A power network vulnerability analysis system and method based on virtual attack and defense deduction

Abstract

The application discloses to the technical field of power network, specifically is a kind of power network vulnerability analysis system and method based on virtual attack and defense deduction, comprising: data acquisition module, for responsible collection various data of power network, the various data include network topology structure data, equipment configuration data, operating state data, security log data;Threat intelligence integration module is used to collect, integrate network security threat intelligence from the world, and with threat intelligence platform establishes data interface, realizes the automatic synchronization and update of threat intelligence.The application can simulate new attack means, monitor power network security state in real time by continuous virtual attack and defense deduction, combined with machine learning algorithm optimization attack and defense strategy.Even if there is unprecedented attack mode, the application can quickly identify potential threats through attack and defense confrontation, greatly improve the discovery ability of new and unknown vulnerabilities, and respond to network security risks in time.

Description

Technical Field

[0001] This invention relates to the field of power network technology, specifically to a power network vulnerability analysis system and method based on virtual attack and defense simulation. Background Technology

[0002] In today's rapidly evolving digital and intelligent world, the stable operation of the power grid, as a critical national infrastructure, is crucial to the national economy and people's livelihoods. With the continuous improvement of the power system's informatization level, the application of numerous digital devices and technologies, such as smart meters, distributed energy access, and power dispatch automation systems, has led to the deep integration of the power grid and information networks. However, traditional vulnerability analysis methods are no longer sufficient to cope with the complex and ever-changing network attack methods and new power network architectures, specifically exhibiting the following problems:

[0003] 1. Traditional vulnerability analysis methods lack timeliness: Traditional vulnerability scanning tools mostly rely on known vulnerability signature databases for detection, making them unable to promptly detect new and unknown attack methods and vulnerabilities. For example, attackers used new malicious software that bypassed the detection of traditional vulnerability scanning tools in the power grid at the time, successfully infiltrating the power grid control system and causing a large-scale power outage. This exposes the lag of traditional methods in the face of unknown threats.

[0004] 2. Lack of dynamism in vulnerability analysis: Existing vulnerability analyses are often static, only assessing the state of the power network at a specific moment. They cannot simulate the dynamic changes in network state during actual operation, or the interaction between attackers and defenders. For example, during peak and off-peak periods of power network load, the network topology and data traffic change. Some vulnerabilities that are not obvious during off-peak periods may be exploited by attackers during peak periods, but static analysis cannot detect such problems.

[0005] 3. Difficulty in assessing the actual impact of vulnerabilities: Traditional methods simply list the discovered vulnerabilities but struggle to assess the actual impact of attacks on the overall operation of the power network. For example, if a communication protocol in the power network has a vulnerability, traditional analysis can only point out its existence but cannot accurately explain the chain reaction that exploitation of this vulnerability will cause to power dispatching, power transmission, and other aspects. It also cannot quantify the extent of the damage, hindering the development of targeted defense strategies.

[0006] Based on the above, a power network vulnerability analysis system and method based on virtual attack and defense simulation are invented. Summary of the Invention

[0007] To address the aforementioned technical problems, according to one aspect of the present invention, the present invention provides the following technical solution:

[0008] A power network vulnerability analysis system based on virtual attack and defense simulation, comprising:

[0009] The data acquisition module is responsible for collecting various types of data from the power network, including network topology data, equipment configuration data, operating status data (such as voltage, current, power, etc.), and safety log data.

[0010] The threat intelligence integration module is used to collect and integrate cybersecurity threat intelligence from around the world, including known attack groups, new attack methods, and zero-day vulnerability information. It also establishes data interfaces with threat intelligence platforms (such as AlienVault and CrowdStrike) to achieve automatic synchronization and updates of threat intelligence. In the process of power grid vulnerability analysis, the threat intelligence integration module can combine the latest threat information with the actual situation of the power grid, providing more targeted attack simulation directions for subsequent attack and defense exercises.

[0011] The virtual simulation module is used to construct a virtual simulation model of the power network based on the acquired data.

[0012] The attack and defense simulation module is used to simulate the attack behavior of attackers and the defense strategies of defenders based on a virtual simulation model. The system has a pre-built library of various common attack methods and defense methods. Attackers can choose appropriate attack paths and methods according to the state of the virtual network. Defenders can formulate corresponding defense measures based on the attack situation. Through continuous attack and defense confrontation, potential vulnerabilities in the power network can be discovered.

[0013] The analysis and evaluation module is used to analyze and process the data generated during the attack and defense simulation, and to assess the severity, scope of impact, and potential for exploitation of vulnerabilities.

[0014] The user interaction module provides an interface for users to configure system parameters, start and stop attack and defense simulations, and view vulnerability analysis reports. It also supports visualization, presenting information such as power network topology, attack and defense processes, and vulnerability distribution to users in an intuitive graphical format.

[0015] As a preferred embodiment of the power network vulnerability analysis system based on virtual attack and defense simulation described in this invention, the virtual simulation module includes:

[0016] The data receiving and verification module is used to verify the integrity and accuracy of various types of data received from the power network; for network topology data, it checks whether there are any missing or contradictory connections between equipment nodes; for equipment configuration data, it verifies whether the parameter settings meet the specifications; for operating status data, it uses statistical analysis to determine whether there are any abnormal fluctuations; if data problems are found, it promptly feeds back to the data acquisition module for re-acquisition or correction to ensure that the data used for simulation is real and reliable.

[0017] The data parsing and feature extraction module is used to perform targeted parsing based on data types. For example, it can parse key feature parameters such as voltage, current, and power from power equipment operating status data; extract physical connections and communication links between devices from network topology data; and then use data mining techniques to perform in-depth processing on the parsed data to extract feature information that reflects the operating rules and characteristics of the power network, providing effective data support for subsequent model construction.

[0018] The virtual model building module is used to first model the devices, then build the network topology, and finally model the interaction relationships.

[0019] The model parameter initialization and calibration module is used to initialize and calibrate the parameters of the constructed model. First, based on the equipment's technical specifications and historical operating data, initial values ​​are assigned to the equipment and network parameters in the model. Then, the simulation results of the virtual model are compared and analyzed with the operating data of the actual power network. By adjusting the model parameters, the operating output of the virtual model is made as close as possible to the actual situation, thus completing the model calibration and ensuring the accuracy of the model.

[0020] The operational scenario simulation is used to first simulate normal operation scenarios, then fault scenarios, and finally load change scenarios.

[0021] As a preferred embodiment of the power network vulnerability analysis system based on virtual attack and defense simulation described in this invention, the specific steps of the virtual model construction module are as follows:

[0022] Step 1, Equipment Modeling: Based on the physical characteristics and functions of power network equipment, a combination of 3D modeling and logical modeling is used to model each device. For example, for transformers, not only is an external structural model built, but also a logical model reflecting electrical characteristics such as voltage transformation and power loss is established. For smart meters, a logical model including data acquisition and communication transmission functions is built to achieve accurate simulation of the equipment's operating status.

