Network security monitoring method and system applied to power monitoring system

Abstract

The application provides a network security monitoring method and system applied to a power monitoring system, and belongs to the technical field of network security; first, a network interaction data set containing device communication messages, operation instruction sequences and system state logs is acquired, security feature analysis is performed on the network interaction data set to obtain network communication features and operation behavior features, a target knowledge network representing the space-time coupling relationship of the features is constructed based on the network communication features and the operation behavior features, a security state evaluation result containing an abnormal source identifier and the like is generated by tracking an abnormal transmission path through the target knowledge network, a hierarchical protection instruction set is generated according to the security state evaluation result and is distributed to partition control nodes to start a cooperative protection mechanism, so that the network security protection and emergency response capability of the power monitoring system can be effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network security monitoring method and system applied to a power monitoring system. BACKGROUND

[0002] At present, with the rapid advancement of intelligence in the power industry, the scale and complexity of the power monitoring system, which is the core of ensuring the safe and stable operation of the power grid, are increasing day by day. It covers a large number of devices in various links such as power generation, power transmission, power transformation, power distribution and power utilization. These devices interact and cooperatively control through the network to form a large and complex network communication environment.

[0003] However, the existing network security monitoring means of the power monitoring system has obvious deficiencies. On the one hand, most monitoring methods only focus on a single type of data, such as only performing simple format checking on device communication messages or only performing preliminary permission checking on operation instructions, lacking comprehensive analysis capability for network interaction data, and being difficult to find complex security threats hidden in multiple data. On the other hand, when facing new network attacks, the traditional monitoring method can only detect the surface phenomenon of the attack, cannot deeply analyze the propagation path and influence range of the attack, cannot accurately identify the attack source and key conduction nodes, and thus cannot take effective protection measures in time when dealing with security incidents, which makes the power monitoring system face increasingly severe network security challenges and seriously threatens the reliable power supply of the power grid and the normal operation of the society. SUMMARY

[0004] In view of the above-mentioned problems, in combination with the first aspect of the present application, the present application embodiment provides a network security monitoring method applied to a power monitoring system, which comprises:

[0005] obtaining a network interaction data set of the power monitoring system, the network interaction data set containing device communication messages, operation instruction sequences and system state logs;

[0006] performing security feature analysis processing on the network interaction data set to obtain network communication features and operation behavior features, the network communication features containing protocol field variation features, cross-region transmission features and message signature verification results, and the operation behavior features containing instruction permission out-of-bound features, non-periodic operation features and cross-machine interaction features;

[0007] constructing a target knowledge network based on the network communication features and the operation behavior features, the target knowledge network being used to represent the spatio-temporal coupling relationship between the network communication features and the operation behavior features;

[0008] performing abnormal conduction path tracking through the target knowledge network to generate a security state evaluation result containing abnormal source identification, conduction node sequence and influence domain boundary;

[0009] generating a hierarchical protection instruction set according to the security state evaluation result and distributing the hierarchical protection instruction set to the partition control node of the power monitoring system to start a cooperative protection mechanism.

[0010] In still another aspect, the embodiment of the present application also provides a network security monitoring system applied to a power monitoring system, comprising a processor, a machine readable storage medium, the machine readable storage medium being connected with the processor, the machine readable storage medium being used for storing programs, instructions or codes, and the processor being used for executing the programs, instructions or codes in the machine readable storage medium to realize the above method.

[0011] Based on the above aspects, the embodiment of the present application can obtain a network interaction data set containing device communication messages, operation instruction sequences and system state logs, perform security feature analysis on the network interaction data set, accurately extract network communication features and operation behavior features, cover multiple key dimensions such as protocol field variation and instruction authority out-of-bound, and catch abnormal signs in the network, build a target knowledge network based on the above features, depict the spatiotemporal coupling relationship between the network communication features and the operation behavior features, perform abnormal conduction path tracking through the target knowledge network, accurately generate a security state evaluation result containing abnormal source identification, conduction node sequence and influence domain boundary, present the propagation path and influence range of security threats, generate a hierarchical protection instruction set according to the security state evaluation result and distribute the hierarchical protection instruction set to the partition control node to start a cooperative protection mechanism, realize the change from local monitoring to global cooperative protection, quickly and effectively respond to various network security events, significantly improve the network security protection capability and emergency response capability of the power monitoring system, and ensure the safe and stable operation of the power system. BRIEF DESCRIPTION OF DRAWINGS

[0012] Figure 1 is an execution flow schematic diagram of the network security monitoring method applied to the power monitoring system provided by the embodiment of the present application.

[0013] Figure 2 is a schematic diagram of exemplary hardware and software components of the network security monitoring system applied to the power monitoring system provided by the embodiment of the present application. DETAILED DESCRIPTION

[0014] The present application will be described in detail below with reference to the accompanying drawings, Figure 1The application is applied to the network security monitoring method of the power monitoring system, and the flowchart of the network security monitoring method applied to the power monitoring system is provided.

[0015] In step S110, the network interaction data set of the power monitoring system is acquired, and the network interaction data set includes device communication messages, operation instruction sequences and system state logs.

[0016] In this embodiment, the power monitoring system of a certain regional power grid is taken as an application scenario, the power monitoring system is connected with multiple transformer substations, dispatching centers, power plants and terminal monitoring devices, and each device realizes data transmission and control operation through a special communication network.

[0017] When the device communication messages are acquired, the data acquisition modules deployed at each communication node can be used for acquisition, the data acquisition modules are embedded in the mirror ports of network switches or communication gateways, and can realize real-time capture and storage of the passing messages.

[0018] The operation instruction sequences are acquired by means of the operation record servers in the interface system. The control instructions are generated by the dispatching center, including remote control commands for the transformer substation devices, parameter adjustment instructions and the like, and the instructions are recorded in the instruction logs of the operation record servers when the instructions are sent, and the logs are read in specific fields during acquisition, and the instruction contents, sending time, target device identifiers and the like are extracted. The device control instructions come from the local monitoring terminals in the transformer substations, such as operation instructions for circuit breakers and disconnectors, and the operation instructions are acquired by reading the terminal operation logs, so that all device-level control operations are ensured.

[0019] The acquisition of the system state logs involves the local log systems of each device. The system state logs are generated by the devices such as servers, switches and remote devices during operation, including startup / shutdown records, fault alarm information, resource occupation conditions and the like. During acquisition, the special log acquisition agent programs are used, the Syslog protocol or special interfaces are used to connect with the devices, and the logs are regularly read and summarized to form the system state log set.

[0020] During the acquisition of the network interaction data set, the data desensitization technology is used to process the data related to privacy and sensitive information, such as the operation personnel identity information and the device key information. The identity information is anonymized and replaced with meaningless identifiers, and the key information is encrypted and stored, and is temporarily decrypted through a special decryption module only when verification is needed, and the decryption process is completed in the encryption chip to prevent sensitive information from being leaked.

[0021] Step S120, the network interaction data set is analyzed to obtain network communication features and operation behavior features, the network communication features include protocol field variation features, cross-region transmission features and message signature verification results, and the operation behavior features include instruction permission boundary crossing features, non-periodic operation features and cross-machine interaction features.

[0022] Step S121, the protocol frame structure in the device communication message is analyzed, the frame header check field, function code field and data field are extracted, the standard field length and coding rule in the preset protocol template library are compared, the field bit offset and redundant byte insertion are identified, and the protocol field variation features are generated.

[0023] Step S1211, the device communication message is classified according to the protocol type, and the classified device communication message is obtained, the protocol type includes remote communication protocol, monitoring information transmission protocol and network time synchronization protocol.

[0024] The device communication message is classified before being analyzed. According to the protocol identification field in the message, the message is divided into remote communication protocol message, monitoring information transmission protocol message and network time synchronization protocol message. For example, the remote communication protocol message frame header has a specific protocol identifier, and the message can be distinguished from other protocol messages; the network time synchronization protocol message such as NTP protocol message has a unique port number and format, and the classification can be completed. The classified message enters the corresponding analysis process to ensure the accuracy of analysis.

[0025] Step S1212, the frame parser corresponding to the protocol is called to analyze the classified device communication message, the start byte and end byte of the frame header check field are located, the check value is extracted and compared with the check result recalculated from the frame body data, the frame structure position of the unmatched check value is recorded, and the frame header check exception record is obtained.

[0026] For each classified protocol message, the corresponding frame parser is called for analysis. The frame parser has the frame structure definition of the corresponding protocol built-in, which can accurately identify the start and end positions of the frame header check field. After extracting the check value, the check value is recalculated from the frame body data using the check algorithm consistent with the protocol (such as CRC check, checksum, etc.). If the two are inconsistent, the frame structure position of the message is recorded, including the frame number, the offset of the check field in the frame, etc., to form the frame header check exception record.

[0027] Step S1213, based on the frame header check exception record, the binary bit string of the function code field is intercepted, converted into a decimal function identifier, and the corresponding operation type is determined by querying the function code mapping table to mark the abnormal situation of undefined function code and function code mismatching the operation type, and obtain the function code exception record.

[0028] With the frame header check exception record as a clue, the function code field of the corresponding message is processed. The binary bit string of the function code field is intercepted, and is converted into a decimal function identification according to the conversion rule specified by the protocol. The function code mapping table pre-constructed is queried, and the mapping relationship between each function identification and the corresponding operation type is stored. If the function identification does not exist in the mapping table, it is an undefined function code; if the operation type corresponding to the function identification does not match the operation type indicated by other fields in the message, these abnormal situations are marked, and the function code field position, function identification value, expected and actual operation type, etc. are recorded to form a function code exception record.

[0029] In step S1214, in combination with the function code exception record, the field separator and data format identification of the data field are analyzed, the data unit is split according to the standard coding rule, the phenomenon of reversed field order, missing field and repeated field is detected, and the data domain structure exception record is obtained.

[0030] In combination with the function code exception record, the message data field is deeply analyzed. First, the field separator (such as comma, semicolon, special character, etc.) and data format identification (such as identification indicating integer, floating point number, string, etc.) are identified. According to the standard coding rule, the data unit is split according to the separator and format identification. Whether there is a phenomenon of reversed field order, missing or repeated field is detected, and the position of these abnormalities, the involved field name, etc. are recorded to form a data domain structure exception record.

[0031] In step S1215, according to the data domain structure exception record, the actual byte length of each field is measured, and the difference value is calculated with the standard field length in the preset protocol template library, the field name and deviation value whose length deviation exceeds the allowed range are recorded, and the field length deviation record is obtained.

[0032] According to the data domain structure exception record, the actual byte length of the involved field is measured. The difference value is calculated with the standard byte length of the corresponding field in the preset protocol template library, and the length deviation value is obtained. The preset protocol template library specifies the allowed range of the length deviation of each field. When the deviation value exceeds the range, the field name, actual and standard byte length, deviation value, etc. are recorded to form the field length deviation record.

[0033] In step S1216, based on the field length deviation record, the special character sequence in the data field is scanned, the non-standard padding byte and the hidden channel identification are identified, the insertion position and byte content of the redundant byte are marked, and the redundant byte insertion record is obtained.

[0034] Based on the field length deviation record, scan the special character sequence in the data field with length deviation. Identify non-standard padding bytes that do not conform to the protocol, which usually do not carry valid data and are only used to fill the field length. At the same time, detect the covert channel identifier that may be used to transmit secret information, such as a specific byte combination sequence. Mark the insertion position (expressed in byte offset) and specific content of the redundant bytes in the field to form a redundant byte insertion record.

