Energy internet intelligent key node identification and elasticity enhancement method based on semantic digital twinning and adversarial evolution deduction

Abstract

The invention discloses an energy internet intelligent key node identification and elasticity enhancement method and system, and the method comprises the steps: 1, constructing and dynamically maintaining a semantic enhanced energy internet digital twin super network and a multi-modal knowledge graph, fusing multi-dimensional information, and achieving the self-evolution and dynamic reasoning capability; 2, based on the model, fusing multi-time scale prediction data, and adaptively evaluating the dynamic comprehensive criticality of the node through an intention-function-resource-vulnerability four-layer penetrating traceability model; 3, aiming at the key nodes, generating an intelligent attack strategy by utilizing a generative adversarial network, deducing an information physical cascade failure process by combining multi-agent deep reinforcement learning, and quantitatively evaluating the system elasticity; and step 4, based on an evaluation result, generating a self-adaptive security reinforcement and dynamic reconstruction decision oriented to active immunity and elastic optimization. According to the method, the accuracy and the dynamism of key node identification can be remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of energy internet security technology, specifically to a method for identifying key nodes in the energy internet, a method for analyzing security impacts, and a method for enhancing resilience, particularly an intelligent integrated solution that integrates semantic digital twins, multimodal knowledge graphs, artificial intelligence prediction, and adversarial inference. Background Technology

[0002] As a product of the deep integration of information technology and energy technology, the safe and stable operation of the Energy Internet is of paramount importance. Traditional methods for identifying critical nodes in power grids often rely on static topology analysis, such as degree centrality and betweenness centrality, which are ill-suited to the dynamic, heterogeneous, and multi-coupled characteristics of the Energy Internet. These methods typically lack in-depth consideration of the functional importance of nodes, their real-time operating status, and the characteristics of cyber-physical systems (CPS), resulting in inaccurate identification of critical nodes and security impact analysis that often remains at the connectivity level, failing to effectively reveal the complex mechanisms and real physical impacts of cascading failures.

[0003] With the widespread integration of distributed energy, energy storage, electric vehicles, and other elements, as well as the application of advanced sensing, communication, and control technologies, the structure and operation mode of the energy internet are becoming increasingly complex. Malicious cyberattacks (such as DDoS attacks, data tampering, and control command forgery) and unexpected failures targeting the energy internet can spread rapidly through cyber-physical coupling effects, causing widespread power outages or even system collapses, resulting in severe economic losses and social impacts.

[0004] Existing technologies have shortcomings in the following aspects:

[0005] 1. Insufficient dynamism and accuracy in identifying key nodes: Failure to fully integrate real-time operational data, the importance of business functions, and the potential vulnerabilities of nodes for comprehensive assessment.

[0006] 2. The depth and breadth of security impact analysis are insufficient: it is mostly limited to connectivity analysis at the information level, and fails to effectively simulate and quantify the cascading propagation of attacks or faults in cyber-physical systems and their actual impact on physical power grid security and stability indicators (such as voltage, frequency, and power angle stability).

[0007] 3. The passivity and lag of resilience enhancement measures: lacking predictive proactive defense capabilities and intelligent resilience resource scheduling strategies, it is difficult to cope with complex and ever-changing attack methods and unknown risks.

[0008] 4. Insufficient utilization of "semantic" information in the energy internet: Deep semantic information such as equipment functions, business logic, and control strategies has not been effectively modeled and utilized, limiting the depth of understanding of system behavior.

[0009] Therefore, there is an urgent need for a new intelligent method that can dynamically and accurately identify key nodes, deeply analyze their security impact, and proactively improve system resilience. Summary of the Invention

[0010] The technical problem to be solved:

[0011] This invention aims to overcome the shortcomings of existing technologies and provide a method for identifying and enhancing the resilience of intelligent key nodes in the energy internet, in order to solve the following technical problems:

[0012] 1. How to construct a dynamic model that can comprehensively characterize the cyber-physical characteristics of the energy internet and integrate multi-source heterogeneous data to achieve dynamic, accurate, and adaptive identification of key nodes.