[0023] Step 2, Network Topology Construction: Based on the extracted network topology feature information, a power network topology is built in a virtual environment; the various device models are combined according to the actual connection relationship to construct a complete power network topology, ensuring that the virtual network topology is consistent with the actual network in structure and can accurately reflect the data and power transmission paths in the power network;

[0024] Step 3, Interaction Relationship Modeling: Establish an interaction relationship model between devices to simulate the data communication and power transmission processes between devices; for power transmission, based on circuit principles and power system operation rules, set the power flow mode and power distribution in the network; in terms of data communication, simulate the data interaction process between devices under different communication protocols to achieve a comprehensive simulation of the physical processes and information interaction processes in the operation of the power network.

[0025] As a preferred embodiment of the power network vulnerability analysis system based on virtual attack and defense simulation described in this invention, the specific operation steps of the simulation of the running scenario are as follows:

[0026] Step 1, Normal Operation Scenario Simulation: After completing the model calibration, the normal operation scenario of the power network is simulated first. According to the daily operation rules of the power network, the normal operation parameters and load levels of the equipment are set, the virtual model is driven to run, and the equipment operation status, power flow distribution, and data transmission of the power network under normal conditions are observed to provide benchmark data for subsequent analysis.

[0027] Step 2, Fault Scenario Simulation: Based on common fault types in power networks, such as line short circuits and equipment failures, set corresponding fault points and fault parameters in the virtual model to simulate the changes in the operating state of the power network when a fault occurs; analyze the redistribution of power flow, abnormal responses of equipment, and actions of protection devices after the fault occurs, in order to study the scope and extent of the fault's impact on the power network.

[0028] Step 3, load change scenario simulation: Simulate the operating status of the power network under different load levels. By adjusting the load parameters, gradually changing from low load to high load, observe the changes in the carrying capacity, voltage stability, and power loss indicators of the power network equipment, and provide data support for evaluating the safety and reliability of the power network under different operating conditions.

[0029] As a preferred embodiment of the power network vulnerability analysis system based on virtual attack and defense simulation described in this invention, the attack and defense simulation module includes:

[0030] The simulation environment initialization module is used to initialize and configure the simulation environment after the virtual power network model is built in the virtual simulation module. First, it selects basic attack strategies and defense strategy templates suitable for the characteristics of the current power network model from the attack method library and defense method library. At the same time, according to the actual security requirements and risk level of the power network, it sets the rules and constraints for attack and defense simulation, such as the upper limit of attack intensity and the limit of defense resources, to ensure that the simulation process is both realistic and within a controllable range.

[0031] The attack strategy generation module is used to first generate the attack strategy automatically, and then assist with manual customization.

[0032] The defense strategy formulation module is used to first perform dynamic response, and then optimize the strategy.

[0033] The attack and defense confrontation execution module is used to initiate the attack and defense confrontation process in the virtual power network model according to the generated attack strategy and the established defense strategy. Attackers simulate attack operations on power network equipment, communication links and business systems according to attack paths and methods. Defenders intercept, respond to and counterattack the attacks in real time according to the defense strategy. During the confrontation process, each attack attempt, defense action and change in power network status are recorded strictly according to the preset simulation rules.

[0034] The data recording and analysis module is used to first collect data and then perform in-depth analysis.

[0035] As a preferred embodiment of the power network vulnerability analysis system based on virtual attack and defense simulation described in this invention, the specific steps of the attack strategy generation module are as follows:

[0036] Step 1, Automated Generation: Utilize machine learning algorithms to analyze historical attack data and current power grid virtual model status data; through deep learning models, such as recurrent neural networks (RNNs) or generative adversarial networks (GANs), learn the correlation between attack patterns and network vulnerabilities, and automatically generate attack strategies for the current network environment;

[0037] Step 2, Manual Customization Assistance: Supports security experts to manually adjust or customize attack strategies based on their experience and in-depth understanding of power networks; experts can supplement or modify attack methods, attack sequences, etc., on the basis of automatically generated strategies for specific business scenarios or new attack trends, so that the attack strategies are more in line with the actual threats that may be faced.

[0038] As a preferred embodiment of the power network vulnerability analysis system based on virtual attack and defense simulation described in this invention, the specific steps of the defense strategy formulation module are as follows:

[0039] Step 1, Dynamic Response: Based on the characteristics of the attack strategy and the real-time status of the power network, a dynamic defense response is automatically generated; for example, when an attack is detected attempting to intrude into the power dispatching system, defense measures such as isolating key areas, enhancing identity authentication, and encrypting communication are automatically initiated; using intelligent decision-making algorithms, the allocation of defense resources is dynamically adjusted according to the intensity and direction of the attack, prioritizing the protection of key nodes and core services in the power network.

[0040] Step 2, Strategy Optimization: Through reinforcement learning algorithms, the defense strategy is self-optimized in continuous attack and defense confrontations; after each attack and defense simulation, the parameters and execution order of the defense strategy are adjusted according to the defense effect evaluation results, so that subsequent defense strategies can more effectively resist similar attacks, and gradually improve the accuracy and effectiveness of the defense.

[0041] As a preferred embodiment of the power network vulnerability analysis system based on virtual attack and defense simulation described in this invention, the specific steps of the data recording and analysis module are as follows:

[0042] Step 1, Data Acquisition: During the attack and defense confrontation, real-time data is collected on attack process (such as attack initiation time, attack type, attack target, etc.), defense process (such as defense measure execution time, defense effect, etc.), and power network status change data (such as equipment operating parameter fluctuations, network topology changes, etc.); then the data is processed in a structured manner.

[0043] Step Two, In-depth Analysis: Using data analysis techniques, the collected data is deeply mined; by comparing the differences in the power network status before and after the attack, and combining with vulnerability assessment models, potential vulnerabilities exposed in the power network by the attack are identified; the reasons for the success or failure of the attack are analyzed, the effectiveness of the defense strategy is evaluated, and a basis is provided for optimizing the attack method library, the defense method library, and improving the attack and defense strategy.

[0044] As a preferred embodiment of the power network vulnerability analysis system based on virtual attack and defense simulation described in this invention, the analysis and evaluation module includes:

[0045] The preprocessing module is used to preprocess the data from the attack and defense simulation module. First, it uses a data cleaning algorithm to remove abnormal data caused by system errors or random factors during the simulation process, such as incorrect attack time recordings or instantaneous fluctuations in network status. Then, it performs format unification and standardization processing on the data, converting different types of raw data (such as text-based attack type descriptions and numerical device operating parameters) into a structured data format suitable for subsequent analysis, laying the foundation for vulnerability analysis.

[0046] The Attack Path Reconstruction and Impact Analysis module first utilizes graph databases and path analysis algorithms to reconstruct the attacker's attack path in the virtual power network based on preprocessed data. Starting from the initial node of the attack, it traces the attacker's movement trajectory in the network step by step based on recorded attack attempts and successful intrusion events, identifying the complete path from the external network into the power network, breaching various defense layers, and finally reaching the target device or system. Next, it analyzes the chain reactions caused by the attack on each node along the attack path, assessing the scope of the attack's impact on different functional modules and business systems of the power network. For example, when an attacker intrudes into a substation automation system, it analyzes the impact on functions such as power dispatching, equipment control, and data acquisition, determining the affected area and the number of devices. Finally, combining the power network's business processes and topology, it establishes an impact propagation model to predict the possible direction and extent of the attack's spread.

