A power grid network attack chain risk assessment and threat situation awareness blocking method

Abstract

The application discloses a power grid network attack chain risk assessment and threat situation awareness blocking method, which comprises the following steps: based on the attack target, attack time, attack event type, attack event influence device and attack tool corresponding to each attack event, a first correlation between each two attack events is constructed through a preset attack mode library; a first directed attack graph structure is constructed, and based on the first directed attack graph structure, a first blockable probability corresponding to each first node is output through a graph neural network model; all first nodes are traversed, and all first nodes with a first blockable probability greater than a preset screening threshold are selected as blockable nodes; and based on the blockable nodes, a corresponding threat situation awareness and blocking suggestion report is generated, so that intelligent blocking for the threat situation is realized, and the safety of the power system is improved.

Description

Technical Field

[0001] This application relates to the technical field of blocking attack chains in power grid networks, specifically a method for blocking attack chains in power grid networks. Background Technology

[0002] Information assets are commodified information that can be converted into corporate profits. As a special type of corporate asset, they play an increasingly important role in corporate production and operation. This is especially true for critical systems related to national welfare and social stability, where the information assets involved are even more crucial.

[0003] In existing technologies, static rules or manual decision-making are mostly used, triggering fixed blocking actions when matching features are detected. However, the threat situation of power systems has dynamic evolution characteristics. The path, strength, and exploitable vulnerabilities of the attack chain change dynamically over time, making it difficult for static blocking strategies to adapt to changes in the threat situation in real time. At the same time, there may be problems such as wasted blocking resources (e.g., repeatedly blocking nodes that are difficult to block) or untimely blocking (e.g., omitting blockable nodes), resulting in attacks that cannot be effectively contained and seriously affecting the security of power systems. Summary of the Invention

[0004] This application aims to at least address the technical problems existing in the prior art. To this end, this application proposes a blocking method for power grid network attack chain risk assessment and threat situation awareness. This method can identify blockable nodes in real time and generate blocking suggestions for these nodes, thereby achieving risk assessment of multiple attack chains corresponding to the blockable nodes and realizing the blocking of power grid network attack chain risk assessment and threat situation awareness.

[0005] The first aspect of this application provides a method for blocking power grid network attack chain risk assessment and threat situation awareness, comprising the following steps:

[0006] Acquire log data, network traffic data, and alarm data from the power system;

[0007] Extract the attack target, attack time, attack event type, affected devices, and attack tools corresponding to each attack event from the log data, network traffic data, and alarm data;

[0008] Based on the attack target, attack time, attack event type, affected device, and attack tool corresponding to each attack event, a first correlation relationship between every two attack events is constructed through a preset attack pattern library;

[0009] construct a first directed attack graph structure, wherein a first node in the first directed attack graph structure is an attack event, a first edge in the directed attack graph structure is a directed edge from a first source node to a first target node, attributes of the first node include the attack target, the attack time, the attack event type, the attack event affected device and the attack tool, and an attribute of the first edge is the first correlation;

[0010] based on the first directed attack graph structure, output a first blockable probability corresponding to each first node through a graph neural network model;

[0011] traverse all the first nodes, and filter out first nodes with a first blockable probability greater than a preset filtering threshold as blockable nodes;

[0012] based on the blockable nodes, generate a corresponding threat situation awareness and blocking suggestion report.

[0013] The power grid network attack chain risk assessment and threat situation awareness blocking method according to the embodiments of the present application has at least the following beneficial effects:

[0014] The method obtains log data, network flow data and alarm data of a power system, extracts an attack target, an attack time, an attack event type, an attack event affected device and an attack tool corresponding to each attack event from the log data, the network flow data and the alarm data, constructs a first correlation between each two attack events based on the attack target, the attack time, the attack event type, the attack event affected device and the attack tool corresponding to each attack event through a preset attack mode library, constructs a first directed attack graph structure, wherein a first node in the first directed attack graph structure is an attack event, a first edge in the directed attack graph structure is a directed edge from a first source node to a first target node, attributes of the first node include the attack target, the attack time, the attack event type, the attack event affected device and the attack tool, and an attribute of the first edge is the first correlation, outputs a first blockable probability corresponding to each first node through a graph neural network model based on the first directed attack graph structure, traverses all the first nodes, and filters out first nodes with a first blockable probability greater than a preset filtering threshold as blockable nodes, and generates a corresponding threat situation awareness and blocking suggestion report based on the blockable nodes. The present application constructs a first directed attack graph structure, builds attack chains between nodes, filters out blockable nodes according to the output of the blockable probability corresponding to each node, and then generates a blocking suggestion for the blockable nodes, thereby realizing risk assessment of multiple attack chains corresponding to the blockable nodes, realizing intelligent blocking of the threat situation, and improving the security of the power system.

