An intelligent power grid security situation assessment method and device, electronic equipment and medium

Abstract

The application provides a smart grid security situation assessment method and device, electronic equipment and medium, the method comprises: including: selecting the basic physical components and security monitoring components in the smart grid as key components, constructing the grid homogeneity graph based on the interaction relationship between the key components, each node in the grid homogeneity graph is provided with a feature vector; using the collected current multi-source heterogeneous power grid data, updating the feature vector of each node; input the grid homogeneity graph after updating the feature vector into the security situation assessment model including graph neural network and function approximation network, determine the grid security situation value. Through the use of the above smart grid security situation assessment method, device, electronic equipment and medium, the implicit topological correlation in the smart grid can be effectively captured, and the accuracy of the grid security situation assessment is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power grid security, in particular to a smart grid security situation assessment method and device, an electronic equipment and a medium. BACKGROUND

[0002] With the continuous expansion of the scale of the smart grid and the continuous increase of the complexity of the power grid, the smart grid is facing increasingly complex network security threats such as device failure, network attack, etc., which may cause local or global instability of the smart grid, and even cause large-scale power outage accidents. Therefore, timely and accurate perception of the security situation of the smart grid and assessment of the security risk of the smart grid are of great significance for the security prevention and emergency control of the smart grid.

[0003] However, the existing technology usually adopts a model-based method for smart grid security situation assessment, which is a method based on the physical model and mathematical model of the power grid to simulate and optimize the security information of the power grid to obtain the security situation of the power grid. However, this method usually uses a static topology model, which lacks quantification of real-time conduction paths, for example: voltage fluctuations caused by output fluctuations of distributed power sources (such as photovoltaic and wind power) through power grid connection points will trigger a chain reaction of adjacent load nodes, which is difficult to fully meet the dynamic changes and complex security requirements of the smart grid. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a smart grid security situation assessment method, device, electronic equipment and medium to overcome at least one of the above-mentioned defects.

[0005] In a first aspect, the embodiments of the present application provide a smart grid security situation assessment method, comprising:

[0006] Selecting the basic physical components and security monitoring components in the smart grid as key components, constructing a power grid homogeneity graph based on the interaction relationship between the key components, and setting a feature vector for each node in the power grid homogeneity graph;

[0007] Updating the feature vector of each node using the collected current multi-source heterogeneous power grid data;

[0008] Inputting the power grid homogeneity graph after updating the feature vector into a security situation assessment model comprising a graph neural network and a function approximation network to determine the power grid security situation value.

[0009] In an optional embodiment, the interaction relationship includes a physical connection relationship and a logical dependency relationship, and the power grid homogeneity graph is constructed by: taking the key components as nodes, setting a feature vector representing a multi-dimensional security situation index for each node, and taking the physical connection relationship and the logical dependency relationship between the key components as edges to construct the power grid homogeneity graph.

[0010] In an optional implementation, the edges in the power grid homogeneous graph include different edge types, the different edge types are used to distinguish different relationship types between the nodes, and the different edge types include a first type representing a direct control relationship and a second type representing an indirect interaction relationship.

[0011] In an optional implementation, the nodes in the power grid homogeneous graph include a plurality of nodes, and the plurality of nodes include at least one of the following: an intrusion detection system, a log recording system, a control panel, a switch, a circuit breaker, and a relay.

[0012] In an optional implementation, the power grid security posture value is obtained by: inputting the power grid homogeneous graph into a graph neural network to obtain global features; and inputting the global features into a function approximation network to obtain the power grid security posture value.

[0013] In an optional implementation, before the basic physical components and the security monitoring components in the smart grid are selected as the key components, the method further includes: preprocessing historical multi-source heterogeneous power grid data to obtain standardized multi-source heterogeneous data; determining a security posture index of the smart grid based on the standardized multi-source heterogeneous data; and training an initial security posture evaluation model by using the security posture index, to determine the power grid security posture value by using the trained security posture evaluation model.

[0014] In an optional implementation, the security posture index of the smart grid is determined by: constructing a multi-dimensional evaluation index, and determining an index quantization model by using the multi-dimensional evaluation index; and inputting target feature data in the standardized multi-source heterogeneous data into the index quantization model to determine the security posture index.