[0047] The vulnerability identification and classification module first analyzes the behavioral data of the power network during an attack using machine learning anomaly detection algorithms to identify abnormal behaviors that deviate from normal operating modes. Then, combining the anomaly detection results with knowledge of the power network's system architecture, it locates the specific device, system component, or communication protocol where the potential vulnerability resides. Based on the vulnerability's technical characteristics and impact type, the identified vulnerabilities are classified, such as network protocol vulnerabilities, application vulnerabilities, and configuration misconfiguration vulnerabilities. Simultaneously, it labels the vulnerability's location information, such as the device's IP address, physical location, and subnet, providing a clear target for subsequent vulnerability remediation.

[0048] The vulnerability quantitative assessment module first constructs a vulnerability assessment indicator system from technical, business, and security management dimensions based on the analytic hierarchy process (AHP) and fuzzy comprehensive evaluation method. The technical dimension includes vulnerability exploitability, attack complexity, and required privileges; the business dimension includes the business importance affected by the vulnerability, data sensitivity, and service interruption duration; and the security management dimension includes vulnerability detectability, remediation difficulty, and remediation cost. Next, expert experience and historical data are used to determine the weight of each assessment indicator. Then, for each identified vulnerability, a score is assigned based on its performance on each indicator. Through weighted calculation, a comprehensive risk score is obtained for each vulnerability, and vulnerabilities are classified into different risk levels, such as high risk, medium risk, and low risk, providing a quantitative basis for subsequent security decisions.

[0049] The defense strategy recommendation generation module is used to first formulate targeted defense measures based on the type, location, and risk level of vulnerabilities, combined with the actual operation and security requirements of the power network. For high-risk vulnerabilities, it recommends emergency measures such as immediate remediation, isolation of affected equipment, and enhanced monitoring. For medium- and low-risk vulnerabilities, it proposes long-term improvement suggestions such as optimized configuration, enhanced security training, and regular inspections. Next, while proposing defense measures, it analyzes the implementation cost and expected benefits of each measure. It considers the human, material, and time costs required to remediate vulnerabilities, as well as the potential impact on business interruption, and assesses the degree of improvement in power network security after implementing defense measures, providing users with cost-effective defense strategy options.

[0050] The report generation and visualization module first integrates the analysis results of vulnerability identification, classification, quantitative assessment, and defense strategy recommendations, and then organizes and generates a detailed vulnerability analysis report according to a logical structure. The report content includes an overview of the power network security status, a list of discovered vulnerabilities, a detailed description of each vulnerability and risk assessment results, defense strategy recommendations for different vulnerabilities, and an overall security improvement plan. Finally, visualization methods are used to intuitively present the security status of the power network.

[0051] A method for analyzing power network vulnerabilities based on virtual attack and defense simulations includes the following specific steps:

[0052] S1: Responsible for collecting various types of data from the power network through the data acquisition module;

[0053] S2: The threat intelligence integration module collects and integrates cybersecurity threat intelligence from around the world and establishes a data interface with the threat intelligence platform to achieve automatic synchronization and updates of threat intelligence. In the process of power network vulnerability analysis, the threat intelligence integration module can combine the latest threat information with the actual situation of the power network to provide more targeted attack simulation directions for subsequent attack and defense simulations.

[0054] S3: After receiving various types of data from the power network, the data receiving and verification module verifies the integrity and accuracy of the data. If data problems are found, they are promptly fed back to the data acquisition module for re-acquisition or correction to ensure the data used for simulation is authentic and reliable. After verification, the data parsing and feature extraction module performs targeted parsing based on the data type. Then, data mining techniques are used to perform in-depth processing on the parsed data to extract feature information that reflects the operating rules and characteristics of the power network, providing effective data support for subsequent model construction. After extraction, the virtual model construction module first models the equipment, and then performs network topology. The process begins with building the model, including creating interactive relationship models. After construction, the model parameter initialization and calibration module initializes and calibrates the parameters. First, initial values ​​are assigned to the equipment and network parameters in the model based on the equipment's technical specifications and historical operating data. Then, the simulation results of the virtual model are compared and analyzed with the actual power network operating data. By adjusting the model parameters, the operating output of the virtual model is made as close to the actual situation as possible, completing model calibration and ensuring the model's accuracy. After calibration, the model is simulated in operating scenarios, first for normal operation, then for fault scenarios, and finally for load change scenarios.

[0055] S4: After the virtual power network model is built in the virtual simulation module, the simulation environment initialization module can initialize and configure the simulation environment. First, it selects basic attack and defense strategy templates suitable for the characteristics of the current power network model from the attack method and defense method libraries. Simultaneously, based on the actual security needs and risk levels of the power network, it sets rules and constraints for the attack and defense simulation to ensure the simulation process is both realistic and within a controllable range. After initialization, the attack strategy generation module generates attack strategies, followed by the defense strategy formulation module. Then, the attack and defense confrontation execution module initiates the attack and defense confrontation process in the virtual power network model according to the generated attack and defense strategies. Attackers simulate attack operations on power network equipment, communication links, and business systems according to attack paths and methods. Defenders intercept, respond to, and counterattack attacks in real time according to the defense strategy. During the confrontation, each attack attempt, defense action, and change in the power network state is recorded strictly according to the preset simulation rules. After the confrontation, the data recording and analysis module first collects data and then performs in-depth analysis.

[0056] S5: The preprocessing module preprocesses the data from the attack and defense simulation module. After processing, the attack path reconstruction and impact analysis module first uses graph databases and path analysis algorithms to reconstruct the attacker's attack path in the virtual power network based on the preprocessed data. Then, it analyzes the chain reactions caused by the attack on each node along the attack path, assessing the impact range of the attack on different functional modules and business systems of the power network. Next, combining the business processes and topology of the power network, it establishes an impact propagation model to predict the possible direction and extent of the attack's spread. Then, the vulnerability identification and classification module first analyzes the behavioral data of the power network during the attack process using machine learning anomaly detection algorithms to identify abnormal behaviors inconsistent with normal operation. Then, combining the anomaly detection results and knowledge of the power network's system architecture, it locates the specific device, system component, or communication protocol where the potential vulnerability is located. The identified vulnerabilities are classified according to their technical characteristics and impact type. Simultaneously, the location information of the vulnerabilities is marked to provide clear targets for subsequent vulnerability remediation. After classification, The vulnerability quantitative assessment module first constructs a vulnerability assessment indicator system from technical, business, and security management dimensions based on the analytic hierarchy process (AHP) and fuzzy comprehensive evaluation method. Next, it uses expert experience and historical data to determine the weight of each assessment indicator. Then, for each identified vulnerability, it scores its performance on each indicator. Through weighted calculation, it obtains a comprehensive risk score for each vulnerability and classifies it into different risk levels, providing a quantitative basis for subsequent security decisions. After assessment, the defense strategy recommendation generation module first formulates targeted defense measures recommendations based on the vulnerability type, location, and risk level, combined with the actual operation and security requirements of the power network. Then, while proposing defense measures, it analyzes the implementation cost and expected benefits of each measure. After generation, the report generation and visualization module first integrates the analysis results of vulnerability identification, classification, quantitative assessment, and defense strategy recommendations, then organizes and generates a detailed vulnerability analysis report according to a logical structure. Finally, it uses visualization methods to intuitively present the security status of the power network.

