Grayscale value dynamic adjustment and risk assessment method in power system network security

Abstract

The invention discloses a gray value dynamic adjustment and risk assessment method in power system network security, and belongs to the technical field of power system network security assessment, and the method comprises the following steps: S1, feature dynamic collection, S2, gray value dynamic coding, S3, topology perception risk assessment, S4, risk alarm threshold dynamic adjustment, and S5, risk prevention and control feedback. Through cooperative operation of four stages of dynamic feature extraction, gray value adaptive coding, topology perception risk assessment and dynamic decision feedback, real-time and accurate assessment of the network security risk of the power system is realized, the gray value is dynamically adjusted along with a real-time risk index, historical risk interference is reduced in combination with a time decay factor, and the network security risk assessment accuracy is improved. The evaluation model effectively solves the hysteresis problem caused by static processing in the prior art by means of a reinforcement learning autonomous optimization strategy, and dynamic threshold adjustment can flexibly change the alarm sensitivity according to the system load change, thereby reducing the false alarm and missing alarm conditions.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power system network security evaluation, more specifically, to a gray value dynamic adjustment and risk evaluation method in power system network security. BACKGROUND

[0002] Power system network security refers to protecting the information and data of the power system from unauthorized access, damage, tampering or leakage, while the adjustment and evaluation of the gray value is achieved by analyzing network traffic, attack features and other data to adjust the security policy in real time and ensure the stability and reliability of power supply.

[0003] The prior art patent document with authorization announcement number CN119945782A discloses a "high-performance detection and analysis method for network security", which includes the following steps: S1, encode network security data into a two-dimensional gray scale form; S2, use a convolutional neural network (CNN) to classify the two-dimensional gray scale; S3, use a generative adversarial network (GAN) to learn and generate new data that conforms to the attack data distribution for the less common attack data, and add it to the original training set to train the deep learning model again.

[0004] The patent document with authorization announcement number CN116318878A discloses an "evaluation method for power information network security risk", which includes the following steps: step one, data acquisition and processing; measure the evaluation raw data with the information security risk evaluation tool and pre-process these data; step two, data fuzzy normalization processing; fuzzy normalize each parameter so that the data provided to the FNN intelligent learning inference process is the normalized fuzzy data; step three, intelligent learning inference; each sub-FNN evaluates according to the processed data and takes the result as the input of the upper-level FNN, finally realizing the comprehensive evaluation of information system security risk.

[0005] Although the existing technology can use fuzzy neural networks combined with fuzzy clustering to process complex data of power information networks, realize security risk comprehensive analysis through hierarchical evaluation, provide support for vulnerability life cycle management, and also can encode network data into a gray scale image to adapt to a convolutional neural network, and expand the few-class attack samples with the help of a generative adversarial network to improve detection accuracy and optimize model robustness and generalization ability, but the data processing is mostly static and does not consider the impact of real-time risk on weights, the gray value mapping rule is fixed and not associated with dynamic indicators such as asset importance and threat level, and it does not combine the characteristics of power network topology, lacks the modeling ability of risk propagation path between nodes, and cannot realize the dynamic linkage of gray value adjustment and risk evaluation, which leads to the evaluation result lagging behind the actual risk change. SUMMARY

[0006] The present application mainly provides a gray value dynamic adjustment and risk assessment method in power system network security, which can solve the problems proposed in the background art.

[0007] To achieve the above-mentioned purpose, the present application provides the following technical scheme: a gray value dynamic adjustment and risk assessment method in power system network security, comprising the following steps:

[0008] S1, collect the basic features of the power system, then extract the topological features, and finally collect the real-time risk features, while using a sliding window to dynamically adjust the window size according to the system load to update the features;

[0009] S2, construct rules according to real-time risk indicators, map the extracted features to a two-dimensional gray image, and determine the gray value according to asset importance, threat probability, vulnerability score and dynamic weight, while considering the time decay factor, and the image size after encoding is dynamically adjusted according to the number of topological nodes;

[0010] S3, fuse the gray image with the power network topology graph, perform hierarchical graph convolution operation through the graph neural network, capture the risk correlation of nodes in the same voltage level and across voltage levels, output the risk propagation probability matrix, and then in the form of reinforcement learning, based on the graph neural network output, the topological connection matrix and the system load, form a state space, form an action space with risk prevention and control operations, and dynamically optimize the evaluation strategy through the reward function;

[0011] S4, according to the system historical risk data and the current evaluation result, adopt an adaptive algorithm to dynamically adjust the risk alarm threshold, reduce the threshold during the high load period of the system, and increase the threshold during the low load period;

[0012] S5, according to the risk assessment result, generate risk prevention and control suggestions, and feed back the risk assessment result and the prevention and control suggestions to the power system operation and management module to assist decision-making and improve the level of power system network security protection.