[0015] According to some embodiments of the present application, before the threat situation awareness and blocking suggestion report corresponding to the blockable node is generated, the method further comprises:

[0016] Based on the first directed attack graph structure, the risk potential value of the blockable node and the propagation weight value of the first edge with the blockable node as the source node are output by the graph neural network model, wherein the risk potential value is a scalar value for representing the risk potential of the node, and the propagation weight value is a value for representing the ability of risk propagation from the source node to the target node;

[0017] Based on the risk potential value of the blockable node and the propagation weight value of the first edge with the blockable node as the source node, a first total risk value before blocking is determined;

[0018] Based on the risk potential value of the blockable node, the first blockable probability of the blockable node and the propagation weight value of the blockable node, a first total risk value after blocking is determined;

[0019] Based on the first total risk before blocking and the first total risk after blocking, a first risk difference value is calculated;

[0020] The threat situation awareness and blocking suggestion report corresponding to the blockable node is generated, comprising:

[0021] Based on the first risk difference value and the blockable node, a threat situation awareness and blocking suggestion report corresponding to the blockable node is generated.

[0022] According to some embodiments of the present application, the training process of the graph neural network model comprises:

[0023] Obtain historical log data, historical network traffic data and historical alarm data of the power system;

[0024] From the historical log data, the historical network traffic data and the historical alarm data, the historical attack target, the historical attack time, the historical attack event type, the historical attack event affected device and the historical attack tool corresponding to each historical attack event are extracted;

[0025] Based on the historical attack target, the historical attack time, the historical attack event type, the historical attack event affected device and the historical attack tool corresponding to each historical attack event, a second association relationship between each two historical attack events is constructed by the preset attack mode library;

[0026] constructing a second directed attack graph structure, wherein a second node in the second directed attack graph structure is the historical attack event, a second edge in the second directed attack graph structure is a directed edge from a second source node to a second target node, and attributes of the second node include the historical attack target, the historical attack time, the historical attack event type, the historical attack event affected device, and the historical attack tool, and an attribute of the second edge is the second correlation;

[0027] constructing an initial graph neural network model, simulating blocking training on the initial graph neural network model based on the second directed attack graph structure, to obtain a risk potential value of the second node, a second blockable probability of the second node, and a propagation weight value of the second edge;

[0028] determining a second total risk value before blocking based on the risk potential value of the second node and the second blockable probability of the second node;

[0029] determining a second total risk value after blocking based on the risk potential value of the second node, the second blockable probability of the second node, and the propagation weight value of the second edge;

[0030] calculating a first loss value based on the second total risk value before blocking, the second total risk value after blocking, and the second blockable probability;

[0031] in a case where the first loss value reaches a preset loss threshold, taking the initial graph neural network model as the graph neural network model.

[0032] According to some embodiments of the present application, the determination of the second total risk value before blocking based on the risk potential value of the second node and the second blockable probability of the second node comprises:

[0033] adding up risk potential values of all the second nodes to obtain a total risk potential value of the second nodes;

[0034] multiplying the propagation weight value of each second edge with the risk potential value of the corresponding second target node to obtain a first risk potential value;

[0035] adding up all the first risk potential values to obtain a total first risk potential value;

[0036] adding the total first risk potential value and the total risk potential value of the second nodes to obtain the second total risk value before blocking.

[0037] According to some embodiments of the present application, the determination of the second total risk value after blocking based on the risk potential value of the second node, the second blockable probability of the second node, and the propagation weight value of the second edge comprises:

[0038] According to the second interruptable probability, a difference of interruptable probability of each second node is calculated;

[0039] The difference of interruptable probability of each second node is multiplied by a risk potential value of the corresponding second node to obtain a second risk potential value;

[0040] All the second risk potential values are added to obtain a second risk potential value sum;

[0041] The difference of interruptable probability of the second node is multiplied by the first risk potential value to obtain a third risk potential value;

[0042] All the third risk potential values are added to obtain a third risk potential value sum;

[0043] The second risk potential value and the third risk potential value are added to obtain the second total risk value after interruption.

[0044] According to some embodiments of the present application, the first loss value is calculated based on the second total risk value before interruption, the second total risk value after interruption and the second interruptable probability, comprising:

[0045] The second total risk value before interruption is subtracted from the second total risk value after interruption to obtain a second risk difference value;

[0046] All the second interruptable probabilities are added to obtain a second interruptable probability sum;

[0047] The first loss value is calculated based on the second interruptable probability sum and the second risk difference value.

[0048] According to some embodiments of the present application, the first loss value is calculated based on the second interruptable probability sum and the second risk difference value, comprising:

[0049] The second interruptable probability sum is multiplied by a preset interruption parameter value to obtain an interruption total value;

[0050] The interruption total value is subtracted from the second risk difference value to obtain the first loss value.

[0051] Additional aspects and advantages of the present application will be in part apparent and in part pointed out hereinafter. BRIEF DESCRIPTION OF DRAWINGS

[0052] The above and / or additional aspects and advantages of the present application will become apparent and be readily appreciated from the following description, including the appended drawings, wherein:

[0053] Figure 1 is a flowchart of a blocking method of power grid network attack chain risk assessment and threat situation awareness provided by an embodiment of the present application;

[0054] Figure 2 is a structural schematic diagram of an embodiment of the blocking system of power grid network attack chain risk assessment and threat situation awareness provided by the present application;

[0055] Figure 3 is a structural schematic diagram of an embodiment of the electronic device provided by the present application. DETAILED DESCRIPTION

[0056] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the drawings, wherein the same or similar notations represent the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the drawings are exemplary and are only used to explain the present application, and cannot be understood as a limitation of the present application.

