Operation safety analysis method and device of power system, equipment and storage medium

Abstract

The invention relates to an operation safety analysis method and device of a power system, computer equipment and a computer readable storage medium. Comprising the following steps: collecting various data generated in an operation process of a power system; identifying sensitive data in the collected operation data set, and marking a data circulation link; determining sensitivity characteristics of the operation data set according to the sensitive data carrying the mark information; performing security risk assessment according to the sensitive data carrying the mark information to obtain a risk assessment result; determining a current security policy according to the sensitivity characteristics and the risk assessment result; executing the current security policy, and monitoring an implementation result in real time; and adjusting the current security policy according to the implementation result. A targeted security policy can be generated, and high efficiency and stability of operation of a power system are ensured; problems existing in the security measure execution process are found in time, the strategy is dynamically adjusted according to the actual execution condition, and the flexibility and adaptability of data security management are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power systems, in particular to a power system operation safety analysis method and device, computer equipment and a computer readable storage medium. BACKGROUND

[0002] In order to ensure the stable operation of the power system, it is necessary to monitor the power system operation data in real time, and timely find the security risks in the data operation process, such as data leakage, network attacks, etc., so as to take effective measures to solve them and prevent power system failures or major safety accidents caused by data security problems.

[0003] The traditional power system operation safety analysis technology mainly focuses on single security measures such as data encryption and access control, and has the following problems: the data collection is not comprehensive enough, and cannot cover the data of all key nodes in the power system, resulting in inaccurate assessment of the data operation safety status and inaccurate identification of sensitive data; it cannot accurately distinguish the sensitivity of data at different links, so that the data management lacks pertinence; the data evaluation method is relatively single, and only a few dimensions are evaluated, which cannot fully reflect the overall risk status of the data operation safety; the generated safety strategy does not fully consider the impact on system performance, resulting in a great impact on the operation efficiency of the power system when the safety measures are implemented. SUMMARY

[0004] Therefore, it is necessary to provide a power system operation safety analysis method, device, computer equipment and computer readable storage medium to solve the above technical problems. The method can generate a targeted safety strategy to ensure the efficiency and stability of the power system operation.

[0005] In a first aspect, the present application provides a power system operation safety analysis method, comprising:

[0006] Collecting various types of data generated during the operation of the power system to obtain a set of operation data;

[0007] Identifying sensitive data in the set of operation data and marking the data flow conversion link corresponding to each sensitive data to obtain sensitive data carrying marked information;

[0008] Determining the sensitivity characteristics of the set of operation data according to the sensitive data carrying marked information;

[0009] Performing safety risk assessment according to the sensitive data carrying marked information to obtain a risk assessment result;

[0010] Determining the current safety strategy according to the sensitivity characteristics and the risk assessment result;

[0011] Execute the current security policy and monitor the implementation results corresponding to the current security policy in real time.

[0012] According to the implementation results, adjust the current security policy.

[0013] In one embodiment, according to the sensitive data carrying the mark information, determine the sensitivity feature of the running data set, including:

[0014] Assess the data sensitivity level of the sensitive data carrying the mark information;

[0015] Assess the risk coefficient of multiple data flow transfer links;

[0016] Determine the access frequency of the sensitive data carrying the mark information;

[0017] The sensitivity feature is calculated according to the following formula:

[0018] ;

[0019] In the formula, is the sensitivity feature, is the data sensitivity level, is the risk coefficient of the i th data flow transfer link, is the access frequency, is the weight coefficient, .

[0020] In one embodiment, according to the sensitive data carrying the mark information, perform security risk assessment to obtain a risk assessment result, including:

[0021] According to the evaluation model corresponding to each of the multiple dimensions, perform security risk assessment on the sensitive data carrying the mark information to obtain risk scores of the multiple dimensions;

[0022] According to the risk scores of the multiple dimensions, determine a risk assessment index;

[0023] Compare the risk assessment index with at least one risk threshold to determine a security risk level;

[0024] The security risk level is taken as the risk assessment result.

[0025] In one embodiment, according to the risk scores of the multiple dimensions, determine a risk assessment index, including:

[0026] According to the weight information of the multiple dimensions, perform weighted summation on the risk scores of the multiple dimensions to obtain the risk assessment index.

[0027] In one embodiment, according to the sensitivity feature and the risk assessment result, determine a current security policy, including:

[0028] determine a policy type according to the risk assessment result;

[0029] determine a policy level according to the sensitivity feature;

[0030] determine a current security policy according to the policy type and the policy level.

[0031] In one of the embodiments, the current security policy is adjusted according to the implementation result, including:

[0032] if the performance parameter of the power system is reduced after implementation of the current security policy, a target security policy with the same policy type as the current security policy and a lower policy level is selected;

[0033] the policy is adjusted according to the target security policy.

[0034] In one of the embodiments, the sensitive data in the running data set is identified, including:

[0035] the running data set is scanned by using a preset machine learning algorithm in combination with a preset sensitive data feature library to identify and output the sensitive data in the running data set.