[0013] 2. Based on this model, how to simulate complex attack scenarios, deeply deduce the cascading effects caused by the failure or attack of key nodes at the cyber-physical level, and quantitatively assess their impact on the safe and stable operation and business functions of the energy internet.

[0014] 3. How to leverage predictive analytics and intelligent decision-making to proactively detect potential threats and respond quickly to security incidents, and to formulate and execute optimal resilience enhancement and dynamic reconfiguration strategies to improve the overall resilience of the energy internet.

[0015] Technical solution:

[0016] To address the aforementioned technical problems, this invention proposes a method for identifying and resiliently enhancing intelligent key nodes in the energy internet. The core technical solution includes the following steps:

[0017] Step 1: Construction and Self-Evolution of a Semantically Enhanced Energy Internet Digital Twin Hypernetwork and Multimodal Knowledge Graph. This step involves deeply customizing a semantic ontology library for the energy internet domain, integrating multimodal data from the physical layer, information layer, business / application layer, and security elements to construct a unified, dynamically evolving energy internet multimodal knowledge graph (MMKG). Based on this knowledge graph, a digital twin hypernetwork model capable of representing multiple coupling relationships is built. This model possesses the self-evolution and dynamic reasoning capabilities of a knowledge graph, automatically updating based on real-time data, and utilizing a rule engine and graph neural networks (GNNs) for complex relationship reasoning and pattern discovery.

[0018] Step Two: An Adaptive Criticality Assessment Engine Integrating Multi-Timescale Prediction and "Intent-Function-Resource-Vulnerability" Penetrating Source Tracing. This step, based on a digital twin hypernetwork and knowledge graph, integrates multi-timescale prediction information (such as load forecasting, renewable energy output forecasting, and equipment health status forecasting) across ultra-short-term, short-term, and medium-to-long-term timescales. It innovatively proposes a four-layer penetrating source tracing model of "Intent-Function-Resource-Vulnerability," decomposing and mapping the high-level strategic intent of the energy internet layer by layer to specific resource nodes and their vulnerabilities, achieving both reverse attribution and forward propagation of criticality. A dynamic feature weighting method based on an attention mechanism is employed to comprehensively evaluate and rank the dynamic comprehensive criticality scores of each information node.

[0019] Step 3: Intelligent Attack Strategy Generation Based on Generative Adversarial Networks (GANs) and Cascade Failure Simulation and Resilience Assessment Using Multi-Agent Deep Reinforcement Learning (MADRL). This step targets identified key nodes and utilizes Conditional Generative Adversarial Networks (cGANs) or Information Maximization GANs (InfoGANs) to generate highly realistic and destructive intelligent attack strategies (such as multi-stage cooperative attacks). A MADRL simulation environment for cascade failure in the energy internet is constructed, modeling key physical and information components as agents and simulating their complex interactions and chain reactions under attack, thereby simulating the cascade failure path and scope. Based on this, a multi-dimensional, dynamic resilience measurement system is established to identify the critical points and precursor events of the "failure avalanche."

[0020] Step Four: Adaptive Security Hardening and Dynamic Reconfiguration Decision Engine for "Proactive Immunity" and "Optimal Resilience". This step designs the "proactive immune system" for the energy internet, including threat perception and feature extraction, risk assessment and decision-making, multi-layered defense and collaborative response, and learning and evolution. Based on criticality assessment, cascading failure simulation, and resilience assessment results, and utilizing hierarchical optimization (strategic, tactical, and operational layers) and game theory, it dynamically configures resilient resources to generate and execute adaptive security hardening measures (such as adjusting network topology, switching control strategies, and deploying virtual patches) and dynamic network reconfiguration decisions. Explainable AI technology is used to provide explanations for hardening recommendations and future-oriented resilient evolution path planning.

[0021] Beneficial effects:

[0022] Compared with the prior art, the present invention has the following beneficial effects:

[0023] 1. Significantly improved accuracy and dynamism in key node identification: By constructing semantically enhanced digital twins and multimodal knowledge graphs, and integrating multi-timescale prediction and a four-layer tracing model of "intent-function-resource-vulnerability", key nodes that change with operational status and potential threats can be identified more accurately and dynamically.

[0024] 2. The depth and breadth of security impact analysis have been expanded: intelligent attack strategies are generated using GANs, and combined with...