[0015] In a second aspect, the embodiments of the present application further provide an intelligent power grid security posture evaluation device, the device includes:

[0016] A homogeneous graph construction module is configured to select the basic physical components and the security monitoring components in the smart grid as the key components, and construct a power grid homogeneous graph based on the interaction relationship between the key components, each node in the power grid homogeneous graph is provided with a feature vector.

[0017] A feature updating module is configured to update the feature vector of each node by using the collected current multi-source heterogeneous power grid data.

[0018] A posture determination module is configured to input the power grid homogeneous graph after the feature vector is updated into a security posture evaluation model including a graph neural network and a function approximation network, and determine a power grid security posture value.

[0019] In a third aspect, the embodiments of the present application further provide an electronic device, comprising a processor, a memory and a bus, the memory stores machine readable instructions executable by the processor, when the electronic device is running, the processor and the memory communicate through the bus, and the machine readable instructions are executed by the processor to perform the steps of the smart grid security posture assessment method as described above.

[0020] In a fourth aspect, the embodiments of the present application further provide a computer readable storage medium, the computer readable storage medium stores a computer program, when the computer program is run by a processor, the steps of the smart grid security posture assessment method as described above are performed.

[0021] The embodiments of the present application have the following beneficial effects:

[0022] The smart grid security posture assessment method, device, electronic device and medium provided by the embodiments of the present application can dynamically represent the implicit topology correlation of the smart grid through the grid homogeneity graph, and evaluate the influence of the implicit topology correlation in the smart grid on the security posture value by using the security posture assessment model, so as to dynamically respond to the dynamic dependency relationship and cascading effect between the physical structure elements or logical structure elements of the grid which are not explicitly modeled, compared with the smart grid security posture assessment method in the prior art, the problem that the implicit topology correlation cannot be captured, resulting in low accuracy of the smart grid security posture assessment is solved.

[0023] In order to make the above objectives, characteristics and advantages of the present application more apparent and easy to understand, the following preferred embodiments are described in detail below, and the accompanying drawings are described as follows. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be considered as limiting the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0025] Figure 1 The flowchart of the smart grid security posture assessment method provided by the embodiments of the present application is shown;

[0026] Figure 2 The structural schematic diagram of the grid homogeneity graph provided by the embodiments of the present application is shown;

[0027] Figure 3 The flowchart of the training steps of the security posture assessment model provided by the embodiments of the present application is shown;

[0028] Figure 4A structural schematic diagram of an intelligent power grid security situation assessment device provided by an embodiment of the present application is shown.

[0029] Figure 5 A structural schematic diagram of an electronic device provided by an embodiment of the present application is shown. DETAILED DESCRIPTION

[0030] To make the objectives, technical solutions, and superiorities of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in connection with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the accompanying drawings herein can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments of the present application, every other embodiment obtained by a person skilled in the art without creative work falls within the scope of the present application.

[0031] It is worth noting that, before the present application is proposed, with the continuous expansion of the scale of the intelligent power grid and the continuous increase of the complexity of the power grid, the intelligent power grid is facing increasingly complex network security threats, such as device failure, network attack, etc., which can cause local or global instability of the intelligent power grid, and even cause large-scale power outage accidents. Therefore, it is of great significance for the security prevention and emergency control of the intelligent power grid to timely and accurately perceive the security situation of the intelligent power grid and assess the security risk of the intelligent power grid. However, the existing technology usually adopts a model-based method for intelligent power grid security situation assessment, which means that according to the physical model and mathematical model of the power grid, the security information of the power grid is simulated and optimized to obtain the security situation of the power grid. However, this method usually uses a static topology model, lacks quantification of real-time conduction paths, for example: voltage fluctuations caused by output fluctuations of distributed power sources (such as photovoltaic and wind power) through power grid connection points can trigger chain reactions of adjacent load nodes, and for another example: after topology structure adjustment (such as microgrid grid connection or splitting), the network security policy (access control, intrusion detection rule) is not updated synchronously, forming a dynamic defense gap, which is difficult to fully meet the dynamic changes and complex security requirements of the intelligent power grid, and reduces the accuracy of intelligent power grid security situation assessment.

[0032] Based on this, the embodiments of the present application provide an intelligent power grid security situation assessment method to improve the accuracy of intelligent power grid security situation assessment.

[0033] Please refer to Figure 1 , Figure 1 A flowchart of an intelligent power grid security situation assessment method provided by an embodiment of the present application is shown. As shown in FIG. 1, the method comprises the following steps.Figure 1 As shown, the smart grid security situation assessment method provided by the embodiment of the application comprises:

[0034] In step S101, the basic physical components and the security monitoring components in the smart grid are selected as key components, and a grid homogenous graph is constructed based on the interaction relationship between the key components.