[0013] Further, in S1, the basic features include network traffic, vulnerability information and patch status, the topological features include node connection relationship and asset importance weight, and the real-time risk features include threat occurrence frequency, vulnerability repair time limit and asset load change rate.

[0014] Further, in S2, the asset importance is determined according to the criticality of the asset in the power system, and the threat probability is calculated based on the number of attack attempts and successful intrusion times per unit time.

[0015] Further, in the S2, the dynamic weight is adaptively allocated according to the current load level of the system and historical risk occurrence, and a time decay factor is used to reduce the influence of the historical risk on the current gray value over time, and finally the adjustment range of the size of the encoded image is matched with the increase and decrease range of the number of topological nodes.

[0016] Further, in the S3, the hierarchical graph convolution operation is specifically that the first layer convolution captures the risk association between nodes of the same voltage level, and the second layer convolution realizes the risk feature fusion of nodes of different voltage levels, wherein the state space contains the risk value, risk propagation probability and real-time load data of the system output by the graph neural network, the risk prevention and control operation in the action space includes isolating high-risk nodes, preferentially repairing vulnerabilities and improving the protection level of nodes, and finally the reward function dynamically optimizes the evaluation strategy by comprehensively considering the risk reduction range of the system and the protection cost control situation.

[0017] Further, in the S4, the high-load period of the system includes a period when the power system data transmission and processing pressure is large during the power consumption peak period, at this time, the threshold is reduced to improve the identification sensitivity to small risks, and the low-load period of the system includes a period when the power system operation pressure is small during the power consumption valley period, at this time, the threshold is increased to reduce false alarms caused by normal fluctuations of the system, and when the adaptive algorithm adjusts the threshold, the historical risk occurrence frequency of the system and the current system load change rate are combined.

[0018] Further, in the S5, the risk prevention and control suggestions include isolation suggestions for high-risk nodes, repair suggestions for high-vulnerability assets, and blocking suggestions for risk propagation paths.

[0019] Further, in the S5, the content fed back to the power system operation and maintenance management module includes the risk distribution, the risk level of the key node, the main path of the risk propagation and the priority of the suggested operation, to assist the operation and maintenance personnel to make accurate protection decisions.

[0020] Further, the dynamic adjustment of the size of the sliding window is specifically that the higher the system load is, the smaller the window size is, so as to shorten the feature update interval and ensure that the feature data can timely reflect the latest security state of the system.

[0021] The gray value dynamic adjustment and risk assessment method in the power system network security has the following advantages:

[0022] Through the coordinated operation of four stages of dynamic feature extraction, gray value adaptive coding, topology-aware risk assessment and dynamic decision feedback, real-time and accurate assessment of power system network security risk is realized, wherein the gray value is dynamically adjusted with real-time risk indicators, combined with a time decay factor to reduce historical risk interference, and the evaluation model uses reinforcement learning to optimize the strategy autonomously, effectively solving the hysteresis problem caused by the static processing of the prior art, while the dynamic threshold adjustment can flexibly change the alarm sensitivity according to the system load change, reducing the false alarm and missed alarm situation.

[0023] By introducing a graph neural network to model the power network topology, a hierarchical graph convolution is designed to capture the risk correlation of nodes within the same voltage level and across voltage levels, and the output risk propagation probability matrix quantifies the risk conduction strength between nodes, making up for the defects of the prior art in considering the topology correlation, providing a more operable quantitative basis for protection decisions, and significantly improving the accuracy and practicality of power system network security risk assessment. BRIEF DESCRIPTION OF DRAWINGS

[0024] The present application will be further described in detail below in combination with the drawings and specific implementation methods.

[0025] Figure 1 The present application will be further described in detail below in combination with the drawings and specific implementation methods. DETAILED DESCRIPTION

[0026] To make the technical solution of the present application clearer, the present application will be further described in detail below in combination with the drawings and specific examples.