[0025] MADRL, through cyber-physical co-simulation, can more realistically deduce cascading failure processes, quantitatively assess the complex impact of critical node failures on physical power grid security and stability indicators, economic losses, and business functions, and reveal the critical point of "failure avalanche".

[0026] 3. Enhanced overall resilience and proactive defense capabilities of the energy internet: The proposed "proactive immune system" and dynamic reconfiguration decision engine based on hierarchical optimization can achieve predictive perception of threats, intelligent response, and optimized allocation of resilient resources, thereby effectively improving the resilience of the energy internet in the face of known and unknown attacks.

[0027] 4. Providing decision support for the intelligent operation of the energy internet: This invention provides a complete intelligent solution from modeling, identification, analysis to decision-making. The interpretable analysis results and flexible evolution path planning generated by this invention can provide strong scientific basis and decision support for the planning, operation and maintenance and security protection of the energy internet.

[0028] 5. Strong Technological Innovation: It innovatively applies cutting-edge artificial intelligence technologies such as semantic technology, digital twins, multimodal knowledge graphs, multi-agent reinforcement learning, and generative adversarial networks to the identification of key nodes in the energy internet.

[0029] In the field of security, it possesses significant technological advancements. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is a schematic diagram of the overall process of a method for identifying and enhancing the resilience of intelligent key nodes in the energy internet proposed in this invention. Figure 2 This is a schematic diagram of the semantically enhanced energy internet digital twin supernetwork and multimodal knowledge graph construction and self-evolution module in this invention.

[0032] Figure 3 This is a schematic diagram of the adaptive criticality assessment engine in this invention, which integrates multi-timescale prediction with penetrating tracing of "intent-function-resource-vulnerability".

[0033] Figure 4 This is a schematic diagram of the intelligent attack strategy generation based on GAN and the cascade failure deduction and resilience assessment module of MADRL in this invention.

[0034] Figure 5 This is a schematic diagram of the adaptive security hardening and dynamic reconstruction decision engine for "active immunity" and "optimal elasticity" in this invention.

[0035] Figure 6 System architecture diagram. Detailed Implementation

[0036] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] Reference Figure 1 The present invention provides a method for identifying and enhancing the resilience of intelligent key nodes in the energy internet, comprising the following main modules / steps:

[0038] Module 1 (corresponding to Step 1): Construction and Self-Evolution of Semantically Enhanced Energy Internet Digital Twin Hypernetwork and Multimodal Knowledge Graph (Module 100). For example... Figure 2 As shown, this module is responsible for building and maintaining the digital infrastructure of the energy internet.

[0039] • Data Acquisition and Preprocessing Submodule (201): Responsible for collecting multi-source heterogeneous data from the physical layer of the energy internet (such as parameters and real-time status of generators, transformers, lines, energy storage, and flexible loads), information layer (such as configuration, logs, and communication topology of RTUs, PMUs, IEDs, switches, and servers), business / application layer (such as SCADA / EMS system data streams, energy management strategies, protection and control logic, and electricity market transaction data), and security elements (such as known vulnerability databases, historical attack events, and security device status), and cleaning, aligning, and standardizing the data.

[0040] • Semantic Ontology Customization Submodule (202): Design and construct a formal semantic ontology model for specific domain knowledge of the Energy Internet. This ontology defines the attributes, categories, and complex relationships (such as physical connections, information dependencies, control subordination, causal influence, and temporal correlation) of various entities in the Energy Internet (such as physical devices, information devices, data types, control functions, business processes, and security threats).

[0041] • Multimodal Knowledge Graph (MMKG) Fusion Construction Submodule (203): This submodule fuses preprocessed structured data (such as topology data and equipment ledgers), semi-structured data (such as system logs and configuration files), entities and relationships extracted from unstructured data (such as operation and maintenance manuals and accident reports) using natural language processing (NLP) techniques, and patterns mined from time-series data (such as SCADA historical data) according to a customized semantic ontology model to construct a unified, semantically rich multimodal knowledge graph for the energy internet. This knowledge graph is stored in a graph database (such as Neo4j) or an RDF triplet library.