[0035] In step S102, the feature vector of each node is updated using the collected current multi-source heterogeneous grid data.

[0036] In step S103, the grid homogenous graph after updating the feature vector is input into a security situation assessment model comprising a graph neural network and a function approximation network, and the grid security situation value is determined.

[0037] Each node in the grid homogenous graph is provided with a feature vector.

[0038] The smart grid security situation assessment method provided by the embodiment of the application can dynamically represent the implicit topology correlation of the smart grid through the grid homogenous graph, and evaluate the influence of the implicit topology correlation in the smart grid on the security situation value by using the security situation assessment model, so as to dynamically respond to the dynamic dependency relationship and cascading effect between the grid physical structure elements or logical structure elements that are not explicitly modeled, thereby solving the problem that the implicit topology correlation cannot be captured, resulting in low accuracy of the smart grid security situation assessment.

[0039] In order to facilitate the understanding of the embodiment, the above exemplary steps provided by the embodiment of the application are described below.

[0040] In step S101, the basic physical components and the security monitoring components in the smart grid are selected as key components, and a grid homogenous graph is constructed based on the interaction relationship between the key components.

[0041] In this step, the basic physical components and the security monitoring components are core components in the power system.

[0042] The basic physical components can refer to the main hardware devices in the smart grid, as an example, the basic physical components include generators, circuit breakers, relays.

[0043] The security monitoring components can refer to information components for security monitoring in the smart grid, as an example, the security monitoring components include intrusion detection systems, log recording systems, control panels.

[0044] The interaction relationship includes a physical connection relationship and a logical dependency relationship.

[0045] In order to construct a graph capable of comprehensively characterizing the features of the smart grid, the basic physical components (physical components) and security monitoring components (information components) of the smart grid system can be integrated into the same graph structure at the same time, and a power grid homogeneous graph is generated.

[0046] The power grid homogeneous graph includes nodes and edges, and the edges include different edge types, which are used to distinguish different relationship types between nodes, and the different relationship types include direct physical connection control relationship type and logical dependency relationship type. Different edge types include a first type representing having a direct physical connection and control relationship, and a second type representing having a logical dependency relationship.

[0047] The nodes in the power grid homogeneous graph include a plurality of nodes, and the plurality of nodes include at least one of the following: intrusion detection system, log recording system, control panel, switch, circuit breaker, relay. And each node in the power grid homogeneous graph is provided with a feature vector.

[0048] In an example, the key components are taken as nodes, and a feature vector representing a multi-dimensional security posture index is set for each node, the physical connection relationship and the logical dependency relationship between the key components are taken as edges, and a power grid homogeneous graph is constructed.

[0049] The multi-dimensional security posture index can refer to an index for measuring the overall security posture of the smart grid, and the multi-dimensional security posture index includes: threat index, vulnerability index, and asset value index.

[0050] For example: select the generator, circuit breaker, relay, intrusion detection system, log recording system, and control panel as key components, each key component corresponds to a node of the homogeneous graph, and a feature vector is set for each node according to the collected component information of each key component. The feature vector can be a 29-dimensional feature vector.

[0051] The feature vectors of different nodes are different, and the feature vector corresponding to the circuit breaker includes but is not limited to: voltage amplitude, current amplitude, phase angle, to provide accurate physical layer information support for security situation awareness. The feature vector corresponding to the relay includes but is not limited to: trip signal, fault type, response time, to extract the operation characteristics directly related to security situation awareness, thereby enhancing the threat recognition capability of the model. The feature vector corresponding to the control panel includes but is not limited to: control instruction, operation history record, user behavior data. The feature vector of the log recording system includes but is not limited to: running event, error report, security audit record. The feature vector of the intrusion detection system is derived from real-time alarm logs, including but not limited to: alarm type, alarm time.

[0052] Then, the nodes with physical connection and control relationship are connected by the first type of edges, and the first type of edges represents direct control relationship or data flow; the nodes with logical dependency relationship are connected by the second type of edges, and the second type of edges represents indirect or weak interaction, to generate the power grid homogenous graph. The presentation form of the first type of edges is different from that of the second type of edges.