[0035] In step S1217, the field bit offset in the field length deviation record is classified to obtain a field offset classification result.

[0036] The field bit offset in the field length deviation record is classified. According to the offset size and the influence degree on protocol analysis, the offset is classified into different levels. For example, the low-level offset has a small offset and does not affect the analysis of key information; the middle-level offset has a large offset and may cause partial information analysis error; and the high-level offset has an extremely large offset and seriously affects the entire field analysis. The offset level and corresponding offset of each field are recorded to obtain a field offset classification result.

[0037] In step S1218, the content of the redundant byte in the redundant byte insertion record is pattern recognized to distinguish random padding bytes, repeated padding bytes and specific sequence padding bytes, and a redundant byte pattern recognition result is obtained.

[0038] The content of the redundant byte in the redundant byte insertion record is pattern recognized. The distribution law, repetition degree and other characteristics of the byte are analyzed to distinguish different types of redundant bytes. The random padding byte has no obvious law and is randomly distributed; the repeated padding byte is a multiple repetition of a certain byte or sequence; and the specific sequence padding byte is a combination conforming to a specific preset sequence. The specific content and occurrence times of each type of redundant byte are recorded to obtain a redundant byte pattern recognition result.

[0039] In step S1219, the frame header check exception record, the function code exception record, the data field structure exception record, the field length deviation record, the redundant byte insertion record, the field offset classification result and the redundant byte pattern recognition result are integrated to generate a protocol field variation feature.

[0040] The various records and results obtained above are integrated according to the time sequence of the message, the protocol type and other dimensions to form a multi-dimensional feature set, which contains detailed information of various abnormal conditions and collectively constitutes a protocol field variation feature.

[0041] Step S122, the tracking device communication message source IP network segment and destination IP network segment, combined with the physical partition topology of the power monitoring system, to determine whether the communication path across the security isolation device and longitudinal encryption device, record the number of times and isolation device alarm information, generate cross-region transmission characteristics.

[0042] After obtaining the device communication message, the source IP address and destination IP address of each message are extracted, and the source IP network segment and destination IP network segment are determined. For example, the source IP address is 192.168.1.5, and the source IP network segment is 192.168.1.0 / 24; the destination IP address is 10.0.0.3, and the destination IP network segment is 10.0.0.0 / 24.

[0043] The physical partition topology of the power monitoring system is called, which details the physical partition (such as dispatching center area, substation area 1, substation area 2, etc.) of each IP network segment and the deployment position of the security isolation device (such as forward isolation device, reverse isolation device) and longitudinal encryption device between each partition. In the topology map, the source IP network segment and destination IP network segment are located to determine the message communication path.

[0044] Check if the security isolation device and longitudinal encryption device are passed along the communication path. If so, record the type, identification and time of the device that is passed. At the same time, query the running log of these devices to obtain the alarm information (such as message filtering alarm, encryption failure alarm, etc.) in this time period. Summarize the number of times, device information involved in each time, and corresponding alarm information to form the cross-region transmission characteristics, reflecting the security status of the message transmission between different physical partitions.

[0045] Step S123, call the digital certificate verification module to decrypt and verify the signature field in the device communication message, compare the preset public key of the sending device with the signature decryption result, and generate a message signature verification result containing the verification pass identification or verification failure reason.

[0046] The signature field is extracted from the device communication message, which is usually located at a specific position in the message and contains the ciphertext signed by the sending device. The digital certificate verification module is called, which has built-in public key infrastructure related functional components.

[0047] The digital certificate verification module first obtains the preset public key of the sending device, which is pre-stored in the key management server of the system and corresponds to the identification of the sending device. The preset public key is used to decrypt the signature field in the message to obtain the decrypted signature result.

[0048] The decrypted signature result is compared with the recalculated hash value of the message content. If they are consistent, a check pass identifier is generated, containing verification time, sending end device identifier and other information. If they are inconsistent, or the public key does not match during decryption, the signature format is incorrect, or other situations, the specific reasons for the check failure (such as hash value mismatch, invalid public key, expired signature, etc.) are recorded, and the message signature verification result is generated.

[0049] Step S124, extract the permission identification field in the operation instruction sequence, match with the device permission configuration table of the operation execution end, detect the instruction record of permission level mismatch and permission range out-of-bounds, and generate the instruction permission out-of-bounds feature.

[0050] Step S1241, parse the permission identification field in the operation instruction sequence, extract the user role code, operation permission level and operation authorization timestamp, and obtain the permission identification information.

[0051] Each instruction in the operation instruction sequence contains a permission identification field, which is encoded in a specific format and contains information related to operation permission. Parsing the permission identification field, extracting the user role code (identifying the role type of the user issuing the instruction, such as dispatcher, maintainer, administrator, etc.), operation permission level (reflecting the operation permission level corresponding to the instruction) and operation authorization timestamp (recording the time point when the operation permission is authorized), and combining to form the permission identification information.

[0052] Step S1242, based on the permission identification information, call the device permission configuration table of the operation execution end, the device permission configuration table contains device identifier, allowed role code range, maximum permission level limit and operation time period constraint.

[0053] According to the operation execution end device identifier involved in the permission identification information, the corresponding device permission configuration table is called from the permission management database of the system. The device permission configuration table is customized for each device, containing device identifier information (ensuring correspondence with the target device of the operation instruction), allowed role code range (only users with roles in this range can operate the device), maximum permission level limit (operation permission level cannot exceed this limit) and operation time period constraint (only within the specified time period can the device be operated).

[0054] Step S1243, compare the user role code in the permission identification information with the allowed role code range in the device permission configuration table, mark the role code and corresponding instruction content that are not within the allowed role code range, and obtain the role permission mismatch record.

[0055] The user role code in the permission identification information is compared with the role code range allowed to operate in the device permission configuration table one by one. If the user role code is not in the allowed range, it means that the user role is not allowed to operate the device, and the user role code and the corresponding instruction content (including specific operation, target device, etc.) are marked to form a role permission mismatch record.

[0056] In step S1244, the operation permission level in the permission identification information is compared with the highest permission level limit in the device permission configuration table in combination with the role permission mismatch record, the instruction execution time and the instruction initiation terminal IP of the permission level exceeding the highest permission level limit are recorded, and a permission level out-of-bound record is obtained.

[0057] On the basis of the role permission mismatch record, the operation permission level in the permission identification information is compared with the highest permission level limit in the device permission configuration table for the operation instruction matched with the role permission. If the operation permission level exceeds the highest limit, it means that the operation permission is too high and does not conform to the device permission regulation. The execution time of the instruction and the IP address of the initiation terminal are recorded to form a permission level out-of-bound record.

[0058] In step S1245, according to the permission level out-of-bound record, it is checked whether the operation authorization timestamp in the permission identification information is within the operation period specified in the device permission configuration table, and the operation instruction and the instruction type in the unauthorized period are marked to obtain an unauthorized period operation record.

[0059] According to the permission level out-of-bound record, it is checked whether the operation authorization timestamp in the permission identification information is within the operation period specified in the device permission configuration table for the operation instruction involved. If it is not within the specified period, it means that the operation is performed at an unauthorized time, and the operation instruction and the instruction type (such as control instruction, parameter modification instruction, etc.) are marked to form an unauthorized period operation record.

[0060] In step S1246, the binding relationship library of the user role code and the operation permission level is associated to detect abnormal binding conditions of the role and the permission level, record the processing state of the abnormal instruction, and obtain a role permission binding abnormal record.

[0061] The binding relationship library of the user role code and the operation permission level in the calling system stores the operation permission level range allowed to be owned by each user role. The user role code and the corresponding operation permission level in the permission identification information are compared and associated with the library to detect whether there is an abnormal binding condition of the role and the permission level. For example, the ordinary maintenance role is assigned an administrator-level operation permission level. For the instructions with abnormalities, the processing state (such as executed, not executed, intercepted, etc.) is recorded to form a role permission binding abnormal record.

[0062] Step S1247, classify and count the role permission mismatch records, permission level boundary crossing records, unauthorized time period operation records, and role permission binding abnormal records according to the instruction type, calculate the boundary crossing frequency and proportion of each type of instruction, and obtain the boundary type statistical result.

[0063] The role permission mismatch records, permission level boundary crossing records, unauthorized time period operation records, and role permission binding abnormal records are classified according to the instruction type, which includes control instructions, parameter adjustment instructions, query instructions, etc. For each type of instruction, the boundary crossing frequency (the number of times the boundary crossing occurs) in each type of record is counted, and the proportion of the boundary crossing frequency of each type of instruction in all boundary crossing records is calculated. These statistical data are sorted to obtain the boundary type statistical result.

[0064] Step S1248, group the above abnormal records according to the time interval, analyze the time distribution law of the boundary crossing behavior, and obtain the boundary crossing time distribution characteristics.

[0065] The role permission mismatch records, permission level boundary crossing records, unauthorized time period operation records, and role permission binding abnormal records are grouped according to the time interval, which can be set to every hour, every day, every week, etc. The number of each type of abnormal record in each time interval, the type distribution of boundary crossing instructions, etc. are counted. By analyzing these data, the occurrence frequency of boundary crossing behavior in different time periods, the high incidence period, etc. are summarized, and the boundary crossing time distribution characteristics are obtained. For example, it may be found that there are more unauthorized time period operation records in the early morning period, or that the permission level boundary crossing records frequently occur in a specific time period during weekdays.

[0066] Step S1249, integrate the role permission mismatch records, permission level boundary crossing records, unauthorized time period operation records, role permission binding abnormal records, boundary type statistical result, and boundary crossing time distribution characteristics to generate the instruction permission boundary crossing feature.

[0067] The role permission mismatch records, permission level boundary crossing records, unauthorized time period operation records, role permission binding abnormal records, boundary type statistical result, and boundary crossing time distribution characteristics are integrated. According to the abnormal type, instruction type, time, etc. dimensions are associated to form a feature set that comprehensively reflects the operation instruction permission boundary crossing situation, i.e. the instruction permission boundary crossing feature, which contains the detailed information of each type of boundary crossing record and the rules obtained by statistical analysis, and presents the security problems existing in the permission of operation instructions.

[0068] Step S125, count the generation time interval of operation instructions, analyze the instruction frequency and instruction type distribution deviating from the preset operation period, and generate the non-periodic operation feature combined with the historical operation time sequence model.

[0069] First, the generation time of each instruction in the operation instruction sequence is extracted, the time interval between two adjacent instructions of the same type is calculated, and a time interval sequence is formed. The preset operation period is the regular execution period of each type of instruction determined according to historical normal operation data, for example, the preset period of a certain type of device inspection instruction is once per hour.

[0070] The calculated time interval is compared with the corresponding preset operation period to determine the time interval deviating from the preset period. The instruction frequency deviating from the preset period, i.e., the number of non-periodic operations, is counted. At the same time, the instruction type distribution of these non-periodic instructions is analyzed, i.e., the proportion of different types of instructions in non-periodic operations, for example, the proportion of control instructions in non-periodic operations, the proportion of parameter adjustment instructions, etc.

[0071] The historical operation time sequence model is constructed based on normal operation instruction data in the past period of time, which contains the normal execution rules of various types of instructions in different time periods, time interval distribution, etc. The frequency and type distribution of the current non-periodic instructions are compared with the historical operation time sequence model to analyze the deviation degree between them.