[0042] • Knowledge Graph Self-Evolution and Dynamic Reasoning Submodule (204): Enables dynamic updating and reasoning capabilities of the knowledge graph.

[0043] - Incremental learning and update mechanism: Based on real-time access to operational data, new equipment commissioning, network topology changes, newly discovered vulnerability information, etc., the entities, attributes and relationships in the knowledge graph are automatically and incrementally updated.

[0044] – Rule-based and Graph Neural Network (GNN)-based reasoning: Expert rules are defined using rule languages ​​such as SWRL and SHACL to perform deterministic logical reasoning, discovering implicit relationships and potential risks. Simultaneously, graph neural networks (such as GCN and GAT) are trained on the knowledge graph to achieve link prediction (predicting potential future dependencies) and node attribute inference (such as inferring the vulnerability level of unknown nodes).

[0045] Uncertainty-based reasoning.

[0046] • Digital Twin Hypernetwork Dynamic Representation Submodule (205): Based on a knowledge graph enhanced by real-time updates and reasoning, a digital twin hypernetwork model for the energy internet is constructed. In this model, nodes not only include single physical or information entities, but can also be functional clusters or business chains identified through reasoning in the knowledge graph. Hyperedges are used to represent the complex interactions or high-order dependencies between these entities or clusters involving multiple heterogeneous elements (e.g., a...).

[0047] The “regional voltage coordinated control” superedge may connect multiple generators, synchronous condensers, SVG devices, and related communication and control nodes.

[0048] Module Two (corresponding to Step Two): An adaptive criticality assessment engine 200 that integrates multi-timescale prediction with penetrating "intent-function-resource-vulnerability" attribution. For example... Figure 3 As shown, this module is responsible for dynamically evaluating the criticality of nodes.

[0049] • Multi-timescale prediction information integration submodule (301): Integrates results from different prediction models, including:

[0050] – Ultra-short-term forecasts (seconds / minutes): Based on PMU data and the output of a fast stability analysis model, predict system response and key synchronization nodes under transient disturbances.

[0051] –Short-term forecasts (hourly / daily): Outputs from integrated load forecasting models, new energy (photovoltaic, wind power) output forecasting models, and equipment health status forecasting models (such as transformer fault probability prediction based on online monitoring data).

[0052] – Medium- to long-term forecasts (weekly / monthly): taking into account factors such as planned maintenance schedules, seasonal load characteristics, and fuel supply forecasts.

[0053] • A four-layer penetrating tracing approach based on "intent-function-resource-vulnerability" and a criticality assignment submodule (302):

[0054] – Intent layer definition: Clearly define the high-level strategic goals and operational requirements of the energy internet (e.g., "Ensure uninterrupted power supply to the core area of ​​city A during an important conference," "Maximize the local absorption rate of renewable energy in region B"). These intents can be predefined or input through human-computer interaction.

[0055] – Functional Layer Decomposition: Utilizing business process mining and functional decomposition techniques, high-level objectives at the intent layer are broken down into critical business and control functions that must be executed (e.g., "Regional Voltage Emergency Control," "Construction and Maintenance of Black Start Path A," "Primary / Secondary Frequency Regulation Response of the Power Grid"). These functions all have corresponding entities or relationships in the knowledge graph.

[0056] –Resource layer mapping: Map the key functions identified in the functional layer to specific physical resources (such as specific generator sets, key transformers, and important transmission channels) and information resources (such as RTUs, PMUs, specific communication links, database services, and control algorithm modules in EMS / DMS) in the knowledge graph.

[0057] – Vulnerability layer association: Associate each resource node with vulnerability information that has been labeled in the knowledge graph or obtained through GNN inference (such as software vulnerability CVE number, device mean time between failures (MTBF), communication link single point of failure risk, and supply chain security risk level).

[0058] – Key Weighting and Propagation Algorithm: Design an algorithm similar to weighted PageRank or network flow-based algorithms to assign key weights layer by layer downwards, starting from the intent layer. A node receives a higher key weight if it supports higher-level intents, participates in more important functions, is associated with more key resources, and has higher vulnerability. Key weights are propagated and accumulated within the dependency network of the knowledge graph.

