Network security protection method, system and device based on electric power big data and medium

Abstract

The invention discloses a network security protection method, system and device based on electric power big data and a medium, and belongs to the technical field of network security protection, and the method comprises the steps: constructing a mixed data set containing structured and unstructured data; performing multi-dimensional feature extraction on the mixed data set; inputting the features into a pre-trained threat analysis model, and outputting an analysis result about an attack type, a danger level and an attack path; generating a protection strategy based on the analysis result; continuously acquiring operation state indexes of the power system; and when the operation state index meets a preset abnormal condition, automatically updating the protection strategy. According to the method, through introduction of the long-short-term memory neural network, the deformable convolutional structure and the graph neural network of period perception, fine modeling of multi-dimensional data of the power system is realized, and the recognition accuracy of complex attack behaviors is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security protection, in particular to a network security protection method, system, device and medium based on power big data. BACKGROUND

[0002] With the deepening of the intelligent transformation of the power system, the data generated by the dispatching control system, smart meter terminal and other devices shows an explosive growth. The existing network security protection technology has the following outstanding problems:

[0003] The traditional intrusion detection system uses single-dimensional data analysis, which is difficult to capture the space-time correlation characteristics unique to power data;

[0004] Static protection strategy cannot adapt to the dynamic changes of power grid operation state, and there is a protection lag problem;

[0005] Security protection and power physical system operation state are separated, and there is a lack of linkage response to abnormal states such as device overload and frequency fluctuation;

[0006] The permission management mechanism is rigid and cannot cope with the horizontal penetration behavior in new APT attacks.

[0007] The existing technology proposes a power monitoring system protection method based on traffic monitoring, but it does not consider the correlation analysis of device operation logs and load data, and the defense strategy lacks dynamic adjustment capability. Therefore, it is urgent to develop an active defense scheme deeply integrated with power business. SUMMARY

[0008] In view of the above problems, the present application is proposed.

[0009] Therefore, the technical problem solved by the present application is: how to realize efficient detection and dynamic response to network security threats in the face of large-scale, multi-source heterogeneous data environment of the power system, and thus improve the overall network protection capability and operation safety of the power system.

[0010] To solve the above technical problems, the present application provides the following technical solutions: a network security protection method based on power big data, comprising,

[0011] Collecting multi-source data related to power system operation through a communication network, and constructing a mixed data set containing structured and unstructured data;

[0012] Multi-dimensional feature extraction is performed on the mixed data set to form a feature representation containing time variation, spatial position and network connection information;

[0013] The feature representation is input into a pre-trained threat analysis model, which combines rule-based reasoning methods and machine learning models to output analysis results about attack type, danger level and attack path;

[0014] generate a protection policy based on the analysis result, the protection policy including at least one security protection sub-policy for network path management, access control or data flow control;

[0015] execute the protection policy and continuously acquire the power system operation state index;

[0016] automatically update the protection policy when the operation state index meets a preset abnormal condition.

[0017] As a preferred scheme of the network security protection method based on power big data, the multi-dimensional feature extraction includes extracting time variation information through a long short-term memory neural network containing a cycle parameter, and the cycle parameter is set according to the daily variation law of power load.

[0018] The spatial position information is extracted by using a spatial feature extraction method with adjustable convolution kernel size, and the convolution kernel size is dynamically set according to the geographic distribution density of the substation.

[0019] The network connection information is extracted based on a graph neural network, and the node weight in the graph is calculated according to the equipment importance index and the power supply coverage range.

[0020] As a preferred scheme of the network security protection method based on power big data, the extraction of time variation information includes inputting time series data in a mixed data set into a recurrent neural network for processing, and a cycle function term based on time step is included in the forgetting gate function of the recurrent neural network, and the cycle function term is used to introduce the periodic variation parameter of power load.

[0021] As a preferred scheme of the network security protection method based on power big data, the extraction of spatial position information includes processing geographic related data by using a convolutional neural network with variable convolution kernel size, and the convolution kernel size is dynamically adjusted according to the density index related to the node position.

[0022] As a preferred scheme of the network security protection method based on power big data, the rule-based method is used to construct a rule set according to expert knowledge related to power network security, and to identify behaviors meeting abnormal operation conditions in the input data.

[0023] The machine learning model is used to learn the corresponding relationship between threat features and attack behaviors based on training data.

[0024] The machine learning model is a neural network model, at least comprising a recurrent neural network module for extracting time sequence features, a convolutional neural network module for extracting spatial distribution features, and a graph neural network module for analyzing power system topology.