[0057] S6: Provides users with an operation interface through the user interaction module, and also supports visual display.

[0058] Compared with existing technologies:

[0059] 1. Advantages over traditional vulnerability analysis methods in terms of timeliness: Traditional vulnerability scanning tools rely on known vulnerability signature databases, making them difficult to detect new and unknown attack methods. This invention, however, through continuous virtual attack and defense simulations combined with machine learning algorithms to optimize attack and defense strategies, can simulate new attack methods and monitor the power network security status in real time. Even in the event of unprecedented attack methods, this invention can quickly identify potential threats through attack and defense confrontation, greatly improving the ability to discover new and unknown vulnerabilities, responding promptly to network security risks, and overcoming the timeliness deficiencies of traditional methods.

[0060] 2. Addressing the lack of dynamism in vulnerability analysis: Traditional static vulnerability analysis cannot simulate the dynamic changes and attack-defense interactions in power network operation, making it difficult to discover potential vulnerabilities under different operating conditions. This invention constructs a high-precision virtual model through a virtual simulation module and dynamically updates it by collecting data in real time, realistically recreating the state of the power network under various scenarios such as normal operation, faults, and load changes. Based on this, the attack-defense simulation module simulates the continuous confrontation between attackers and defenders, fully considering factors such as network topology and data traffic changes, comprehensively evaluating the security of the power network under different scenarios, fundamentally solving the problem of the lack of dynamism in traditional analysis.

[0061] 3. Addressing the difficulty in assessing the actual impact of vulnerabilities: Traditional methods can only identify the existence of vulnerabilities, but cannot quantify their impact on the overall operation of the power network after an attack. This invention utilizes a vulnerability assessment model combining the Analytic Hierarchy Process (AHP) and fuzzy comprehensive evaluation to comprehensively assess vulnerabilities from multiple dimensions, including their technical characteristics, the degree of impact on power network operation, and the likelihood of attack. Through a quantitative assessment index system, such as vulnerability exploitation difficulty and vulnerability impact coefficient, each vulnerability is comprehensively scored. This accurately illustrates the chain reactions triggered by vulnerability exploitation in power dispatching, power transmission, and other aspects, and quantifies the degree of loss, providing a scientific and accurate basis for developing targeted defense strategies. Attached Figure Description

[0062] Figure 1 This is a schematic diagram of the overall framework of the present invention;

[0063] Figure 2 This is a schematic diagram of the virtual simulation module framework of the present invention;

[0064] Figure 3 This is a schematic diagram of the attack and defense simulation module framework of the present invention;

[0065] Figure 4 This is a schematic diagram of the analysis and evaluation module framework of the present invention. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0067] This invention provides a power network vulnerability analysis system based on virtual attack and defense simulation. Please refer to [link / reference]. Figures 1-4 ,include:

[0068] The data acquisition module is responsible for collecting various types of data from the power network, including network topology data, equipment configuration data, operating status data (such as voltage, current, power, etc.), and safety log data.

[0069] The threat intelligence integration module is used to collect and integrate cybersecurity threat intelligence from around the world, including known attack groups, new attack methods, and zero-day vulnerability information. It also establishes data interfaces with threat intelligence platforms (such as AlienVault and CrowdStrike) to achieve automatic synchronization and updates of threat intelligence. In the process of power grid vulnerability analysis, the threat intelligence integration module can combine the latest threat information with the actual situation of the power grid, providing more targeted attack simulation directions for subsequent attack and defense exercises.

[0070] The virtual simulation module is used to construct a virtual simulation model of the power network based on the acquired data.

[0071] The attack and defense simulation module is used to simulate the attack behavior of attackers and the defense strategies of defenders based on a virtual simulation model. The system has a pre-built library of various common attack methods and defense methods. Attackers can choose appropriate attack paths and methods according to the state of the virtual network. Defenders can formulate corresponding defense measures based on the attack situation. Through continuous attack and defense confrontation, potential vulnerabilities in the power network can be discovered.

[0072] The analysis and evaluation module is used to analyze and process the data generated during the attack and defense simulation, and to assess the severity, scope of impact, and potential for exploitation of vulnerabilities.

[0073] The user interaction module provides an interface for users to configure system parameters, start and stop attack and defense simulations, and view vulnerability analysis reports. It also supports visualization, presenting information such as power network topology, attack and defense processes, and vulnerability distribution to users in an intuitive graphical format.

[0074] The virtual simulation module includes:

[0075] The data receiving and verification module is used to verify the integrity and accuracy of various types of data received from the power network; for network topology data, it checks whether there are any missing or contradictory connections between equipment nodes; for equipment configuration data, it verifies whether the parameter settings meet the specifications; for operating status data, it uses statistical analysis to determine whether there are any abnormal fluctuations; if data problems are found, it promptly feeds back to the data acquisition module for re-acquisition or correction to ensure that the data used for simulation is real and reliable.

[0076] The data parsing and feature extraction module is used to perform targeted parsing based on data types. For example, it can parse key feature parameters such as voltage, current, and power from power equipment operating status data; extract physical connections and communication links between devices from network topology data; and then use data mining techniques to perform in-depth processing on the parsed data to extract feature information that reflects the operating rules and characteristics of the power network, providing effective data support for subsequent model construction.

[0077] The virtual model building module is used to first model the devices, then build the network topology, and finally model the interaction relationships.

[0078] The specific steps of the virtual model construction module are as follows:

[0079] Step 1, Equipment Modeling: Based on the physical characteristics and functions of power network equipment, a combination of 3D modeling and logical modeling is used to model each device. For example, for transformers, not only is an external structural model built, but also a logical model reflecting electrical characteristics such as voltage transformation and power loss is established. For smart meters, a logical model including data acquisition and communication transmission functions is built to achieve accurate simulation of the equipment's operating status.

[0080] Step 2, Network Topology Construction: Based on the extracted network topology feature information, a power network topology is built in a virtual environment; the various device models are combined according to the actual connection relationship to construct a complete power network topology, ensuring that the virtual network topology is consistent with the actual network in structure and can accurately reflect the data and power transmission paths in the power network;

[0081] Step 3, Interaction Relationship Modeling: Establish an interaction relationship model between devices to simulate the data communication and power transmission processes between devices; for power transmission, based on circuit principles and power system operation rules, set the power flow mode and power distribution in the network; for data communication, simulate the data interaction process between devices under different communication protocols to achieve a comprehensive simulation of the physical processes and information interaction processes in the operation of the power network.

[0082] The model parameter initialization and calibration module is used to initialize and calibrate the parameters of the constructed model. First, it assigns initial values ​​to the equipment and network parameters in the model based on the equipment's technical specifications and historical operating data. Then, it compares and analyzes the simulation results of the virtual model with the operating data of the actual power network. By adjusting the model parameters, it makes the operating output of the virtual model as close as possible to the actual situation, completes the model calibration, and ensures the accuracy of the model.