[0072] If the non-periodic frequency of a certain type of instruction is significantly higher than the normal range in the historical model, or its type distribution is significantly different from the historical model, it is marked as abnormal non-periodic operation. Record the specific instruction content, generation time, and device belonging to these abnormal non-periodic operations, etc. information, combined with the frequency statistics and type distribution analysis results, integrate into the non-periodic operation characteristics. The non-periodic operation characteristics can reflect the abnormal situation of the operation instruction in time execution.

[0073] Step S126, identify the initiation device identifier and the receiving device identifier of the operation instruction, query the device affiliation table, mark the cross-station, cross-interval instruction interaction record, and generate the cross-machine interaction feature.

[0074] The initiation device identifier and the receiving device identifier of each instruction in the operation instruction sequence are extracted, which are usually the unique number or IP address of the device. The device affiliation table is called, which records the information such as the station, interval, etc. to which each device belongs, for example, which devices belong to interval No. 1 of substation A, which devices belong to power plant B, etc.

[0075] The initiation device identifier and the receiving device identifier are queried in the device affiliation table to determine the station and interval to which they belong. If the initiation device and the receiving device do not belong to the same station, it is a cross-station instruction interaction; if they belong to the same station but not to the same interval, it is a cross-interval instruction interaction.

[0076] Mark these cross-station, cross-interval instruction interaction records, record the instruction type, execution time, detailed information of the initiating and receiving devices, etc. At the same time, the frequency of cross-station, cross-interval interaction in the setting time is counted, and whether the interaction mode conforms to the normal business process is analyzed. The marking record, frequency statistics and mode analysis result are integrated to generate the inter-machine interaction feature, which can reflect the abnormal interaction between different devices.

[0077] Step S127, integrate the protocol field variation feature, the cross-area transmission feature and the message signature verification result into network communication features; integrate the instruction permission boundary crossing feature, the non-periodic operation feature and the inter-machine interaction feature into operation behavior features.

[0078] For the integration of network communication features, the protocol field variation feature, the cross-area transmission feature and the message signature verification result are combined according to the time sequence and the device association relationship. For example, the protocol field variation, the cross-area transmission record and the message signature verification result of the same device in the same time period are associated to form a feature set that comprehensively describes the network communication security status of the device. In the integration process, the time stamps, device identifiers and other key information between the features are ensured to be consistent for subsequent analysis.

[0079] For the integration of operation behavior features, the instruction permission boundary crossing feature, the non-periodic operation feature and the inter-machine interaction feature are combined according to the time sequence and the device association relationship. The various operation behavior features for the same device or the same operation sequence are associated to form a complete operation behavior security feature description. For example, the non-periodic operation and inter-machine interaction that occur at the same time as the instruction permission boundary crossing of a certain device are integrated together to comprehensively reflect the operation behavior anomaly of the device.

[0080] Step S128, perform time stamp alignment processing on the network communication features and the operation behavior features to make the feature dimensions in the same monitoring period match.

[0081] Extract the time stamp information contained in the network communication features and the operation behavior features to determine the respective monitoring periods. The network communication features and the operation behavior features are divided into multiple same monitoring periods according to the time stamp, for example, each 10 minutes is a monitoring period.

[0082] For each monitoring period, the dimensions of the network communication features and the operation behavior features are adjusted. If the dimensions of a feature in the period do not match those of another feature, the missing dimensions are supplemented (filled with default values) or the repeated dimensions are merged to ensure that both have the same number and type of feature dimensions in the same monitoring period. For example, in a certain monitoring period, the network communication features include 5 dimensions, and the operation behavior features include 4 dimensions. A default dimension consistent with the corresponding dimension type of the network communication features is supplemented for the operation behavior features to match the dimensions.

[0083] In step S129, a feature association index table is established to record the correspondence between the network communication features and the operation behavior features. The feature association index table includes feature identifiers, association weights, and timestamp information.

[0084] Each specific feature in the network communication features and the operation behavior features is assigned a unique feature identifier for distinguishing different features. According to the association degree between the features, such as whether they belong to the same device or whether they occur at the same time, an association weight is set for each pair of associated network communication features and operation behavior features. The closer the association, the higher the weight value.

[0085] In the feature association index table, the feature identifiers of each pair of associated features, the corresponding association weights, and their timestamp information are recorded. Through the index table, the operation behavior features associated with a certain network communication feature or the network communication features associated with a certain operation behavior feature can be quickly queried, providing association basis for subsequent construction of the target knowledge network.

[0086] In step S130, a target knowledge network is constructed based on the network communication features and the operation behavior features. The target knowledge network is used to represent the spatiotemporal coupling relationship between the network communication features and the operation behavior features.

[0087] In step S131, the device nodes of the power monitoring system are taken as network vertices. The device nodes include server nodes, switch nodes, remote devices nodes, and terminal device nodes.

[0088] Each type of device in the power monitoring system, such as servers, switches, remote devices, and terminal devices, is regarded as an independent device node, and each device node serves as a vertex in the target knowledge network. For example, the database server of the dispatch center, the remote device of the substation, and the monitoring terminal each exist as a vertex in the network.

[0089] In step S132, a unique vertex identifier is assigned to each device node, and the physical location information and the function module to which the device node belongs are recorded to obtain vertex attribute information.

[0090] A unique vertex identification, which can be a number or a combination of characters, is assigned to each device node to ensure that each vertex can be uniquely identified in the network. At the same time, the physical location information of each device node is recorded, such as which station, which interval, etc.; and the function module to which it belongs, such as data acquisition module, control module, communication module, etc. These information are combined to form the attribute information of each vertex.

[0091] In step S133, the network communication features are mapped to the communication edge attribute between vertices to obtain initial communication edge attributes, which include protocol variation degree, signature verification result and cross-region transmission marker.

[0092] The information related to the communication between the device nodes in the network communication features is analyzed and mapped to the attribute of the communication edge connecting the corresponding vertices. The protocol variation degree reflects the variation degree of the protocol field in the communication process, which can be determined according to the related data in the protocol field variation feature; the signature verification result is directly taken from the message signature verification result; the cross-region transmission marker is determined according to the cross-region transmission feature, which marks whether the communication edge involves cross-region transmission. The above attributes jointly constitute the initial communication edge attribute.

[0093] In step S134, based on the initial communication edge attribute, an initial weight value is set for each communication edge to obtain an initial weight configuration, and the initial weight value is determined based on the historical communication frequency and communication stability.

[0094] For each communication edge, the communication frequency between the two device nodes within a set time is counted according to the historical communication data; at the same time, the communication stability is analyzed, such as the frequency of communication interruption, the error rate of data transmission, etc. The communication frequency and communication stability are quantified as specific parameters, and the initial weight value is calculated according to the preset calculation rule (such as the higher the communication frequency and the better the stability, the greater the weight value) to allocate the initial weight value to each communication edge to form the initial weight configuration.

[0095] In step S135, the operation behavior features are mapped to the operation attribute label of the vertex to obtain the vertex operation attribute, and the operation attribute label includes the number of permission boundary crossing, the probability of non-periodic operation and the frequency of cross-machine interaction.

[0096] From the operation behavior features, the operation information related to each device node is extracted and mapped to the operation attribute label of the node (vertex). The number of permission boundary crossing is obtained according to the instruction permission boundary crossing feature; the probability of non-periodic operation is calculated based on the non-periodic operation feature, i.e. the ratio of the number of non-periodic operations to the total number of operations; the frequency of cross-machine interaction is determined according to the cross-machine interaction feature, i.e. the number of interactions with other device nodes per unit time, and the above labels jointly constitute the vertex operation attribute.

[0097] Step S136, constructing an initial knowledge network according to the physical connection relationship of the device nodes, the vertex attribute information, the initial communication edge attribute, the initial weight configuration and the vertex operation attribute.

[0098] According to the actual physical connection relationship of the device nodes in the power monitoring system, the connection between the vertices in the initial knowledge network is established to form a communication edge. The vertex attribute information, the initial communication edge attribute, the initial weight configuration and the vertex operation attribute are respectively assigned to the corresponding vertices and communication edges to construct an initial knowledge network which can initially reflect the communication and operation relationship between the device nodes.

[0099] Step S137, setting a time sliding window of the initial knowledge network to obtain a knowledge network with a time window. In each time sliding window of the knowledge network with a time window, the mutual information value of the communication edge attribute and the operation attribute label is calculated, the weight coefficient of the knowledge network edge is adjusted based on the mutual information value, and a knowledge network with adjusted weight is obtained.

[0100] Step S1371, in the current time sliding window, extracting a communication edge attribute parameter set of all communication edges, the communication edge attribute parameters including a protocol variation quantization value, a Boolean value of a signature verification result and a count of a cross-region transmission mark.

[0101] From the current time sliding window of the target knowledge network, the attribute parameters of all communication edges are collected. The protocol variation quantization value is a quantitative representation of the protocol field variation characteristics, the Boolean value of the signature verification result is represented by 0 and 1 respectively to indicate verification failure and success, and the count of the cross-region transmission mark is the number of times that the communication edge crosses the security isolation device and the longitudinal encryption device, forming a communication edge attribute parameter set.

[0102] Step S1372, standardizing the communication edge attribute parameter set to obtain a standardized communication edge attribute parameter.

[0103] The min-max standardization method is used to process the communication edge attribute parameter set. The protocol variation quantization value and the count of the cross-region transmission mark are mapped to the interval [0, 1], and the Boolean value of the signature verification result is kept unchanged to obtain the standardized communication edge attribute parameter.

[0104] Step S1373, extracting an operation attribute label parameter set of each device node, the operation attribute label parameter set including a statistical value of permission boundary crossing times, a calculated value of non-periodic operation probability and a mean value of cross-machine interaction frequency.

[0105] From the attribute information of each device node, an operation attribute label parameter is extracted. The statistical value of the permission boundary times is the total number of permission boundary times of the node in a specified time period, the calculated value of the non-periodic operation probability is the proportion of non-periodic operation instructions to the total operation instructions of the node, and the average value of the inter-machine interaction frequency is the average number of interactions with other device nodes per unit time, which constitutes an operation attribute label parameter set.

[0106] In step S1374, the operation attribute label parameter set is normalized to obtain a normalized operation attribute parameter.

[0107] The z-score normalization method is used to process the operation attribute label parameter set, and the statistical value of the permission boundary times, the calculated value of the non-periodic operation probability, and the average value of the inter-machine interaction frequency are converted into standardized values with a mean of 0 and a standard deviation of 1, to obtain a normalized operation attribute parameter.

[0108] In step S1375, the standardized communication edge attribute parameter and the normalized operation attribute parameter of the connected device node are combined to form a feature pair, and a feature joint probability distribution of the feature pair is constructed.

[0109] The standardized communication edge attribute parameter of each communication edge and the normalized operation attribute parameters of the two device nodes connected thereto are combined to form a feature pair, and a feature joint probability distribution of the feature pair is constructed by counting the frequency of the feature pair in the sample.

[0110] In step S1376, the edge probability distribution of the feature joint probability distribution is calculated, and the feature mutual information value is calculated based on the feature joint probability distribution and the edge probability distribution.

[0111] According to the feature joint probability distribution, the edge probability distributions of the standardized communication edge attribute parameter and the normalized operation attribute parameter are calculated, and the feature mutual information value is calculated by using the mutual information calculation formula and combining the feature joint probability distribution and the edge probability distribution.

[0112] In step S1377, when the feature mutual information value is higher than the upper threshold of the mutual information threshold range, the weight coefficient of the corresponding communication edge is increased to obtain a first adjusted weight, and the increase amplitude is positively correlated with the degree of exceeding the upper threshold.