[0027] Example 1

[0028] As shown in Figure 1 , a technical solution is provided: a gray value dynamic adjustment and risk assessment method in power system network security, comprising:

[0029] Step 1, dynamic feature acquisition

[0030] The basic features of the power system are collected, then the topology features are extracted, and finally the real-time risk features are collected, while the window size is dynamically adjusted according to the system load using a sliding window to update the features.

[0031] Specifically, the basic features include network traffic, vulnerability information, patch status, the topology features include node connection relationship and asset importance weight, and the real-time risk features include threat occurrence frequency, vulnerability repair time, and asset load change rate.

[0032] Among them, network traffic can be refined as the number of different types of data packets per unit of time, traffic peak and valley, etc., vulnerability information includes vulnerability number, vulnerability level, vulnerability impact range, patch status records patch installation time, patch covers vulnerability number, and all basic features are added with real-time label to distinguish the data collection time, ensuring that the data reflects the current latest state;

[0033] In addition, in the topology feature, the node connection relationship covers whether the node is in series, parallel or complex mesh connection, etc., and the asset importance weight is determined according to the key degree of the asset in the power system (for example, the weight of the substation node is higher than that of the ordinary terminal node), so as to reflect the difference in the impact on the system after different node failures or attacks;

[0034] Finally, in the real-time risk feature, the threat frequency is calculated based on the number of attack attempts and successful intrusion times per unit of time, the vulnerability repair time is the time interval from the discovery of vulnerability to the completion of repair, and the asset load change rate reflects the change amplitude of the asset processing data volume and task load, and the dynamic adjustment of the sliding window size follows the principle that the higher the system load, the smaller the window (for example, during the power peak period, the system data transmission and processing pressure is large, the window is reduced to update the feature more frequently, ensuring the timeliness of the data), so that the subsequent evaluation is based on the latest system state.

[0035] Step 2, dynamic encoding of gray value

[0036] According to the real-time risk index construction rule, the extracted features are mapped to a two-dimensional gray image, and the gray value is determined according to the asset importance, threat probability, vulnerability score and dynamic weight, while considering the time decay factor, and the size of the encoded image is dynamically adjusted according to the number of topology nodes.

[0037] Specifically, the asset importance is determined according to the key degree of the asset in the power system, and the threat probability is calculated based on the number of attack attempts and successful intrusion times per unit of time, in addition, the dynamic weight is adaptively allocated according to the current load level and historical risk occurrence of the system, while the time decay factor is used to reduce the influence of historical risk on the current gray value over time, and finally the adjustment amplitude of the encoded image size matches the increase and decrease amplitude of the number of topology nodes;

[0038] Among them, the risk index is calculated by the following formula:

[0039]

[0040] In the formula, is the asset importance (for example, the value range is 0-10), is the threat probability (for example, the value range is 0-1), a vulnerability score (e.g. ranging from 0 to 10), , , a dynamic weight, which is self-adaptively assigned according to the current state of the system (e.g. load level, historical risk occurrence, etc.) (for example, when the system has frequent threat events recently, the weight of the threat factor is adjusted to be higher, so as to highlight the influence of the threat factor on the risk);

[0041] For example, a 110 kV substation as a key asset, its asset importance A = 8 (full score is 10), because the number of attack attempts per unit time is 20, and the number of successful invasions is 2, the threat probability T = 0.1 is calculated, if there are 3 unpatched high-risk vulnerabilities in the substation, the vulnerability score V = 6, assuming that the system has frequent threat events recently, the dynamic weight is assigned as = 0.2, = 0.5, = 0.3, then the risk index R of the substation = 0.2x8 + 0.5x0.1 + 0.3x6 = 1.6 + 0.05 + 1.8 = 3.45;

[0042] The mapping of the gray value and the risk index follows the following formula:

[0043]

[0044] In the formula, is the maximum risk index value monitored by the system in history, which is used to normalize so that the gray value is in the range of 0-255, the higher the risk (i.e. is greater), the closer the gray value is to 0 (presenting black), which can intuitively reflect the risk distribution (for example, when the threat frequency of a substation increases from 0.2 to 0.8, the gray value of the corresponding area can decrease from 204 (light gray) to 51 (dark gray));

[0045] Suppose the maximum risk index of the system in history is 10, the of the above substation is 3.45, then its gray value G = 255x(1−3.45 / 10) = 255x0.655≈167, presenting medium gray, if the of another ordinary terminal node is 8 (close to the maximum value in history), then its gray value G = 255x(1−8 / 10) = 51, presenting dark gray, which intuitively reflects the risk difference between the two;

[0046] Finally, the time decay factor uses the formula:

[0047]

[0048] In the formula,​ To make the influence of historical risks on the current gray value decrease exponentially over time, the size of the encoded image will dynamically adjust with the number of topology nodes. When the number of nodes increases, the image resolution will automatically expand to adapt to changes in the power network topology.