[0059] • Dynamic feature weighting and comprehensive criticality assessment submodule (303):

[0060] Feature extraction: Extract multiple features from each node from the digital twin hypernetwork and knowledge graph, including topological features (such as weighted degree centrality and betweenness centrality), functional carrying features (such as the number and level of key functions participated in), real-time status features (such as current load rate and communication bandwidth utilization), predicted risk features (such as the probability of overload in the next N hours), and vulnerability features.

[0061] – Dynamic weighting based on attention mechanisms: Employing self-attention or cross-attention mechanisms, weights are dynamically assigned to features across different dimensions based on the current operational scenario (e.g., normal operation, early warning state, initial fault stage) and the evaluation objective. For example, when extreme weather events are anticipated, the weights of node features related to emergency power supply will automatically increase.

[0062] –Comprehensive Keyness Score and Ranking: The weighted multi-dimensional features are input into a pre-trained machine learning model (such as Gradient Boosting Decision Tree (GBDT) or neural network) or a multi-criteria decision analysis method (such as the improved TOPSIS) to calculate the comprehensive keyness score of each information node, and then sort them in real time to output a Top-K list of key nodes.

[0063] Module 3 (corresponding to Step 3): Module 300 for GAN-based intelligent attack strategy generation and MADRL-based cascade failure deduction and resilience assessment. For example... Figure 4 As shown, this module is responsible for simulating attacks and assessing their impact.

[0064] • Intelligent attack strategy generator submodule (401):

[0065] – Training based on cGAN / InfoGAN: Training a Conditional Generative Adversarial Network (cGAN) or an Information Maximization GAN (InfoGAN). The generator's input can include the current state of the energy internet (obtained from digital twins, such as topology, load distribution, and identified vulnerabilities), the attacker's pre-defined objectives (such as maximizing load loss, paralyzing scheduling functions in specific areas, or stealing sensitive data), and potential attack resource constraints. The discriminator learns to distinguish between real attack sequences (obtained from historical event databases and red-blue team exercise data) and generated attack sequences.

[0066] – Attack Strategy Generation and Diversification: Utilizing a trained generator, a series of intelligent attack paths and attack behavior sequences with high stealth, multi-stage collaborative characteristics, and targeting specific protocol vulnerabilities or business logic flaws can be generated. The "characteristics" of the generated attacks, such as attack speed and stealth level, can be controlled.

[0067] • Submodule for constructing the MADRL simulation environment for cascading failures in the Energy Internet (402):

[0068] – Cyber-physical co-simulation platform: Integrating power system simulation software (such as model-based PSASP, etc.)

[0069] DIgSILENT, or based on open-source OpenDSS, Pandapower) and network simulation tools (such as OMNeT++, NS-3) or information system models in digital twins.

[0070] – Multi-agent modeling: Key physical components (such as generator governors / exciters, transformer tap changers, relay protection devices, and energy storage controllers) and information components (such as control master station decision-making units, area controllers, and the communication and processing logic of key RTUs / IEDs) in the energy internet are modeled as agents with autonomous decision-making capabilities. Each agent has its own local observation space, action space, and reward function.

[0071] – Cascaded Failure Simulation: Attack strategies generated by GANs are injected into the simulation environment. Each agent responds based on its learned strategy (trained using MADRL algorithms such as MAPPO, MADDPG, and QMIX) and local information. The simulator simulates the propagation of the attack at the information layer (e.g., communication interruption, packet tampering, delayed or erroneous control commands), and the resulting dynamic responses at the physical layer.

[0072] (Such as generator loss of synchronization, line overload tripping, voltage collapse), and further feedback to the information layer, forming a complex cascading failure process.

[0073] • Multi-dimensional dynamic resilience assessment submodule (403):

[0074] – Definition of the resilience index system: Establish a system that includes absorption capacity (e.g., maximum tolerable disturbance) and adaptability.

[0075] A comprehensive resilience indicator encompassing factors such as the rate of deterioration (e.g., the speed of deterioration, the degree of functional degradation) and recovery capabilities (e.g., recovery time and cost). Specifically introduced:

[0076] • Functional resilience: Assess the percentage of performance degradation of critical business functions (such as frequency regulation, voltage support, market clearing) under attack and the time to recover to an acceptable level.

