Power grid similar attack behavior modeling and detection analysis system
By building a power grid similar attack detection system with multi-source data acquisition and four-dimensional attack behavior maps, the problem of difficulty in identifying new variant attacks in existing technologies has been solved, and efficient and accurate identification and rapid response to power grid attacks have been achieved, thereby improving the active defense capabilities and adaptability of the power grid.
Patent Information
- Application Number
- CN202510995018.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-18
- Publication Date
- 2025-10-21
AI Technical Summary
Existing detection systems lack the ability to dynamically model the similarities of attack behaviors, making it difficult to identify new variant attacks, leading to increased threats to power grid security.
Build a closed-loop system of multi-source data acquisition, attack behavior modeling, real-time data collection, dynamic knowledge base and defense execution, perform real-time similarity matching through four-dimensional attack behavior graph and graph neural network, generate defense strategies and optimize the knowledge base.
It achieves efficient and accurate identification and rapid response to power grid attacks, improves the active defense capability of the power grid and the adaptability of the system, reduces false alarms and missed alarms, and ensures the long-term safe and stable operation of the power grid.
Smart Images
Figure CN120825319A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of power grid technology, and in particular to a system for modeling, detecting and analyzing similar attack behaviors in power grids. Background Art
[0002] The current state of power grid companies has inevitably led to an increasing reliance on information network systems for office work. This is driven by the growing size of intranets, coupled with the development of a variety of subnetworks of varying sizes, tailored to specific tasks. Furthermore, the grid system inevitably intersects more and more with the internet. The security of power grid information networks can be threatened by natural disasters, structural vulnerabilities, human error, technological deficiencies, and malicious activity. Information system failures caused by cyber intrusion attacks not only damage information systems but also threaten physical systems, disrupting the smooth operation of the power grid. In particular, various cyber intrusion attacks targeting power systems pose a severe threat to power infrastructure, which exhibits the characteristics of cyber-physical convergence. Existing detection systems lack the ability to dynamically model attack behavior similarities, making it difficult to identify new attack variants. Summary of the Invention
[0003] Purpose of the invention: The purpose of the present invention is to provide a power grid similar attack behavior modeling and detection analysis system; it can solve the problem that existing detection systems lack the ability to dynamically model the similarity of attack behaviors and have difficulty identifying new variant attacks.
[0004] Technical Solution: To solve the above technical problems, according to one aspect of the present invention, more specifically, a system for modeling and detecting similar attack behaviors in power grids, the system specifically includes the following steps:
[0005] S1. A multi-source data acquisition and processing module acquires first historical data of power grid attacks, and pre-processes the first historical data of power grid attacks to obtain second historical data of power grid attacks;
[0006] S2, the attack behavior modeling module performs behavior atomization decomposition on the second historical data of power grid attacks to obtain the third historical data of power grid attacks, and constructs a four-dimensional attack behavior map based on the third historical data of power grid attacks;
[0007] S3, the real-time data collection module collects real-time data and extracts real-time behavior features. The attack behavior modeling module performs attack similarity matching calculation based on the processed real-time behavior features.
[0008] S4. The dynamic knowledge base module triggers a response based on the similarity and generates a corresponding defense strategy. The defense execution module executes the generated defense strategy. The tracking and statistics module collects statistics on the execution results of the defense strategy. The storage management module stores the execution results.
[0009] S5. The analysis and processing module issues corresponding instructions to optimize the grid similarity matching calculation based on the attack data recorded by the tracking and statistics module and the response triggered by the dynamic knowledge base module;
[0010] S6. The analysis and processing module triggers an instruction to upgrade the dynamic knowledge base based on the execution results collected by the tracking and statistics module and the historical execution results stored by the storage management module. The warning and reminder module issues a warning and reminder based on the dynamic knowledge base upgrade.
[0011] Furthermore, the step S1 specifically includes the following steps:
[0012] S11, a multi-source data acquisition module acquires first historical data of power grid attacks including system logs, network traffic mirrors, network device status data, and security device alarms;
[0013] S12: performing preprocessing including time sequence alignment, anomaly cleaning, and protocol analysis on the first historical data of power grid attacks to obtain second historical data of power grid attacks.
[0014] Furthermore, the step S2 specifically includes the following steps:
[0015] S21, the attack behavior modeling module decomposes the second historical data of the power grid attack into the third historical data of the power grid attack including reconnaissance behavior, infiltration behavior, lateral impact, and physical impact;
[0016] S22. Construct a four-dimensional attack behavior map covering time dimension, space dimension, behavior dimension, and impact dimension based on the third historical data of power grid attacks.