[0057] In the description of the present application, if the first, second, etc. are described, it is only for the purpose of distinguishing technical features, and cannot be understood as indicating or implying the relative importance of the indicated technical features or implicitly indicating the number of the indicated technical features or the sequence of the indicated technical features.

[0058] In the description of the present application, it should be understood that the orientation description, such as the orientation or position relationship indicated by up, down, etc. is based on the orientation or position relationship shown in the drawings, and is only for the convenience of describing the present application and simplifying the description, and therefore cannot be understood as indicating or implying that the indicated device or element must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation of the present application.

[0059] In the description of the present application, it should be noted that, unless otherwise explicitly limited, the words such as setting, installing, connecting, etc. should be broadly understood, and the person skilled in the art can reasonably determine the specific meaning of the above words in the present application in combination with the specific content of the technical solution.

[0060] Information assets are commercialized information that can be converted into enterprise profits, and as a special asset of an enterprise, they play an increasingly important role in the production and operation of an enterprise. Especially for key systems related to national economy and social stability, the information assets involved are even more important.

[0061] In the prior art, static rules or manual decision modes are mostly used to trigger fixed blocking actions when matching features are detected. However, the threat situation of the power system has a dynamic evolution characteristic, the path, intensity and exploitable vulnerabilities of the attack chain dynamically change over time, and the static blocking strategy is difficult to adapt to the changes of the threat situation in real time; at the same time, the problems of waste of blocking resources (such as repeated blocking of non-critical nodes) or untimely blocking (such as missing critical blockable nodes) may occur, which leads to the fact that the attack cannot be effectively contained, and seriously affects the safety of the power system.

[0062] In order to solve the above technical defects, the embodiment of the present application provides a power grid network attack chain risk assessment and threat situation awareness blocking method.

[0063] Please refer to Figure 1 It is a flowchart of a power grid network attack chain risk assessment and threat situation awareness blocking method provided by the embodiment of the present application, which is applied to an electronic device, which can be a server and the like. As Figure 1 The power grid network attack chain risk assessment and threat situation awareness blocking method comprises the following steps.

[0064] Step S101, acquiring log data, network flow data and alarm data of the power system;

[0065] Step S102, extracting the attack target, attack time, attack event type, attack event affected device and attack tool corresponding to each attack event from the log data, network flow data and alarm data;

[0066] Step S103, constructing a first association relationship between each two attack events based on the attack target, attack time, attack event type, attack event affected device and attack tool corresponding to each attack event through a preset attack mode library;

[0067] Step S104, constructing a first directed attack graph structure, wherein the first node in the first directed attack graph structure is an attack event, the first edge in the directed attack graph structure is a directed edge from the first source node to the first target node, the attributes of the first node include the attack target, the attack time, the attack event type, the attack event affected device and the attack tool, and the attributes of the first edge are the first association relationship;

[0068] Step S105, outputting the first blockable probability corresponding to each first node through a graph neural network model based on the first directed attack graph structure;

[0069] Step S106, traversing all the first nodes, and screening out all the first nodes with a first blockable probability greater than a preset screening threshold as blockable nodes;

[0070] Step S107: Based on the blockable nodes, generate the corresponding threat situation awareness and blocking suggestion report.

[0071] The aforementioned log data can come from various devices within the power system. Examples include SCADA system operation logs, distributed control system logs, communication logs from smart meters and remote terminal units, server system logs, firewall and intrusion detection system alarm logs, and security event logs from security information and event management platforms. These logs record device operating status, user behavior, network connections, and security events, serving as fundamental data for identifying attacks.

[0072] The aforementioned network traffic data can be used to monitor network traffic within the power system (such as between OT networks, office networks, and control networks). This includes industrial control protocol traffic, monitoring and data acquisition communication traffic, and traditional transmission control protocol / Internet Protocol traffic. By performing deep packet inspection and behavioral analysis on this traffic, abnormal activities such as unusual connections, unknown protocol usage, large-scale data transmission, or specific attack payloads can be detected.

[0073] The alarm data mentioned above can include alarm information from various security devices (such as firewalls, intrusion detection systems, intrusion prevention systems, and advanced persistent threat detection systems), network devices (such as routers and switches), and industrial control equipment in the power system. These alarms may indicate the detection of viruses, malware, abnormal access, port scanning, and denial-of-service attack attempts.

[0074] The aforementioned preset filtering threshold can be a constant value less than 1, set in advance according to actual needs.

[0075] The first side mentioned above starts from the first source node and points to the first target node.

[0076] The aforementioned pre-defined attack pattern library is compiled based on historical attack event data, existing attack tactics, and research findings on new vulnerabilities and attack methods. It identifies atomic patterns of specific attack behaviors (such as a port scan or a privilege escalation attempt) and identifies the temporal, logical, and causal relationships between these atomic patterns to construct attack sequence patterns. An attack sequence pattern can be a "ransomware attack" pattern, which may include an "initial intrusion." Lateral movement "Data encryption" "Ransomware notifications," etc., are then converted into a set of rules that can be recognized and matched by the system using regular expressions, resulting in a preset attack pattern library.