[0083] The operational scenario simulation is used to first simulate normal operation scenarios, then simulate fault scenarios, and finally simulate load change scenarios.

[0084] The specific steps for simulating the running scenario are as follows:

[0085] Step 1, Normal Operation Scenario Simulation: After completing the model calibration, the normal operation scenario of the power network is simulated first. According to the daily operation rules of the power network, the normal operation parameters and load levels of the equipment are set, the virtual model is driven to run, and the equipment operation status, power flow distribution, and data transmission of the power network under normal conditions are observed to provide benchmark data for subsequent analysis.

[0086] Step 2, Fault Scenario Simulation: Based on common fault types in power networks, such as line short circuits and equipment failures, set corresponding fault points and fault parameters in the virtual model to simulate the changes in the operating state of the power network when a fault occurs; analyze the redistribution of power flow, abnormal responses of equipment, and actions of protection devices after the fault occurs, in order to study the scope and extent of the fault's impact on the power network.

[0087] Step 3, load change scenario simulation: Simulate the operating status of the power network under different load levels. By adjusting the load parameters, gradually changing from low load to high load, observe the changes in the carrying capacity, voltage stability, and power loss indicators of the power network equipment, and provide data support for evaluating the safety and reliability of the power network under different operating conditions.

[0088] The attack and defense simulation module includes:

[0089] The simulation environment initialization module is used to initialize and configure the simulation environment after the virtual power network model is built in the virtual simulation module. First, it selects basic attack strategies and defense strategy templates suitable for the characteristics of the current power network model from the attack method library and defense method library. At the same time, according to the actual security requirements and risk level of the power network, it sets the rules and constraints for attack and defense simulation, such as the upper limit of attack intensity and the limit of defense resources, to ensure that the simulation process is both realistic and within a controllable range.

[0090] The attack strategy generation module is used to first generate the attack strategy automatically, and then assist with manual customization.

[0091] The specific steps of the attack strategy generation module are as follows:

[0092] Step 1, Automated Generation: Utilize machine learning algorithms to analyze historical attack data and current power grid virtual model status data; through deep learning models, such as recurrent neural networks (RNNs) or generative adversarial networks (GANs), learn the correlation between attack patterns and network vulnerabilities, and automatically generate attack strategies for the current network environment;

[0093] Step 2, Manual Customization Assistance: Supports security experts to manually adjust or customize attack strategies based on their experience and in-depth understanding of power networks; experts can supplement or modify attack methods, attack order, etc. on the basis of automatically generated strategies for specific business scenarios or new attack trends, so that the attack strategies are more in line with the actual threats that may be faced.

[0094] The defense strategy formulation module is used to first perform dynamic response, and then optimize the strategy.

[0095] The specific steps of the defense strategy formulation module are as follows:

[0096] Step 1, Dynamic Response: Based on the characteristics of the attack strategy and the real-time status of the power network, a dynamic defense response is automatically generated; for example, when an attack is detected attempting to intrude into the power dispatching system, defense measures such as isolating key areas, enhancing identity authentication, and encrypting communication are automatically initiated; using intelligent decision-making algorithms, the allocation of defense resources is dynamically adjusted according to the intensity and direction of the attack, prioritizing the protection of key nodes and core services in the power network.

[0097] Step 2, Strategy Optimization: Through reinforcement learning algorithms, the defense strategy is self-optimized in continuous attack and defense confrontations; after each attack and defense simulation, the parameters and execution order of the defense strategy are adjusted according to the defense effect evaluation results, so that subsequent defense strategies can more effectively resist similar attacks and gradually improve the accuracy and effectiveness of the defense.

[0098] The attack and defense confrontation execution module is used to initiate the attack and defense confrontation process in the virtual power network model according to the generated attack strategy and the established defense strategy. Attackers simulate attack operations on power network equipment, communication links and business systems according to attack paths and methods. Defenders intercept, respond to and counterattack the attacks in real time according to the defense strategy. During the confrontation process, each attack attempt, defense action and change in power network status are recorded strictly according to the preset simulation rules.

[0099] The data recording and analysis module is used to first collect data and then perform in-depth analysis.

[0100] The specific steps of the data recording and analysis module are as follows:

[0101] Step 1, Data Acquisition: During the attack and defense confrontation, real-time data is collected on attack process (such as attack initiation time, attack type, attack target, etc.), defense process (such as defense measure execution time, defense effect, etc.), and power network status change data (such as equipment operating parameter fluctuations, network topology changes, etc.); then the data is processed in a structured manner.

[0102] Step Two, In-depth Analysis: Using data analysis techniques, the collected data is deeply mined; by comparing the differences in the power network status before and after the attack, and combining with vulnerability assessment models, potential vulnerabilities exposed in the power network by the attack are identified; the reasons for the success or failure of the attack are analyzed, the effectiveness of the defense strategy is evaluated, and a basis is provided for optimizing the attack method library, the defense method library, and improving the attack and defense strategy.

[0103] The analysis and evaluation module includes:

[0104] The preprocessing module is used to preprocess the data from the attack and defense simulation module. First, it uses a data cleaning algorithm to remove abnormal data caused by system errors or random factors during the simulation process, such as incorrect attack time recordings or instantaneous fluctuations in network status. Then, it performs format unification and standardization processing on the data, converting different types of raw data (such as text-based attack type descriptions and numerical device operating parameters) into a structured data format suitable for subsequent analysis, laying the foundation for vulnerability analysis.

[0105] The Attack Path Reconstruction and Impact Analysis module first utilizes graph databases and path analysis algorithms to reconstruct the attacker's attack path in the virtual power network based on preprocessed data. Starting from the initial node of the attack, it traces the attacker's movement trajectory in the network step by step based on recorded attack attempts and successful intrusion events, identifying the complete path from the external network into the power network, breaching various defense layers, and finally reaching the target device or system. Next, it analyzes the chain reactions caused by the attack on each node along the attack path, assessing the scope of the attack's impact on different functional modules and business systems of the power network. For example, when an attacker intrudes into a substation automation system, it analyzes the impact on functions such as power dispatching, equipment control, and data acquisition, determining the affected area and the number of devices. Finally, combining the power network's business processes and topology, it establishes an impact propagation model to predict the possible direction and extent of the attack's spread.

[0106] The vulnerability identification and classification module first analyzes the behavioral data of the power network during an attack using machine learning anomaly detection algorithms to identify abnormal behaviors that deviate from normal operating modes. Then, combining the anomaly detection results with knowledge of the power network's system architecture, it locates the specific device, system component, or communication protocol where the potential vulnerability resides. Based on the vulnerability's technical characteristics and impact type, the identified vulnerabilities are classified, such as network protocol vulnerabilities, application vulnerabilities, and configuration misconfiguration vulnerabilities. Simultaneously, it labels the vulnerability's location information, such as the device's IP address, physical location, and subnet, providing a clear target for subsequent vulnerability remediation.

