solve fuzzy and difficult-to-quantify problems, making it suitable for solving various uncertain problems.

[0104] The steps of the fuzzy comprehensive evaluation method are as follows:

[0105] ① Determine the set of factors

[0106] ② Determine the comment collection

[0107] ③ Construct membership functions

[0108] ④ Conduct single-factor evaluation

[0109] ⑤ Construct a comprehensive evaluation matrix

[0110] ⑥ Substitute the weights for comprehensive evaluation

[0111] The eight data service flow operation security parameters involved in the study were incorporated into the factor set of this fuzzy comprehensive evaluation, resulting in: U (factor set) = {abnormal service access relationship, data network congestion risk, high-risk port scanning, abnormal IP path, abnormal IP traffic, packet loss rate, latency, latency variation}.

[0112] Based on the data security risk assessment requirements, data interaction security is rated into four levels: low, low, high, and high. This yields the set of comments required for the fuzzy comprehensive evaluation.

[0113] V (Comment Set) = {Lower, Low, High, Higher}.

[0114] A comprehensive assessment of data interaction security risks can play an important role in identifying data security risks. According to the analysis results of this study, a data interaction security score above 0.3949 indicates low data interaction security risk and relatively stable data security; conversely, a score below 0.3949 indicates poor data security.

[0115] Furthermore, as a response to the above Figures 1 to 5 The implementation of the example shown in this application provides a data application security protection device adapted to a novel power system. This device embodiment corresponds to the foregoing method embodiment. For ease of reading, this device embodiment will not repeat the details of the foregoing method embodiment, but it should be understood that the device in this embodiment can implement all the contents of the foregoing method embodiment. This device is used to implement a solution that provides security protection at the interface communication layer, specifically as follows... Figure 6 As shown, the device includes:

[0116] Deployment unit 21 is used to deploy each microservice to one or more servers under the power system microservice architecture, wherein the microservice is a number of independent services obtained by splitting the power system business;

[0117] The construction unit 22 is used to construct a feature recognition model corresponding to the business data interaction interface, which is applied to monitor the interface communication between servers corresponding to different microservices; the feature recognition model includes at least: a preliminary recognition module 221, a preliminary classification module 222, a redundancy processing module 223, and a directory classification module 224.

[0118] The preliminary identification module 221 is used to identify the data format of the interface communication process by using built-in identification rules during the process of monitoring the interface communication between servers corresponding to different microservices.

[0119] The preliminary classification module 222 is used to match different interface communications to a built-in URL according to the data format of the interface communication processing using manual adjustment rules, wherein the data format of the interface communications matched to the same built-in URL is the same;

[0120] The redundancy processing module 223 is used to process redundant information that appears in the interface communication corresponding to the same built-in URL, and obtain the redundancy-processed business data corresponding to each interface communication.

[0121] The directory classification module 224 is used to tag the business data in the interface communication corresponding to each built-in URL one by one according to the built-in interface tag rules, so as to obtain the tag classification of the interface communication.

[0122] The generation unit 23 is used to generate an interface directory list corresponding to each built-in URL based on the tag classification corresponding to each built-in URL and the matching interface communication.

[0123] The first analysis unit 24 is used to analyze the security information corresponding to the interface communication based on the tag classification of different interface communications and the business data in the interface communication displayed in the interface directory list corresponding to each built-in URL. The security information includes at least: interface activity, whether sensitive data is involved, and the interaction relationship between different interface communications.

[0124] Furthermore, such as Figure 7 As shown, the first analysis unit 24 is specifically used for:

[0125] Based on the interface activity level in the security information corresponding to the interface communication, the load situation corresponding to different interface communications is measured and detected.

[0126] Based on whether the security information corresponding to the interface communication involves sensitive data and the interaction relationship between different interface communications, the detection of abnormal activity or abnormal traffic is assessed.

[0127] Furthermore, such as Figure 7 As shown, the device further includes a second analysis unit 25, specifically used for:

[0128] For each built-in URL corresponding to a matching interface communication, obtain the parameter information corresponding to the source IP address; based on the access frequency in the parameter information corresponding to the source IP address, determine whether there is any potential attack behavior.

[0129] Furthermore, such as Figure 7 As shown, the device further includes: a third analysis unit 26, specifically used for:

[0130] Construct data interaction security indicators and their initial weights;

[0131] By pre-setting security decision rules, a comparison matrix corresponding to the security indicators is constructed. The comparison matrix compares any two security indicators and scores them.

[0132] Based on the results corresponding to the comparison matrix, update the initial weights corresponding to the security indicators to obtain the target weights corresponding to the security indicators;

[0133] For each built-in URL, the security risk assessment of the data interaction is performed using the security indicators and the target weight.

[0134] In summary, the data application security protection device adapted to the new power system includes a processor and a memory. The aforementioned deployment unit, construction unit, generation unit, and first analysis unit are all stored in the memory as program units, and the processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0135] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured. By adjusting kernel parameters, a feature recognition model is first used to perform preliminary identification, classification, redundancy removal, and directory categorization of a large amount of interface communication between microservices. This is equivalent to preprocessing a large amount of interface communication data. Then, based on this, especially according to the tag classification and business data corresponding to the interface communication, the security information of the interface communication is analyzed to provide a security protection solution at the interface communication level.

[0136] This application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the data application security protection method adapted to the new power system as described above.

[0137] This application provides an electronic device, which includes at least one processor, at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other through the bus; the processor is used to share program instructions in the memory to execute the data application security protection method adapted to the new power system as described above.

[0138] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing initialization steps of a data application security protection method adapted to a new type of power system.

[0139] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0140] In a typical configuration, the device includes one or more processors (CPUs), memory, and a bus. The device may also include input / output interfaces, network interfaces, etc.