[0036] In a second aspect, the present application further provides an operation safety analysis device of a power system, including:

[0037] a data collection module, configured to collect various types of data generated in the operation process of the power system to obtain a running data set;

[0038] a sensitive data identification module, configured to identify the sensitive data in the running data set and mark a data flow conversion link corresponding to each sensitive data to obtain sensitive data carrying marked information; and determine a sensitivity feature of the running data set according to the sensitive data carrying marked information;

[0039] a risk assessment module, configured to perform a security risk assessment according to the sensitive data carrying marked information to obtain a risk assessment result;

[0040] a policy implementation module, configured to determine a current security policy according to the sensitivity feature and the risk assessment result; execute the current security policy and monitor an implementation result corresponding to the current security policy in real time; and adjust the current security policy according to the implementation result.

[0041] In a third aspect, the present application further provides a computer device including a memory and a processor, wherein the memory stores a computer program, and the processor realizes the steps of the method of the first aspect when executing the computer program.

[0042] In a fourth aspect, the present application also provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the method in the first aspect.

[0043] The operation safety analysis method, device, computer equipment and computer readable storage medium of the power system collect various types of data generated in the operation process of the power system to obtain an operation data set, identify sensitive data in the operation data set, mark a data flow transfer link corresponding to each sensitive data to obtain sensitive data carrying marked information, determine a sensitivity feature of the operation data set according to the sensitive data carrying marked information, perform safety risk assessment according to the sensitive data carrying marked information to obtain a risk assessment result, determine a current safety policy according to the sensitivity feature and the risk assessment result, execute the current safety policy, and monitor an implementation result corresponding to the current safety policy in real time. The implementation result is used to adjust the current safety policy. In this way, the data flow transfer links are distinguished, the sensitive data of multiple data flow transfer links is identified, and the sensitivity feature is determined to quantify the sensitivity, so that the sensitivity of the data at different stages can be clearly presented, and important basis for formulating a data safety policy is provided. On the other hand, the safety risk assessment is used to quantify the safety risk faced by the power system, and important basis for formulating a data safety policy is provided. The sensitivity feature and the risk assessment result are combined to generate a targeted safety policy, so that the efficiency and stability of the operation of the power system are ensured. The implementation of the safety policy is monitored in real time, problems existing in the execution process of the safety measures can be found in time, and the policy is dynamically adjusted according to the actual execution, so that the flexibility and adaptability of data safety management are improved. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the description of the embodiments of the present application or the related art will be briefly introduced. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other related drawings can be obtained without creative labor on the basis of these drawings.

[0045] Figure 1 An application environment diagram of the operation safety analysis method of the power system in an embodiment;

[0046] Figure 2 A flowchart of the operation safety analysis method of the power system in an embodiment;

[0047] Figure 3 A structural block diagram of the operation safety analysis device of the power system in an embodiment;

[0048] Figure 4Fig. 1 is a schematic diagram of an internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0049] For the purpose of the present application, technical solutions and advantages, the following will be further described in detail in conjunction with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not intended to limit the present application.

[0050] It should be noted that the terms "first", "second", etc. used in the present application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "include" and "have" and any variations thereof used in the present application are intended to cover non-exclusive inclusion. The term "a plurality of" used in the present application refers to two or more. The term "and / or" used in the present application refers to one of the options, or any combination of multiple options.

[0051] The operation safety analysis method of the power system provided by the embodiments of the present application can be applied to the application environment as shown in Figure 1 . Among them, a plurality of different data generation nodes of the power system 102 are deployed with corresponding data acquisition units, each data acquisition unit acquires various types of data in the operation process of the power system, and transmits the data to the server 104 through the network. The server 104 analyzes the data collected by each data acquisition unit based on the operation safety analysis method of the power system provided by the present application, and generates a safety strategy to realize the safety control of the power system 102. The data storage system can store the data required to be processed by the server 104. The data storage system can be integrated on the server 104, or placed on the cloud or other network servers. The server 104 can be a stand-alone physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0052] In one exemplary embodiment, as shown in Figure 2 , an operation safety analysis method of a power system is provided. Taking the server 104 in Figure 1 as an example, the method includes:

[0053] Step 202, collecting various types of data generated in the operation process of the power system to obtain a set of operation data.

[0054] The operation data set includes multiple types of data. It can be understood that at least one data collection unit is deployed at different data generation nodes of the power system. By using the data collection units, various types of data generated during the operation of the power system can be collected. The data generation nodes include the dispatching center server and various monitoring devices, which can obtain system operation logs, operation records, real-time monitoring parameters, and other types of data, and integrate the collected data into the operation data set. In this embodiment, by deploying data collection units at multiple key nodes, the operation data of the power system can be comprehensively and real-timely collected, providing rich and accurate data basis for subsequent data analysis, which helps to more accurately evaluate the data operation security status.

[0055] In step 204, sensitive data in the operation data set is identified, and each sensitive data corresponding data flow transfer link is marked to obtain sensitive data carrying marking information.