[0017] Furthermore, in step S3, when performing attack similarity matching calculation, the dynamic and static features of the real-time data are extracted, the temporal offset of the behavior sequence is aligned, and the graph similarity is quantified based on the graph neural network to perform attack similarity matching calculation:
[0018]
[0019] in, is the attack similarity, is the temporal similarity, is the graph structure similarity, It is a quantitative value of the actual impact of the attack behavior on the physical operation status of the power grid. 、 、 The weight coefficient satisfies + + =1.
[0020] Furthermore, in step S4, when the attack similarity is greater than the attack similarity threshold, it is determined to be a high-similarity attack, and the dynamic knowledge base module generates a corresponding defense strategy based on the result of the four-dimensional attack behavior graph matching. Otherwise, no defense strategy is generated.
[0021] Furthermore, in step S5, when performing similarity matching calculation optimization, if the power grid attack is successfully blocked, the , and According to and The value is reduced proportionally Increase; if a false alarm of a power grid attack occurs, decrease , and According to and The value increases proportionally If the power grid attack is missed, the , and According to and The value is reduced proportionally The increase of 、 、 Value range, combined with the set value range 、 、 The new value is determined.
[0022] Furthermore, in step S6, the analysis and processing module obtains the number of times the generated defense strategy effectively defends against attacks, the number of times the generated defense strategy fails to defend against attacks, and the effectiveness of the defense strategy in resisting attacks each time the defense strategy effectively defends against attacks, and analyzes and processes the above data to obtain an evaluation index of the current dynamic knowledge base:
[0023]
[0024] in, is the evaluation index of the current dynamic knowledge base, To generate the number of attacks that the defense strategy effectively defends, To generate the number of times the defense strategy fails to defend against attacks, The effectiveness of each effective defense strategy against attacks, The benchmark efficiency is set.
[0025] Furthermore, in step S6, if the evaluation index of the current dynamic knowledge base is greater than the threshold of the evaluation index of the current dynamic knowledge base, the current dynamic knowledge base will continue to be used; otherwise, the instruction to upgrade the dynamic knowledge base will be triggered, and a warning reminder will be issued for the dynamic knowledge base upgrade.
[0026] Beneficial effects:
[0027] 1. The multi-source data acquisition and processing module collects various types of historical data on power grid attacks, such as system logs and network traffic mirrors, and performs pre-processing such as time alignment, anomaly cleaning, and protocol analysis. It can comprehensively integrate scattered attack-related information, remove redundant and erroneous data, and provide a high-quality data foundation for subsequent modeling and analysis, thereby improving the accuracy and reliability of attack behavior analysis and laying a data foundation for accurate identification of attack behavior.
[0028] 2. The attack behavior modeling module breaks down preprocessed historical data into atomic behaviors like reconnaissance and infiltration, and constructs a four-dimensional attack behavior map encompassing time, space, behavior, and impact. This atomic decomposition and multi-dimensional map construction deeply analyzes the nature and characteristics of attack behavior, clearly presenting the attack's development process, scope, specific actions, and impact. This provides a structured, multi-dimensional reference for subsequent similarity matching, helping to more accurately identify similar attacks.
[0029] 3. The real-time data acquisition module promptly acquires real-time data and extracts features. The attack behavior modeling module combines these real-time features to perform attack similarity matching calculations, taking into account factors such as timing, graph structure, and the degree of physical impact. This process enables dynamic monitoring and rapid comparison of real-time attack behaviors on the power grid, enabling the timely identification of potential similar attacks, improving the timeliness and sensitivity of attack detection, and enabling the early implementation of defensive measures.
[0030] 4. The dynamic knowledge base module generates defense strategies based on similarity results. The defense execution module rapidly executes these strategies, while the tracking, statistics, and storage management modules record and store the results. This closed-loop process ensures a rapid response and effective defense measures when highly similar attacks are detected. It also comprehensively records the defense process and results, providing practical data support for subsequent strategy optimization and knowledge base upgrades, enhancing the grid's proactive defense capabilities.
[0031] 5. The analysis and processing module optimizes similarity matching calculations based on attack data and response conditions. By adjusting weight coefficients, the matching algorithm can dynamically adjust to the actual defense effectiveness, reducing false positives and missed negatives. For example, when an attack is successfully blocked, the weight of graph structure similarity is increased, while when a false positive is detected, the weight of time sequence similarity is reduced. This continuously improves the accuracy of similarity matching, allowing the system to more accurately identify true attack behavior.