[0077] • Cyber-physical resilience: quantifying the impact of information flow interruptions / errors on the stability margin of physical systems, and the counter-effects of physical system disturbances (such as large-scale power outages) on the availability of critical information system services.

[0078] • “Failure Avalanche” Critical Index: Based on percolation theory or complex network phase transition analysis, it identifies the attack intensity threshold or the critical number of key node combinations that lead to large-scale cascading failures, and analyzes the characteristics of its precursor events.

[0079] - Elasticity Quantification and Risk Ranking: Through multiple Monte Carlo MADRL simulation experiments, the distribution of various elasticity indicators under different attack strategies is statistically analyzed, the expected loss or risk value is calculated, and the potential security impact of different key nodes or node combinations is ranked.

[0080] Module Four (corresponding to Step Four): Adaptive Security Hardening and Dynamic Reconstruction Decision Engine 400 for "Proactive Immunity" and "Optimal Resilience". For example... Figure 5 As shown, this module is responsible for formulating and implementing elasticity enhancement strategies.

[0081] • Energy Internet “Active Immune System” Architecture Submodule (501):

[0082] – Threat perception and signature extraction layer (antigen recognition): Integrating signature-based intrusion detection systems

[0083] (IDS), machine learning-based anomaly detection (such as using autoencoders, LSTMs)

[0084] Anomaly detection is performed on SCADA / PMU data streams, along with threat intelligence from knowledge graphs, to quickly identify known and unknown attack patterns.

[0085] – Risk Assessment and Immune Decision Layer: Dynamically assess the urgency and potential impact of currently perceived threats (based on the results of the deduction in Module 3) and the current vulnerability state of the system, and decide on the level and type of "immune response" to initiate.

[0086] – Multi-layered defense and synergistic response (antibodies and immune cells):

[0087] • Information layer response: dynamically adjust firewall / IDS policies, deploy micro-segmentation, enable redundant communication links, encrypt and quickly back up critical data, isolate suspicious nodes or traffic, and issue virtual patches.

[0088] • Control layer response: Switch to a more robust or simplified control strategy (such as switching from centralized optimized scheduling to distributed collaborative control or emergency plan control), perform multiple checks or reject control commands from suspicious sources, adjust protection settings, or block certain unnecessary protection actions.

[0089] Physical layer response: Preventively adjust generator output, dispatch energy storage for rapid power support, implement orderly load control (intelligent load shedding), and adjust grid topology (such as disconnecting specific areas or changing line switching status).

[0090] – Learning and Evolution Layer (Immune Memory): Learns from each successful defense or failed attack, updating information such as threat models, attack paths, and the effectiveness of defense strategies in the knowledge graph. Utilizes reinforcement learning to optimize the combination of defense strategies, forming "immune memory" against specific attack patterns, and driving adaptive adjustments to network topology or control logic.

[0091] • A dynamic allocation submodule for elastic resources based on hierarchical optimization and game theory (502):

[0092] – Strategic Layer Optimization (Long-Term): Based on historical data and simulation results, long-term planning and portfolio optimization are carried out on network topology (such as adding redundant links), backup of critical equipment, security domain division, and the introduction of new technologies (such as quantum encrypted communication and blockchain data storage). The goal is to maximize the inherent resilience of the system, and multi-objective optimization algorithms (such as NSGA-II) are usually adopted.

[0093] – Tactical Layer Optimization (Mid-Term / Event-Driven): Upon detecting a high-risk warning or in the early stages of an attack, how to select and deploy the optimal combination of defense measures under constraints of limited defense resources (such as schedulable network bandwidth, backup computing power, schedulable energy storage capacity, and operations team response time). This can be modeled as a Stackelberg game (considering the adversarial and countermeasures between attackers and defenders) or a robust optimization problem to find the optimal defense strategy under the worst-case attack scenario.

[0094] - Operational layer execution (real-time): Quickly and accurately execute defensive actions based on tactical layer decisions, such as issuing network reconfiguration commands, automatically switching control modes, and targeted pushing of alarm information.

[0095] • Explainable AI-driven hardening recommendations and evolutionary path planning submodule (503):

[0096] – Decision interpretability: Using LIME, SHAP, or rule-based extraction methods, interpret the key drivers behind the identification results of critical nodes, risk assessment results, and recommended hardening measures to enhance the credibility and acceptability of decisions.