[0049] For example, a risk event occurred at a node one time step ago (t=1), with a time decay factor λ=0.95¹=0.95, retaining 95% of the influence on the current gray value. The historical risk three time steps ago (t=3) has a λ=0.95³≈0.857, reducing the influence to about 86%, significantly reducing the interference of old data.

[0050] Step 3: Topology-aware risk assessment

[0051] By fusing the gray image with the power network topology map and performing hierarchical graph convolution operations through a graph neural network, the risk association between nodes of the same voltage level and across voltage levels is captured, and a risk propagation probability matrix is output. Then, in a reinforcement learning manner, a state space is constructed based on the graph neural network output, the topology connection matrix, and the system load, and an action space is constructed based on risk prevention and control operations. The evaluation strategy is dynamically optimized through a reward function.

[0052] Specifically, the hierarchical graph convolution operation specifically captures the risk association between nodes of the same voltage level in the first layer of convolution, and realizes the risk feature fusion of nodes of different voltage levels in the second layer of convolution. The state space includes the risk values, risk propagation probabilities, and real-time load data of each node output by the graph neural network. The risk prevention and control operations in the action space include isolating high-risk nodes, prioritizing vulnerability repair, and improving node protection levels. Finally, the reward function dynamically optimizes the evaluation strategy by comprehensively considering the system risk reduction amplitude and protection cost control situation;

[0053] Among them, the graph neural network (GNN) layer takes the gray image pixels as node features and the topology connection as edge features, and through graph convolution operation, it deeply excavates the propagation path of risks between nodes (for example, the conduction probability from terminal vulnerabilities to dispatching centers can be effectively captured);

[0054] At the same time, the hierarchical graph convolution is designed for the common tree or ring topology of the power network. The first layer of convolution focuses on capturing the risk association between nodes of the same voltage level (e.g., 110kV), and the second layer of convolution realizes the risk feature fusion of nodes of different voltage levels (e.g., 110kV and 220kV). The risk propagation probability matrix generated by the output layer can quantify the risk conduction strength between nodes (e.g., the value range is 0-1), providing accurate quantitative basis for subsequent decision-making;

[0055] In addition, the state space of reinforcement learning specifically includes node risk values of GNN output, topology connection matrix, and system load data. The action space includes operations such as “isolating risk path” in addition to the above operations. The reward function adopts the formula:

[0056]

[0057] wherein, is the system risk reduction amount, is the protection cost saving amount, and is the weight, which is dynamically adjusted according to the current focus of the system on risk prevention and cost control, so as to realize the autonomous optimization of the evaluation strategy.

[0058] For example, after performing the “isolating high-risk node” operation on a high-risk area, the system risk is reduced by = 15 (assuming that the total risk of the original system is 50 and the risk is reduced to 35 after the operation), and the cost is saved by avoiding large-scale maintenance = 8 (unit: ten thousand yuan). If the system currently focuses more on risk prevention, the weights are set as = 0.7, = 0.3, then the reward of the operation is = 0.7 x 15 + 0.3 x 8 = 10.5 + 2.4 = 12.9, indicating that the operation is good and will be preferentially included in the evaluation strategy.

[0059] Step 4, dynamic adjustment of risk alarm threshold

[0060] According to the historical risk data and the current evaluation results of the system, an adaptive algorithm is used to dynamically adjust the risk alarm threshold. The threshold is lowered during the high-load period of the system to improve the identification sensitivity to small risks, and the threshold is raised during the low-load period of the system to reduce false positives due to normal fluctuations of the system. When the adaptive algorithm adjusts the threshold, it will combine the historical risk occurrence frequency of the system and the current system load change rate.