[0113] The mutual information threshold range is set, and when the feature mutual information value is higher than the upper threshold of the range, it indicates that the communication edge attribute and the operation attribute label have strong correlation, and the weight coefficient of the corresponding communication edge is increased in a positive proportion according to the exceeding degree to obtain a first adjusted weight.

[0114] Step S1378, when the feature mutual information value is lower than the lower threshold of the mutual information threshold range, the weight coefficient of the corresponding communication edge is reduced to obtain a second adjusted weight, and the reduction amplitude is positively correlated with the degree to which the mutual information value is lower than the lower threshold.

[0115] When the feature mutual information value is lower than the lower threshold of the mutual information threshold range, it indicates that the communication edge attribute and the operation attribute label are weakly associated. The weight coefficient of the corresponding communication edge is reduced in direct proportion to the degree to which it is lower than the lower threshold to obtain a second adjusted weight.

[0116] Step S1379, the first adjusted weight and the second adjusted weight are normalized to obtain a normalized weight coefficient, and the adjustment amplitude, adjustment reason and numerical change before and after adjustment of the normalized weight coefficient are recorded to generate a weight change log. The weight change log is stored in association with the identification of the time sliding window.

[0117] The first adjusted weight and the second adjusted weight are mapped to the [0, 1] interval to obtain a normalized weight coefficient, and adjustment-related information is recorded in detail to generate a weight change log and save it in association with the current time sliding window identification.

[0118] Step S138, monitor the state change of the device node in the knowledge network after weight adjustment, and dynamically update the vertex attribute of the knowledge network and the connection relationship of the associated edge when the device node is offline, restarted or configuration changed.

[0119] Real-time monitoring of the running state of each device node in the knowledge network after weight adjustment, through the heartbeat detection mechanism or state feedback information of the device to obtain whether the node is offline, restarted or configuration changed. When these state changes occur, update the vertex attribute of the node in time, such as updating the state information when the physical location does not change but the running state changes; at the same time, adjust the connection relationship of the communication edge associated with the node, such as temporarily disconnecting the connection when the node is offline, and re-establishing the connection after the node is restarted.

[0120] Step S139, when the node is offline, mark the corresponding vertex as invalid state, and temporarily remove the communication edge connected to the vertex to obtain the knowledge network after the node is offline.

[0121] Once the device node is detected to be offline, mark the vertex corresponding to the node as invalid state in the knowledge network to distinguish from the normally running vertex. At the same time, temporarily remove all communication edges connected to the vertex, because the node cannot communicate after it is offline. After the above processing, the knowledge network after the node is offline is obtained, which can accurately reflect the current device connection state.

[0122] Step S1310, after the node restarts or the configuration changes, the corresponding vertex is restored to an active state, and the communication edge with other nodes is re-established, the communication edge attribute is updated, and the knowledge network after the node is restored is obtained.

[0123] When the offline node restarts or the configuration changes, the corresponding vertex state is restored from invalid to active. According to the communication situation after the node restarts or the parameters after the configuration changes, the communication edge with other related nodes is re-established, and the attribute of the communication edge is updated, such as the protocol variation degree which may change due to the configuration change. Through these operations, the knowledge network after the node is restored is obtained.

[0124] Step S1311, the knowledge network after the node is restored is partitioned and clustered by a community discovery algorithm, the node community with similar communication characteristics and operation characteristics is identified, the abnormal communication channel between the node communities is marked, and the knowledge network after the community division is obtained.

[0125] The knowledge network after the node is restored is processed by applying a community discovery algorithm (such as Louvain algorithm). The algorithm will gather nodes with similar communication characteristics and operation characteristics together to form multiple node communities according to the communication edge weight, attribute and vertex operation attribute between nodes.

[0126] The communication channels between different node communities are analyzed. If the communication frequency, protocol variation degree and other characteristics of a communication channel are significantly different from the normal situation, such as abnormal increase of communication frequency, protocol variation degree exceeding the normal range, etc., it is marked as an abnormal communication channel. The node community division result and abnormal communication channel marking are added to the knowledge network to obtain the knowledge network after the community division.

[0127] Step S1312, a target knowledge network containing vertex attributes, vertex identifiers, physical location information, edge weight coefficients, community partition information and time stamps is generated, and the target knowledge network is updated in real time with the update of network interaction data.

[0128] The vertex attributes, vertex identifiers, physical location information, communication edge weight coefficients, community partition information and corresponding time stamps obtained in the above process are integrated to form a target knowledge network. The target knowledge network can comprehensively reflect the communication and operation relationship of the device nodes in the power monitoring system and the space-time coupling characteristics.

[0129] With the continuous acquisition and processing of new network interaction data, the target knowledge network will receive the feature information corresponding to these new data in real time, update the vertex attributes, communication edge attributes, weight coefficients and other contents, realize real-time iterative update, and ensure that the network can accurately reflect the latest security state of the system.

[0130] In step S1313, in each time sliding window, the mutual information value of the communication edge attribute and the operation attribute label is calculated, and the weight coefficient of the knowledge network edge is adjusted based on the mutual information value, including: in the current time sliding window, the communication edge attribute parameter set of all communication edges is extracted, the communication edge attribute parameters include protocol variation quantitative value, Boolean value of signature verification result and count of cross-region transmission mark; the communication edge attribute parameter set is standardized to obtain standardized communication edge attribute parameters; the operation attribute label parameter set of each device node is extracted, the operation attribute label parameter set includes statistical value of permission boundary crossing times, calculation value of non-periodic operation probability and mean value of cross-machine interaction frequency; the operation attribute label parameter set is normalized to obtain normalized operation attribute parameters; the standardized communication edge attribute parameters and the normalized operation attribute parameters of the connected device nodes are combined into a feature pair to construct a feature joint probability distribution of the feature pair; the edge probability distribution of the feature joint probability distribution is calculated, and the feature mutual information value is calculated based on the feature joint probability distribution and the edge probability distribution; when the feature mutual information value is higher than the upper threshold value of the mutual information threshold range, the weight coefficient of the corresponding communication edge is increased to obtain a first adjusted weight, and the increase amplitude is positively correlated with the degree of exceeding the upper threshold value; when the feature mutual information value is lower than the lower threshold value of the mutual information threshold range, the weight coefficient of the corresponding communication edge is reduced to obtain a second adjusted weight, and the reduction amplitude is positively correlated with the degree of being lower than the lower threshold value; the first adjusted weight and the second adjusted weight are normalized to obtain a normalized weight coefficient, and the adjustment amplitude, adjustment reason and numerical change before and after adjustment of the normalized weight coefficient are recorded to generate a weight change log, and the weight change log is stored in association with the identifier of the time sliding window.

[0131] In the current time sliding window, first, the communication edge attribute parameters of all communication edges are collected, the protocol variation quantitative value is a quantitative representation of the protocol field variation feature, the Boolean value of the signature verification result is represented by 0 and 1 respectively to indicate verification failure and success, and the count of cross-region transmission mark is the number of cross-region transmissions in the window.

[0132] The communication edge attribute parameter set is standardized by calculating the difference between each parameter and the mean value of the parameter in the historical window, and then dividing by the standard deviation, so that the processed parameters have the same scale, and the standardized communication edge attribute parameters are obtained.

[0133] The operation attribute label parameters of each device node are extracted, the statistical value of permission boundary crossing times is the total number of permission boundary crossings in the window, the calculation value of non-periodic operation probability is the ratio of non-periodic operation times to total operation times, and the mean value of cross-machine interaction frequency is the average number of cross-machine interactions per unit time.

[0134] The operation attribute label parameter set is normalized, each parameter value is mapped to the range of 0-1, and the normalized operation attribute parameter is calculated in the manner of (parameter value-parameter minimum value) / (parameter maximum value-parameter minimum value).

[0135] The normalized communication edge attribute parameter and the normalized operation attribute parameter of the two connected device nodes are respectively formed into feature pairs. For example, a communication edge connects node A and node B, and two feature pairs are formed, i.e., (normalized communication edge attribute parameter, normalized operation attribute parameter of node A) and (normalized communication edge attribute parameter, normalized operation attribute parameter of node B).

[0136] According to the frequency of the parameters in the feature pair, a feature joint probability distribution is constructed, which represents the probability of the simultaneous occurrence of the two parameters. The marginal probability distribution of the feature joint probability distribution is calculated, i.e., the probability of the occurrence of each parameter alone.

[0137] The feature mutual information value is calculated based on the feature joint probability distribution and the marginal probability distribution, in the manner of taking the logarithm of the ratio of the product of the feature joint probability distribution and the two marginal probability distributions, then multiplying the feature joint probability distribution and summing.

[0138] A mutual information threshold range is set. When the feature mutual information value is higher than the upper threshold of the range, it indicates that the communication edge attribute and the operation attribute label are strongly associated, and the weight coefficient of the corresponding communication edge is increased. The increase is increased with the degree to which the mutual information value exceeds the upper threshold. The first adjustment weight is obtained.

[0139] When the feature mutual information value is lower than the lower threshold of the range, it indicates that the two are weakly associated, and the weight coefficient of the corresponding communication edge is decreased. The decrease is increased with the degree to which the mutual information value is lower than the lower threshold. The second adjustment weight is obtained.

[0140] The first adjustment weight and the second adjustment weight are normalized to make the weight coefficient in a reasonable range (such as 0-10), and the normalized weight coefficient is obtained. The adjustment range (such as the value of increase or decrease), the adjustment reason (such as the mutual information value being too high or too low), and the change of the value before and after the adjustment are recorded to generate a weight change log, which is stored in association with the identifier of the current time sliding window for subsequent tracing and analysis.

[0141] In step S140, the abnormal conduction path tracking is performed through the target knowledge network to generate a safety state evaluation result, which includes an abnormal source identifier, a conduction node sequence, and an influence domain boundary.

[0142] In step S141, based on the preset abnormal feature library, an initial abnormal node is identified in the target knowledge network, and an initial abnormal node identifier is obtained. The initial abnormal node is a device node whose communication edge attribute or operation attribute label exceeds the normal threshold range.

[0143] The preset abnormal feature library stores the normal threshold range of various communication edge attributes and operation attribute labels, such as the normal range of protocol variation degree, the normal upper limit of permission boundary crossing times, etc. In the target knowledge network, the communication edge attributes and operation attribute labels of each device node are checked one by one, and those device nodes whose communication edge attributes and operation attribute labels exceed the normal threshold range are identified as initial abnormal nodes.

[0144] A unique initial abnormal node identifier is assigned to each initial abnormal node, which is associated with the node's vertex identifier, so as to accurately point to the corresponding node.

[0145] In step S142, an initial abnormal propagation factor is assigned to the initial abnormal node corresponding to the initial abnormal node identifier, and an initial abnormal propagation factor is obtained. The initial value of the abnormal propagation factor is determined based on the type of abnormal feature and the degree of deviation from the normal range.