[0077] The first correlation relationship can include a time relationship, a logical relationship, and a causal relationship. The time relationship can be used to represent the order of occurrence of attack events, for example, event A can only lead to event B after event A occurs. The logical relationship can be used to represent the conditional dependence between attack events, for example, successfully obtaining a certain permission (attack event A) is a necessary condition for exploiting a certain vulnerability (attack event B). The causal relationship can be used to represent the state change of one attack event causing another attack event.

[0078] The threat situation awareness and blocking recommendation report can be a comprehensive document generated based on the blockable nodes, and can be used to present the network threat state currently faced by the power system and provide targeted blocking decisions.

[0079] Based on the attack target, attack time, attack event type, attack event affected device and attack tool corresponding to each attack event, the first correlation relationship between each two attack events can be constructed by matching the attack target, attack time, attack event type, attack event affected device and attack tool corresponding to each attack event with the preset attack mode library.

[0080] Based on the first directed attack graph structure, the first blockable probability corresponding to each first node can be output by the graph neural network model, which can input the first directed attack graph structure into the graph neural network model to obtain the first blockable probability corresponding to each first node output by the graph neural network model.

[0081] The method comprises the following steps: obtaining log data, network flow data and alarm data of a power system; extracting an attack target, an attack time, an attack event type, an attack event affected device and an attack tool corresponding to each attack event from the log data, the network flow data and the alarm data; constructing a first correlation between each two attack events based on the attack target, the attack time, the attack event type, the attack event affected device and the attack tool corresponding to each attack event through a preset attack mode library; constructing a first directed attack graph structure, wherein a first node in the first directed attack graph structure is an attack event, a first edge in the directed attack graph structure is a directed edge from a first source node to a first target node, attributes of the first node include the attack target, the attack time, the attack event type, the attack event affected device and the attack tool, and an attribute of the first edge is the first correlation; outputting a first blockable probability corresponding to each first node through a graph neural network model based on the first directed attack graph structure; traversing all the first nodes, and screening out first nodes with a first blockable probability greater than a preset screening threshold as blockable nodes; and generating a corresponding threat situation awareness and blocking suggestion report based on the blockable nodes. The application builds an attack chain between nodes by constructing a first directed attack graph structure, screens out blockable nodes according to the output of the blockable probability corresponding to each node, and then generates a blocking suggestion for the blockable nodes, thereby realizing risk assessment of multiple attack chains corresponding to the blockable nodes, intelligent blocking of the threat situation, and improving the security of the power system.

[0082] In some embodiments, before the corresponding threat situation awareness and blocking suggestion report is generated based on the blockable nodes, the method further comprises:

[0083] Step S201: outputting a risk potential value of the blockable node and a propagation weight value of the first edge with the blockable node as a source node through a graph neural network model based on the first directed attack graph structure, wherein the risk potential value is a scalar value for representing the risk potential of the node, and the propagation weight value is a capability value for representing the risk propagation from the source node to the target node;

[0084] Step S202: determining a first total risk value before blocking based on the risk potential value of the blockable node and the propagation weight value of the first edge with the blockable node as the source node;

[0085] Step S203: determining a first total risk value after blocking based on the risk potential value of the blockable node, the first blockable probability of the blockable node and the propagation weight value of the blockable node;

[0086] Step S204: calculating a first risk difference value based on the first total risk before blocking and the first total risk after blocking;

[0087] Based on the blockable node, a corresponding threat situation awareness and blocking suggestion report is generated, including:

[0088] Step S205, based on the first risk difference value and the blockable node, a corresponding threat situation awareness and blocking suggestion report is generated.

[0089] The determination of the first total risk value before blocking based on the risk potential value of the blockable node and the propagation weight value of the first edge with the blockable node as the source node can include the following steps:

[0090] Step S2021, the risk potential values of all blockable nodes are added to obtain the risk potential value sum of the blockable node;

[0091] Step S2022, the propagation weight value of each first edge with the blockable node as the source node is multiplied by the risk potential value of the third target node to obtain the fourth risk potential value, wherein the third target node is the target node of the first edge with the blockable node as the source node;

[0092] Step S2023, all fourth risk potential values are added to obtain the fourth risk potential value sum;

[0093] Step S2024, the fourth risk potential value sum and the risk potential value sum of the blockable node are added to obtain the first total risk value before blocking.

[0094] The determination of the first total risk value after blocking based on the risk potential value of the blockable node, the first blockable probability of the blockable node and the propagation weight value of the blockable node can include the following steps:

[0095] Step S2031, according to the first blockable probability of the blockable node, the blockable probability difference of each blockable node is calculated;

[0096] Step S2032, the blockable probability difference of each blockable node is multiplied by the risk potential value of each blockable node to obtain the fifth risk potential value;

[0097] Step S2033, all fifth risk potential values are added to obtain the fifth risk potential value sum;

[0098] Step S2034, the blockable probability difference of the blockable node and the corresponding fourth risk potential value are obtained to obtain the sixth risk potential value;

[0099] Step S2035, all sixth risk potential values are added to obtain the sixth risk potential value sum;

[0100] Step S2036, the fifth risk potential value and the sixth risk potential value are added to obtain the first total risk value after blocking.