[0061] Specifically, the high-load period of the system includes the period when the power system data transmission and processing pressure is large during the peak electricity consumption period, at which time the threshold is lowered to improve the identification sensitivity to small risks. The low-load period of the system includes the period when the power system operation pressure is small during the valley electricity consumption period, at which time the threshold is raised to reduce false positives due to normal fluctuations of the system. When the adaptive algorithm adjusts the threshold, it will combine the historical risk occurrence frequency of the system and the current system load change rate.

[0062] Wherein, the adaptive algorithm will construct a benchmark threshold model based on the historical risk data of the system, and then modify it in combination with dynamic parameters such as risk propagation probability matrix and node risk value in the current evaluation results. For example, when the system load change rate exceeds a preset threshold (for example, 10%), the algorithm will trigger a rapid adjustment mechanism for the threshold. The threshold during the high-load period may be adjusted to 60%-80% of the threshold during the low-load period. The specific proportion is dynamically determined according to the risk occurrence intensity during the high-load period in the historical risk data.

[0063] Meanwhile, the threshold adjustment process will refer to the threat occurrence frequency and vulnerability repair time in real-time risk features. If the recent threat occurrence frequency increases significantly (for example, more than 50% higher than the historical average), the threshold will be appropriately lowered to enhance risk identification ability even in low load periods. Conversely, if the vulnerability repair time is short (for example, less than 2 hours on average), it indicates that the system has strong self-repairing ability, and the threshold can be appropriately relaxed.

[0064] Step 5, risk prevention and control feedback

[0065] According to the risk assessment results, risk prevention and control suggestions are generated, and the risk assessment results and prevention and control suggestions are fed back to the power system operation and management module to assist decision-making to improve the level of power system network security protection.

[0066] Specifically, the risk prevention and control suggestions include isolation suggestions for high-risk nodes, repair suggestions for high-vulnerability assets, and blocking suggestions for risk propagation paths. The feedback to the power system operation and management module includes risk distribution, risk level of key nodes, main path of risk propagation, and priority of suggested operations to assist operation personnel in making accurate protection decisions.

[0067] Among them, the isolation suggestion for high-risk nodes will combine the conduction intensity of the node and other nodes in the risk propagation probability matrix (for example, when the conduction intensity is greater than 0.7, it is recommended to isolate immediately to block the spread of risk), the repair suggestion for high-vulnerability assets will refer to the historical data of vulnerability repair time, and the repair resources will be allocated to assets with long repair time (for example, more than 24 hours) first, and the blocking suggestion for risk propagation path will be based on the key path mined by graph neural network, and the path with high risk conduction probability (for example, the top 20%) will be blocked first.

[0068] Meanwhile, the risk level fed back to the operation and management module will be linked with the grayscale visualization result, for example, nodes with a grayscale value below 50 (dark gray) are marked as "extremely high risk", and nodes with a grayscale value between 50 and 100 (medium dark gray) are marked as "high risk", and a risk heat map is automatically generated. The priority of the suggested operation is sorted by the potential benefit value calculated by the reinforcement learning reward function. The higher the benefit value (i.e., the more significant the system risk reduction and the more cost savings after execution), the higher the priority, making it easier for operation personnel to handle in order.

[0069] In summary, through the above five steps, the dynamic, accurate and real-time assessment and prevention and control closed loop of power system network security risk is realized, from dynamically collecting multi-dimensional features, to self-adaptive coding based on real-time risk indicators, then mining risk propagation path and optimizing evaluation strategy through the topology perception model of graph neural network and reinforcement learning fusion, combining with the system load to dynamically adjust the risk alarm threshold, finally generating targeted prevention and control suggestions and feeding back to the operation and maintenance module, forming an innovative scheme of "feature extraction-coding mapping-risk assessment-threshold adjustment-prevention feedback" whole process linkage, effectively solving the problems of static processing and insufficient topology correlation of the prior art, significantly improving the timeliness, accuracy and operability of the power system network security risk assessment, and providing strong support for the safe and stable operation of the power system.