[0146] According to the type of abnormal feature of the initial abnormal node, such as protocol field variation abnormality, permission boundary crossing abnormality, etc., and the degree of deviation from the normal range (such as the greater the deviation value, the higher the initial value), an initial abnormal propagation factor is assigned to each initial abnormal node. For example, if the protocol variation degree of a node is far beyond the normal range, a higher initial abnormal propagation factor is assigned to it; if the permission boundary crossing degree of a node is relatively light, the deviation from the normal range is relatively small, and a relatively low initial abnormal propagation factor is assigned. When determining the initial abnormal propagation factor, the initial value of the propagation factor corresponding to the same type of abnormal feature in the historical abnormal event can be referred to, and the running state of the current system can be adjusted to ensure the rationality of the initial value. For example, when the system is in a high load running state, for the same type and deviation degree of abnormality, its initial abnormal propagation factor can be appropriately increased, because the anti-interference ability of the system under high load is relatively weak, and the abnormality is more likely to propagate.

[0147] In step S143, the initial abnormal propagation factor is propagated to the adjacent nodes in order according to the weight coefficient of the communication edge in the target knowledge network from high to low, and the propagated abnormal value is obtained. During the propagation process, the value of the abnormal propagation factor is attenuated according to the anti-interference coefficient of the node.

[0148] In step S1431, all communication edges connected to the initial abnormal node in the target knowledge network are sorted in descending order according to the weight coefficient, and a communication edge propagation priority is generated.

[0149] In the target knowledge network, all communication edges connected with the initial abnormal node are found, and the weight coefficients of each communication edge are extracted. These weight coefficients are arranged in descending order, and the corresponding communication edges are also sorted, forming the communication edge propagation priority. After sorting, the adjacent node corresponding to the communication edge with the highest weight coefficient will receive the propagation of the abnormal propagation factor first.

[0150] In step S1432, a priority sequence number is assigned to each communication edge in the communication edge propagation priority, and a priority sequence number assignment result is obtained.

[0151] According to the sorting result of the communication edge propagation priority, a priority sequence number is assigned to each communication edge, with the highest priority communication edge assigned sequence number 1, the second highest priority communication edge assigned sequence number 2, and so on. Through the priority sequence number, the propagation order of the abnormal propagation factor can be clearly determined, ensuring that the propagation is in the order of weight coefficient from high to low.

[0152] In step S1433, the adjacent node corresponding to the communication edge with the highest weight coefficient is selected as the first propagation node from the priority sequence number assignment result, and a first propagation node identifier is obtained.

[0153] According to the priority sequence number assignment result, the communication edge with sequence number 1 is selected, and the adjacent node corresponding to this communication edge is the first propagation node. The identifier information of this node, i.e. the first propagation node identifier, is recorded.

[0154] In step S1434, the anti-interference coefficient of the first propagation node corresponding to the first propagation node identifier is queried, and a first node anti-interference coefficient is obtained. The anti-interference coefficient is calculated based on the security protection level, patch update status, historical abnormal record and running load of the node.

[0155] The anti-interference coefficient of each node is pre-stored in the system, and the calculation of the anti-interference coefficient considers multiple attributes of the node. Among them, the higher the security protection level, the larger the anti-interference coefficient; the more timely the patch update, the larger the anti-interference coefficient; the fewer the historical abnormal records, the larger the anti-interference coefficient; the lower the running load, the larger the anti-interference coefficient. By querying the information stored in the system, the anti-interference coefficient of the first propagation node, i.e. the first node anti-interference coefficient, is obtained.

[0156] In step S1435, the first node anti-interference coefficient is used to calculate the decay ratio of the abnormal propagation factor, and a first decay ratio is obtained. The anti-interference coefficient and the decay ratio are positively correlated.

[0157] The positive correlation between the anti-interference coefficient and the attenuation ratio means that the greater the anti-interference coefficient of a node is, the higher the attenuation ratio of the abnormal propagation factor when propagating to the node is. For example, if the anti-interference coefficient of the first node is 0.7, the corresponding attenuation ratio can be 0.3; if the anti-interference coefficient is 0.5, the attenuation ratio can be 0.2. The specific corresponding relationship is determined by a preset mapping rule.

[0158] In step S1436, the abnormal propagation factor of the initial abnormal node is multiplied by (1-first attenuation ratio) to obtain the abnormal value of the first propagation node.

[0159] After the initial abnormal propagation factor is attenuated by the first attenuation ratio, the abnormal value of the first propagation node is obtained. For example, if the initial abnormal propagation factor is 0.8 and the first attenuation ratio is 0.3, the abnormal value of the first propagation node is 0.56.

[0160] In step S1437, when the abnormal value to the first propagation node exceeds the abnormal threshold of the first propagation node, the first propagation node is added to the conduction node sequence, and the joining time and the corresponding propagation source node are recorded to obtain an updated conduction node sequence.

[0161] Each node is provided with an abnormal threshold, which is determined according to the type, function and historical running data of the node. When the abnormal value of the first propagation node exceeds its abnormal threshold, it means that the node has been affected by the abnormality, and it is added to the conduction node sequence. At the same time, the time when the node joins the sequence and the identification of the propagation source node are recorded to form an updated conduction node sequence.

[0162] In step S1438, the first propagation node is taken as a new starting point, and the above propagation process is repeated until the abnormal propagation factor is attenuated to below a preset threshold, and a conduction node sequence after multiple rounds of propagation is obtained.

[0163] The first propagation node is taken as a new abnormal source, and the abnormal value is propagated to its adjacent nodes according to the procedures of steps S1431 to S1437. Each time of propagation, the abnormal value of the current node is taken as the propagation factor, the attenuation ratio is calculated according to the anti-interference coefficient of the new propagation node, and a new abnormal value is obtained. This is repeated until the abnormal propagation factor is attenuated to below a preset threshold, and the propagation is stopped. At this time, the obtained conduction node sequence is the conduction node sequence after multiple rounds of propagation.

[0164] In step S1439, the adjacent nodes corresponding to the other communication edges are processed in turn according to the propagation priority list, and the abnormal values, propagation sequences and corresponding propagation source nodes of the nodes are recorded to obtain complete propagation records.

[0165] After the first propagation node is processed, the other adjacent nodes corresponding to the communication edges are processed in turn according to the priority order, and the processes of steps S1433 to S1438 are repeated. During the processing, the abnormal value, the propagation order (i.e., the corresponding priority order) and the identification of the propagation source node of each node are recorded in detail, and the information is summarized to form a complete propagation record.

[0166] Step S14310, during the propagation, if the node has been in the sequence of the conduction nodes, the abnormal value of the node is not calculated again, and only the cumulative value of the abnormal propagation factor and the latest propagation source node of the node are updated to obtain the abnormal value cumulative update result of the node.

[0167] When the abnormality propagates to a node that has been in the sequence of the conduction nodes, the abnormal value of the node is not recalculated, but the abnormal value newly propagated is added to the cumulative value of the abnormal propagation factor of the node to obtain a new cumulative value. At the same time, the latest propagation source node of the node is updated to the source node of the current propagation to form the abnormal value cumulative update result of the node.

[0168] Step S14311, when multiple propagation source nodes propagate abnormal propagation factors to the same node, the abnormal value of the node is the sum of the abnormal values propagated by the propagation source nodes to obtain the abnormal value of the multi-source propagation node.

[0169] If multiple different propagation source nodes propagate abnormal values to the same node at the same time or in sequence, the final abnormal value of the node is the sum of the abnormal values propagated by all the propagation source nodes. For example, node A obtains an abnormal value of 0.3 from a propagation source B and an abnormal value of 0.2 from a propagation source C, and the abnormal value of the multi-source propagation node A is 0.5.

[0170] Step S14312, the change process of the abnormal value of each node is recorded to generate an abnormal value-time curve to obtain an abnormal value-time curve.

[0171] From the start of the abnormal propagation, the abnormal value of each node is recorded regularly, and the time is taken as the horizontal axis and the abnormal value is taken as the vertical axis to draw the abnormal value-time curve of each node. Through the abnormal value-time curve, the change trend of the abnormal value of the node can be observed intuitively, including the rising, falling, stable and other states.

[0172] Step S144, the nodes through which the abnormal value flows after the propagation and the propagation time are recorded to generate a sequence of conduction nodes, and the sequence of conduction nodes includes the abnormal value of each node, the infection time and the corresponding propagation path identification.

[0173] During the whole process of anomaly propagation, each node through which the propagated anomaly value passes and the propagation time (i.e., the infection time) of the anomaly value to the node are recorded in real time. A unique propagation path identifier is assigned to each propagation path, which is associated with the priority sequence number, the propagation source node and other information in the propagation process. The node identifier, the anomaly value, the infection time and the propagation path identifier and other information are arranged in chronological order to form a conduction node sequence.

[0174] In step S145, when the propagated anomaly value decays below a preset threshold, the propagation is stopped and the current node is marked as a conduction boundary node, and a conduction boundary node identifier is obtained.

[0175] The preset threshold is an anomaly value limit set in the system. When the propagated anomaly value decreases below the threshold, it is considered that the anomaly no longer has the ability to propagate or the impact on the system can be ignored. At this time, the propagation of the anomaly value to the adjacent nodes of the node is stopped, and the current node is marked as a conduction boundary node, and the identification information, i.e., the conduction boundary node identifier, is recorded.

[0176] In step S146, an anomaly conduction path topology is constructed by taking the initial anomaly node identifier as the starting point and the conduction boundary node identifier as the end point, and combining the conduction node sequence, and an anomaly conduction path topology structure is obtained.

[0177] According to the initial anomaly node identifier and the conduction boundary node identifier, all nodes from the starting point to the end point and the corresponding propagation relationship in the conduction node sequence are filtered out. The nodes are taken as vertices, and the propagation relationship between the nodes is taken as edges to construct an anomaly conduction path topology. In the topology structure, the connection mode, the propagation direction and the propagation order between the nodes and other information are clearly displayed to form an anomaly conduction path topology structure.

[0178] In step S147, a path identifier is assigned to each anomaly conduction path in the anomaly conduction path topology structure, and the number of nodes on the anomaly conduction path and the total propagation time are recorded to obtain an anomaly conduction path identifier and time record.

[0179] Each independent anomaly conduction path in the anomaly conduction path topology structure is identified, and a unique path identifier is assigned. At the same time, the number of nodes included in each path and the total propagation time from the initial anomaly node to the conduction boundary node are counted, and these information are stored in association with the path identifier to obtain an anomaly conduction path identifier and time record.

[0180] In step S148, the function type of the device node through which the anomaly conduction path passes is analyzed, the affected system module and business process are determined, and the impact domain boundary is delineated, the impact domain boundary includes a physical boundary and a logical boundary, the physical boundary is determined based on the physical location of the device node, and the logical boundary is determined based on the functional association of the system module.

[0181] Firstly, the function type of each device node passed through by the abnormal conduction path is determined, such as server node, switch node, remote device node, etc. According to the function type of the device node, the system module affected by the anomaly is inferred, for example, server node anomaly may affect data storage module, switch node anomaly may affect communication module, etc. Further, the role of these system modules in the business process is analyzed to determine the affected business process, such as data acquisition process, control instruction issuing process, etc.

[0182] The physical boundary is determined according to the physical location information of the device node, and the physical area where all the affected and possibly affected device nodes are located is determined as the physical boundary, for example, a specific machine room area of a substation. The logical boundary is determined according to the functional association of the system module, and other modules that have functional interaction with the affected system module are included in the logical boundary, for example, data processing module, data display module, etc. associated with the data storage module.

[0183] Step S149, integrate the initial abnormal node identification, conduction node sequence, abnormal conduction path topology structure, abnormal conduction path identification and time record, and the range description of the impact domain boundary to generate a security state evaluation result.