[0101] The difference in the blockable probability of each blockable node according to the first blockable probability of the blockable node can be obtained by subtracting the first blockable probability of each blockable node from one.

[0102] The application improves the accuracy of reading the threat situation awareness and blocking suggestion report by calculating the first risk difference value and generating a corresponding threat situation awareness and blocking suggestion report according to the first risk difference value and the blockable node, and enables a user reading the threat situation awareness and blocking suggestion report to understand the situation more efficiently.

[0103] In some embodiments, the training process of the graph neural network model includes:

[0104] Step S301, historical log data, historical network traffic data and historical alarm data of a power system are obtained;

[0105] Step S302, the historical attack target, the historical attack time, the historical attack event type, the historical attack event affected device and the historical attack tool corresponding to each historical attack event are extracted from the historical log data, the historical network traffic data and the historical alarm data;

[0106] Step S303, based on the historical attack target, the historical attack time, the historical attack event type, the historical attack event affected device and the historical attack tool corresponding to each historical attack event, a second correlation relationship between each two historical attack events is constructed through a preset attack mode library;

[0107] Step S304, a second directed attack graph structure is constructed, wherein the second nodes in the second directed attack graph structure are historical attack events, the second edges in the second directed attack graph structure are directed edges from the second source nodes to the second target nodes, the attributes of the second nodes include the historical attack target, the historical attack time, the historical attack event type, the historical attack event affected device and the historical attack tool, and the attributes of the second edges are the second correlation relationship;

[0108] Step S305, an initial graph neural network model is constructed, and the initial graph neural network model is simulated and blocked for training based on the second directed attack graph structure to obtain the risk potential value of the second node, the second blockable probability of the second node and the propagation weight value of the second edge;

[0109] Step S306, the second total risk value before blocking is determined based on the risk potential value of the second node and the second blockable probability of the second node;

[0110] Step S307, the second total risk value after blocking is determined based on the risk potential value of the second node, the second blockable probability of the second node and the propagation weight value of the second edge;

[0111] Step S308, calculating a first loss value based on the second total risk value before blocking, the second total risk value after blocking, and the second blockable probability;

[0112] Step S309, in a case where the first loss value reaches a preset loss threshold, taking the initial graph neural network model as the graph neural network model.

[0113] The second correlation relationship can include a time relationship, a logical relationship, and a causal relationship.

[0114] The preset loss threshold can be a constant value set in advance according to actual needs.

[0115] The second correlation relationship between each two historical attack events can be obtained by matching the historical attack target, the historical attack time, the historical attack event type, the historical attack event affected device, and the historical attack tool corresponding to each historical attack event with the preset attack mode library.

[0116] The risk potential value of the second node, the second blockable probability of the second node, and the propagation weight value of the second edge can be obtained by inputting the second directed attack graph structure into the initial graph neural network model for simulation blocking training.

[0117] The first loss value is calculated based on the second total risk value before blocking, the second total risk value after blocking, and the second blockable probability, and the initial graph neural network model is iteratively updated based on the first loss value, thereby improving the accuracy of model prediction and the efficiency of model training.

[0118] In some embodiments, determining the second total risk value before blocking based on the risk potential value of the second node and the second blockable probability of the second node includes:

[0119] Step S401, adding the risk potential values of all second nodes to obtain a total risk potential value of the second nodes;

[0120] Step S402, multiplying the propagation weight value of each second edge by the risk potential value of the corresponding second target node to obtain a first risk potential value;

[0121] Step S403, adding all first risk potential values to obtain a total first risk potential value;

[0122] Step S404, adding the first risk potential value sum and the risk potential value sum of the second node to obtain a second total risk value before blocking.

[0123] Specifically, the second total risk value before blocking is calculated by the following formula:

[0124] ;

[0125] Wherein, the second total risk value before blocking, the risk potential value of the i-th second node, the risk potential value of the i-th second node, the propagation weight value of the second edge with the i-th second node as the source node and the i-th second node as the target node. The present application can quantify the total risk value before blocking of the second node by calculating the total risk value before blocking, provide data basis for subsequent calculation of loss value, and can intuitively feedback the total risk value before blocking of the node to the user, which can be used to remind the user of the urgency of intelligent blocking of the threat situation. In some embodiments, determining the second total risk value after blocking based on the risk potential value of the second node, the second blockable probability of the second node and the propagation weight value of the second edge comprises:

[0126] Step S501, calculating the blockable probability difference of each second node according to the second blockable probability;

[0127] Step S502, multiplying the blockable probability difference of each second node and the risk potential value of the corresponding second node to obtain a second risk potential value;

[0128] Step S503, adding all the second risk potential values to obtain a second risk potential value sum;

[0129] Step S504, multiplying the blockable probability difference of the second node and the corresponding first risk potential value to obtain a third risk potential value;

[0130] Step S505, adding all the third risk potential values to obtain a third risk potential value sum;

[0131] Step S506, adding the second risk potential value and the third risk potential value to obtain a second total risk value after blocking.