[0053] The power grid homogenous graph will be described in detail below with reference to Figure 2 The power grid homogenous graph.

[0054] Figure 2 The structure of the power grid homogenous graph provided by the embodiment of the application is shown in the schematic diagram as Figure 2 The first type of edges is represented by solid lines, and the second type of edges is represented by dashed lines. Since the relay is responsible for monitoring the state of the circuit breaker and triggering the tripping operation when detecting device failure, to protect system safety. Each relay is directly connected with a circuit breaker, forming a kind of physical connection control relationship, therefore, the circuit breaker 201 and the relay 211, the circuit breaker 202 and the relay 212, the circuit breaker 203 and the relay 213, the circuit breaker 204 and the relay 214 are connected by the first type of edges; since the circuit breaker 201 and the circuit breaker 202 are directly connected, and since the circuit breaker 203 and the circuit breaker 204 are directly connected, the circuit breaker 201 and the circuit breaker 202, the circuit breaker 203 and the circuit breaker 204 are connected by the first type of edges.

[0055] The relay is not only connected with its corresponding circuit breaker, but also connected with the switch 220, which indicates that the relay can communicate or transmit control signals through the switch to realize the cooperative operation of fault response. Each relay is connected with the switch 220, forming an indirect connection relationship, i.e. a logical dependency relationship. Therefore, the relay 211 and the switch 220, the relay 212 and the switch 220, the relay 213 and the switch 220, the relay 214 and the switch 220 are connected by the second type of edges.

[0056] The switch 220 is also connected with the control panel 240 and the intrusion detection system 230, which highlights the key role of the switch 220 in data flow management and system component coordination, and there is a logical dependency relationship between each other. Therefore, the switch 220 and the intrusion detection system 230, the switch 220 and the control panel 240 are connected by the second type of edges.

[0057] The control panel 240 and the intrusion detection system 230 are also connected with the log recording system 250, and there is also a logical dependency relationship between them. Therefore, the intrusion detection system 230 and the log recording system 250, and the log recording system 250 and the control panel 240 are connected by the second type of edges.

[0058] In step S102, the feature vector of each node is updated by using the collected current multi-source heterogeneous power grid data.

[0059] In this step, in order to calculate the power grid security situation value in real time and accurately, it is necessary to collect multi-source heterogeneous power grid data in real time, extract the feature data corresponding to each node from the real-time collected multi-source heterogeneous power grid data, and update the feature vector of the node in the power grid homogeneous graph by using the feature data at the current time.

[0060] Taking a switch node as an example, the feature data of the switch at the current time is extracted from the multi-source heterogeneous power grid data, such as the number of attack events and the number of attacked devices. Then, the feature data at the current time is fused with the historical feature data to calculate the latest values of the feature vectors of the switch, such as the attack event occurrence probability and the device vulnerability level, up to the current time, and the feature vector of the switch at the current time is updated by using the latest values of the feature vectors, so as to reflect the dynamic information of each node in the power grid homogeneous graph in real time.

[0061] In step S103, the power grid homogeneous graph with the updated feature vector is input into a security situation assessment model including a graph neural network and a function approximation network to determine the power grid security situation value.

[0062] In this step, the security situation assessment model is a trained model, and the security situation assessment model includes a graph neural network and a function approximation network.

[0063] The graph neural network can refer to a graph attention network. As an example, the graph neural network can be a GAT (Graph Attention Network) network. The GAT network can adaptively aggregate node features through a dynamic attention mechanism, significantly improving the accuracy of feature learning in complex systems. In smart grid security situation awareness, the GAT network can effectively capture the complex physical and information interaction relationships between devices, thereby improving the perception accuracy and robustness.

[0064] The GAT network is used as a core module for feature extraction in the security situation assessment model, and is responsible for dynamically capturing the dependency relationship between nodes in the power grid homogeneous graph.

[0065] The function approximation network can refer to a new function approximation neural network based on a mathematical representation theorem. As an example, the function approximation network can be a KAN (Kolmogorov-Arnold) network.

[0066] After updating the values of the feature vectors of each node, the power grid homophily data after updating the feature vectors is input into the security posture assessment model, and the security posture assessment model includes a graph neural network and a function approximation network, and the function approximation network includes a nonlinear enhancement module and a threat classification module.

[0067] In an example, the power grid homophily graph is input into the graph neural network to obtain global features, and the global features are input into the function approximation network to obtain a power grid security posture value.