[0107] The vulnerability quantitative assessment module first constructs a vulnerability assessment indicator system from technical, business, and security management dimensions based on the analytic hierarchy process (AHP) and fuzzy comprehensive evaluation method. The technical dimension includes vulnerability exploitability, attack complexity, and required privileges; the business dimension includes the business importance affected by the vulnerability, data sensitivity, and service interruption duration; and the security management dimension includes vulnerability detectability, remediation difficulty, and remediation cost. Next, expert experience and historical data are used to determine the weight of each assessment indicator. Then, for each identified vulnerability, a score is assigned based on its performance on each indicator. Through weighted calculation, a comprehensive risk score is obtained for each vulnerability, and vulnerabilities are classified into different risk levels, such as high risk, medium risk, and low risk, providing a quantitative basis for subsequent security decisions.

[0108] The defense strategy recommendation generation module is used to first formulate targeted defense measures based on the type, location, and risk level of vulnerabilities, combined with the actual operation and security requirements of the power network. For high-risk vulnerabilities, it recommends emergency measures such as immediate remediation, isolation of affected equipment, and enhanced monitoring. For medium- and low-risk vulnerabilities, it proposes long-term improvement suggestions such as optimized configuration, enhanced security training, and regular inspections. Next, while proposing defense measures, it analyzes the implementation cost and expected benefits of each measure. It considers the human, material, and time costs required to remediate vulnerabilities, as well as the potential impact on business interruption, and assesses the degree of improvement in power network security after implementing defense measures, providing users with cost-effective defense strategy options.

[0109] The report generation and visualization module first integrates the analysis results of vulnerability identification, classification, quantitative assessment, and defense strategy recommendations, and then organizes and generates a detailed vulnerability analysis report according to a logical structure. The report content includes an overview of the power network security status, a list of discovered vulnerabilities, a detailed description of each vulnerability and risk assessment results, defense strategy recommendations for different vulnerabilities, and an overall security improvement plan. Finally, visualization methods are used to intuitively present the security status of the power network.

[0110] A method for analyzing power network vulnerabilities based on virtual attack and defense simulations includes the following specific steps:

[0111] S1: Responsible for collecting various types of data from the power network through the data acquisition module;

[0112] S2: The threat intelligence integration module collects and integrates cybersecurity threat intelligence from around the world and establishes a data interface with the threat intelligence platform to achieve automatic synchronization and updates of threat intelligence. In the process of power network vulnerability analysis, the threat intelligence integration module can combine the latest threat information with the actual situation of the power network to provide more targeted attack simulation directions for subsequent attack and defense simulations.

[0113] S3: After receiving various types of data from the power network, the data receiving and verification module verifies the integrity and accuracy of the data. If data problems are found, they are promptly fed back to the data acquisition module for re-acquisition or correction to ensure the data used for simulation is authentic and reliable. After verification, the data parsing and feature extraction module performs targeted parsing based on the data type. Then, data mining techniques are used to perform in-depth processing on the parsed data to extract feature information that reflects the operating rules and characteristics of the power network, providing effective data support for subsequent model construction. After extraction, the virtual model construction module first models the equipment, and then performs network topology. The process begins with building the model, including creating interactive relationship models. After construction, the model parameter initialization and calibration module initializes and calibrates the parameters. First, initial values ​​are assigned to the equipment and network parameters in the model based on the equipment's technical specifications and historical operating data. Then, the simulation results of the virtual model are compared and analyzed with the actual power network operating data. By adjusting the model parameters, the operating output of the virtual model is made as close to the actual situation as possible, completing model calibration and ensuring the model's accuracy. After calibration, the model is simulated in operating scenarios, first for normal operation, then for fault scenarios, and finally for load change scenarios.

[0114] S4: After the virtual power network model is built in the virtual simulation module, the simulation environment initialization module can initialize and configure the simulation environment. First, it selects basic attack and defense strategy templates suitable for the characteristics of the current power network model from the attack method and defense method libraries. Simultaneously, based on the actual security needs and risk levels of the power network, it sets rules and constraints for the attack and defense simulation to ensure the simulation process is both realistic and within a controllable range. After initialization, the attack strategy generation module generates attack strategies, followed by the defense strategy formulation module. Then, the attack and defense confrontation execution module initiates the attack and defense confrontation process in the virtual power network model according to the generated attack and defense strategies. Attackers simulate attack operations on power network equipment, communication links, and business systems according to attack paths and methods. Defenders intercept, respond to, and counterattack attacks in real time according to the defense strategy. During the confrontation, each attack attempt, defense action, and change in the power network state is recorded strictly according to the preset simulation rules. After the confrontation, the data recording and analysis module first collects data and then performs in-depth analysis.

[0115] S5: The preprocessing module preprocesses the data from the attack and defense simulation module. After processing, the attack path reconstruction and impact analysis module first uses graph databases and path analysis algorithms to reconstruct the attacker's attack path in the virtual power network based on the preprocessed data. Then, it analyzes the chain reactions caused by the attack on each node along the attack path, assessing the impact range of the attack on different functional modules and business systems of the power network. Next, combining the business processes and topology of the power network, it establishes an impact propagation model to predict the possible direction and extent of the attack's spread. Then, the vulnerability identification and classification module first analyzes the behavioral data of the power network during the attack process using machine learning anomaly detection algorithms to identify abnormal behaviors inconsistent with normal operation. Then, combining the anomaly detection results and knowledge of the power network's system architecture, it locates the specific device, system component, or communication protocol where the potential vulnerability is located. The identified vulnerabilities are classified according to their technical characteristics and impact type. Simultaneously, the location information of the vulnerabilities is marked to provide clear targets for subsequent vulnerability remediation. After classification, The vulnerability quantitative assessment module first constructs a vulnerability assessment indicator system from technical, business, and security management dimensions based on the analytic hierarchy process (AHP) and fuzzy comprehensive evaluation method. Next, it uses expert experience and historical data to determine the weight of each assessment indicator. Then, for each identified vulnerability, it scores its performance on each indicator. Through weighted calculation, it obtains a comprehensive risk score for each vulnerability and classifies it into different risk levels, providing a quantitative basis for subsequent security decisions. After assessment, the defense strategy recommendation generation module first formulates targeted defense measures recommendations based on the vulnerability type, location, and risk level, combined with the actual operation and security requirements of the power network. Then, while proposing defense measures, it analyzes the implementation cost and expected benefits of each measure. After generation, the report generation and visualization module first integrates the analysis results of vulnerability identification, classification, quantitative assessment, and defense strategy recommendations, then organizes and generates a detailed vulnerability analysis report according to a logical structure. Finally, it uses visualization methods to intuitively present the security status of the power network.

[0116] S6: Provides users with an operation interface through the user interaction module, and also supports visual display.

[0117] Although the present invention has been described above with reference to embodiments, various modifications can be made and components can be replaced with equivalents without departing from the scope of the invention. In particular, as long as there is no structural conflict, the features in the disclosed embodiments can be combined with each other in any manner. The lack of an exhaustive description of these combinations in this specification is merely for the sake of brevity and resource conservation. Therefore, the present invention is not limited to the specific embodiments disclosed herein, but includes all technical solutions falling within the scope of the claims.