[0132]

[0133]

[0134] ​​​​The above calculation of the blockable probability difference of each second node based on the second blockable probability can be obtained by subtracting the second blockable probability of each second node from one.

[0135] Specifically, the total risk value after the second blockade is calculated using the following formula:

[0136] ;

[0137] in, This represents the total risk value after the second blockade. For the first The second blockable probability of a second node. This application quantifies the total risk value after blocking by calculating the total risk value, providing data for subsequent loss value calculation, and also providing users with intuitive feedback on the total risk value after blocking the node, which can be used to remind users of the urgency of intelligent blocking in response to the threat situation.

[0138] This application improves the accuracy of calculating the total risk potential by comprehensively calculating the risk potential value of the second node itself and the risk potential value propagated from the node to multiple downstream nodes.

[0139] In some embodiments, the threat situation awareness and blocking suggestion report generated based on the blockable node can be a comprehensive document generated based on the blockable node, the total risk value before blocking, and the total risk value after blocking.

[0140] In some embodiments, calculating a first loss value based on the total risk value before the second blocking, the total risk value after the second blocking, and the second blocking probability includes:

[0141] Step S601: Subtract the total risk value before the second blocking from the total risk value after the second blocking to obtain the second risk difference;

[0142] Step S602: Sum all the second blockable probabilities to obtain the total second blockable probability;

[0143] Step S603: Calculate the first loss value based on the sum of the second blockable probabilities and the difference between the second risk.

[0144] In some embodiments, calculating a first loss value based on the sum of second blockable probabilities and the difference between second risks includes:

[0145] Step S701: Multiply the sum of the second blockable probabilities by the preset blocking parameter value to obtain the total blocking value;

[0146] Step S702: Subtract the total blocking value from the second risk difference to obtain the first loss value.

[0147] The preset blocking parameter value can be a constant value set in advance according to actual needs.

[0148] Specifically, the first loss value is calculated by the following formula:

[0149] ;

[0150] wherein, the second risk difference, the first loss value, the preset blocking parameter value.

[0151] The application calculates the first loss value by the second blockable probability sum and the second risk difference, provides data basis for subsequent model updating, and improves the convergence efficiency of the model training process and the accuracy of the model prediction.

[0152] In addition, with reference to Figure 2 , one embodiment of the application provides a blocking system for power grid network attack chain risk assessment and threat situation awareness, comprising a data acquisition module 1100, an attack event extraction module 1200, a first association relationship construction module 1300, a first directed attack graph structure construction module 1400, a model output module 1500, a node screening module 1600 and a report generation module 1700, wherein:

[0153] The data acquisition module 1100 is used for acquiring log data, network flow data and alarm data of a power system;

[0154] The attack event extraction module 1200 is used for extracting an attack target, an attack time, an attack event type, an attack event affected device and an attack tool corresponding to each attack event from the log data, the network flow data and the alarm data;

[0155] The first association relationship construction module 1300 is used for constructing a first association relationship between each two attack events based on the attack target, the attack time, the attack event type, the attack event affected device and the attack tool corresponding to each attack event through a preset attack mode library;

[0156] The first directed attack graph structure construction module 1400 is used for constructing a first directed attack graph structure, wherein a first node in the first directed attack graph structure is an attack event, a first edge in the directed attack graph structure is a directed edge from a first source node to a first target node, attributes of the first node include the attack target, the attack time, the attack event type, the attack event affected device and the attack tool, and an attribute of the first edge is the first association relationship;

[0157] The model output module 1500 is used for outputting a first blockable probability corresponding to each first node through a graph neural network model based on the first directed attack graph structure.

[0158] The node screening module 1600 is configured to traverse all the first nodes, screen out all the first nodes with a first interruptable probability greater than a preset screening threshold as interruptable nodes.

[0159] The report generation module 1700 is configured to generate a corresponding threat situation awareness and interruption suggestion report based on the interruptable nodes.

[0160] The system obtains log data, network flow data and alarm data of the power system, extracts attack targets, attack times, attack event types, attack event affected devices and attack tools corresponding to each attack event from the log data, network flow data and alarm data, constructs a first association relationship between each two attack events based on the attack targets, attack times, attack event types, attack event affected devices and attack tools corresponding to each attack event through a preset attack mode library, constructs a first directed attack graph structure, wherein the first nodes in the first directed attack graph structure are attack events, the first edges in the directed attack graph structure are directed edges from first source nodes to first target nodes, the attributes of the first nodes include attack targets, attack times, attack event types, attack event affected devices and attack tools, and the attributes of the first edges are the first association relationships, outputs a first interruptable probability corresponding to each first node through a graph neural network model based on the first directed attack graph structure, traverses all the first nodes, screens out all the first nodes with a first interruptable probability greater than a preset screening threshold as interruptable nodes, and generates a corresponding threat situation awareness and interruption suggestion report based on the interruptable nodes. The system constructs a first directed attack graph structure, builds attack chains between nodes, screens out interruptable nodes according to the output of the interruptable probability corresponding to each node, and generates an interruption suggestion for the interruptable nodes, thereby realizing risk assessment of multiple attack chains corresponding to the interruptable nodes, realizing intelligent interruption of threat situations, and improving the security of the power system.