[0025] The beneficial effects of the preferred technical solution are: the scheme significantly improves the detection accuracy and adaptability of power network security threats by fusing rule-based reasoning mechanism and deep learning model. The rule-based reasoning part can construct an abnormal behavior rule library based on the experience of power industry experts, and quickly screen typical attack features in the data matching stage; the deep learning part introduces three structures: recurrent neural network (RNN) for time series modeling, convolutional neural network (CNN) for geographic spatial feature extraction, and graph neural network (GNN) for power network topology perception. This multi-model collaborative architecture enables the system to capture the time regularity, spatial distribution characteristics and propagation path of attacks in the power network, significantly enhancing the comprehensive detection capability of complex network attacks such as DDoS attacks, disguised access, and horizontal penetration. At the same time, the model can adapt to new attack patterns through continuous training, and has continuous learning ability.

[0026] As a preferred scheme of the network security protection method based on power big data, the execution of the protection strategy includes a communication path management sub-strategy for triggering communication link switching when an attack path risk is identified.

[0027] A user access control sub-strategy for adjusting access permissions according to the security credit level of the device;

[0028] A data flow processing sub-strategy for performing filtering, shaping or bandwidth limiting operations on abnormal traffic.

[0029] The beneficial effects of the preferred technical solution are: the scheme subdivides the protection strategy into three specific executable security sub-strategies, and dynamically links with the real-time state monitoring results of the power system, realizing a network protection mechanism with scene adaptability. Specifically: when the system identifies that a communication path has attack risk, the communication path management sub-strategy can trigger dynamic link switching or bypass scheduling to ensure that the key communication link is not interrupted; the user access control sub-strategy adjusts the permission level based on the real-time security credit scoring system of the device to prevent high-risk users or nodes from continuing to operate; and the data flow processing sub-strategy can perform filtering of abnormal data packets, data flow shaping or limitation of specific port bandwidth according to the identified attack traffic type. The above mechanisms effectively realize the rapid containment of network attacks and the minimum interference response of system operation without affecting normal business operation, greatly improving the resilience defense and continuous availability of the power system under complex network threats.

[0030] As a preferred scheme of the network security protection method based on power big data, wherein: the automatic updating of the protection strategy comprises collecting voltage and frequency indexes of the current power system;

[0031] When the voltage fluctuation exceeds the first threshold or the frequency deviation exceeds the second threshold, it is determined that the operation state is abnormal;

[0032] If the above abnormality occurs, and there is a network attack with a high-risk level of attack type output by the threat analysis model at the same time, a strategy optimization program is triggered;

[0033] The strategy optimization program dynamically adjusts the combination of the sub-strategies in the protection strategy package according to the preset rules corresponding to the current attack type and the operation abnormality type.

[0034] The application provides a network security protection system based on power big data.

[0035] To solve the above technical problems, the application provides the following technical scheme: a network security protection system based on power big data, comprising: a data acquisition module for acquiring multi-source data related to the operation of a power system and constructing a mixed data set containing structured and unstructured data;

[0036] A feature analysis engine is used for multi-dimensional feature extraction of the mixed data set to form a feature representation containing time variation, spatial position and network connection information;

[0037] A strategy decision center is used for analyzing the feature representation through a threat analysis model, wherein the threat analysis model combines a rule-based reasoning method and a machine learning model and is used for outputting analysis results of attack type, danger level and attack path;

[0038] The strategy decision center is used for generating a protection strategy according to the analysis results, wherein the protection strategy comprises at least one security protection sub-strategy for network path management, access control or data flow control;

[0039] A dynamic execution unit is used for executing the protection strategy and continuously acquiring power system operation state indexes; when the operation state indexes meet preset abnormal conditions, the protection strategy is automatically updated by the strategy decision center, and the update is implemented through the dynamic execution unit;

[0040] A situation awareness platform is used for network security situation monitoring, providing visual display and early warning information push support.

[0041] The application provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the network security protection method based on power big data when executing the computer program.

[0042] The application provides a computer readable storage medium, which stores a computer program, and the computer program is characterized in that the computer program is executed by a processor to realize the steps of the network security protection method based on power big data.

[0043] The application has the beneficial effects that: by introducing a cycle-aware long short-term memory neural network, a deformable convolution structure and a graph neural network, fine modeling of multi-dimensional data of a power system is realized, and the identification accuracy of complex attack behaviors is improved.

[0044] The threat analysis model fusing rule reasoning and neural network learning has the rapid identification ability of known attacks and the generalization detection ability of unknown threats, and effectively enhances the system robustness.

[0045] The operation state monitoring mechanism based on multi-source data and the dynamic protection strategy linkage updating mechanism can quickly adjust the defense scheme when key indicators such as voltage and frequency are abnormal, and significantly improve the response speed and protection timeliness. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions of the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0047] Figure 1 The overall flowchart of the network security protection method based on power big data provided by an embodiment of the application is shown.