[0056] Different data flow transfer links reflect the flow path and state change of data in the power system, which is crucial for risk assessment. By analyzing the data flow of different links, potential security risk points can be identified, such as eavesdropping or tampering of data during transmission, and unauthorized access during storage.

[0057] In this embodiment, the existing sensitive data is identified and the data flow transfer link is marked, providing basic data for subsequent sensitive quantification and security risk analysis, and improving the accuracy of sensitive quantification and risk assessment.

[0058] In one exemplary embodiment, the sensitive data in the operation data set is identified, including: combining the pre-set sensitive data feature library, using the pre-set machine learning algorithm to scan the operation data set, and identifying and outputting the sensitive data in the operation data set.

[0059] The pre-set sensitive data feature library refers to a pre-defined rule, pattern or feature set for identifying and detecting sensitive information in data. By using machine learning algorithms and sensitive data feature libraries, sensitive data (such as user privacy information, key equipment operation parameters, etc.) can be accurately identified, and data flow transfer links can be marked to clearly present the sensitivity of data at different stages, providing an important basis for the development of data security strategies.

[0060] The data flow conversion link includes data collection, data transmission, data storage, data processing and data use, etc. For example, the real-time monitoring parameters collected on the dispatch center server are transmitted to the data center for storage through the internal network, and then processed by the data analysis module, and finally used by the relevant personnel. In this process, data can be collected from multiple links. Each link involves different security risks and sensitivities.

[0061] In step 206, the sensitivity feature of the running data set is determined according to the sensitive data carrying the mark information.

[0062] The sensitivity feature is used to quantify the sensitivity of the running data set, making the data management more refined, and providing an important basis for subsequent data security policy making.

[0063] In step 208, the security risk is evaluated according to the sensitive data carrying the mark information, and the risk evaluation result is obtained.

[0064] Optionally, the pre-trained neural network model is used to analyze the sensitive data carrying the mark information, evaluate the security risk level, and obtain the risk evaluation result.

[0065] In an optional implementation, the sensitive data carrying the mark information is analyzed according to the preset evaluation rules and model, the data running security risk is evaluated, and the risk evaluation result is output. In specific implementation, an evaluation model based on multi-dimensional factors can be used to evaluate the integrity risk of data in the transmission process according to the error rate and loss rate, to evaluate the confidentiality risk by monitoring whether the data is accessed or tampered without authorization, etc. The risk evaluation results of different dimensions are given corresponding weights, and the weighted sum calculation method is used to comprehensively reflect the overall risk situation of data running security, and the risk evaluation index is calculated. Compare it with the preset risk threshold to determine the data running security risk level.

[0066] In step 210, the current security policy is determined according to the sensitivity feature and the risk evaluation result.

[0067] According to the sensitivity characteristics and the risk assessment results, the current security policy is generated by using the computer built-in script, and the data protection, monitoring and emergency measures taken under different risk levels are determined. For example, for low-risk data, regular data backup and regular security audit policies can be set; for high-risk data, data encryption transmission, real-time monitoring and early warning, and limiting data access permissions and other enhanced measures can be taken. These security policies can be stored in the form of configuration files or scripts on the computer device, and dynamically adjusted according to the evaluation results. When generating the security policy, it can also be determined according to the sensitivity characteristics which data to take more stringent protection measures such as encryption transmission, access permission restriction, etc.; and it can also be determined according to the sensitivity characteristics which level of security policy to adopt.

[0068] Step 212, execute the current security policy and monitor the implementation results corresponding to the current security policy in real time.

[0069] Step 214, adjust the current security policy according to the implementation results.

[0070] Among them, the current security policy is executed, the implementation results after the operation of the security measures are monitored in real time, and the policy is dynamically adjusted according to the implementation results. For example, if it is monitored that a certain data access permission is frequently accessed beyond authority, the system can automatically adjust the policy and strengthen the access control of the data or trigger the alarm mechanism. Optionally, when monitoring the implementation of the security policy, an automatic response mechanism is provided, and for preset high-risk situations, corresponding emergency measures are immediately started, such as automatically cutting off data transmission, locking sensitive data access permissions, etc., and relevant personnel are notified in time to handle, which can effectively reduce the risk loss. Optionally, during the policy generation or policy dynamic adjustment process, the impact of the security policy on the performance of the power system is also considered, and under the premise of ensuring data security, the negative impact of the security measures on the system performance is reduced, and the efficiency of the power system operation is ensured.