[0184] The initial abnormal node identification, conduction node sequence, abnormal conduction path topology structure, abnormal conduction path identification and time record, and the range description of the impact domain boundary are summarized and integrated to form a security state evaluation result, which comprehensively reflects the propagation of the anomaly in the power monitoring system, the impact range and other information.

[0185] Step S150, generate a hierarchical protection instruction set according to the security state evaluation result, and distribute the hierarchical protection instruction set to the partition control node of the power monitoring system to start the cooperative protection mechanism.

[0186] Step S150, generate a hierarchical protection instruction set according to the security state evaluation result, and distribute the hierarchical protection instruction set to the partition control node of the power monitoring system to start the cooperative protection mechanism.

[0187] After obtaining the security state evaluation result, a corresponding protection strategy needs to be developed based on the result, a hierarchical protection instruction set is generated, and it is distributed to the appropriate partition control node to start the cooperative protection mechanism, so as to effectively cope with the security threats existing in the power monitoring system.

[0188] Step S151, analyze the abnormal source identification in the security state evaluation result to determine the abnormal type and initial attack vector, query the corresponding protection strategy library, and the protection strategy library contains the protection measures, execution steps and parameter range corresponding to different abnormal types, and obtain the abnormal type and protection strategy.

[0189] The abnormal source identification in the security state evaluation result is parsed to determine the device node where the abnormal source is located and the abnormal situation of the node. According to the characteristics of the abnormal source, the abnormal type is determined, such as protocol field variation abnormality, permission boundary exception, non-periodic operation exception, etc. At the same time, the possible initial attack vector is analyzed, that is, the way in which the attack enters the system and causes the exception, such as through an abnormal communication message, a privileged operation instruction, etc.

[0190] The pre-established protection strategy library is queried, and the protection strategy library stores corresponding protection measures, execution steps and parameter ranges for different abnormal types. For example, for the protocol field variation abnormality, the protection strategy may include filtering of abnormal messages, upgrading of related protocol analysis modules, etc.; for the permission boundary exception, the protection strategy may include reconfiguration of operation permissions, interception of privileged operations, etc. According to the determined abnormal type, the corresponding protection strategy is obtained from the protection strategy library to obtain the abnormal type and the protection strategy.

[0191] In step S152, the protection level division result is obtained according to the length of the conduction node sequence in the security state evaluation result, the node importance and the abnormal value size.

[0192] The conduction node sequence in the security state evaluation result is analyzed, and the length of the conduction node sequence, that is, the number of nodes through which the exception propagates from the abnormal source to the boundary node, is counted. The more the number of nodes, the wider the range of abnormal propagation, and the greater the potential threat to the system.

[0193] The importance of each node in the conduction node sequence is evaluated. The node importance is determined according to the function and role of the node in the power monitoring system. For example, the server node of the dispatching center and the remote device node of the key substation are important nodes, and the influence of their abnormality on the system is greater; while some auxiliary terminal device nodes have relatively low importance.

[0194] At the same time, the abnormal value size of each node is considered. The larger the abnormal value, the deeper the degree of influence of the node by the exception. By comprehensively considering the length of the conduction node sequence, the node importance and the abnormal value size, the protection level is divided into different levels, such as first-level protection, second-level protection, third-level protection, etc., to obtain the protection level division result. The first-level protection corresponds to the situation of wide abnormal influence range, important nodes involved and large abnormal value, and the most stringent protection measures need to be taken; the third-level protection corresponds to the situation of small abnormal influence range, low node importance involved and small abnormal value, and the protection measures are relatively loose.

[0195] Step S153, for the abnormal source identification in the security state evaluation result, the corresponding device node is generated based on the protection level division result Abnormal source isolation instruction, the abnormal source isolation instruction contains port closing parameter, communication blocking range, isolation duration and isolation mode, isolation mode includes physical isolation and logical isolation, physical isolation is realized by disconnecting physical connection, logical isolation is realized by setting access control list.

[0196] For the abnormal source identification in the security state evaluation result, the corresponding device node is generated according to the protection level division result Abnormal source isolation instruction, to prevent further spread of abnormality. Abnormal source isolation instruction contains multiple parameters, in which port closing parameter specifies the device port that needs to be closed, these ports may be the entrance or exit of abnormal communication; Communication blocking range specifies the communication object that needs to be blocked, such as specific IP address, network segment, etc.; Isolation duration sets the length of time for isolating abnormal source, ensuring enough time for subsequent detection and repair work; Isolation mode is divided into physical isolation and logical isolation, physical isolation is realized by disconnecting the physical connection of the device, such as unplugging the network cable; Logical isolation is realized by setting access control list in network device to limit the communication between abnormal source node and other nodes.

[0197] For example, when the protection level is level one, the abnormal source isolation instruction may require closing all external communication ports of the abnormal source node, blocking communication with all external network segments, and isolating for 24 hours with physical isolation; When the protection level is level three, it may only close part of the suspicious port, block communication with specific IP address, isolate for 1 hour with logical isolation.

[0198] Step S154, for the intermediate node in the conduction node sequence in the security state evaluation result, the intermediate node detection instruction is generated combining the protection level division result, the intermediate node detection instruction contains deep scanning range, log audit focus, suspicious process killing parameter and detection frequency.

[0199] For example, step S1541, analyze the device type of the intermediate node in the conduction node sequence, determine the range of deep scanning, for server node, the scanning range covers system kernel, application program, database, configuration file and process space; For terminal device node, the scanning range covers operating system process, registry, peripheral interface, system service and installed software, and the deep scanning range definition result is obtained.

[0200] According to whether the intermediate node is a server node or a terminal device node, different deep scanning ranges are determined respectively, the server node focuses on system core and application data related area, and the terminal device node focuses on operating system and external interaction related part, forming the deep scanning range definition result.

[0201] Step S1542, based on the deep scanning range definition result, extract the system log of the intermediate node in the abnormal conduction period, including system event log, application log, security log and network log, to obtain the set of system logs to be audited.

[0202] According to the deep scanning range, collect the various types of system logs of the intermediate node from the abnormal start to the current period, and form the set of system logs to be audited.

[0203] Step S1543, determine the log audit focus from the set of system logs to be audited, including login event, file modification record, network connection log, process creation and termination record and permission change record, mark the time window and event type that need to be audited, and obtain the log audit focus identification.

[0204] In the set of system logs to be audited, filter out the key event records related to security, mark the time window and event type of their occurrence, and form the log audit focus identification.

[0205] Step S1544, query the process list of the intermediate node, and identify the suspicious process characteristics in combination with the abnormal feature library, including process name, process path, parent process ID, resource occupation, network connection behavior and registry operation behavior, to obtain the suspicious process characteristic description.

[0206] Get the process list currently running on the intermediate node, compare it with the features in the abnormal feature library, identify the processes with suspicious features and describe their characteristics, and obtain the suspicious process characteristic description.

[0207] Step S1545, determine the suspicious process killing parameters according to the suspicious process characteristic description, including process identifier, associated file path, registry item, killing method and cleaning operation after killing, the killing method includes forced termination and normal exit, the forced termination is suitable for the process that cannot normally exit, and the normal exit is suitable for the process that can respond to termination instruction, to obtain the suspicious process killing parameter configuration.

[0208] According to the suspicious process characteristic description, the identification of the process to be killed, the related files and registry items are determined, the appropriate killing method and subsequent cleaning operation are selected, and the suspicious process killing parameter configuration is formed.

[0209] Step S1546, set the execution time of the deep scanning, obtain the scanning execution time arrangement, and configure the output format of the log audit, to obtain the log audit output format setting.

[0210] According to the intermediate node service load condition, a service idle period is selected as a deep scanning opportunity, and fields, formats and storage paths of log audit results are specified to form a scanning execution opportunity arrangement and a log audit output format setting.

[0211] In step S1547, a suspicious process killing sequence is constructed, and the suspicious processes are sequentially killed from small to large in the influence range and from low to high in the importance degree, to obtain a process killing sequence plan.

[0212] According to the sequence of the influence range and the importance degree of the suspicious processes on the system, the killing sequence is determined, and the processes with small influence and low importance are processed first to obtain a process killing sequence plan.

[0213] In step S1548, the deep scanning range definition result, the log audit focus identification, the suspicious process killing parameter configuration, the scanning execution opportunity arrangement, the log audit output format setting and the process killing sequence plan are integrated into the specific content of the detection instruction to obtain initial detection instruction content.

[0214] The above results are logically integrated to form initial detection instruction content, and it is ensured that the instruction covers all necessary information.

[0215] In step S1549, a check code is added to the initial detection instruction content to obtain a detection instruction with a check code, and the instruction identification, generation time and validity period information are added to the detection instruction with a check code, and the validity period information is used to limit the execution time range of the instruction to obtain a final detection instruction.

[0216] The check code of the initial detection instruction content is calculated and added, and the instruction identification, generation time and validity period are added to form a final executable intermediate node detection instruction.

[0217] In step S155, a boundary node reinforcement instruction is generated according to the protection level division result for the uninfected nodes within the influence domain boundary in the security state evaluation result, and the boundary node reinforcement instruction contains access control list update parameters, password reset requirements, patch installation list and security policy adjustment content.

[0218] For the uninfected nodes within the influence domain boundary in the security state evaluation result, in order to prevent abnormal expansion to these nodes, a boundary node reinforcement instruction needs to be generated according to the protection level division result. The boundary node reinforcement instruction aims to improve the security protection capability of these nodes.

[0219] The access control list update parameter specifies the access control rules that need to be added, modified or deleted to limit unnecessary network access and only allow necessary communication traffic to pass. The password reset requirement specifies the user accounts that need to reset the password and the password complexity requirement such as password length, character type contained, etc. to improve the security of the account.

[0220] The patch installation list lists the security patches that need to be installed for the node, which are used to fix security vulnerabilities in the node's operating system or application. The security policy adjustment content includes the adjustment of the firewall policy, intrusion detection policy, etc. of the node to enhance the defense capability of the node against abnormal attacks.

[0221] For example, when the protection level is level one, the border node reinforcement instruction may require strict updating of the access control list, prohibiting most external access, forcing all user accounts to reset to high complexity passwords, installing all available security patches, and enabling strict firewall and intrusion detection policies; when the protection level is level three, it may only need to update part of the key access control rules, reset the password for part of the important accounts, install important security patches, and adjust the security policy appropriately.

[0222] Step S156, the abnormal source isolation instruction, the intermediate node detection instruction and the border node reinforcement instruction are classified according to the protection level to form a hierarchical protection instruction set, and each instruction in the hierarchical protection instruction set contains an execution priority, a timeout retry number, an execution condition and a feedback requirement.

[0223] The generated abnormal source isolation instruction, intermediate node detection instruction and border node reinforcement instruction are classified according to the protection level, and the instructions of the same protection level are classified into a group to form a hierarchical protection instruction set. Each instruction contains multiple attributes, the execution priority is used to determine the execution order of the instruction, the instruction with high priority is executed first; the timeout retry number specifies the number of retries after the instruction execution times out; the execution condition specifies the conditions required for the instruction execution, such as execution within a specific time window, execution after a certain pre-instruction execution succeeds, etc.; the feedback requirement specifies the result information returned after the instruction execution, such as execution status, execution time, logs generated during execution, etc.

[0224] Step S157, according to the partition topology of the power monitoring system, determine the partition control node corresponding to each hierarchical protection instruction in the hierarchical protection instruction set, establish the mapping relationship between the hierarchical protection instruction and the partition control node, and obtain the instruction node mapping table.