[0032] 6. The analysis and processing module evaluates the dynamic knowledge base based on historical and real-time execution results. It triggers an upgrade when the evaluation index falls below a threshold, and the alert module issues a timely reminder. This mechanism ensures that the dynamic knowledge base is continuously updated and improved based on actual attack situations, adapting to new attack variants and keeping the system's defense capabilities up to date. At the same time, alerts ensure that relevant personnel are kept informed of the knowledge base's status, ensuring the long-term safe and stable operation of the power grid. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] Figure 1 It is a schematic diagram of the system principle. DETAILED DESCRIPTION
[0034] In order to make the technical solution of the present invention clearer, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.
[0035] Example 1
[0036] like Figure 1 As shown, in the first step, the multi-source data acquisition and processing module acquires the first historical data of the power grid attack, and pre-processes the first historical data of the power grid attack to obtain the second historical data of the power grid attack. Specifically, the following steps are included:
[0037] 1. The multi-source data acquisition module acquires the first historical data of power grid attacks, including system logs, network traffic mirrors, network device status data, and security device alarms;
[0038] 2. Preprocessing the first historical data of power grid attacks, including time sequence alignment, anomaly cleaning, and protocol analysis, is performed on the first historical data of power grid attacks to obtain the second historical data of power grid attacks.
[0039] The multi-source data acquisition and processing module collects the first historical data of various types of power grid attacks, such as system logs and network traffic mirrors, and performs pre-processing such as time alignment, anomaly cleaning, and protocol analysis. It can comprehensively integrate scattered attack-related information, remove redundant and erroneous data, and provide a high-quality data foundation for subsequent modeling and analysis, thereby improving the accuracy and reliability of attack behavior analysis and laying a data foundation for the accurate identification of attack behavior.
[0040] In the second step, the attack behavior modeling module atomically decomposes the second historical data of power grid attacks to obtain the third historical data of power grid attacks, and constructs a four-dimensional attack behavior map based on the third historical data of power grid attacks. The specific steps include:
[0041] 1. The attack behavior modeling module breaks down the second historical data of power grid attacks into the third historical data of power grid attacks, including reconnaissance behavior, infiltration behavior, lateral impact, and physical impact;
[0042] 2. Based on the third-party historical data of power grid attacks, a four-dimensional attack behavior map covering time dimension, space dimension, behavior dimension and impact dimension is constructed.
[0043] The attack behavior modeling module breaks down preprocessed historical data into atomic behaviors like reconnaissance and infiltration, and constructs a four-dimensional attack behavior map encompassing time, space, behavior, and impact. This atomic decomposition and multi-dimensional map construction deeply analyzes the nature and characteristics of attack behavior, clearly presenting the attack's development process, scope, specific actions, and impact. This provides a structured, multi-dimensional reference for subsequent similarity matching, facilitating more accurate identification of similar attacks.
[0044] In the third step, the real-time data acquisition module collects real-time data and extracts real-time behavioral features. The attack behavior modeling module then performs attack similarity matching based on the processed real-time behavioral features. During the attack similarity matching calculation, the dynamic and static features of the real-time data are extracted, the temporal offsets of the behavioral sequences are aligned, and the graph neural network is used to quantify the graph similarity. This is then used to perform the attack similarity matching calculation:
[0045]
[0046] in, is the attack similarity, is the temporal similarity, is the graph structure similarity, It is a quantitative value of the actual impact of the attack behavior on the physical operation status of the power grid. 、 、 The weight coefficient satisfies + + =1.
[0047] The real-time data acquisition module promptly acquires real-time data and extracts features. The attack behavior modeling module combines these real-time features to perform attack similarity matching calculations, taking into account factors such as timing, graph structure, and the degree of physical impact. This process enables dynamic monitoring and rapid comparison of real-time attack behaviors on the power grid, enabling the timely identification of potential similar attacks, improving the timeliness and sensitivity of attack detection, and enabling the early implementation of defensive measures.
[0048] In the fourth step, the dynamic knowledge base module triggers a response based on the similarity and generates a corresponding defense strategy. The defense execution module executes the generated defense strategy, the tracking and statistics module compiles statistics on the execution results of the defense strategy, and the storage management module stores the execution results. If the attack similarity exceeds the attack similarity threshold, it is determined to be a high-similarity attack. The dynamic knowledge base module generates a corresponding defense strategy based on the matching results of the four-dimensional attack behavior graph. Otherwise, no defense strategy is generated.
[0049] The dynamic knowledge base module generates defense strategies based on similarity results, which are rapidly executed by the defense execution module, while the tracking, statistics, and storage management modules record and store the results. This closed-loop process ensures a rapid response and effective defense measures when highly similar attacks are detected. It also comprehensively records the defense process and results, providing practical data support for subsequent strategy optimization and knowledge base upgrades, thereby enhancing the grid's proactive defense capabilities.