Claims

1. A power network vulnerability analysis system based on virtual attack and defense simulation, characterized in that, include: The data acquisition module is responsible for collecting various types of data from the power network, including network topology data, equipment configuration data, operating status data, and security log data. The threat intelligence integration module is used to collect and integrate cybersecurity threat intelligence from around the world, and establish a data interface with the threat intelligence platform to achieve automatic synchronization and updates of threat intelligence. In the process of power network vulnerability analysis, the threat intelligence integration module can combine the latest threat information with the actual situation of the power network, providing more targeted attack simulation directions for subsequent attack and defense simulations. The virtual simulation module is used to construct a virtual simulation model of the power network based on the acquired data. The attack and defense simulation module is used to simulate the attacker's attack behavior and the defender's defense strategy based on a virtual simulation model. The analysis and evaluation module is used to analyze and process the data generated during the attack and defense simulation, and to assess the severity, scope of impact, and potential for exploitation of vulnerabilities. The user interaction module provides users with an interface and also supports visual displays. The analysis and evaluation module includes: The preprocessing module is used to preprocess the data from the attack and defense simulation module. First, it uses a data cleaning algorithm to remove abnormal data caused by system errors or random factors during the simulation process. Then, it performs format unification and standardization processing on the data, converting different types of raw data into a structured data format suitable for subsequent analysis, laying the foundation for vulnerability analysis. The attack path reconstruction and impact analysis module is used to first reconstruct the attacker's attack path in the virtual power network based on preprocessed data using graph databases and path analysis algorithms; then, it analyzes the chain reaction caused by the attack on each node on the attack path and assesses the scope of the attack's impact on different functional modules and business systems of the power network; finally, it establishes an impact propagation model by combining the business processes and topology of the power network to predict the possible direction and extent of the attack's spread. The vulnerability identification and classification module first analyzes the behavioral data of the power network during the attack process based on machine learning anomaly detection algorithms to identify abnormal behaviors that do not conform to the normal operation mode; then, combining the abnormal behavior detection results with the system architecture knowledge of the power network, it locates the specific device, system component or communication protocol where the potential vulnerability is located; and classifies the identified vulnerabilities according to their technical characteristics and impact type; at the same time, it marks the location information of the vulnerabilities to provide clear targets for subsequent vulnerability remediation. The vulnerability quantitative assessment module first constructs a vulnerability assessment indicator system from technical, business, and security management dimensions based on the analytic hierarchy process (AHP) and fuzzy comprehensive evaluation method. Then, it uses expert experience and historical data to determine the weight of each assessment indicator. Next, for each identified vulnerability, it scores it based on its performance on each indicator. Through weighted calculation, it obtains a comprehensive risk score for each vulnerability and classifies the vulnerabilities into different risk levels, providing a quantitative basis for subsequent security decisions. The defense strategy recommendation generation module is used to first formulate targeted defense measures recommendations based on the type, location, and risk level of the vulnerability, combined with the actual operation and security requirements of the power network; then, while proposing defense measures, it analyzes the implementation cost and expected benefits of each measure. The report generation and visualization module first integrates the analysis results of vulnerability identification, classification, quantitative assessment, and defense strategy recommendations, then organizes and generates a detailed vulnerability analysis report according to a logical structure; finally, it uses visualization methods to intuitively present the security status of the power network.

2. The power network vulnerability analysis system based on virtual attack and defense simulation according to claim 1, characterized in that, The virtual simulation module includes: The data receiving and verification module is used to verify the integrity and accuracy of various types of data received from the power network. If data problems are found, they are promptly fed back to the data acquisition module for re-acquisition or correction to ensure that the data used for simulation is real and reliable. The data parsing and feature extraction module is used to perform targeted parsing based on data type; then, data mining technology is used to perform in-depth processing on the parsed data to extract feature information that can reflect the operating rules and characteristics of the power network, providing effective data support for subsequent model construction; The virtual model building module is used to first model the devices, then build the network topology, and finally model the interaction relationships. The model parameter initialization and calibration module is used to initialize and calibrate the parameters of the constructed model. First, based on the equipment's technical specifications and historical operating data, initial values ​​are assigned to the equipment and network parameters in the model. Then, the simulation results of the virtual model are compared and analyzed with the operating data of the actual power network. By adjusting the model parameters, the operating output of the virtual model is made as close as possible to the actual situation, thus completing the model calibration and ensuring the accuracy of the model. The operational scenario simulation is used to first simulate normal operation scenarios, then fault scenarios, and finally load change scenarios.

3. The power network vulnerability analysis system based on virtual attack and defense simulation according to claim 2, characterized in that, The specific steps of the virtual model construction module are as follows: Step 1, Equipment Modeling: Based on the physical characteristics and functions of power network equipment, each device is modeled using a combination of 3D modeling and logical modeling. Step 2, Network Topology Construction: Based on the extracted network topology feature information, a power network topology is built in a virtual environment; the various device models are combined according to the actual connection relationship to construct a complete power network topology, ensuring that the virtual network topology is consistent with the actual network in structure and can accurately reflect the data and power transmission paths in the power network; Step 3, Interaction Relationship Modeling: Establish an interaction relationship model between devices to simulate the data communication and power transmission processes between devices.

4. The power network vulnerability analysis system based on virtual attack and defense simulation according to claim 2, characterized in that, The specific steps for simulating the running scenario are as follows: Step 1, Normal Operation Scenario Simulation: After completing the model calibration, the normal operation scenario of the power network is simulated first. According to the daily operation rules of the power network, the normal operation parameters and load levels of the equipment are set, the virtual model is driven to run, and the equipment operation status, power flow distribution, and data transmission of the power network under normal conditions are observed to provide benchmark data for subsequent analysis. Step 2, Fault Scenario Simulation: Based on common fault types in power networks, set corresponding fault points and fault parameters in the virtual model to simulate the changes in the operating state of the power network when a fault occurs; The analysis focuses on the redistribution of power flow, abnormal responses of equipment, and operation of protection devices after a fault occurs, in order to study the scope and extent of the fault's impact on the power network. Step 3, load change scenario simulation: Simulate the operating status of the power network under different load levels. By adjusting the load parameters, gradually changing from low load to high load, observe the changes in the carrying capacity, voltage stability, and power loss indicators of the power network equipment, and provide data support for evaluating the safety and reliability of the power network under different operating conditions.

5. A power network vulnerability analysis system based on virtual attack and defense simulation as described in claim 1, characterized in that, The attack and defense simulation module includes: The simulation environment initialization module is used to initialize and configure the simulation environment after the virtual power network model is built in the virtual simulation module. First, it selects basic attack strategies and defense strategy templates suitable for the characteristics of the current power network model from the attack method library and defense method library. At the same time, it sets the rules and constraints of attack and defense simulation according to the actual security requirements and risk level of the power network to ensure that the simulation process is both realistic and within a controllable range. The attack strategy generation module is used to first generate the attack strategy automatically, and then assist with manual customization. The defense strategy formulation module is used to first perform dynamic response, and then optimize the strategy. The attack and defense confrontation execution module is used to initiate the attack and defense confrontation process in the virtual power network model according to the generated attack strategy and the established defense strategy. Attackers simulate attack operations on power network equipment, communication links and business systems according to attack paths and methods. Defenders intercept, respond to and counterattack the attacks in real time according to the defense strategy. During the confrontation process, each attack attempt, defense action and change in power network status are recorded strictly according to the preset simulation rules. The data recording and analysis module is used to first collect data and then perform in-depth analysis.