[0071] The operation safety analysis method of the power system collects various types of data generated in the operation of the power system to obtain an operation data set, identifies sensitive data in the operation data set, and marks each sensitive data corresponding data flow transfer link to obtain sensitive data carrying marked information, determines the sensitivity characteristics of the operation data set according to the sensitive data carrying marked information, performs safety risk assessment according to the sensitive data carrying marked information to obtain a risk assessment result, determines a current safety policy according to the sensitivity characteristics and the risk assessment result, executes the current safety policy, and monitors the implementation result corresponding to the current safety policy in real time, and adjusts the current safety policy according to the implementation result. In the above manner, the data flow transfer links are distinguished, the sensitive data of multiple data flow transfer links are identified, and the sensitivity characteristics are determined to quantify the sensitivity, which can clearly present the sensitivity of data at different stages and provide an important basis for formulating a data safety policy. On the other hand, the safety risk assessment is used to quantify the safety risks faced by the power system, which provides an important basis for formulating a data safety policy. The sensitivity characteristics and the risk assessment result are combined to generate a targeted safety policy, which ensures the efficiency and stability of the operation of the power system. The implementation of the safety policy is monitored in real time, which can timely find problems existing in the execution process of the safety measures, and dynamically adjust the policy according to the actual execution, thereby improving the flexibility and adaptability of data safety management.

[0072] In one exemplary embodiment, step 206 includes: evaluating a data sensitivity level of the sensitive data carrying marked information; evaluating a risk coefficient of the multiple data flow transfer links; determining an access frequency corresponding to the sensitive data carrying marked information; and calculating the sensitivity characteristics according to the following formula:

[0073] ;

[0074] In the formula, is the sensitivity characteristics, is the data sensitivity level, is the risk coefficient of the i th data flow transfer link, is the access frequency, is a weight coefficient, .

[0075] The data sensitivity level can be determined by querying a preset sensitive data feature library, or can be determined by analyzing the sensitive data carrying marked information through a pre-trained neural network model.

[0076] The risk coefficient of the i-th data flow transfer link can be determined according to historical security event records, vulnerability scanning results, security audit reports and other factors of the i-th data flow transfer link. For example, if a data leakage event occurs many times in a data flow transfer link layer, the risk coefficient of the data flow transfer link is set to a higher value. Alternatively, a pre-trained scoring model is used to score the historical risk characteristics (such as the number of vulnerability occurrences, the number of leakage occurrences, etc.) of each data flow transfer link to obtain the risk coefficient of each data flow transfer link.

[0077] The access frequency is determined according to the number of times that the sensitive data corresponding file and collection are accessed within a preset time period, which can be collected and counted by a log analysis tool or a database audit system. For example, the number of times that a certain data file is accessed within a day can be counted to determine its access frequency. It can be understood that if the sensitive data corresponds to multiple files or collections, the access frequency of the embodiment refers to the average access frequency of the multiple files or collections.

[0078] The weight coefficient is a parameter set in advance and can be adjusted according to actual conditions. The embodiment quantifies the sensitivity of the running data collection based on the data sensitivity level, the risk coefficient of each data flow transfer link, and the access frequency of the sensitive data, determines the sensitivity feature from the dynamic change of the data, and can improve the accuracy of the sensitivity evaluation.

[0079] In an exemplary embodiment, step 208 includes: performing security risk assessment on the sensitive data carrying the marked information according to the evaluation model corresponding to each of the plurality of dimensions to obtain risk scores of the plurality of dimensions; determining a risk assessment index according to the risk scores of the plurality of dimensions; comparing the risk assessment index with at least one risk threshold to determine a security risk level; and taking the security risk level as a risk assessment result.

[0080] In the embodiment, a plurality of evaluation models corresponding to each of the plurality of dimensions are used to perform security risk assessment on the sensitive data carrying the marked information from the aspects of data integrity, reliability, confidentiality, etc. to obtain risk scores of the plurality of dimensions. The risk scores of the plurality of dimensions are integrated to comprehensively reflect the overall risk situation to obtain a risk assessment index. The security risk level is determined by comparing with a preset risk threshold, which provides clear guidance for subsequent strategy formulation. The risk assessment result is more accurate and comprehensive from the plurality of dimensions. Alternatively, the integrity risk is evaluated by analyzing the error rate and loss rate of the data in the transmission process, the confidentiality risk is evaluated by monitoring whether the data is accessed or tampered by unauthorized access, and the reliability risk is evaluated by analyzing the failure rate and calibration record of the data acquisition device.

[0081] In an example embodiment, the risk assessment index is determined according to the risk scores of the plurality of dimensions, comprising: performing weighted summation on the risk scores of the plurality of dimensions according to the weight information of the plurality of dimensions to obtain the risk assessment index.

[0082] Exemplarily, the data integrity includes error rate and loss rate, which is the ratio of the number of data packets with errors to the total number of data packets in the data transmission and processing process. For example, 1000 data packets are transmitted in a certain period of time, of which 10 data packets have errors, and the error rate is 0.01. The number of lost data packets is calculated and the ratio of the total number of data packets is calculated. For example, 5 data packets are lost in the transmission process, and the loss rate is 0.005.

[0083] Data reliability is measured by evaluating the stability and accuracy of data acquisition equipment, such as equipment failure rate, calibration records, etc. For example, a certain data acquisition equipment has failed twice in the past month, and the total running time of the equipment is 720 hours, so the failure rate is about 0.0028, which can be used as a reference index of data source reliability.