[0068] Here, the power grid homophily graph is input into the graph neural network to extract global features of the smart grid, and then the extracted global features are input into the nonlinear module for nonlinear enhancement to obtain global features after nonlinear enhancement. Finally, the global features after nonlinear enhancement are input into the threat classification module, and the power grid security posture value is output through the threat classification module.

[0069] The graph neural network is used for attention feature extraction, and the graph neural network GAT includes a double-layer multi-head graph attention network, a pooling layer (Global Pooling), and a flatten&Normalization. Each layer of the multi-head graph attention network includes a multi-head attention mechanism, a layer normalization (LayerNorm), a Softmax function, a Dropout layer, and a nonlinear activation function.

[0070] When the graph neural network extracts features, the multi-head graph attention network is used to calculate the unnormalized attention coefficients, balance the interaction intensity between different nodes, and normalize the attention coefficients through the softmax function to obtain attention weights, which reflect the interaction importance between different nodes. This dynamic weight distribution mechanism enables the graph neural network to adaptively capture complex dependency relationships between nodes, thereby assigning different importance to different neighbor nodes during feature aggregation. After obtaining the attention weights, the features of the neighbor nodes are weighted and aggregated using the attention weights to generate updated features of the nodes. This aggregation method not only considers the interaction intensity between nodes, but also introduces nonlinear transformation through the nonlinear activation function, thereby enhancing the expression ability of the model.

[0071] The nonlinear enhancement module performs nonlinear transformations on the global features output by the graph neural network to enhance the model's expressive and fitting capabilities. This module primarily consists of multiple fully connected (dense) layers, each including basis functions and B-spline functions to construct edge-activated functions for each neuron.

[0072] The threat classification module mainly consists of a Sigmoid layer and a Softmax layer, which are used to meet the output requirements of different classification tasks.

[0073] In one example, in order to use a security situation assessment model to determine the power grid security situation value, the initial security situation assessment model needs to be trained.

[0074] The following reference Figure 3 This section will introduce the training process of the security situation assessment model.

[0075] Figure 3 A flowchart illustrating the training steps of the security situation assessment model provided in this application embodiment is shown, as follows: Figure 3 As shown, the training steps for the security situation assessment model include:

[0076] Step S201: Preprocess historical multi-source heterogeneous power grid data to obtain standardized multi-source heterogeneous data.

[0077] For example, before identifying key components, historical multi-source heterogeneous power grid data is acquired and preprocessed, such as data selection, outlier removal, numerical filling, and normalization, to select important factors in the smart grid, eliminate redundant data, and convert the data into standardized data with unified dimensions to obtain standardized multi-source heterogeneous data.

[0078] Step S202: Determine the security status index of the smart grid based on standardized multi-source heterogeneous data.

[0079] To determine the security situation index, it is necessary to establish a multi-dimensional evaluation index system and use this system to calculate the security situation index.

[0080] For example, core indicators can be selected from three dimensions: threat, vulnerability, and asset value, to construct a multi-dimensional evaluation indicator, and then a quantitative model can be built using this multi-dimensional evaluation indicator. The core indicators include threat indicators, vulnerability indicators, and asset value indicators.

[0081] The threat index is determined based on a dynamic evolution theory of attack behaviors, and the threat dimension focuses on the potential damage of external attacks to the power grid, covering feature analysis and impact range prediction of attack behaviors. The threat index is constructed from three aspects of attack frequency, attack complexity and horizontal penetration ability. The attack frequency is used to quantify the spatiotemporal distribution of attack intensity by counting the number of attack events in a unit time window. The attack complexity can refer to the complexity of the attack chain. The attack complexity is used to evaluate the technical maturity of advanced threats by analyzing the diversity of attack paths and the privilege escalation logic according to the attack stage evolution theory. The horizontal penetration index is used to predict the expansion potential of attacks between devices according to the node correlation theory of power grid topology. The threat index includes: the number of attack events, the severity of attack events, and the probability of attack event occurrence.