[0141] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM, and memory includes at least one memory chip. Memory is an example of computer-readable media.

[0142] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0143] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0144] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0145] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A data application security protection method adapted to new power systems, characterized in that, The method includes: In the microservice architecture of the power system, each microservice is deployed on one or more servers. The microservice is a number of independent services obtained by splitting the power system business. A feature recognition model corresponding to the business data interaction interface is constructed and applied to monitor the interface communication between servers corresponding to different microservices; the feature recognition model includes at least: a preliminary recognition module, a preliminary classification module, a redundancy processing module, and a directory classification module. During the monitoring of interface communication between servers corresponding to different microservices, the preliminary identification module uses built-in identification rules to identify the data format processed by the interface communication. Based on the data format of the interface communication, the preliminary classification module uses manual adjustment rules to match different interface communications to the built-in URL, wherein the data format of the interface communications matched by the same built-in URL is the same; The redundancy processing module is used to process redundant information in the interface communication corresponding to the same built-in URL, so as to obtain the redundancy-processed business data for each interface communication. The directory classification module uses built-in interface tag rules to tag the business data in the interface communication corresponding to each built-in URL one by one, and obtains the tag classification of the interface communication. For each built-in URL that corresponds to a matching interface communication, an interface directory list corresponding to each built-in URL is generated based on the tag classification corresponding to the interface communication. Based on the tag classification of different interface communications and the business data in the interface communications displayed in the interface directory list corresponding to each built-in URL, the security information corresponding to the interface communications is analyzed. The security information includes at least: interface activity, whether sensitive data is involved, and the interaction relationship between different interface communications.

2. The method according to claim 1, characterized in that, The method further includes: Based on the interface activity level in the security information corresponding to the interface communication, the load situation corresponding to different interface communications is measured and detected. Based on whether the security information corresponding to the interface communication involves sensitive data and the interaction relationship between different interface communications, the detection of abnormal activity or abnormal traffic is assessed.

3. The method according to claim 1 or 2, characterized in that, The method further includes: For each built-in URL that corresponds to a matching interface communication, obtain the parameter information corresponding to the source IP address; Based on the access frequency in the parameter information corresponding to the source IP address, it is determined whether there is any potential attack behavior.

4. The method according to claim 1 or 2, characterized in that, The method further includes: Construct data interaction security indicators and their initial weights; By pre-setting security decision rules, a comparison matrix corresponding to the security indicators is constructed. The comparison matrix compares any two security indicators and scores them. Based on the results corresponding to the comparison matrix, update the initial weights corresponding to the security indicators to obtain the target weights corresponding to the security indicators; For each built-in URL, the security risk assessment of the data interaction is performed using the security indicators and the target weight.

5. A data application security protection device adapted to a new type of power system, characterized in that, The device includes: The deployment unit is used to deploy each microservice to one or more servers under the microservice architecture of the power system, wherein the microservice is a number of independent services obtained by splitting the power system business; The construction unit is used to build a feature recognition model corresponding to the business data interaction interface, which is applied to monitor the interface communication between servers corresponding to different microservices; the feature recognition model includes at least: a preliminary recognition module, a preliminary classification module, a redundancy processing module, and a directory classification module. The preliminary identification module is used to identify the data format of the interface communication process by using built-in identification rules during the process of monitoring the interface communication between servers corresponding to different microservices. The preliminary classification module is used to match different interface communications to a built-in URL according to the data format of the interface communication processing using manually adjusted rules, wherein the data format of the interface communications matched by the same built-in URL is the same; The redundancy processing module is used to process redundant information that appears in the interface communication corresponding to the same built-in URL, and obtain the redundancy-processed business data corresponding to each interface communication. The directory classification module is used to tag the business data in the interface communication corresponding to each built-in URL one by one according to the built-in interface tag rules, so as to obtain the tag classification of the interface communication. The generation unit is used to generate an interface directory list corresponding to each built-in URL based on the tag classification corresponding to each built-in URL and the matching interface communication. The first analysis unit is used to analyze the security information corresponding to the interface communication based on the tag classification of different interface communications and the business data in the interface communication, as displayed in the interface directory list corresponding to each built-in URL. The security information includes at least: interface activity, whether sensitive data is involved, and the interaction relationship between different interface communications.

6. The apparatus according to claim 5, characterized in that, The first analysis unit is specifically used for: Based on the interface activity level in the security information corresponding to the interface communication, the load situation corresponding to different interface communications is measured and detected. Based on whether the security information corresponding to the interface communication involves sensitive data and the interaction relationship between different interface communications, the detection of abnormal activity or abnormal traffic is assessed.

7. The apparatus according to claim 5 or 6, characterized in that, The device further includes: a second analysis unit, specifically used for: For each built-in URL that corresponds to a matching interface communication, obtain the parameter information corresponding to the source IP address; Based on the access frequency in the parameter information corresponding to the source IP address, it is determined whether there is any potential attack behavior.

8. The apparatus according to claim 5 or 6, characterized in that, The device further includes: a third analysis unit, specifically used for: Construct data interaction security indicators and their initial weights; By pre-setting security decision rules, a comparison matrix corresponding to the security indicators is constructed. The comparison matrix compares any two security indicators and scores them. Based on the results corresponding to the comparison matrix, update the initial weights corresponding to the security indicators to obtain the target weights corresponding to the security indicators; For each built-in URL, the security risk assessment of the data interaction is performed using the security indicators and the target weight.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the data application security protection method for adapting to a new type of power system as described in any one of claims 1-4.

10. An electronic device, characterized in that, The device includes at least one processor, and at least one memory and bus connected to the processor; The processor and the memory communicate with each other via the bus. The processor is used to call program instructions in the memory to execute the data application security protection method adapted to the new power system as described in any one of claims 1-4.

Images