[0225] The partition topology of the power monitoring system shows the partition structure of the system and the device range governed by each partition control node. According to the partition topology, analyze the partition to which the device node corresponding to each hierarchical protection instruction belongs, and determine the corresponding partition control node.

[0226] The mapping relationship between the hierarchical protection instructions and the partition control nodes is established, that is, each hierarchical protection instruction corresponds to one or more partition control nodes responsible for executing the instruction, forming an instruction node mapping table. For example, a certain exception source isolation instruction is directed to a device node belonging to partition A, so the hierarchical protection instruction corresponds to the control node of partition A; a certain boundary node reinforcement instruction involves part of the nodes of partition B and partition C, so the instruction corresponds to the control nodes of partition B and partition C.

[0227] In step S158, the hierarchical protection instruction set is encrypted to obtain an encrypted protection instruction set, which is then distributed to the partition control nodes corresponding to the instruction node mapping table. The instruction sending time, sending frequency and receiving confirmation information are recorded to obtain instruction distribution records.

[0228] In order to ensure the security of the hierarchical protection instruction set during transmission and prevent the instructions from being tampered with or stolen, the hierarchical protection instruction set needs to be encrypted. An encryption algorithm is used to encrypt the instruction set. The encryption algorithm can be a symmetric encryption algorithm or an asymmetric encryption algorithm that meets security standards.

[0229] The encrypted protection instruction set is distributed to the partition control nodes corresponding to the instruction node mapping table through a secure communication channel. During distribution, the sending time, sending frequency (including first sending and retry sending) of each instruction and the receiving confirmation information returned by the partition control nodes, such as the time of confirming receipt, the receiving state, etc., are recorded to form instruction distribution records.

[0230] In step S159, the instruction execution results returned by the partition control nodes are received to obtain instruction execution feedback. The instruction execution results include execution status, execution time and log information generated during execution.

[0231] The partition control nodes can return instruction execution results after executing the received hierarchical protection instructions. Receiving these execution results obtains instruction execution feedback. The instruction execution results record the execution status of the instructions in detail, such as successful execution, partial execution success, execution failure, etc.; the execution time includes the time when the instruction starts to execute and the time when the execution is completed; the log information generated during execution records the specific operations and situations encountered during the execution of the instructions, such as closed ports, killed processes, installed patches, etc.

[0232] In step S180, when the execution results in the instruction execution feedback do not meet the expectations, the protection instructions are regenerated and distributed to obtain instruction adjustment and retransmission results.

[0233] The instruction execution feedback is analyzed to determine whether the instruction execution result is expected. If the execution result is not expected, such as instruction execution failure, execution effect not reaching protection requirements, etc., the feedback information needs to be found to re-generate the protection instruction.

[0234] The re-generated protection instruction can need to adjust instruction parameters, execution steps or execution conditions, etc. Then, the re-generated protection instruction is distributed to the corresponding partition control node again according to the above distribution process, and the instruction adjustment content, re-transmission time, re-transmission times and new execution result, etc. are recorded to obtain the instruction adjustment and re-transmission result.

[0235] Figure 2 A schematic diagram of exemplary hardware and software components of the network security monitoring system 100 applied to the power monitoring system, which can implement the idea of the present application, is shown. For example, the processor 120 can be used in the network security monitoring system 100 applied to the power monitoring system, and used to execute the functions in the present application.

[0236] For example, the network security monitoring system 100 applied to the power monitoring system can include a network port 110 connected to a network, one or more processors 120 for executing program instructions, a communication bus 130, and different forms of storage media 140, such as a disk, a ROM, or a RAM, or any combination thereof. Exemplarily, the network security monitoring system 100 applied to the power monitoring system can also include program instructions stored in a ROM, a RAM, or other types of non-transitory storage media, or any combination thereof. The method of the present application can be implemented according to these program instructions. The network security monitoring system 100 applied to the power monitoring system also includes an I / O interface 150 between the computer and other input / output devices.

[0237] In addition, the present application also provides a readable storage medium, wherein computer executable instructions are pre-set in the readable storage medium, and when the processor executes the computer executable instructions, the network security monitoring method applied to the power monitoring system is implemented.

[0238] It should be noted that, in order to simplify the description of the present application and help understand one or more embodiments of the present application, in the foregoing description of the embodiments of the present application, various features are sometimes combined into one embodiment, drawing or description thereof.

Claims

1. A network security monitoring method applied to a power monitoring system, characterized in that, The method includes: Acquire a set of network interaction data from a power monitoring system, the set of network interaction data including device communication messages, operation instruction sequences, and system status logs; The network interaction data set is subjected to security feature parsing to obtain network communication features and operation behavior features. The network communication features include protocol field variation features, cross-regional transmission features, and message signature verification results. The operation behavior features include instruction permission overrun features, non-periodic operation features, and inter-machine interaction features. A target knowledge network is constructed based on the network communication features and the operational behavior features. The target knowledge network is used to characterize the spatiotemporal coupling relationship between the network communication features and the operational behavior features. Anomaly propagation path tracing is performed through the target knowledge network to generate a security status assessment result, which includes anomaly source identifier, propagation node sequence, and influence domain boundary. A graded protection instruction set is generated based on the security status assessment results, and the graded protection instruction set is distributed to the partition control nodes of the power monitoring system to activate the collaborative protection mechanism; The construction of the target knowledge network based on the network communication features and the operational behavior features includes: The network vertices are the device nodes of the power monitoring system, which include server nodes, switch nodes, remote control device nodes, and terminal device nodes. A unique vertex identifier is assigned to each device node, and the physical location information and functional module to which the device node belongs are recorded to obtain vertex attribute information; The network communication features are mapped to communication edge attributes between vertices to obtain initial communication edge attributes, which include protocol variability, signature verification results, and cross-regional transmission markers. Based on the initial communication edge attributes, an initial weight value is set for each communication edge to obtain the initial weight configuration. The initial weight value is determined based on the historical communication frequency and communication stability. The operation behavior features are mapped to vertex operation attribute labels to obtain vertex operation attributes. The operation attribute labels include the number of permission out-of-bounds occurrences, the probability of non-periodic operations, and the frequency of inter-machine interaction. An initial knowledge network is constructed based on the physical connection relationships of device nodes, vertex attribute information, initial communication edge attributes, initial weight configuration, and vertex operation attributes. Set the time sliding window of the initial knowledge network to obtain the knowledge network with time window. In each time sliding window of the knowledge network with time window, calculate the mutual information value of the communication edge attribute and the operation attribute label. Adjust the weight coefficient of the knowledge network edge based on the mutual information value to obtain the weight-adjusted knowledge network. Monitor the state changes of device nodes in the knowledge network after weight adjustment, and dynamically update the vertex attributes and connection relationships of associated edges of the knowledge network when the device node goes offline, restarts, or undergoes configuration changes. When a node goes offline, its corresponding vertex is marked as invalid, and the communication edges connected to that vertex are temporarily removed, resulting in the knowledge network after the node goes offline. When a node restarts or its configuration changes, its corresponding vertex is restored to an active state, communication edges with other nodes are re-established, communication edge attributes are updated, and the knowledge network after the node is restored is obtained. The knowledge network after node recovery is partitioned and clustered using a community detection algorithm to identify node clusters with similar communication and operational characteristics, mark abnormal communication channels between node clusters, and obtain the knowledge network after cluster division. A target knowledge network is generated, which includes vertex attributes, vertex identifiers, physical location information, edge weight coefficients, community partitioning information, and timestamps. The target knowledge network is iteratively updated in real time as the network interaction data is updated.

2. The network security monitoring method applied to a power monitoring system according to claim 1, characterized in that, The security feature parsing process performed on the network interaction data set to obtain network communication features and operational behavior features includes: The protocol frame structure in the device communication message is parsed, the frame header verification field, function code field and data field are extracted, the standard field length and encoding rules in the preset protocol template library are compared, the field bit offset and redundant byte insertion are identified, and the protocol field variation characteristics are generated. The source IP network segment and destination IP network segment of the device communication message are tracked. Combined with the physical partition topology map of the power monitoring system, it is determined whether the communication path crosses the security isolation device and the vertical encryption device, the number of crossings and the alarm information of the isolation device are recorded, and cross-regional transmission characteristics are generated. The digital certificate verification module is invoked to decrypt and verify the signature field in the device communication message, compares the preset public key of the sending device with the signature decryption result, and generates a message signature verification result containing a verification pass flag or a verification failure reason. Extract the permission identifier field from the operation instruction sequence, match it with the device permission configuration table of the operation execution end, detect instruction records with mismatched permission levels and out-of-bounds permission ranges, and generate instruction permission out-of-bounds features; The generation time interval of statistical operation instructions is analyzed, the frequency and type distribution of instructions that deviate from the preset operation cycle are analyzed, and non-periodic operation characteristics are generated by combining the historical operation time sequence model. Identify the initiating and receiving device identifiers of operation commands, query the device affiliation table, mark command interaction records across plants and bays, and generate inter-machine interaction features; The protocol field variation characteristics, the cross-regional transmission characteristics, and the message signature verification results are integrated into network communication characteristics. The instruction permission over-boundary feature, the non-periodic operation feature, and the inter-machine interaction feature are integrated into an operation behavior feature; The network communication features and the operational behavior features are time-stamp aligned to ensure that the feature dimensions of the two remain matched within the same monitoring period. A feature association index table is established to record the correspondence between network communication features and operational behavior features. The feature association index table includes feature identifiers, association weights, and timestamp information.

3. The network security monitoring method applied to a power monitoring system according to claim 2, characterized in that, The process involves parsing the protocol frame structure in the device communication message, extracting the frame header checksum field, function code field, and data field, comparing the standard field lengths and encoding rules in the preset protocol template library, identifying field bit offsets and redundant byte insertions, and generating protocol field variation features, including: The device communication messages are classified according to the protocol type to obtain the classified device communication messages. The protocol types include remote communication protocol, monitoring information transmission protocol and network time synchronization protocol. The corresponding protocol's frame parser is invoked to parse the classified device communication messages, locate the start and end bytes of the frame header check field, extract the check value and compare it with the check result recalculated from the frame body data, record the frame structure positions where the check values ​​do not match, and obtain the frame header check anomaly record. Based on the frame header verification anomaly record, the binary bit string of the function code field is extracted, converted into a decimal function identifier, and the corresponding operation type is determined by querying the function code mapping table. Anomalies such as undefined function codes and function codes that do not match the operation type are marked to obtain function code anomaly records. Based on the function code anomaly record, the field separators and data format identifiers of the data field are parsed, the data units are split according to the standard encoding rules, and the phenomena of reversed field order, missing fields, and duplicate fields are detected to obtain the data field structure anomaly record. Based on the abnormal data field structure record, the actual byte length of each field is measured and the difference is calculated with the standard field length in the preset protocol template library. The names and deviation values ​​of fields whose length deviation exceeds the allowable range are recorded to obtain the field length deviation record. Based on the field length deviation record, special character sequences in the data field are scanned to identify non-standard padding bytes and hidden channel identifiers, and the insertion position and byte content of redundant bytes are marked to obtain the redundant byte insertion record; The field position offset in the field length deviation record is classified into levels to obtain the field offset classification result; The content of redundant bytes inserted into the record is subjected to pattern recognition to distinguish between random padding bytes, repeated padding bytes and padding bytes with a specific sequence, and the redundancy byte pattern recognition result is obtained. By integrating frame header verification anomaly records, function code anomaly records, data field structure anomaly records, field length deviation records, redundant byte insertion records, field offset grading results, and redundant byte pattern recognition results, protocol field variation features are generated.