[0048] Figure 2 The substation load temperature time sequence curve of the network security protection method based on power big data provided by an embodiment of the application is shown.

[0049] Figure 3 The substation geographic distribution map of the network security protection method based on power big data provided by an embodiment of the application is shown.

[0050] Figure 4 The network topology structure diagram of the network security protection method based on power big data provided by an embodiment of the application is shown. DETAILED DESCRIPTION

[0051] In order to make the above objectives, characteristics and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should belong to the protection scope of the present application.

[0052] Embodiment 1, refer to Figure 1 For an embodiment of the present application, the embodiment provides a network security protection method based on power big data, comprising:

[0053] Step 101: collecting power system operation related multi-source data through a communication network, and constructing a mixed data set containing structured and unstructured data;

[0054] Step 102: multi-dimensional feature extraction is performed on the mixed data set to form a feature representation containing time variation, spatial position and network connection information;

[0055] Step 103: inputting the feature representation into a pre-trained threat analysis model, the model fuses rule-based reasoning method and machine learning model, and is used to output analysis results about attack type, danger level and attack path;

[0056] Step 104: generating a protection strategy based on the analysis results, the protection strategy including at least one security protection sub-strategy for network path management, access control or data flow control;

[0057] Step 105: executing the protection strategy and continuously acquiring power system operation state indicators; when the operation state indicators meet the preset abnormal conditions, the protection strategy is automatically updated.

[0058] In step 102, the multi-dimensional feature extraction includes extracting time variation information through a long short-term memory neural network containing a periodic parameter, and the periodic parameter is set according to the daily variation law of power load;

[0059] The spatial position information is extracted by using a spatial feature extraction method with adjustable convolution kernel size, and the convolution kernel size is dynamically set according to the geographical distribution density of the transformer substation;

[0060] The network connection information is extracted based on a graph neural network, and the node weight in the graph is calculated according to the equipment importance index and the power supply coverage range.

[0061] The extraction of time variation information includes inputting time series data in the mixed data set into a recurrent neural network for processing, and a periodic function term based on time step is included in the forgetting gate function of the recurrent neural network, and the periodic function term is used to introduce the periodic variation parameter of power load.

[0062] The extraction of the spatial position information comprises processing geographical related data by using a convolutional neural network with a variable convolution kernel size, and the convolution kernel size is dynamically adjusted according to a density index related to the position of the node.

[0063] In a preferred embodiment of the present application, the multi-dimensional feature extraction comprises: modeling the time series information in the mixed data set by using a long short-term memory neural network (LSTM) embedded with a period parameter, and the period parameter is designed based on the daily period characteristics of power load; extracting the spatial position information by using a deformable convolutional neural network, and the convolution kernel size is dynamically adjusted according to the distribution density of the transformer substation in the geographical grid; modeling the network connection structure by using a graph neural network, and the node weight is calculated according to the power supply coverage range and the criticality (such as transformer capacity) of the equipment, and finally a unified three-dimensional feature representation is constructed.

[0064] The preferred technical scheme has the beneficial effects that the periodic fluctuations, spatial distribution heterogeneity and network structure level information of the power data can be captured respectively, the model's recognizability of the attack behavior in different dimensions is improved, and the multi-source feature fusion capability and detection accuracy are significantly improved.

[0065] In an optional embodiment of the present application, the multi-dimensional feature extraction can also obtain time features by using an isolated forest-based time series anomaly detection algorithm, extract spatial position information by using a Gaussian mixture model-based clustering method, and extract network node relationships by using a PageRank weight-based graph algorithm, so as to construct a low-complexity feature representation scheme suitable for resource-limited scenarios.

[0066] In step 103, the rule-based method is used to construct a rule set according to expert knowledge related to power network security, and identify behaviors in the input data that meet abnormal operation conditions;

[0067] The machine learning model is used to learn the corresponding relationship between threat features and attack behaviors based on training data;

[0068] The machine learning model is a neural network model, which at least includes a recurrent neural network module for extracting time series features, a convolutional neural network module for extracting spatial distribution features, and a graph neural network module for analyzing the topology of the power system.

[0069] In a preferred embodiment of the present application, the threat analysis model is a dual-channel fusion architecture, including a rule base channel based on expert knowledge and a multi-layer neural network channel. The rule channel introduces typical rules from the NERC-CIP standard and the attack case library, combined with real-time data to determine whether to trigger a risk alarm; the neural network channel is composed of a time series analysis module, a spatial attention module and a graph structure perception module, which respectively model the time, space and topology dimensions in depth, and combine the rule confidence output in the fusion layer to unify the threat evaluation results.