[0161] It should be noted that the system embodiment and the method embodiment described above are based on the same inventive concept, and therefore the related content of the method embodiment described above is also applicable to the system embodiment, which will not be described here.

[0162] Figure 3 A rule mining hardware structure schematic diagram provided by an embodiment of the application is shown.

[0163] The power grid network attack chain risk assessment and threat situation awareness interruption device can include a processor 301 and a memory 302 storing computer program instructions.

[0164] In particular, the processor 301 can include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to perform the operations of the embodiments of the application.

[0165] The memory 302 can include mass storage for data or instructions. As an example and not by way of limitation, the memory 302 can include a hard disk drive (HDD), a floppy disk drive, flash memory, an optical disc (e.g., a compact disc (CD) or DVD), a tape drive, a USB drive, or a combination of two or more of these. The memory 302 can include removable or non-removable (or fixed) media, where appropriate. The memory 302 can be internal or external to the integrated gateway disaster recovery device, where appropriate. In particular embodiments, the memory 302 is non-volatile, solid-state memory.

[0166] In some implementations, the memory 302 includes read-only memory (ROM), random access memory (RAM), magnetic disk storage mediums, optical storage mediums, flash memory devices, electrical, optical, or other physical / tangible memory storage devices. Accordingly, in some embodiments, the memory includes one or more tangible (non-transitory) computer-readable storage media specifically configured to store software; and, when the software is executed (by one or more processors), the software is operable to perform operations described with reference to the methods according to the aspects of the present disclosure.

[0167] The processor 301 implements the power grid cyber attack chain risk assessment and threat situation awareness blocking method of any of the above embodiments by reading and executing computer program instructions stored in the memory 302.

[0168] In one example, the power grid cyber attack chain risk assessment and threat situation awareness blocking device can also include a communication interface 303 and a bus 310. As shown, the processor 301, the memory 302, and the communication interface 303 are connected through the bus 310 and complete communication with each other. Figure 3

[0169] The communication interface 303 is mainly used to realize the communication between the modules, devices, units and / or equipment in the embodiments of the application.

[0170] ​Bus 310 includes hardware, software, or both, coupling components of the power grid cyber attack chain risk assessment and threat situational awareness blocking device to each other in a known manner. Although specific bus implementations have been described, any bus implementations associating components of the power grid cyber attack chain risk assessment and threat situational awareness blocking device, or portions thereof, can be implemented in accordance with the teachings herein.

[0171] The power grid cyber attack chain risk assessment and threat situational awareness blocking device can perform the power grid cyber attack chain risk assessment and threat situational awareness blocking method in the embodiments of the present application based on the three-dimensional design model, thereby realizing the power grid cyber attack chain risk assessment and threat situational awareness blocking method described above in combination with Figure 1 and Figure 2 the power grid cyber attack chain risk assessment and threat situational awareness blocking method and system described above.

[0172] In addition, in combination with the power grid cyber attack chain risk assessment and threat situational awareness blocking method in the above embodiments, the embodiments of the present application can provide a computer storage medium to realize. The computer storage medium has computer program instructions stored thereon; the computer program instructions are executed by a processor to realize any one of the power grid cyber attack chain risk assessment and threat situational awareness blocking methods in the above embodiments.

[0173] It needs to be clear that the present application is not limited to the specific configurations and processes described above and shown in the drawings. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between steps, after understanding the spirit of the present application.

[0174] The functional blocks shown in the structural block diagrams above can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, and the like. When implemented in software, the elements of the present application are program or code segments that are used to perform the required tasks. The program or code segments can be stored in a machine-readable medium, or transmitted through a data signal carried in a carrier wave over a transmission medium or communication link. A "machine-readable medium" includes any medium that can store or transport information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROMs, flash memories, erasable ROMs (EROMs), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, and the like. The code segments can be downloaded via computer networks such as the Internet, intranets, and the like.

[0175] It is also important to note that the examples mentioned in the present application describe some methods or systems based on a series of steps or devices. However, the present application is not limited to the order of the above steps, that is, the steps can be performed in the order mentioned in the examples, or in an order different from the examples, or several steps can be performed simultaneously.

[0176] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other processing device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other processing device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer program instructions can also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other processing device to operate in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function / act specified in the flowchart and / or block diagram block or blocks. The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other processing device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other processing device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer program instructions can also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other processing device to operate in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function / act specified in the flowchart and / or block diagram block or blocks.

[0177] The above merely describes a specific implementation of the present application. Those skilled in the art can clearly understand the specific working processes of the system, modules and units described above for the convenience and brevity of description, and can refer to the corresponding processes in the foregoing method embodiments, which will not be described herein again. It should be understood that the protection scope of the present application is not limited to this, and any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed by the present application, and these modifications or replacements should be covered within the protection scope of the present application.