4. The network security monitoring method applied to a power monitoring system according to claim 2, characterized in that, The step of extracting the permission identifier field from the operation instruction sequence, matching it with the device permission configuration table of the operation execution end, detecting instruction records with mismatched permission levels and out-of-bounds permission ranges, and generating instruction permission out-of-bounds features includes: Parse the permission identifier field in the operation instruction sequence to extract the user role code, operation permission level and operation authorization timestamp to obtain permission identifier information; Based on the permission identification information, the device permission configuration table of the operation execution terminal is retrieved. The device permission configuration table includes the device identifier, the range of allowed operation role codes, the maximum permission level limit, and the operation time period constraint. The user role code in the permission identification information is compared with the range of allowed role codes in the device permission configuration table. Role codes that are not in the range of allowed role codes and their corresponding instructions are marked to obtain a role permission mismatch record. By combining the role permission mismatch records, the operation permission level in the permission identification information is compared with the highest permission level limit in the device permission configuration table. The execution time of the instruction and the IP of the instruction initiating terminal when the permission level exceeds the highest permission level limit are recorded to obtain the permission level over-limit record. Based on the permission level out-of-bounds record, check whether the operation authorization timestamp in the permission identification information is within the operation period specified in the device permission configuration table, mark the operation instructions and instruction types of the unauthorized period, and obtain the operation record of the unauthorized period; The database associates user role codes with operation permission levels, detects abnormal bindings where roles and permission levels do not match, records the processing status of abnormal commands, and obtains abnormal role-permission binding records. The records of mismatched role permissions, out-of-bounds permission levels, unauthorized operation periods, and abnormal role permission binding are classified and statistically analyzed according to the instruction type. The frequency and percentage of out-of-bounds errors for each type of instruction are calculated to obtain the statistical results of out-of-bounds types. The above abnormal records were grouped according to time intervals, and the temporal distribution pattern of the boundary crossing behavior was analyzed to obtain the boundary crossing time distribution characteristics. Integrate records of role and permission mismatch, permission level out-of-bounds, unauthorized time period operation, role and permission binding anomaly, out-of-bounds type statistics, and out-of-bounds time distribution characteristics to generate command permission out-of-bounds characteristics.

5. The network security monitoring method applied to a power monitoring system according to claim 1, characterized in that, Within each time sliding window of the knowledge network with a time window, the mutual information value between the communication edge attribute and the operation attribute label is calculated. Based on the mutual information value, the weight coefficients of the knowledge network edges are adjusted to obtain the weight-adjusted knowledge network, including: Within the current time sliding window, extract the communication edge attribute parameter set of all communication edges. The communication edge attribute parameters include the protocol variation quantification value, the Boolean value of the signature verification result, and the count of the cross-regional transmission tag. The set of communication edge attribute parameters is standardized to obtain standardized communication edge attribute parameters; Extract the set of operation attribute label parameters for each device node. The set of operation attribute label parameters includes the statistical value of the number of permission overruns, the calculated value of the probability of non-periodic operations, and the average value of the frequency of inter-machine interaction. The set of operation attribute label parameters is normalized to obtain normalized operation attribute parameters; The standardized communication edge attribute parameters and the normalized operation attribute parameters of the connected device nodes are combined to form feature pairs, and the joint probability distribution of the feature pairs is constructed. Calculate the marginal probability distribution of the joint probability distribution of features, and calculate the feature mutual information value based on the joint probability distribution of features and the marginal probability distribution; When the mutual information value of the feature is higher than the upper limit of the mutual information threshold range, the weight coefficient of the corresponding communication edge is increased to obtain the first adjustment weight. The increase is positively correlated with the degree to which the mutual information value exceeds the upper limit threshold. When the feature mutual information value is lower than the lower limit of the mutual information threshold range, the weight coefficient of the corresponding communication edge is reduced to obtain the second adjustment weight. The reduction magnitude is positively correlated with the degree to which the mutual information value is lower than the lower limit threshold. The first adjustment weight and the second adjustment weight are normalized to obtain normalized weight coefficients. The adjustment range, adjustment reason and numerical change before and after the adjustment of the normalized weight coefficients are recorded to generate a weight change log. The weight change log is stored in association with the identifier of the time sliding window.

6. The network security monitoring method applied to a power monitoring system according to claim 1, characterized in that, The step of performing anomaly propagation path tracing through the target knowledge network and generating a security status assessment result includes: Based on a preset abnormal feature library, an initial abnormal node is identified in the target knowledge network to obtain an initial abnormal node identifier. The initial abnormal node is a device node whose communication edge attribute or operation attribute label exceeds the normal threshold range. Assign an anomaly propagation factor to the initial anomaly node corresponding to the initial anomaly node identifier to obtain the initial anomaly propagation factor. The initial value of the anomaly propagation factor is determined based on the type of anomaly feature and the degree of deviation from the normal range. According to the weight coefficients of the communication edges in the target knowledge network from high to low, the initial anomaly propagation factor is propagated to the adjacent nodes in turn to obtain the propagated anomaly value. During the propagation process, the value of the anomaly propagation factor is attenuated according to the anti-interference coefficient of the node. Record the nodes through which the outliers flow and the propagation time after propagation, and generate a transmission node sequence. The transmission node sequence includes the outlier value, the time of infection, and the corresponding propagation path identifier of each node. When the propagated outlier decays to below a preset threshold, propagation stops and the current node is marked as a propagation boundary node, thus obtaining the propagation boundary node identifier. Starting from the initial abnormal node identifier and ending at the propagation boundary node identifier, the abnormal propagation path topology is constructed by combining the propagation node sequence, thus obtaining the abnormal propagation path topology structure. Assign a path identifier to each abnormal propagation path in the abnormal propagation path topology, record the number of nodes on the abnormal propagation path and the total propagation time, and obtain the abnormal propagation path identifier and time record; Analyze the functional types of the device nodes along the abnormal propagation path, determine the affected system modules and business processes, and delineate the boundary of the impact domain. The boundary of the impact domain includes a physical boundary and a logical boundary. The physical boundary is determined based on the physical location of the device nodes, and the logical boundary is determined based on the functional association of the system modules. The initial abnormal node identifier, the sequence of propagating nodes, the topology of the abnormal propagation path, the abnormal propagation path identifier and time record, and the range description of the boundary of the affected domain are integrated to generate a security status assessment result.

7. The network security monitoring method applied to a power monitoring system according to claim 6, characterized in that, The process of propagating the initial anomaly propagation factor to adjacent nodes sequentially according to the weight coefficients of the communication edges in the target knowledge network from high to low, to obtain the propagated anomaly values, includes: All communication edges connected to the initial abnormal node in the target knowledge network are sorted in descending order according to their weight coefficients to generate a communication edge propagation priority. Assign a priority number to each communication edge in the communication edge propagation priority, and obtain the priority number allocation result; From the priority number allocation results, select the adjacent node corresponding to the communication edge with the highest weight coefficient as the first propagation node, and obtain the first propagation node identifier; The interference resistance coefficient of the first propagation node corresponding to the first propagation node identifier is obtained by querying the interference resistance coefficient of the first node. The interference resistance coefficient is calculated based on the node's security protection level, patch update status, historical anomaly records and operating load. The attenuation ratio of the abnormal propagation factor is calculated based on the anti-interference coefficient of the first node to obtain the first attenuation ratio. The anti-interference coefficient is positively correlated with the attenuation ratio. Multiply the anomaly propagation factor of the initial anomaly node by (1 - the first decay ratio) to obtain the anomaly value of the first propagation node. When the outlier value of the first propagation node exceeds the outlier threshold of the first propagation node, the first propagation node is added to the propagation node sequence, and the addition time and the corresponding propagation source node are recorded to obtain the updated propagation node sequence. Starting from the first propagation node, repeat the above propagation process until the abnormal propagation factor decays to below a preset threshold, and obtain the transmission node sequence after multiple rounds of propagation. Process the adjacent nodes corresponding to other communication edges in order according to the propagation priority list, record the abnormal values, propagation order and corresponding propagation source nodes of each node, and obtain a complete propagation record; During the propagation process, if a node is already in the propagation node sequence, its outlier value will not be recalculated. Instead, the cumulative value of its outlier propagation factor and the latest propagation source node will be updated to obtain the cumulative update result of the node outlier value. When multiple source nodes propagate abnormal propagation factors to the same node, the abnormal value of that node is the sum of the abnormal values ​​propagated by each source node, thus obtaining the multi-source propagation node abnormal value. Record the outlier change process of each node, generate an outlier change curve over time, and obtain the outlier time curve.

8. The network security monitoring method applied to a power monitoring system according to claim 1, characterized in that, The step of generating a graded protection instruction set based on the security status assessment results and distributing the graded protection instruction set to the partition control nodes of the power monitoring system to activate the collaborative protection mechanism includes: The anomaly source identifier in the security status assessment result is analyzed to determine the anomaly type and initial attack vector. The corresponding protection strategy library is queried. The protection strategy library contains protection measures, execution steps and parameter ranges corresponding to different anomaly types to obtain the anomaly type and protection strategy. The protection level classification results are obtained based on the length of the transmission node sequence, node importance, and outlier size in the safety status assessment results; For the device nodes corresponding to the anomaly source identifier in the security status assessment results, an anomaly source isolation instruction is generated based on the protection level classification results. The anomaly source isolation instruction includes port shutdown parameters, communication blocking range, isolation duration and isolation method. The isolation method includes physical isolation and logical isolation. Physical isolation is achieved by disconnecting physical connections, and logical isolation is achieved by setting access control lists. For intermediate nodes in the transmission node sequence in the security status assessment results, intermediate node detection instructions are generated in combination with the protection level classification results. The intermediate node detection instructions include the deep scan range, log audit focus, suspicious process killing parameters and detection frequency. For uninfected nodes within the boundary of the impact domain in the security status assessment results, boundary node hardening instructions are generated based on the protection level classification results. The boundary node hardening instructions include access control list update parameters, password reset requirements, patch installation list and security policy adjustment content. The abnormal source isolation instructions, intermediate node detection instructions, and boundary node reinforcement instructions are classified according to the protection level to form a hierarchical protection instruction set. Each instruction in the hierarchical protection instruction set includes the execution priority, the number of timeout retries, the execution conditions, and the feedback requirements. Based on the partition topology of the power monitoring system, the partition control node corresponding to each hierarchical protection instruction in the hierarchical protection instruction set is determined, and a mapping relationship between hierarchical protection instructions and partition control nodes is established to obtain the instruction node mapping table. The hierarchical protection instruction set is encrypted to obtain the encrypted protection instruction set. Then, it is distributed to the partition control node corresponding to the instruction node mapping table. The instruction sending time, number of times it is sent and the reception confirmation information are recorded to obtain the instruction distribution record. The system receives the instruction execution result returned by the partition control node and obtains instruction execution feedback. The instruction execution result includes the execution status, execution time, and log information generated during the execution process. When the execution result in the instruction execution feedback does not meet expectations, the protection instruction is regenerated and distributed to obtain the instruction adjustment and resend result.

9. A network security monitoring system applied to a power monitoring system, characterized in that, The system includes a processor and a memory, the memory being connected to the processor. The memory is used to store programs, instructions, or code, and the processor is used to execute the programs, instructions, or code in the memory to implement the network security monitoring method for power monitoring systems as described in any one of claims 1-8.

Images