[0070] The beneficial effects of the preferred technical solution are: the rule channel has explicit interpretability and is suitable for known attack identification; the neural network channel has strong generalization ability and can discover unknown or variant attacks, and through the fusion mechanism, the precision and recall rate can be balanced to improve the overall identification ability.

[0071] In an optional embodiment of the present application, the threat analysis model can be composed of only data-driven shallow learning algorithms, such as using support vector machines combined with feature engineering to extract attack type classification results, which is suitable for lightweight or fast response scenarios; or using an unsupervised autoencoder structure to learn normal behavior patterns of data, and identifying potential threats through reconstruction error.

[0072] In step 105, the execution of the protection strategy includes a communication path management sub-strategy for triggering communication link switching when a risk of attack path is identified;

[0073] A user access control sub-strategy for adjusting access permissions according to the security credit level of the device;

[0074] A data flow processing sub-strategy for performing filtering, shaping or bandwidth limiting operations on abnormal traffic.

[0075] The automatic updating of the protection strategy includes collecting voltage and frequency indicators of the current power system;

[0076] When voltage fluctuations exceed a first threshold or frequency deviation exceeds a second threshold, it is determined that the operating state is abnormal;

[0077] If the above abnormality occurs, and at the same time there is a network attack with a high-risk level output by the threat analysis model, a strategy optimization program is triggered;

[0078] The strategy optimization program dynamically adjusts the sub-strategy combination in the protection strategy package according to the preset rules corresponding to the current attack type and the operating abnormality type.

[0079] In a preferred embodiment of the present application, the obtaining of the operation state indicator comprises: periodically obtaining key operation parameters including bus voltage, power grid frequency, device temperature and load rate, etc. by interfacing with the power master station and the PMU (synchronous phasor measurement device); wherein voltage fluctuation exceeding a preset threshold AV or frequency deviation exceeding Df is taken as a trigger condition for judging abnormal operation of the power system, and the output result of the threat analysis model is used to jointly determine whether to update the protection strategy.

[0080] The preferred technical solution has the beneficial effect of realizing network situation and physical operation linkage identification, avoiding false positives and false negatives, and especially being able to capture potential threats through physical side changes when attacks do not cause significant network abnormalities, thereby enhancing system robustness.

[0081] In an optional embodiment of the present application, the operation state indicator can also include line power flow fluctuation, load shedding record and switch tripping information, which can be sourced from the SCADA system or intelligent terminal log, for early detection of abnormal evolution trends on the edge side, thereby improving the advance of abnormal response.

[0082] Embodiment 2, refer to Figures 1-4 For an embodiment of the present application, a network security protection method based on power big data is provided based on the previous embodiment, comprising:

[0083] Step S201: real-time collection of power dispatching instruction data, user load curve data and device operation log data through a power special communication network, to form a mixed data set containing structured and unstructured data;

[0084] Step S202: multi-dimensional feature extraction on the mixed data set to generate a three-dimensional feature matrix containing time variation features, spatial position features and network connection features;

[0085] Step S203: inputting the three-dimensional feature matrix into a pre-trained threat analysis model, which adopts an architecture combining an expert rule base and a deep neural network, to output analysis results containing attack type, danger level and attack path;

[0086] Step S204: generating a dynamic protection strategy package according to the analysis results, the strategy package at least including a communication line switching scheme, a user permission dynamic management scheme and a data flow filtering scheme;

[0087] Step S205: implementing the protection strategy package through a strategy execution module, and continuously monitoring power grid operation indicators during the execution process, and when voltage fluctuation is found to be out of standard or frequency deviation is abnormal, automatically starting a strategy optimization program for real-time adjustment.

[0088] In use, step S202 is specifically implemented as: the time-varying feature is extracted by using an improved long short-term memory network, and the improvement point is that a periodic change parameter of the power load is added to the forgetting gate; the spatial position feature is extracted by using a deformable convolution kernel, and the size of the convolution kernel is automatically adjusted according to the distribution density of the transformer substation; and the network connection feature is learned by using a graph neural network, and the device importance and the power supply coverage range are considered at the same time when the node weight is calculated.

[0089] The user permission dynamic management scheme in step S204 includes: establishing a device security credit scoring system, and the score is based on the historical operation specification degree, the vulnerability repair speed and the number of abnormal operations; when a network penetration attack is found, the access permission level of the related device is automatically reduced; and when the power grid is in high load operation, the operation permission threshold of the core device is temporarily increased.