[0097] – Resilient Evolution Path Planning: Based on the current system status, available budget, and cost-benefit analysis of different reinforcement measures (based on the resilience assessment results of Module 3), plan a phased and gradual path for improving the security capabilities and resilience level of the energy internet. For example, prioritize reinforcement of the links with the highest current risk and the greatest return on investment.

[0098] Figure 1 Abstract: This paper demonstrates the complete processing flow and main data flow of this invention, starting from data input, through four core modules: semantic digital twin construction, dynamic criticality assessment, GAN attack and MADRL cascade inference, and proactive immunity and resilience enhancement decision-making, ultimately achieving the security and resilience enhancement of the energy internet.

[0099] Figure 2 Abstract: This paper describes the core processing flow of Module 1. Multi-source heterogeneous data is customized through a semantic ontology library and constructed through a multimodal knowledge graph (MMKG). Through self-evolution and dynamic reasoning, it ultimately forms a dynamic digital twin hypernetwork model for the energy internet and a real-time updatable MMKG.

[0100] Figure 3 Introduction: This diagram illustrates the working principle of Module 2. By integrating digital twin models, MMKG, and multi-scale predictive information, and through an innovative four-layer "Intent-Function-Resource-Vulnerability" (IFRV) tracing model and a dynamic attention weighting mechanism, it achieves accurate assessment of the dynamic comprehensive criticality of energy internet nodes.

[0101] Figure 4 Introduction: The operational logic of Module 3. It utilizes GANs to generate intelligent attack strategies, and then, in a cyber-physical co-simulation environment based on multi-agent deep reinforcement learning (MADRL), it deduces the cascading failure process of key nodes after an attack, and performs multi-dimensional dynamic resilience assessment.

[0102] Figure 5 Introduction: Module Four's decision-making mechanism. It constructs an "active immune system" architecture for the energy internet, combining hierarchical optimization and game theory to dynamically allocate resilient resources, and generates adaptive security hardening measures and resilient evolution path suggestions based on interpretable AI.

[0103] Figure 6 Abstract: This paper describes the overall system architecture for implementing the method of this invention. It includes a data and interface layer (data source, knowledge base, user interaction, control interface) and a core processing module layer (semantic construction, criticality assessment, cascade deduction, security decision-making), clearly demonstrating the interaction relationships between the components.

[0104] Those skilled in the art will understand that the above embodiments are illustrative and not restrictive. Various modifications and variations can be made without departing from the spirit and scope of the invention. For example, the module division can be different, and the specific algorithm selection within the modules can be diversified; as long as the core functions and beneficial effects described in this invention are achieved, they should fall within the protection scope of this invention.

Claims

1. A method for identifying and resiliently enhancing intelligent key nodes in the energy internet, characterized in that, Includes the following steps: a. Construct and dynamically maintain a semantically enhanced energy internet digital twin supernetwork and multimodal knowledge graph, wherein the knowledge graph integrates multi-dimensional information such as physical layer, information layer, business layer and vulnerability, and has self-evolution and dynamic reasoning capabilities; b. Based on the aforementioned digital twin hypernetwork and knowledge graph, multi-timescale prediction data is fused, and the dynamic comprehensive criticality of each node in the energy internet is adaptively assessed through a four-layer penetrating tracing model of "intent-function-resource-vulnerability". c. For the identified key nodes, generate intelligent attack strategies using generative adversarial networks, and combine multi-agent deep reinforcement learning to deduce the cyber-physical cascade failure process in the digital twin environment, and quantitatively evaluate the system resilience index. d. Based on the results of critical assessments, cascading failure simulations, and resilience assessments, adaptive security hardening and dynamic network reconfiguration decisions are generated, oriented towards "active immunity" and "optimal resilience," to improve energy efficiency. The overall resilience of the internet.