[0082] The vulnerability index is constructed in accordance with a dynamic risk assessment theory. The vulnerability dimension is used to evaluate the inherent defects of internal defense mechanisms of the system, including device vulnerabilities, protocol configuration defects and security policy failures. The vulnerability index is constructed from three aspects of vulnerability exposure, protocol compliance and configuration security. The vulnerability exposure is used to integrate vulnerability scores and device operating status to establish a time-varying risk assessment model. The protocol compliance can refer to the abnormality of protocol entropy. The protocol compliance is used to analyze the instruction distribution characteristics of industrial protocols based on information entropy theory, and to identify abnormal behaviors by deviation from the baseline value. The configuration security can refer to the configuration offset degree. The configuration security is used to quantify the difference between device configuration and security baseline through fuzzy matching theory to detect configuration errors or malicious tampering. The vulnerability index includes: the number of attack events, the device vulnerability level, and the probability of attack event occurrence.

[0083] The asset value index is determined based on power grid topology theory and business impact analysis theory. The asset value dimension is used to identify the functional importance of key resources in power production, and is theoretically classified according to the logical position of devices in the power grid topology, data sensitivity and business continuity requirements. The asset value index is constructed from device criticality, data value and service continuity. The device criticality is used to identify single point failure risks in the topology by combining node centrality and functional dependency. The data value is used to evaluate the data value by weighting according to data classification and hierarchical theory, combined with encryption strength and access control strategy. The service continuity is used to evaluate the importance of its function by analyzing the cascading effects of device failure on power supply. The asset value index includes: the number of attacks, the asset value level, and the probability of attack event occurrence.

[0084] After constructing the multi-dimensional evaluation index, an index quantization model is established based on the multi-dimensional evaluation index. The target feature data in the standardized multi-source heterogeneous data is input into the index quantization model to determine the security posture index.

[0085] For example, based on the hierarchical weight dynamic scoring method, the sum of the weights of the threat index, the vulnerability index and the asset value index is determined as the index quantification model.

[0086] After determining the index quantification model, the standardized multi-source heterogeneous data is analyzed to determine the values of the threat index, the vulnerability index and the asset value index. Then, the threat index is determined based on the value of the threat index, the vulnerability index is determined based on the value of the vulnerability index, and the asset value index is determined based on the value of the asset value index. The threat index, the vulnerability index and the asset value index are substituted into the index quantification model to determine the security posture index.

[0087] The higher the security posture index is, the worse the network security state is, and the more urgent the measures to be taken are; the lower the security posture index is, the better the network security state is, and the smaller the strength of the measures to be taken is.

[0088] In step S203, the initial security posture evaluation model is trained using the security posture index, so as to determine the power grid security posture value using the trained security posture evaluation model.

[0089] The initial security posture evaluation model is trained using the calculated security posture index and the standardized multi-source heterogeneous data, so as to obtain the trained security posture evaluation model. The security posture index is the security posture value used for model training, and whether the model converges is evaluated through the security posture index.

[0090] Based on the same inventive concept, the embodiments of the present application also provide an intelligent power grid security posture evaluation device corresponding to the intelligent power grid security posture evaluation method. Since the principle of solving problems in the device of the embodiments of the present application is similar to the above-mentioned intelligent power grid security posture evaluation method of the embodiments of the present application, the implementation of the device can be referred to the implementation of the method, and the repeated parts will not be described here.

[0091] Please refer to Figure 4 , Figure 4 The structure of an intelligent power grid security posture evaluation device provided by the embodiments of the present application is shown in FIG. 3. Figure 4 As shown in FIG. 3, the intelligent power grid security posture evaluation device 300 includes:

[0092] The homogeneous graph construction module 301 is configured to select the basic physical components and the security monitoring components in the intelligent power grid as the key components, and construct a power grid homogeneous graph based on the interaction relationship between the key components. Each node in the power grid homogeneous graph is provided with a feature vector.

[0093] The feature updating module 302 is configured to update the feature vector of each node using the collected current multi-source heterogeneous power grid data.

[0094] The situation determination module 303 is configured to input the updated feature vector into a security situation assessment model including a graph neural network and a function approximation network, to determine a power grid security situation value.

[0095] Please refer to Figure 5 , Figure 5 A structural schematic diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 4. Figure 5 As shown in FIG. 4, the electronic device 400 includes a processor 410, a memory 420 and a bus 430.

[0096] The memory 420 stores machine readable instructions executable by the processor 410, and when the electronic device 400 is running, the processor 410 and the memory 420 communicate through the bus 430. When the machine readable instructions are executed by the processor 410, the steps of the smart grid security situation assessment method in the method embodiment shown in the above Figure 1 The specific implementation can be referred to the method embodiment, and will not be repeated here.