[0090] Step S205 also includes: constructing an associated analysis model of the power grid operation state and the network security situation, establishing the correspondence between the device temperature, the load rate and the network attack success rate by using a neural network; when a specific device has a temperature anomaly and is accompanied by abnormal data access, a device isolation scheme is automatically executed;

[0091] In the strategy adjustment process, load prediction data is introduced, and the network security resources of the key power supply area are preferentially guaranteed.

[0092] Model architecture and training details: threat analysis model structure: a dual-channel fusion architecture is adopted: (1) rule channel: the expert knowledge base includes 327 power system attack feature rules, which are derived from the NERC CIP standard and the historical attack case library, and a rule example is: IF login time ∈ [0:00-5:00] ∧ operation type = SCADA instruction ∧ source IP ∈ external address THEN risk level += 20%.

[0093] (2) neural network channel: including 3 DNN sub-modules: time analysis module: 4 layers of BiLSTM, hidden layer dimension 128, time window length 144 (24 hours of data); spatial analysis module: deformable convolution layer (maximum kernel size 7×7) + spatial attention mechanism; topological analysis module: graph convolution network (GCN), number of layers = 3, node weight calculation formula: W_i = 0.6×(main transformer capacity / MVA) + 0.4×(number of power supply users / 1000); fusion layer: the rule confidence (0-1) and the neural network output are summed by weighting to obtain the final result, and the weight coefficient is dynamically adjusted by reinforcement learning; the LSTM details: the forgetting gate calculation formula is modified as:

[0094] f t =σ(W f ·[h t-1 ,x t ]+b f+ P cos(T2πt)); where P is a periodic parameter matrix, T = 144 (daily cycle step), determined by spectral analysis of grid historical data.

[0095] Training parameter settings: training data: data of a provincial system of State Grid from 2018 to 2022, containing: normal data: 8.5 million; labeled attack data: 150,000 in 12 categories.

[0096] Training process: ① Pre-training stage: unsupervised contrastive learning is used in the neural network channel, learning rate 1e-4, batch_size 256.

[0097] ② Fine-tuning stage: joint training is added to the rule channel, loss function:

[0098] L = 0.7 x cross-entropy loss + 0.3 x rule matching loss.

[0099] ③ Optimizer: NAdam, learning rate decay strategy: decrease by 30% every 10 epochs.

[0100] Method core: build a "data feature-threat analysis-dynamic protection" three-layer linkage mechanism, which specifically includes:

[0101] Multi-source data fusion collection: through the special protocol converter to interface SCADA, PMU and other systems, synchronously obtain dispatching instructions (structured data) and equipment vibration logs (unstructured data), solve the problem of single data source of traditional system.

[0102] Power feature enhancement analysis: time dimension: embed daily / weekly load cycle parameters in the LSTM forget gate to improve the feature extraction capability for regular fluctuations in load; spatial dimension: use deformable convolution kernels to automatically adapt to the difference in distribution density of substations, for example, use 5x5 large kernel to extract macro features in dense urban areas, and use 3x3 small kernel to capture details in remote areas; topology dimension: introduce device importance index (such as transformer capacity / supplied user number) as node weight calculation coefficient in graph neural network;

[0103] Dynamic strategy generation technology: establish a device security credit score model: number of rule violations (30% weight) + patch installation delay time (50% weight) + number of abnormal login locations (20% weight); defense strategy dynamic packaging technology: when DDoS attack is detected, automatically combine "traffic cleaning (priority 1) + link switching (priority 2)" strategy package; running state linkage protection: build a device temperature-network attack success rate correlation model, when the transformer winding temperature > 85℃ and abnormal access is detected, immediately trigger device isolation strategy.

[0104] Specific steps of model establishment: data simulation subsystem construction: establish multi-node power data generator: time reference: generate continuous time series data at 10-minute intervals; load characteristics: simulate daily / weekly load fluctuations using a sinusoidal periodic function, and the basic load value increases linearly with node number (500 kW reference + 100 kW / node); temperature parameters: superimpose periodic fluctuations and Gaussian noise (μ = 0, σ = 2); output structure: generate a 5-node x 1008-time-step x 2-feature (load, temperature) three-dimensional matrix.

[0105] Space-time feature extraction module: (1) improved LSTM time series processor: network structure: input layer (2 neurons) → hidden layer (64 units) → fully connected output layer (2 neurons); improvement mechanism: embed daily cycle parameters in the forgetting gate calculation; mathematical expression: f t = σ(W f · [h t-1 , x t ]+ b f + P cos((1442πt)). Where P is a trainable parameter matrix, and 144 corresponds to the number of daily cycle data points.