[0050] In the fifth step, the analysis and processing module sends corresponding instructions to optimize the grid similarity matching calculation based on the attack data recorded by the tracking and statistics module and the response triggered by the dynamic knowledge base module. When optimizing the similarity matching calculation, if the grid attack is successfully blocked, the , and According to and The value is reduced proportionally Increase; if a false alarm of a power grid attack occurs, decrease , and According to and The value increases proportionally If the power grid attack is missed, the , and According to and The value is reduced proportionally The increase of 、 、 Value range, combined with the set value range 、 、 The new value is determined.
[0051] The analysis and processing module optimizes similarity matching calculations based on attack data and response conditions. By adjusting weight coefficients, the matching algorithm dynamically adjusts to the actual defense effectiveness, reducing false positives and missed negatives. For example, when an attack is successfully blocked, the weight of graph structure similarity is increased, while when a false positive is detected, the weight of temporal similarity is reduced. This continuously improves the accuracy of similarity matching, allowing the system to more accurately identify true attack behavior.
[0052] In the sixth step, the analysis and processing module triggers the instruction to upgrade the dynamic knowledge base based on the execution results counted by the tracking and statistics module and the historical execution results stored by the storage management module. The warning and reminder module issues warnings based on the dynamic knowledge base upgrade. The analysis and processing module obtains the number of times the generated defense strategy effectively defends against attacks, the number of times the generated defense strategy fails to defend against attacks, and the effectiveness of the defense strategy in each effective defense against attacks. It then analyzes and processes the above data to obtain the evaluation index of the current dynamic knowledge base:
[0053]
[0054] in, is the evaluation index of the current dynamic knowledge base, To generate the number of attacks that the defense strategy effectively defends, To generate the number of times the defense strategy fails to defend against attacks, The effectiveness of each effective defense strategy against attacks, If the evaluation index of the current dynamic knowledge base is greater than the evaluation index threshold of the current dynamic knowledge base, the current dynamic knowledge base will continue to be used; otherwise, the instruction to upgrade the dynamic knowledge base will be triggered, and a warning reminder will be issued for the dynamic knowledge base upgrade. Limit the value range to , to achieve nonlinear weighting of defense strategies. When the effective defense ratio is higher, The value of is close to 1, The larger the value, the more positive incentives there are for high effective ratios. In, if The larger the The larger the value, the more positive the amplification effect on the evaluation index. On the contrary, it will lower the evaluation index of the current dynamic knowledge base, reflecting that the defense strategy is "effective" but does not meet the preset standards. A comprehensive evaluation of the dynamic knowledge base is achieved, focusing on both the "quantity of effectiveness" of the defense strategy and the "actual quality compliance", achieving accurate quantification of the practicality and adaptability of the knowledge base, and providing a scientific basis for the dynamic optimization of power grid attack defense.
[0055] The analysis and processing module evaluates the dynamic knowledge base based on historical and real-time execution results. When the evaluation index falls below a threshold, an upgrade is triggered, and the alert module issues a timely reminder. This mechanism ensures that the dynamic knowledge base is continuously updated and improved based on actual attack scenarios, adapting to new attack variants and keeping the system's defense capabilities up to date. At the same time, alerts ensure that relevant personnel are kept informed of the knowledge base's status, ensuring the long-term safe and stable operation of the power grid.
[0056] Example 2
[0057] When performing similarity matching calculation, if , , , , , , then we have:
[0058]
[0059] like If the attack similarity threshold is exceeded, it is determined to be a high-similarity attack. The dynamic knowledge base module generates a corresponding defense strategy based on the results of the four-dimensional attack behavior graph matching. Otherwise, no defense strategy is generated.
[0060] Example 3
[0061] When the attack is successfully blocked 、 、 When the weight of 、 、 The initial value is , , , , , , At this time, take , , ,Pick ,Pick That is, the optimized similarity matching calculation is .
[0062] Example 4
[0063] When calculating the evaluation index of the current dynamic knowledge base, if , , , , then we have:
[0064]
[0065] like If the evaluation index of the current dynamic knowledge base exceeds the threshold, the current dynamic knowledge base will continue to be used; otherwise, the instruction to upgrade the dynamic knowledge base will be triggered, and a warning reminder will be issued for the dynamic knowledge base upgrade.
[0066] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.