[0070] The above-described embodiments only express several embodiments of the present application, and the description is relatively specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be noted that for ordinary skilled persons in the art, without departing from the concept of the present application, several modifications and improvements can be made, which belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. A method for dynamic adjustment of grayscale values ​​and risk assessment in power system network security, characterized in that, Includes the following steps: S1. Collect the basic features of the power system, then extract the topology features, and finally collect real-time risk features. At the same time, use a sliding window to dynamically adjust the window size according to the system load to update the features. S2. Based on the rules for constructing real-time risk indicators, the extracted features are mapped into a two-dimensional grayscale image. The grayscale value is determined according to the asset importance, threat probability, vulnerability score and dynamic weight. At the same time, the time decay factor is considered, and the size of the encoded image is dynamically adjusted according to the number of topological nodes. S3. The grayscale image is fused with the power network topology map. Layered graph convolution operation is performed through graph neural network to capture the risk association between nodes at the same voltage level and across voltage levels. The risk propagation probability matrix is ​​output. Then, in a reinforcement learning manner, the state space is constructed based on the graph neural network output, the topology connection matrix, and the system load. The action space is constructed based on the risk prevention and control operation. The evaluation strategy is dynamically optimized through the reward function. S4. Based on the system's historical risk data and current assessment results, an adaptive algorithm is used to dynamically adjust the risk alarm threshold, lowering the threshold during periods of high system load and raising the threshold during periods of low load. S5. Based on the risk assessment results, generate targeted risk prevention and control suggestions, and feed back the risk assessment results and prevention and control suggestions to the power system operation and maintenance management module to assist decision-making and improve the power system network security protection level.

2. The method for dynamic adjustment of grayscale values ​​and risk assessment in power system network security according to claim 1, characterized in that: In S1, the basic features include network traffic, vulnerability information, and patch status; the topology features include node connection relationships and asset importance weights; and the real-time risk features include threat occurrence frequency, vulnerability remediation timeliness, and asset load change rate.

3. The method for dynamic adjustment of grayscale values ​​and risk assessment in power system network security according to claim 1, characterized in that: In S2, asset importance is determined based on the criticality of the asset's function in the power system, while threat probability is calculated based on the number of attack attempts and successful intrusions against the system per unit time.

4. The method for dynamic adjustment of grayscale values ​​and risk assessment in power system network security according to claim 1, characterized in that: In S2, the dynamic weights are adaptively allocated based on the current system load level and the occurrence of historical risks. At the same time, the time decay factor is used to reduce the impact of historical risks on the current grayscale value over time. Finally, the adjustment range of the encoded image size matches the increase or decrease range of the number of topology nodes.

5. The method for dynamic adjustment of grayscale values ​​and risk assessment in power system network security according to claim 1, characterized in that: In S3, the layered graph convolution operation specifically involves a first-layer convolution that captures the risk correlation between nodes of the same voltage level, and a second-layer convolution that fuses the risk features of nodes of different voltage levels. The state space includes the risk values ​​of each node output by the graph neural network, the risk propagation probability, and the real-time load data of the system. The risk prevention and control operations in the action space include isolating high-risk nodes, prioritizing the repair of vulnerabilities, and improving the protection level of nodes. Finally, the reward function dynamically optimizes the evaluation strategy by comprehensively considering the reduction in system risk and the control of protection costs.

6. The method for dynamic adjustment of grayscale values ​​and risk assessment in power system network security according to claim 1, characterized in that: In S4, the high-load period of the system includes the peak electricity consumption period when the power system data transmission and processing pressure is large. At this time, the threshold is lowered to improve the sensitivity to the identification of minor risks. The low-load period of the system includes the off-peak electricity consumption period when the power system operates under less pressure. At this time, the threshold is raised to reduce false alarms caused by normal system fluctuations. When the adaptive algorithm adjusts the threshold, it will combine the frequency of historical risks in the system and the current system load change rate.

7. The method for dynamic adjustment of grayscale values ​​and risk assessment in power system network security according to claim 1, characterized in that: In S5, the risk prevention and control recommendations include isolation recommendations for high-risk nodes, repair recommendations for highly vulnerable assets, and recommendations for blocking risk propagation paths.

8. The method for dynamic adjustment of grayscale values ​​and risk assessment in power system network security according to claim 1, characterized in that: In S5, the content fed back to the power system operation and maintenance management module includes risk distribution, risk level of key nodes, main risk propagation paths, and priority of recommended operations, in order to assist operation and maintenance personnel in making accurate protection decisions.

9. The method for dynamic adjustment of grayscale values ​​and risk assessment in power system network security according to claim 1, characterized in that: The dynamic adjustment of the sliding window size specifically means that the higher the system load, the smaller the window size, in order to shorten the feature update interval and ensure that the feature data can reflect the latest security status of the system in a timely manner.

Images