[0106] Training configuration: data preprocessing: Min-Max normalization processing; sliding window: set a 12-time-step (2 hours) history window; optimizer: Adam algorithm, learning rate 0.001; ④ training iteration: 50 epochs, loss function uses MSE; adaptive spatial feature extractor: deformable convolution kernel adjustment rule: substation density d > 0.8 / km 2 → use 7x7 large kernel; 0.3 < d ≤ 0.8 → use 5x5 medium kernel; d ≤ 0.3 → use 3x3 small kernel; geographic coding: map node GPS coordinates to 10x10 standard grid coordinate system; threat detection module implementation: anomaly detector: built based on the Isolation Forest algorithm; number of trees: 100; sampling strategy: bootstrap sampling; anomaly threshold: -0.5 (determine score < -0.5 as abnormal); attack pattern library: predefine three typical attack features; DDoS attack: multi-node concurrent traffic mutation; data tampering: load-temperature correlation anomaly; unauthorized access: login event outside working hours.

[0107] Visualization system construction: (1) space-time feature display interface: time series curve: bi-axial display of load and temperature change trend; heat distribution map: different size squares represent substation size, color mapping temperature value; topological relationship diagram: use force-directed layout algorithm to distinguish control center (gold), substation (green), and user group (blue) three types of nodes.

[0108] Generate three visualizations: substation load temperature time series curve, such as Figure 2As shown in the figure, the figure is a load prediction effect diagram, the Y coordinate system is named load or temperature value, the X coordinate system is named time step (10 minute interval), the upper curve is the load change trend, and the lower curve is the temperature change trend; the geographical distribution diagram of the transformer substation is as shown in Figure 3 As shown in the figure, the figure is a load prediction effect diagram, the Y coordinate system is named load or temperature value, the X coordinate system is named time step (10 minute interval), the upper curve is the load change trend, and the lower curve is the temperature change trend; the geographical distribution diagram of the transformer substation is as shown in Figure 4 As shown in the figure, the figure is a load prediction effect diagram, the Y coordinate system is named load or temperature value, the X coordinate system is named time step (10 minute interval), the upper curve is the load change trend, and the lower curve is the temperature change trend; the geographical distribution diagram of the transformer substation is as shown in

[0109] In one application environment of the embodiment, when a provincial power grid is attacked by a phishing email, the steps are as follows: abnormal login logs (unstructured data) of a dispatcher workstation and load curve mutation data (structured data) are collected; the feature engine detects that ±15% load fluctuation (time anomaly) occurs in a non-peak shaving period of a working day and the network connection hop count of the workstation suddenly increases (topology anomaly); the threat model determines that it is an APT attack (confidence 92%), and the tracing path points to a certain outsourcing system maintenance terminal; a strategy package is generated: ①limiting access of the workstation to the SCADA system (permission downgrade) ②enabling a backup dispatch channel (link switching); after the strategy is executed, the frequency deviation is reduced from 0.35Hz to 0.08Hz, and the backup channel switching is automatically removed.

[0110] In another application environment of the embodiment, high-load operation protection during peak summer: when the main transformer load rate is greater than 90%, the system automatically executes: the dispatching master station operation permission threshold is raised (double authentication is required); the encryption algorithm is forcibly upgraded to SM4-256; the traffic bandwidth of important load areas is preferentially guaranteed (the QoS level is set to the highest); when the temperature of a certain feeder terminal abnormally rises by 5℃, the node is automatically isolated and load transfer is started.

[0111] In summary, the network security protection method and system based on power big data have the following technical effects: attack detection efficiency is improved: compared with traditional methods, the APT attack discovery time is greatly shortened; dynamic defense capability is enhanced: the strategy adjustment response time is less than or equal to 50ms, meeting the safety protection requirements of the power secondary system; resource optimization configuration: the calculation resource consumption is reduced by guiding the safety resource deployment through load prediction; the system compatibility is high: seamless docking with the existing dispatching control system is supported, and the transformation implementation period is less than or equal to 3 working days.

[0112] Embodiment 3 is an embodiment of the present application, which provides a network security protection system based on power big data, comprising:

[0113] A data collection module is configured to collect multi-source data related to power system operation and build a mixed data set containing structured and unstructured data.

[0114] A feature analysis engine is configured to perform multi-dimensional feature extraction on the mixed data set to form a feature representation containing time variation, spatial position and network connection information.

[0115] A policy decision center is configured to analyze the feature representation by a threat analysis model that integrates rule-based reasoning method and machine learning model to output analysis results of attack type, danger level and attack path.

[0116] The policy decision center is configured to generate a protection policy based on the analysis results, which includes at least one security protection sub-policy for network path management, access control or data flow control.

[0117] A dynamic execution unit is configured to execute the protection policy and continuously collect power system operation state indicators. When the operation state indicators meet the preset abnormal conditions, the protection policy is automatically updated by the policy decision center, and the update is implemented by the dynamic execution unit.