[0084] Data confidentiality includes the number of unauthorized access attempts and data tampering, which is the number of unauthorized access attempts to data within a certain period of time. For example, 5 unauthorized access attempts were recorded in a day. To detect whether the data has been tampered with, the original data and the backup data can be compared, and the ratio of the amount of tampered data to the total data amount is calculated. For example, if 1% of the data is found to be tampered with, the data tampering ratio is 0.01.

[0085] According to the importance of each evaluation dimension to the operation safety of the power system data, the weight information of each dimension is allocated.

[0086] Each index is normalized to map its value to the range of 0-1. For example, for the error rate index, if the maximum allowed error rate is 0.05 and the current error rate is 0.01, the normalized value is 1-0.01 / 0.05=8;

[0087] The risk score of each evaluation dimension is calculated. Taking data integrity as an example, its risk score The risk score is calculated by the following formula:

[0088] ;

[0089] The risk assessment index is calculated by the following formula:

[0090] ;

[0091] In the formula, the risk assessment index, W is the weight information, and S is the risk score of each dimension.

[0092] The calculated risk assessment index is compared with a preset risk threshold to determine the security risk level. For example, the risk threshold is set to 0.5, 0.7, and when <0.5, it is a low risk level; when 0.5≤ <0.7, it is a medium risk level; when s≥0.7, it is a high risk level.

[0093] In this embodiment, the evaluation model based on multiple dimensions factors evaluates the data operation security risk from multiple angles such as integrity, reliability and confidentiality, and uses weighted summation to comprehensively reflect the overall risk situation, so that the evaluation result is more accurate and comprehensive. By comparing with the preset risk threshold, the security risk level is determined, which provides clear guidance for subsequent strategy formulation.

[0094] In an exemplary embodiment, step 210 includes: determining a strategy type according to the risk assessment result; determining a strategy level according to the sensitivity feature; and determining a current security strategy according to the strategy type and the strategy level.

[0095] The security strategy library includes multiple different types of strategies (for example, encryption strategy, early warning strategy, backup strategy, etc.), and each security strategy corresponds to at least one strategy level (for example, the encryption strategy corresponds to multiple encryption algorithms with different encryption levels).

[0096] According to the risk assessment result, the strategy type is determined, for example, the strategy includes regular data backup and regular security audit in the case of low risk, and the enhanced measures such as data encryption transmission, real-time monitoring and early warning, and limiting data access rights are taken in the case of high risk.

[0097] According to the sensitivity feature, the strategy level is determined, for example, the higher the sensitivity degree represented by the sensitivity feature, the higher the corresponding strategy level and the stricter the security control measures.

[0098] According to the determined strategy type and strategy level, the corresponding security strategy is called from the security strategy library as the current security strategy.

[0099] In an exemplary embodiment, step 214 includes: if the performance parameter of the power system is reduced after the implementation of the current security strategy, a target security strategy with the same strategy type as the current security strategy and a lower strategy level is selected; and the strategy is adjusted according to the target security strategy.

[0100] By executing the security policy, such as starting a data encryption transmission process, deploying an access control policy, etc., and monitoring data in real time during the execution process, problems existing in the execution process of the security measures can be found in time. According to the actual execution effect and the change of the data running state, the data security policy is dynamically adjusted, and the flexibility and adaptability of data security management are improved.

[0101] In a specific implementation, during real-time monitoring of the security policy execution process, the performance parameters of the power system are monitored. If the implementation of the current security policy causes the performance parameters of the power system to decrease, it indicates that the current security policy has an impact on the performance of the power system, and the policy level needs to be adjusted, and the strength and complexity of the security protection measures are reduced. The performance parameters of the power system include, but are not limited to, at least one of the following: network transmission performance parameters (such as transmission delay, packet loss rate, etc.), system processing performance parameters (such as computing power occupancy rate, etc.), and power service performance parameters (such as control instruction response time, data acquisition integrity rate, etc.).

[0102] In this embodiment, after monitoring that the performance of the power system is affected, the security level of the security policy is adjusted in time, which can reduce the negative impact of the security measures on the system performance under the premise of ensuring data security, and ensure the efficiency and stability of the power system operation.

[0103] It should be understood that, although each step in the flowchart involved in each embodiment as described above is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be alternately executed with at least part of other steps or steps or stages in other steps. It can be understood that the steps in different embodiments can be freely combined as needed, and various non-contradictory schemes formed by the combination are within the scope of protection of the present application.

[0104] Based on the same inventive concept, the present embodiment also provides an operation safety analysis device of a power system for implementing the operation safety analysis method of the power system as described above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more operation safety analysis device embodiments of the power system provided below can refer to the limitations of the operation safety analysis method of the power system described above, which will not be described here.

[0105] In one exemplary embodiment, as shown in Figure 3 An operation safety analysis device of a power system is provided, comprising:

[0106] A data collection module 302 is configured to collect various types of data generated by the power system during operation to obtain a set of operation data.