Claims

1. A method for blocking power grid cyber attack chain risk assessment and threat situation awareness, characterized in that, The method comprises: obtaining log data, network traffic data and alarm data of a power system; extracting attack targets, attack times, attack event types, attack event affected devices and attack tools corresponding to each attack event from the log data, the network traffic data and the alarm data; based on the attack targets, the attack times, the attack event types, the attack event affected devices and the attack tools corresponding to each attack event, constructing a first correlation between each two attack events through a preset attack mode library; constructing a first directed attack graph structure, wherein the first nodes in the first directed attack graph structure are attack events, the first edges in the directed attack graph structure are directed edges from a first source node to a first target node, the attributes of the first nodes include the attack targets, the attack times, the attack event types, the attack event affected devices and the attack tools, and the attributes of the first edges are the first correlation; based on the first directed attack graph structure, outputting a first blockable probability corresponding to each first node through a graph neural network model; traversing all the first nodes and screening out all the first nodes with a first blockable probability greater than a preset screening threshold as blockable nodes; based on the blockable nodes, generating a corresponding threat situation awareness and blocking suggestion report.

2. The method of claim 1, wherein, Before the method based on the blockable nodes generates a corresponding threat situation awareness and blocking suggestion report, the method further comprises: based on the first directed attack graph structure, outputting a risk potential value of the blockable node and a propagation weight value of the first edge with the blockable node as the source node through the graph neural network model, wherein the risk potential value is a scalar value for representing the risk potential of a node, and the propagation weight value is a value for representing the ability of risk propagation from a source node to a target node; determining a first total risk value before blocking based on the risk potential value of the blockable node and the propagation weight value of the first edge with the blockable node as the source node; determining a first total risk value after blocking based on the risk potential value of the blockable node, the first blockable probability of the blockable node and the propagation weight value of the blockable node; calculating a first risk difference value based on the first total risk before blocking and the first total risk after blocking; the method based on the blockable nodes generates a corresponding threat situation awareness and blocking suggestion report, comprising: based on the first risk difference value and the blockable nodes, generating a corresponding threat situation awareness and blocking suggestion report.

3. The method of claim 2, wherein, The training process of the graph neural network model comprises: obtaining historical log data, historical network traffic data and historical alarm data of the power system; extracting historical attack targets, historical attack times, historical attack event types, historical attack event affected devices and historical attack tools corresponding to each historical attack event from the historical log data, the historical network traffic data and the historical alarm data; constructing a second association relationship between each two historical attack events based on the historical attack target, the historical attack time, the historical attack event type, the historical attack event affected device and the historical attack tool corresponding to each historical attack event through the preset attack mode library; constructing a second directed attack graph structure, wherein a second node in the second directed attack graph structure is the historical attack event, a second edge in the second directed attack graph structure is a directed edge from a second source node to a second target node, and an attribute of the second node includes the historical attack target, the historical attack time, the historical attack event type, the historical attack event affected device and the historical attack tool, and an attribute of the second edge is the second association relationship; constructing an initial graph neural network model, simulating blocking training on the initial graph neural network model based on the second directed attack graph structure, and obtaining a risk potential value of the second node, a second blockable probability of the second node and a propagation weight value of the second edge; determining a second total risk value before blocking based on the risk potential value of the second node and the second blockable probability of the second node; determining a second total risk value after blocking based on the risk potential value of the second node, the second blockable probability of the second node and the propagation weight value of the second edge; calculating a first loss value based on the second total risk value before blocking, the second total risk value after blocking and the second blockable probability; in a case where the first loss value reaches a preset loss threshold, taking the initial graph neural network model as the graph neural network model.

4. The method of claim 3, wherein, The determination of the second total risk value before blocking based on the risk potential value of the second node and the second blockable probability of the second node includes: adding the risk potential values of all the second nodes to obtain a total risk potential value of the second nodes; multiplying the propagation weight value of each second edge and the risk potential value of the corresponding second target node to obtain a first risk potential value; adding all the first risk potential values to obtain a total first risk potential value; adding the total first risk potential value and the total risk potential value of the second nodes to obtain the second total risk value before blocking.

5. The method of claim 4, wherein, The determination of the second total risk value after blocking based on the risk potential value of the second node, the second blockable probability of the second node and the propagation weight value of the second edge includes: calculating a blockable probability difference of each second node according to the second blockable probability; multiplying the blockable probability difference of each second node and the risk potential value of the corresponding second node to obtain a second risk potential value; adding all the second risk potential values to obtain a total second risk potential value; multiplying the blockable probability difference of the second node and the corresponding first risk potential value to obtain a third risk potential value; adding all the third risk potential values to obtain a total third risk potential value; adding the second risk potential value and the third risk potential value to obtain the second total risk value after blocking.

6. The method of claim 3, wherein, The first loss value is calculated based on the second pre-blocking total risk value, the second post-blocking total risk value, and the second blockable probability, including: The second risk difference value is obtained by subtracting the second post-blocking total risk value from the second pre-blocking total risk value; The second blockable probability sum is obtained by adding all the second blockable probabilities; The first loss value is calculated based on the second blockable probability sum and the second risk difference value.

7. The method of claim 6, wherein, The first loss value is calculated based on the second blockable probability sum and the second risk difference value, including: The blocking total value is obtained by multiplying the second blockable probability sum by a preset blocking parameter value; The first loss value is obtained by subtracting the second risk difference value from the blocking total value.

Images