[0118] A situational awareness platform is configured to monitor the network security situation and provide visual display and early warning information push support.

[0119] It should be noted that the data collection module is equipped with a power special protocol converter and a multi-protocol adapter for connecting the dispatching system, the synchronous phasor measurement device and the smart meter.

[0120] The feature analysis engine includes a hardware-accelerated parallel computing component, which integrates a time series processing unit, a spatial feature extraction unit and a graph computing accelerator.

[0121] The policy decision center is deployed with a power grid digital twin simulation environment for simulating and testing the effect of the protection policy.

[0122] The dynamic execution unit includes a programmable controller and a software-defined network controller to realize millisecond-level policy distribution and network reconstruction.

[0123] The situational awareness platform has a three-dimensional visual interface and a hierarchical early warning information push function, and supports multi-dimensional data analysis.

[0124] The feature analysis engine further comprises: an abnormal traffic detection unit that adopts a modified cumulative sum algorithm for mutation detection, and a detection window that is automatically adjusted according to the load; a protocol compliance checking unit that is built-in with a white list of power special communication protocols, and supports deep analysis of Modbus and IEC 60870-5-104 protocols; and a behavior pattern analysis unit that establishes a device operation benchmark library, and dynamically adjusts the benchmark values according to the season, weather and working day type.

[0125] The dynamic execution unit further comprises:

[0126] An intelligent encryption module that can automatically select the encryption strength according to the network traffic;

[0127] A traffic shaping module that is configured with a data packet priority management mechanism based on the quality of service level;

[0128] A link switching module that has millisecond-level switching capability for the main and backup communication lines.

[0129] The situation awareness platform comprises: a risk prediction model that adopts a time series analysis algorithm for short-term risk early warning, and cross- validates the prediction results with real-time data; an attack impact assessment model that establishes a correlation table of device failure probability and network security events; and an emergency command module that is built-in with 36 typical attack scenario disposal schemes, and supports online simulation and effect evaluation.

[0130] The intelligent encryption module specifically comprises: an encryption strength regulator that automatically selects AES-128 or AES-256 encryption according to the network delay and CPU usage; a key distribution unit that adopts a threshold secret sharing technology to realize segmented storage of the key; and a session key generator that dynamically generates a unique key each time communication is established.

[0131] The emergency command module further comprises:

[0132] A pre-plan optimization unit that automatically records the disposal effect and generates optimization suggestions through simulation attacks;

[0133] A multi-system linkage interface that realizes data intercommunication with the power grid dispatching system and the device management system;

[0134] A disposal effect evaluation unit that adopts attack blocking rate and fault recovery time as double indicators to evaluate the effectiveness of the pre-plan.

[0135] The system solution core: the cooperative working mechanism of the four core modules: intelligent acquisition terminal:

[0136] A multi-protocol adapter that supports 12 power protocols such as IEC 61850 / Modbus for protocol analysis;

[0137] An embedded security chip that realizes real-time encryption of the collected data by using the national encryption algorithm SM4;

[0138] Feature analysis engine hardware architecture: three parallel processing channels: time series processor (FPGA implementation of LSTM acceleration) + spatial feature extractor (GPU accelerated convolution operation) + graph computing accelerator (proprietary chip optimized for adjacency matrix calculation);

[0139] Policy simulation test environment:

[0140] The digital twin module has a built-in regional power grid equivalent model, which can simulate 220kV / 110kV multi-voltage level network attack scenarios;

[0141] Policy effectiveness evaluation indicators: attack blocking rate (≥95%), fault recovery time (≤200ms);

[0142] Adaptive execution unit:

[0143] Software-defined network controller supports millisecond-level communication link switching (master-backup channel switching time ≤15ms);

[0144] Intelligent encryption module dynamic selection algorithm: AES-256 is enabled when network delay <50ms, and downgraded to AES-128 when delay >50ms.

[0145] The embodiment also provides an electronic device suitable for the network security protection method based on power big data, including: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions to realize the network security protection method based on power big data proposed in the above embodiment.

[0146] The embodiment also provides a storage medium having a computer program stored thereon, and the program is executed by a processor to realize the network security protection method based on power big data proposed in the above embodiment.

[0147] The storage medium proposed in the embodiment and the network security protection method based on power big data proposed in the above embodiment belong to the same inventive concept, and the technical details not described in detail in the embodiment can be referred to the above embodiment, and the embodiment has the same beneficial effects as the above embodiment.