[0107] A sensitive data identification module 304 is configured to identify sensitive data in the set of operation data, mark each data flow link corresponding to the sensitive data, and obtain sensitive data carrying marked information; and determine a sensitivity feature of the set of operation data according to the sensitive data carrying marked information.

[0108] A risk assessment module 306 is configured to perform safety risk assessment according to the sensitive data carrying marked information to obtain a risk assessment result.

[0109] A policy implementation module 308 is configured to determine a current safety policy according to the sensitivity feature and the risk assessment result, execute the current safety policy, monitor an implementation result corresponding to the current safety policy in real time, and adjust the current safety policy according to the implementation result.

[0110] In the operation safety analysis device of the power system, the data flow links are distinguished, the sensitive data of multiple data flow links are identified, and the sensitivity feature is determined to quantify the sensitivity, which can clearly present the sensitivity of the data at different stages and provide an important basis for formulating a data security policy. On the other hand, the safety risk assessment is performed to quantify the safety risk faced by the power system, which provides an important basis for formulating a data security policy. The targeted safety policy is generated in combination with the sensitivity feature and the risk assessment result, which ensures the efficiency and stability of the operation of the power system. The implementation of the safety policy is monitored in real time, which can timely find problems existing in the execution process of the safety measures and dynamically adjust the policy according to the actual execution, thereby improving the flexibility and adaptability of data security management.

[0111] In one exemplary embodiment, the sensitive data identification module 304 is further configured to evaluate a data sensitivity level of the sensitive data carrying marked information, evaluate a risk coefficient of the multiple data flow links, determine an access frequency corresponding to the sensitive data carrying marked information, and calculate the sensitivity feature according to the following formula:

[0112] ;

[0113] In the formula, is the sensitivity feature, is the data sensitivity level, is the risk coefficient of the i th data flow link, is the access frequency, and The weight coefficient is .

[0114] In an example embodiment, the risk assessment module 306 is further configured to perform security risk assessment on the sensitive data carrying the label information according to the assessment model corresponding to each of the plurality of dimensions, to obtain risk scores of the plurality of dimensions; determine a risk assessment index according to the risk scores of the plurality of dimensions; compare the risk assessment index with at least one risk threshold to determine a security risk level; and take the security risk level as the risk assessment result.

[0115] In an example embodiment, the risk assessment module 306 is further configured to perform weighted summation on the risk scores of the plurality of dimensions according to the weight information of the plurality of dimensions to obtain the risk assessment index.

[0116] In an example embodiment, the policy implementation module 308 is further configured to determine a policy type according to the risk assessment result, determine a policy level according to the sensitivity feature, and determine a current security policy according to the policy type and the policy level.

[0117] In an example embodiment, the policy implementation module 308 is further configured to, if it is monitored that the performance parameter of the power system decreases after implementation of the current security policy, select a target security policy of the same policy type as the current security policy and of a lower policy level, and perform policy adjustment according to the target security policy.

[0118] In an example embodiment, the data collection module 302 is further configured to, in combination with the preset sensitive data feature library, use a preset machine learning algorithm to scan the operation data set, and identify and output the sensitive data in the operation data set.

[0119] The above-mentioned modules in the operation security analysis device of the power system can be all or partially realized by software, hardware, and combinations thereof. The above-mentioned modules can be embedded in or independent of a processor in a computer device in hardware form, or can be stored in a memory in a computer device in software form, so as to be called and executed by a processor to perform operations corresponding to the above-mentioned modules.

[0120] In an example embodiment, a computer device is provided, which can be a server, and an internal structure diagram of the computer device can be as shown in Figure 4As shown in the figure. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through the system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capability. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operating system and the computer program in the non-volatile storage medium to run. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with the terminal outside through the network connection. The computer program is executed by the processor to realize a power system operation safety analysis method.

[0121] Those skilled in the art can understand that, Figure 4 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0122] In one exemplary embodiment, a computer device is provided, comprising a memory and a processor, the memory storing a computer program, and the processor executing the computer program to realize the following steps: collecting various types of data generated by the power system during operation to obtain a set of operation data; identifying sensitive data in the set of operation data and marking each sensitive data corresponding data flow transfer link to obtain sensitive data carrying marking information; determining the sensitivity feature of the set of operation data according to the sensitive data carrying marking information; performing security risk assessment according to the sensitive data carrying marking information to obtain a risk assessment result; determining the current security policy according to the sensitivity feature and the risk assessment result; executing the current security policy and monitoring the implementation result corresponding to the current security policy in real time; and adjusting the current security policy according to the implementation result.

[0123] In one embodiment, the processor executing the computer program further realizes the following steps: evaluating the data sensitivity level of the sensitive data carrying marking information; evaluating the risk coefficient of the plurality of data flow transfer links; determining the access frequency corresponding to the sensitive data carrying marking information; and calculating the sensitivity feature according to the following formula:

[0124] ;

[0125] In the formula, is the sensitivity feature, is the data sensitivity level, a risk coefficient of a i-th data flow transfer link, an access frequency, a weight coefficient, .