2. The method according to claim 1, characterized in that, In step S100, constructing the semantically enhanced energy internet digital twin supernetwork and multimodal knowledge graph includes: - A deeply customized semantic ontology library for the energy internet field, defining entities, attributes, and relationships; –Construct a multimodal knowledge graph by integrating structured, semi-structured, unstructured, and energy internet time-series data; - Utilize incremental learning mechanisms to achieve automatic updates of knowledge graphs, and employ dynamic reasoning techniques based on rule engines and / or graph neural networks to enhance the expressive and analytical capabilities of knowledge graphs; – Construct a digital twin hypernetwork model based on the knowledge graph that can represent multiple coupling relationships. type.

3. The method according to claim 1, characterized in that, In step S200, the key aspects of dynamic integration of the adaptive evaluation node include: -Integrates multi-timescale forecasting information, including but not limited to load forecasting, new energy output forecasting, and equipment health status forecasting; – Through the aforementioned four-layer model of “intent-function-resource-vulnerability”, the high-level strategic intent of the energy internet is decomposed layer by layer and mapped to specific resource nodes and their associated vulnerability information, thereby achieving key reverse assignment and forward propagation computation; – Extract the topological features, functional characteristics, real-time status features, predicted risk features, and vulnerability features of nodes, and use a dynamic feature weighting method based on an attention mechanism to calculate… A comprehensive criticality score for each node.

4. The method according to claim 1, characterized in that, In step S300, the simulation of cyber-physical cascade failure process and the quantitative evaluation of system resilience indicators include: – Employ conditional generative adversarial networks (cGAN) or information-maximizing GANs (InfoGAN) to generate multi-stage, collaborative intelligent attack strategies. – Construct a cyber-physical co-simulation environment and model the key physical and information components in the energy internet as intelligent agents with autonomous decision-making capabilities; – The agents are trained using a multi-agent deep reinforcement learning algorithm. After injecting intelligent attack strategies, their interactions and chain reactions are simulated to deduce the cascading failure paths and scope. –Establish a multi-dimensional dynamic resilience measurement system that includes functional resilience, cyber-physical interaction resilience, and the "failure avalanche" critical index, and conduct quantitative assessments.

5. The method according to claim 1, characterized in that, In step S400, generating adaptive security hardening and dynamic network reconstruction decisions includes: - Construct an "active immune system" architecture for the energy internet that includes threat perception and feature extraction, risk assessment and immune decision-making, multi-layered defense and collaborative response, as well as learning and evolution mechanisms; – Employing a hierarchical optimization and / or game theory-based approach, elastic resources are dynamically configured and security hardening measures are generated at the strategic, tactical, and operational levels. These measures include, but are not limited to, adjusting network topology, switching control strategies, deploying virtual patches, and adjusting protection settings. –Utilize explainable artificial intelligence technology to interpret decision-making outcomes and plan resilient evolutionary paths for the future.

6. A smart key node identification and resilience enhancement system for the energy internet, characterized in that, include: – Semantic digital twin and knowledge graph construction module, used to perform step S100 as described in claim 1; – An adaptive criticality assessment module for performing step S200 as described in claim 1; – Cascaded failure simulation and resilience assessment module, used to perform step S300 as described in claim 1; – Adaptive security hardening and decision-making module, used to perform step S400 as described in claim 1.

7. The system according to claim 6, characterized in that, The semantic digital twin and knowledge graph construction module further includes: a semantic ontology library customization unit, a multimodal data fusion unit, a knowledge graph self-evolution and dynamic reasoning unit, and a digital twin hypernetwork representation unit.

8. The system according to claim 6, characterized in that, The adaptive criticality assessment module further includes: a multi-timescale prediction information integration unit, an "intent-function-resource-vulnerability" tracing and criticality assignment unit, and a dynamic feature weighting and comprehensive criticality assessment unit.

9. The system according to claim 6, characterized in that, The cascade failure simulation and resilience assessment module further includes: an intelligent attack strategy generator unit, an energy internet cascade failure multi-agent deep reinforcement learning simulation environment construction unit, and a multi-dimensional dynamic resilience assessment unit.

10. The system according to claim 6, characterized in that, The adaptive security hardening and decision-making module further includes: an energy internet "active immune system" architecture implementation unit, a flexible resource dynamic allocation unit based on hierarchical optimization and game theory, and an interpretable AI-driven hardening suggestion and evolution path planning unit.

Images