Claims
1. The power grid similar attack behavior modeling and detection analysis system is characterized by: The system specifically includes the following steps: S1. A multi-source data acquisition and processing module acquires first historical data of power grid attacks, and pre-processes the first historical data of power grid attacks to obtain second historical data of power grid attacks; S2, the attack behavior modeling module performs behavior atomization decomposition on the second historical data of power grid attacks to obtain the third historical data of power grid attacks, and constructs a four-dimensional attack behavior map based on the third historical data of power grid attacks; S3, the real-time data collection module collects real-time data and extracts real-time behavior features. The attack behavior modeling module performs attack similarity matching calculation based on the processed real-time behavior features. S4. The dynamic knowledge base module triggers a response based on the similarity and generates a corresponding defense strategy. The defense execution module executes the generated defense strategy. The tracking and statistics module collects statistics on the execution results of the defense strategy. The storage management module stores the execution results. S5. The analysis and processing module issues corresponding instructions to optimize the grid similarity matching calculation based on the attack data recorded by the tracking and statistics module and the response triggered by the dynamic knowledge base module; S6. The analysis and processing module triggers an instruction to upgrade the dynamic knowledge base based on the execution results collected by the tracking and statistics module and the historical execution results stored by the storage management module. The warning and reminder module issues a warning and reminder based on the dynamic knowledge base upgrade.
2. The power grid similar attack behavior modeling and detection analysis system according to claim 1 is characterized by: The step S1 specifically includes the following steps: S11, a multi-source data acquisition module acquires first historical data of power grid attacks including system logs, network traffic mirrors, network device status data, and security device alarms; S12: performing preprocessing including time sequence alignment, anomaly cleaning, and protocol analysis on the first historical data of power grid attacks to obtain second historical data of power grid attacks.
3. The power grid similar attack behavior modeling and detection analysis system according to claim 1 is characterized by: The step S2 specifically includes the following steps: S21, the attack behavior modeling module decomposes the second historical data of the power grid attack into the third historical data of the power grid attack including reconnaissance behavior, infiltration behavior, lateral impact, and physical impact; S22. Construct a four-dimensional attack behavior map covering time dimension, space dimension, behavior dimension, and impact dimension based on the third historical data of power grid attacks.
4. The power grid similar attack behavior modeling and detection analysis system according to claim 1 is characterized by: In step S3, when performing attack similarity matching calculation, the dynamic and static features of the real-time data are extracted, the temporal offset of the behavior sequence is aligned, and the graph similarity is quantified based on the graph neural network to perform attack similarity matching calculation: ; in, is the attack similarity, is the temporal similarity, is the graph structure similarity, It is a quantitative value of the actual impact of the attack behavior on the physical operation status of the power grid. 、 、 The weight coefficient satisfies + + =1.
5. The power grid similar attack behavior modeling and detection analysis system according to claim 1 is characterized by: In step S4, when the attack similarity is greater than the attack similarity threshold, it is determined to be a high-similarity attack, and the dynamic knowledge base module generates a corresponding defense strategy based on the result of the four-dimensional attack behavior graph matching. Otherwise, no defense strategy is generated.
6. The power grid similar attack behavior modeling and detection analysis system according to claim 4 is characterized by: In step S5, when performing similarity matching calculation optimization, if the power grid attack is successfully blocked, the , and According to and The value is reduced proportionally Increased volume; If a false alarm is reported for a power grid attack, the , and According to and The value increases proportionally If the power grid attack is missed, the , and According to and The value is reduced proportionally The increase of 、 、 Value range, combined with the set value range 、 、 The new value is determined.
7. The power grid similar attack behavior modeling and detection analysis system according to claim 1 is characterized by: In step S6, the analysis and processing module obtains the number of times the generated defense strategy effectively defends against attacks, the number of times the generated defense strategy fails to defend against attacks, and the effectiveness of the defense strategy in resisting attacks each time the defense strategy effectively defends against attacks, and analyzes and processes the above data to obtain the evaluation index of the current dynamic knowledge base: ; in, is the evaluation index of the current dynamic knowledge base, To generate the number of attacks that the defense strategy effectively defends, To generate the number of times the defense strategy fails to defend against attacks, The effectiveness of each effective defense strategy against attacks, The benchmark efficiency is set.
8. The power grid similar attack behavior modeling and detection analysis system according to claim 7 is characterized by: In step S6, if the evaluation index of the current dynamic knowledge base is greater than the evaluation index threshold of the current dynamic knowledge base, the current dynamic knowledge base continues to be used; otherwise, an instruction to upgrade the dynamic knowledge base is triggered, and a warning reminder is issued for the dynamic knowledge base upgrade.