[0126] In one embodiment, the processor, when executing the computer program, further implements the following steps: performing security risk assessment on the sensitive data carrying the marked information according to the evaluation model corresponding to each dimension, to obtain risk scores of multiple dimensions; determining a risk assessment index according to the risk scores of multiple dimensions; comparing the risk assessment index with at least one risk threshold to determine a security risk level; and taking the security risk level as a risk assessment result.

[0127] In one embodiment, the processor, when executing the computer program, further implements the following steps: performing weighted summation on the risk scores of multiple dimensions according to the weight information of multiple dimensions, to obtain a risk assessment index.

[0128] In one embodiment, the processor, when executing the computer program, further implements the following steps: determining a policy type according to the risk assessment result; determining a policy level according to the sensitivity feature; and determining a current security policy according to the policy type and the policy level.

[0129] In one embodiment, the processor, when executing the computer program, further implements the following steps: if it is monitored that the performance parameter of the power system is reduced after implementation of the current security policy, selecting a target security policy with the same policy type and a lower policy level than the current security policy; and performing policy adjustment according to the target security policy.

[0130] In one embodiment, the processor, when executing the computer program, further implements the following steps: combining the preset sensitive data feature library, and using a preset machine learning algorithm to scan the running data set, to identify and output the sensitive data in the running data set.

[0131] In one embodiment, a computer readable storage medium is provided, which stores a computer program. The computer program, when executed by a processor, implements the following steps: collecting various types of data generated by a power system during operation to obtain a running data set; identifying sensitive data in the running data set and marking each data flow transfer link corresponding to the sensitive data to obtain sensitive data carrying marked information; determining a sensitivity feature of the running data set according to the sensitive data carrying marked information; performing security risk assessment on the sensitive data carrying marked information to obtain a risk assessment result; determining a current security policy according to the sensitivity feature and the risk assessment result; executing the current security policy and monitoring the implementation result corresponding to the current security policy in real time; and adjusting the current security policy according to the implementation result.

[0132] In an embodiment, the computer program, when executed by the processor, further implements the following steps: evaluating a data sensitivity level of the sensitive data carrying the marked information; evaluating a risk coefficient of the plurality of data flow links; determining an access frequency corresponding to the sensitive data carrying the marked information; and calculating the sensitivity feature according to the following formula:

[0133]

[0134] In the formula, is the sensitivity feature, is the data sensitivity level, is the risk coefficient of the i th data flow link, is the access frequency, is the weight coefficient, .

[0135] In an embodiment, the computer program, when executed by the processor, further implements the following steps: performing security risk assessment on the sensitive data carrying the marked information according to the evaluation model corresponding to each of the plurality of dimensions, to obtain a risk score of each of the plurality of dimensions; determining a risk assessment index according to the risk scores of the plurality of dimensions; comparing the risk assessment index with at least one risk threshold to determine a security risk level; and taking the security risk level as the risk assessment result.

[0136] In an embodiment, the computer program, when executed by the processor, further implements the following steps: performing weighted summation on the risk scores of the plurality of dimensions according to the weight information of the plurality of dimensions, to obtain the risk assessment index.

[0137] In an embodiment, the computer program, when executed by the processor, further implements the following steps: determining a strategy type according to the risk assessment result; determining a strategy level according to the sensitivity feature; and determining a current security strategy according to the strategy type and the strategy level.

[0138] In an embodiment, the computer program, when executed by the processor, further implements the following steps: if it is monitored that the performance parameter of the power system decreases after implementation of the current security strategy, selecting a target security strategy of the same strategy type as the current security strategy and of a lower strategy level; and performing strategy adjustment according to the target security strategy.

[0139] In an embodiment, the computer program, when executed by the processor, further implements the following steps: combining a preset sensitive data feature library, and using a preset machine learning algorithm to scan the running data set, to identify and output the sensitive data in the running data set.

[0140] ​In one embodiment, a computer program product is provided, comprising a computer program which, when executed by a processor, implements the following steps: collecting various types of data generated by a power system during operation to obtain a set of operation data; identifying sensitive data in the set of operation data and marking each data flow link corresponding to the sensitive data to obtain sensitive data carrying marked information; determining a sensitivity feature of the set of operation data according to the sensitive data carrying marked information; performing security risk assessment according to the sensitive data carrying marked information to obtain a risk assessment result; determining a current security policy according to the sensitivity feature and the risk assessment result; executing the current security policy and monitoring the implementation result corresponding to the current security policy in real time; and adjusting the current security policy according to the implementation result.

[0141] In one embodiment, the computer program, when executed by the processor, further implements the following steps: evaluating a data sensitivity level of the sensitive data carrying marked information; evaluating risk coefficients of a plurality of data flow links; determining an access frequency corresponding to the sensitive data carrying marked information; and calculating the sensitivity feature according to the following formula:

[0142] ;

[0143] In the formula, is the sensitivity feature, is the data sensitivity level, is the risk coefficient of the i-th data flow link, is the access frequency, is a weight coefficient, .