[0148] From the above description of the embodiments, those skilled in the art can clearly understand that the present application can be implemented by means of software and necessary universal hardware, and of course can also be implemented by hardware, but in many cases the former is a better implementation. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a floppy disk, a ROM, a RAM, a FLASH, a hard disk, or an optical disc, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of various embodiments of the present application.

[0149] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application but not limit the present application, and although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the technical solutions of the present application, and all of them should be covered in the scope of the claims of the present application.

Claims

1. A network security protection method based on power big data, characterized in that: include, Multi-source data related to power system operation are collected through communication networks to construct a hybrid dataset containing both structured and unstructured data; Multi-dimensional feature extraction is performed on the hybrid dataset to form a feature representation that includes information on temporal variation, spatial location, and network connectivity. The feature representations are input into a pre-trained threat analysis model, which integrates rule-based reasoning methods and machine learning models to output analysis results on attack type, danger level, and attack path. Based on the analysis results, a protection policy is generated, which includes at least one security protection sub-policy for network path management, access control, or data flow management. Implement protection strategies and continuously acquire power system operating status indicators; When the operational status indicators meet the preset abnormal conditions, the protection strategy is automatically updated.

2. The network security protection method based on power big data as described in claim 1, characterized in that: The multi-dimensional feature extraction includes extracting time change information through a long short-term memory neural network containing a period parameter, wherein the period parameter is set according to the daily variation pattern of power load. Spatial location information is extracted using a spatial feature extraction method with adjustable convolution kernel size, and the convolution kernel size is dynamically set according to the geographical distribution density of substations; Network connection information is extracted based on graph neural networks, and the node weights in the graph are calculated based on both the device importance index and the power supply coverage.

3. The network security protection method based on power big data as described in claim 2, characterized in that: The extraction of time variation information includes inputting time series data from the mixed dataset into a recurrent neural network for processing. The forgetting gate function of the recurrent neural network includes a periodic function term based on the time step, which is used to introduce the periodic variation parameters of the power load.

4. The network security protection method based on power big data as described in claim 3, characterized in that: The extraction of spatial location information includes processing geographically relevant data using a convolutional neural network with a variable kernel size, wherein the kernel size is dynamically adjusted according to a density index related to the node location.

5. The network security protection method based on power big data as described in claim 4, characterized in that: The rule-based method is used to construct a rule set based on expert knowledge related to power network security, and to identify behaviors in the input data that meet the abnormal operation conditions. The machine learning model is used to learn the correspondence between threat features and attack behaviors based on training data; The machine learning model is a neural network model, which includes at least a recurrent neural network module for extracting time series features, a convolutional neural network module for extracting spatial distribution features, and a graph neural network module for analyzing the topology of the power system.

6. The network security protection method based on power big data as described in claim 5, characterized in that: The execution protection strategy includes a communication path management sub-strategy, which is used to trigger communication link switching when an attack path is identified as having a risk. User access control sub-policies are used to adjust access permissions based on the device's security credit level; Data traffic processing sub-policies are used to perform filtering, shaping, or bandwidth limiting operations on abnormal traffic.

7. The network security protection method based on power big data as described in claim 6, characterized in that: The automatic update protection strategy includes collecting the current voltage and frequency indicators of the power system; When a voltage fluctuation exceeding the first threshold or a frequency offset exceeding the second threshold is detected, it is determined to be an abnormal operating state. If the above anomaly occurs, and there is also a network attack whose attack type is high-risk as output by the threat analysis model, the policy optimization program will be triggered. The strategy optimization program dynamically adjusts the combination of sub-strategies in the protection strategy package based on the preset rules corresponding to the current attack type and the type of runtime anomaly.

8. A network security protection system based on power big data, employing the network security protection method based on power big data as described in any one of claims 1 to 7, characterized in that, include: The data acquisition module is used to acquire multi-source data related to the operation of the power system and construct a mixed dataset containing both structured and unstructured data. The feature analysis engine is used to extract multi-dimensional features from the hybrid dataset to form a feature representation that includes information on time variation, spatial location, and network connectivity. The strategy decision center is used to analyze feature representations through a threat analysis model, which integrates rule-based reasoning methods and machine learning models to output analysis results on attack type, danger level, and attack path. The strategy decision center is used to generate protection policies based on the analysis results. The protection policies include at least one security protection sub-policy for network path management, access control, or data flow management. The dynamic execution unit is used to execute protection strategies and continuously acquire power system operating status indicators; When the operational status indicators meet the preset abnormal conditions, the protection policy is automatically updated by the strategy decision center and the update is implemented through the dynamic execution unit. The situational awareness platform is used for network security situational monitoring, providing visualization and early warning information push support.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the network security protection method based on power big data as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the network security protection method based on power big data as described in any one of claims 1 to 7.

Images