6. A power network vulnerability analysis system based on virtual attack and defense simulation as described in claim 5, characterized in that, The specific steps of the attack strategy generation module are as follows: Step 1, Automated Generation: Utilize machine learning algorithms to analyze historical attack data and current power network virtual model status data; through deep learning models, learn the correlation between attack patterns and network vulnerabilities, and automatically generate attack strategies for the current network environment; Step 2, Manual Customization Assistance: Supports security experts to manually adjust or customize attack strategies based on their experience and in-depth understanding of power grids.

7. A power network vulnerability analysis system based on virtual attack and defense simulation as described in claim 5, characterized in that, The specific steps of the defense strategy formulation module are as follows: Step 1, Dynamic Response: Based on the characteristics of the attack strategy and the real-time status of the power network, automatically generate dynamic defense responses; Step 2, Strategy Optimization: Through reinforcement learning algorithms, the defense strategy is self-optimized in continuous attack and defense confrontations; after each attack and defense simulation, the parameters and execution order of the defense strategy are adjusted according to the defense effect evaluation results, so that subsequent defense strategies can more effectively resist similar attacks, and gradually improve the accuracy and effectiveness of the defense.

8. A power network vulnerability analysis system based on virtual attack and defense simulation as described in claim 5, characterized in that, The specific steps of the data recording and analysis module are as follows: Step 1, Data Acquisition: During the offensive and defensive confrontation, real-time data on the attack process, defense process, and power network status changes are collected; then, the data is processed in a structured manner. Step Two, In-depth Analysis: Using data analysis techniques, the collected data is deeply mined; by comparing the differences in the power network status before and after the attack, and combining with vulnerability assessment models, potential vulnerabilities exposed in the power network by the attack are identified; the reasons for the success or failure of the attack are analyzed, the effectiveness of the defense strategy is evaluated, and a basis is provided for optimizing the attack method library, the defense method library, and improving the attack and defense strategy.

9. A method for analyzing power network vulnerabilities based on virtual attack and defense simulation, characterized in that, The specific steps are as follows: S1: Responsible for collecting various types of data from the power network through the data acquisition module; S2: The threat intelligence integration module collects and integrates cybersecurity threat intelligence from around the world and establishes a data interface with the threat intelligence platform to achieve automatic synchronization and updates of threat intelligence. In the process of power network vulnerability analysis, the threat intelligence integration module can combine the latest threat information with the actual situation of the power network to provide more targeted attack simulation directions for subsequent attack and defense simulations. S3: After receiving various types of data from the power network, the data receiving and verification module can verify the integrity and accuracy of the data; If data issues are discovered, they are promptly reported to the data acquisition module for re-acquisition or correction to ensure the data used for simulation is authentic and reliable. After verification, the data parsing and feature extraction module performs targeted analysis based on the data type. Then, data mining techniques are used to deeply process the parsed data, extracting feature information that reflects the operating rules and characteristics of the power network, providing effective data support for subsequent model construction. After extraction, the virtual model construction module first models the equipment, then the network topology, and finally the interaction relationships. After construction, the model parameter initialization and calibration module initializes and calibrates the parameters of the constructed model. First, initial values ​​are assigned to the equipment and network parameters in the model based on the equipment's technical specifications and historical operating data. Then, the simulation results of the virtual model are compared and analyzed with the actual power network operating data. By adjusting the model parameters, the operating output of the virtual model is made as close to the actual situation as possible, completing model calibration and ensuring the accuracy of the model. After calibration, the operating scenario simulation is performed first for normal operation, then for fault scenarios, and finally for load change scenarios. S4: After the virtual power network model is built in the virtual simulation module, the simulation environment initialization module can initialize and configure the simulation environment. First, it selects basic attack and defense strategy templates suitable for the characteristics of the current power network model from the attack method and defense method libraries. Simultaneously, based on the actual security requirements and risk level of the power network, it sets the rules and constraints for the attack and defense simulation to ensure that the simulation process is both realistic and within a controllable range. After initialization, the attack strategy generation module generates attack strategies, and the defense strategy formulation module generates defense strategies. Then, the attack and defense confrontation execution module initiates the attack and defense confrontation process in the virtual power network model according to the generated attack strategies and the formulated defense strategies. Attackers simulate attack operations on power network equipment, communication links, and business systems according to attack paths and methods; defenders intercept, respond to, and counterattack the attacks in real time according to the defense strategies. During the confrontation, every attack attempt, defensive action, and change in the power network status is recorded strictly according to the preset simulation rules; after the confrontation, the data is collected through the data recording and analysis module, followed by in-depth analysis. S5: The preprocessing module preprocesses the data from the attack and defense simulation module. After processing, the attack path reconstruction and impact analysis module first uses graph databases and path analysis algorithms to reconstruct the attacker's attack path in the virtual power network based on the preprocessed data. Then, it analyzes the chain reactions caused by the attack on each node along the attack path, assessing the impact range of the attack on different functional modules and business systems of the power network. Next, combining the business processes and topology of the power network, it establishes an impact propagation model to predict the possible direction and extent of the attack's spread. Then, the vulnerability identification and classification module first analyzes the behavioral data of the power network during the attack process using machine learning anomaly detection algorithms to identify abnormal behaviors inconsistent with normal operation. Then, combining the anomaly detection results and knowledge of the power network's system architecture, it locates the specific device, system component, or communication protocol where the potential vulnerability is located. The identified vulnerabilities are classified according to their technical characteristics and impact type. Simultaneously, the location information of the vulnerabilities is marked to provide clear targets for subsequent vulnerability remediation. After classification, The vulnerability quantitative assessment module first constructs a vulnerability assessment indicator system from technical, business, and security management dimensions based on the analytic hierarchy process (AHP) and fuzzy comprehensive evaluation method. Next, it uses expert experience and historical data to determine the weight of each assessment indicator. Then, for each identified vulnerability, it scores its performance on each indicator. Through weighted calculation, it obtains a comprehensive risk score for each vulnerability and classifies it into different risk levels, providing a quantitative basis for subsequent security decisions. After assessment, the defense strategy recommendation generation module first formulates targeted defense measures recommendations based on the vulnerability type, location, and risk level, combined with the actual operation and security requirements of the power network. Then, while proposing defense measures, it analyzes the implementation cost and expected benefits of each measure. After generation, the report generation and visualization module first integrates the analysis results of vulnerability identification, classification, quantitative assessment, and defense strategy recommendations, then organizes and generates a detailed vulnerability analysis report according to a logical structure. Finally, it uses visualization methods to intuitively present the security status of the power network. S6: Provides users with an operation interface through the user interaction module, and also supports visual display.

Images