[0144] In one embodiment, the computer program, when executed by the processor, further implements the following steps: performing security risk assessment on the sensitive data carrying marked information according to the evaluation model corresponding to each of a plurality of dimensions to obtain risk scores of the plurality of dimensions; determining a risk assessment index according to the risk scores of the plurality of dimensions; comparing the risk assessment index with at least one risk threshold to determine a security risk level; and taking the security risk level as the risk assessment result.

[0145] In one embodiment, the computer program, when executed by the processor, further implements the following steps: performing weighted summation on the risk scores of the plurality of dimensions according to weight information of the plurality of dimensions to obtain the risk assessment index.

[0146] In one embodiment, the computer program, when executed by the processor, further implements the following steps: determining a policy type according to the risk assessment result; determining a policy level according to the sensitivity feature; and determining the current security policy according to the policy type and the policy level.

[0147] In one embodiment, the computer program, when executed by the processor, further implements the following steps: if it is monitored that the performance parameter of the power system is reduced after the current security policy is implemented, a target security policy with the same policy type as the current security policy and a lower policy level is selected; and policy adjustment is performed according to the target security policy.

[0148] In one embodiment, the computer program, when executed by the processor, further implements the following steps: in combination with the preset sensitive data feature library, the preset machine learning algorithm is used to scan the running data set, and sensitive data in the running data set is identified and output.

[0149] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of the related data need to comply with relevant regulations.

[0150] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. The non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. The volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., without being limited thereto.

[0151] The technical features of the above embodiments can be combined in any manner. To make the description concise, all possible combinations of the technical features in the above embodiments are not described, but as long as the combinations of the technical features do not exist contradictions, they should be considered as the scope of the present application.

[0152] The above-described embodiments are merely illustrative of several embodiments of the present application, and the description is relatively specific and detailed, but should not be understood as a limitation on the scope of the patent. It should be noted that for those skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of protection of the present application should be subject to the appended claims.

Claims

1. A method of operational security analysis of an electric power system, characterized by, The method comprises: collecting various types of data generated by the power system during operation to obtain an operation data set; identifying sensitive data in the operation data set and marking each data flow transfer link corresponding to the sensitive data to obtain sensitive data carrying marked information; determining the sensitivity feature of the operation data set according to the sensitive data carrying marked information; performing security risk assessment on the sensitive data carrying marked information to obtain a risk assessment result; determining a current security policy according to the sensitivity feature and the risk assessment result; executing the current security policy and monitoring the implementation result corresponding to the current security policy in real time; adjusting the current security policy according to the implementation result.

2. The method of claim 1, wherein, The method comprises: evaluating the data sensitivity level of the sensitive data carrying marked information; evaluating the risk coefficient of multiple data flow transfer links; determining the access frequency corresponding to the sensitive data carrying marked information; calculating the sensitivity feature according to the following formula: ； In the formula, is a sensitivity characteristic, is a data sensitivity level, is a risk coefficient of the i-th data flow transfer link, is a frequency of access, is a weight coefficient, .

3. The method of claim 1, wherein, The method comprises: performing security risk assessment on the sensitive data carrying marked information according to the evaluation model corresponding to each dimension to obtain the risk score of each dimension; determining a risk assessment index according to the risk score of each dimension; comparing the risk assessment index with at least one risk threshold to determine a security risk level; taking the security risk level as the risk assessment result.

4. The method of claim 3, wherein, The method comprises: weighting and summing the risk score of each dimension according to the weight information of each dimension to obtain the risk assessment index.

5. The method according to any one of claims 1 to 4, characterized in that, The method comprises: determining a policy type according to the risk assessment result; determining a policy level according to the sensitivity feature; determining the current security policy according to the policy type and the policy level.

6. The method of claim 5, wherein, The method comprises: if the performance parameter of the power system decreases after the implementation of the current security policy, selecting a target security policy with the same policy type as the current security policy and a lower policy level; performing policy adjustment according to the target security policy.

7. The method according to any one of claims 1 to 4, characterized in that, The method comprises: combining a preset sensitive data feature library, using a preset machine learning algorithm to scan the operation data set, and identifying and outputting the sensitive data in the operation data set.

8. An operation security analysis device of a power system, characterized by comprising: The device comprises: a data collection module configured to collect various types of data generated by the power system during operation to obtain an operation data set; The sensitive data identification module is configured to identify sensitive data in the running data set, mark a data flow transfer link corresponding to each sensitive data, and obtain sensitive data carrying marked information; and determine a sensitivity feature of the running data set according to the sensitive data carrying marked information. The risk assessment module is configured to perform security risk assessment according to the sensitive data carrying marked information, and obtain a risk assessment result. The policy implementation module is configured to determine a current security policy according to the sensitivity feature and the risk assessment result, execute the current security policy, monitor an implementation result corresponding to the current security policy in real time, and adjust the current security policy according to the implementation result. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor executes the computer program to implement the steps of the method in any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 7.

Images