[0097] The embodiment of the present application further provides a computer readable storage medium, which stores a computer program. When the computer program is run by a processor, the steps of the smart grid security situation assessment method in the method embodiment shown in the above Figure 1 The specific implementation can be referred to the method embodiment, and will not be repeated here.

[0098] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, and will not be repeated here.

[0099] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented by other ways. The device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some communication interface, device or unit, and can be electrical, mechanical or other forms.

[0100] The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, i.e. may be located in one place, or may be distributed on multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0101] In addition, the functional units in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit.

[0102] If the functions are realized in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer readable storage medium executable by a processor. Based on this understanding, the technical solutions of the present application or the part of the present application that essentially contributes to the prior art or the part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and various program code storage media.

[0103] Finally, it should be noted that: the above-described embodiments are only specific embodiments of the present application, used to illustrate the technical solutions of the present application, and not to limit them, the protection scope of the present application is not limited thereto, although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand: any person skilled in the art within the technical scope disclosed by the present application, they can still modify or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to part of the technical features; and these modifications, changes or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and all should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for assessing the security status of a smart grid, characterized in that, include: Basic physical components and safety monitoring components in the smart grid are selected as key components. A grid homogeneous graph is constructed based on the interaction relationship between the key components. Each node in the grid homogeneous graph is assigned a feature vector. The feature vector of each node is updated using the collected current multi-source heterogeneous power grid data; The updated feature vectors of the grid homogeneous graph are input into a security situation assessment model that includes graph neural networks and function approximation networks to determine the grid security situation value. The interaction relationships include physical connectivity and logical dependencies, and a grid homogeneity graph is constructed in the following ways: The key components are used as nodes, and a feature vector representing a multi-dimensional security situation indicator is set for each node. The physical connection relationship and logical dependency relationship between the key components are used as edges to construct a grid homogeneous graph. The power grid security status value is obtained through the following methods: The homogeneous graph of the power grid is input into the graph neural network to obtain global features; The global features are input into the function approximation network to obtain the power grid security status value.

2. The method according to claim 1, characterized in that, The edges in the homogeneous graph of the power grid include different edge types, which are used to distinguish different relationship types between nodes. The different edge types include a first type representing a direct control relationship and a second type representing an indirect interaction relationship.

3. The method according to claim 1, characterized in that, The nodes in the homogeneous power grid graph include multiple nodes, and each node includes at least one of the following: Intrusion detection system, logging system, control panel, switch, circuit breaker, relay.

4. The method according to claim 1, characterized in that, Before selecting the basic physical components and security monitoring components in the smart grid as key components, the following are also included: Historical multi-source heterogeneous power grid data is preprocessed to obtain standardized multi-source heterogeneous data; Based on the standardized multi-source heterogeneous data, the security status index of the smart grid is determined; The initial security situation assessment model is trained using the security situation index, and the trained security situation assessment model is used to determine the power grid security situation value.

5. The method according to claim 4, characterized in that, The security status index of the smart grid is determined in the following way: Construct multi-dimensional evaluation indicators and use the multi-dimensional evaluation indicators to determine the indicator quantification model; The target feature data from the standardized multi-source heterogeneous data is input into the index quantification model to determine the security situation index.

6. A smart grid security status assessment device, characterized in that, include: The homogeneous graph construction module is used to select basic physical components and security monitoring components in the smart grid as key components, and construct a grid homogeneous graph based on the interaction relationship between the key components. Each node in the grid homogeneous graph is set with a feature vector. The feature update module is used to update the feature vector of each node using the collected current multi-source heterogeneous power grid data; The situation determination module is used to input the updated feature vector of the grid homogeneous graph into the security situation assessment model, which includes graph neural networks and function approximation networks, to determine the grid security situation value. The interaction relationships include physical connections and logical dependencies. The homogeneous graph construction module is specifically used for: The key components are used as nodes, and a feature vector representing a multi-dimensional security situation indicator is set for each node. The physical connection relationship and logical dependency relationship between the key components are used as edges to construct a grid homogeneous graph. The situation determination module is specifically used for: The homogeneous graph of the power grid is input into the graph neural network to obtain global features; The global features are input into the function approximation network to obtain the power grid security status value.

7. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus, and the processor executes the machine-readable instructions to perform the steps of the smart grid security situation assessment method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, performs the steps of the smart grid security situation assessment method as described in any one of claims 1 to 5.

Images