New energy station 5G network security risk assessment system

Abstract

The invention relates to the technical field of network security, in particular to a new energy station 5G network security risk assessment system, which comprises a data acquisition module, a data analysis module, a threat prediction module, an early warning module and a database module. According to the new energy station 5G network security risk assessment system, a hybrid model is constructed by fusing a multilayer perceptron and fuzzy logic reasoning, and by means of the learning ability of the multilayer perceptron to a complex data mode and the processing advantage of fuzzy logic reasoning to uncertainty information, currently occurring security threats can be identified more accurately, and the security risk assessment accuracy is improved. Meanwhile, in combination with time sequence analysis and a Bayesian network prediction model, potential network security threats in the future can be effectively predicted by mining change rules in historical data and performing probabilistic reasoning, and a reliable basis is provided for a new energy station to prevent risks in advance.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network security, and particularly relates to a new energy station 5G network security risk evaluation system. BACKGROUND

[0002] With the transformation of global energy structure to clean and low-carbon, the large-scale construction and intelligent upgrading of new energy stations have become an inevitable trend. 5G technology has become the core infrastructure supporting remote monitoring, device interconnection and intelligent scheduling of new energy stations due to its characteristics of high bandwidth, low latency and wide connection. Through the 5G network, the station can realize real-time monitoring of wind turbine blade status, data acquisition of photovoltaic panel group string level, and collaborative control of energy storage systems, and greatly improve the operation efficiency and power generation benefit. According to industry data, as of 2024, the 5G network coverage rate of newly built new energy stations in China has reached more than 85%, and the integration of 5G and new energy has become an industry standard.

[0003] However, while 5G network enables the intelligentization of new energy stations, it also brings security risks far beyond traditional industrial networks due to its open and complex technical architecture. Specifically, the risks mainly exist in three aspects: first, network layer risk. 5G adopts software-defined network (SDN), network function virtualization (NFV) and other technologies, and the deployment and interface exposure of virtual network function (VNF) increase the face of malicious attacks. For example, a signaling storm attack on AMF (access and mobility management function) may cause terminal access interruption; second, data layer risk. Real-time operation data (such as unit vibration data and battery SOC value) transmitted by new energy stations through 5G belong to critical information infrastructure data. Once leaked due to encryption mechanism vulnerabilities or transmission link hijacking, they may be used for precise attacks or cause commercial losses; third, terminal layer risk. A large number of sensors and controllers in the station access the network through 5G modules. These terminal devices have limited computing power and weak security protection capabilities, and are easy to become a stepping stone for botnet attacks, thereby triggering a chain reaction.

[0004] The existing network security risk evaluation means cannot adapt to the particularity of the 5G network of the new energy station: the evaluation method of the traditional industrial control network, such as the compliance check based on IEC62443, focuses on static vulnerability scanning and cannot cope with the dynamic change of the topology and business of the 5G network; the general network risk assessment tool (such as Nmap, Wireshark) lacks deep analysis capability for new energy business protocols (such as Modbus over 5G, MQTT-SN), and it is difficult to identify targeted attacks against the core business of the station; and the method of simply relying on manual audit is also limited by the processing capacity of the 5G network mass data (TB level operation data per day per station), which leads to lagging risk discovery and insufficient evaluation accuracy. According to the safety report of a certain energy group in 2023, 37 unplanned downtime events occurred in the new energy stations under its jurisdiction due to the 5G network security risks not being discovered in time, with direct economic losses exceeding 20 million yuan.

[0005] Therefore, in view of the technical characteristics and business scenarios of the 5G network of the new energy station, it is an urgent need to build a security risk evaluation system with real-time perception, accurate evaluation and dynamic prediction capability to ensure the safe and stable operation of the new energy station. SUMMARY

[0006] The purpose of the present application is to provide a new energy station 5G network security risk evaluation system to solve the problems raised in the background art.

[0007] To achieve the above purpose, the present application provides the following technical solution: a new energy station 5G network security risk evaluation system, comprising:

[0008] A data acquisition module is used to acquire network traffic data, device state data, user behavior data and security event data in the 5G network of the new energy station, and to preprocess and format the acquired data;

[0009] A data analysis module is connected to the data acquisition module, and a hybrid model of multilayer perception and fuzzy logic reasoning is used to analyze the preprocessed data to evaluate the current security threats;

[0010] A threat prediction module is connected to the data analysis module and the data acquisition module, respectively, and based on a prediction model combining time series analysis and Bayesian network, it predicts potential network security threats in the future according to historical data and current network state;

[0011] An early warning module is connected to the data analysis module and the threat prediction module, respectively, for issuing an alarm when a security threat is detected or a potential threat is predicted, and for grading the warning according to the severity of the threat;

[0012] A database module is connected with the data collection module, the data analysis module, the threat prediction module and the early warning module respectively, and is used for storing the collected data, the analysis result, the prediction model and the system configuration information.

[0013] Preferably, the data collection module acquires data through a network probe, a sensor and a log system, and realizes preprocessing of the collected data by removing repeated data and invalid data.

[0014] Preferably, the specific processing steps of the data analysis module include:

[0015] standardizing the collected data;

[0016] inputting the standardized data into a multilayer perception machine for training, wherein the output layer of the multilayer perception machine adopts a Sigmoid activation function;

[0017] taking the output of the multilayer perception machine as the input of fuzzy logic reasoning, performing fuzzy processing by using a triangular membership function, and obtaining a specific evaluation result according to fuzzy rule reasoning.

[0018] Preferably, the triangular membership function calculates the membership value by segmentation according to the value range of the input variable, wherein parameters a, b and c are boundary values of the membership function.

[0019] Preferably, the time series analysis in the threat prediction module adopts an ARIMA model, and analyzes and predicts the time series data by using an autoregressive coefficient polynomial, a moving average coefficient polynomial, a lag operator and a difference order.

[0020] Preferably, the construction of the Bayesian network in the threat prediction module includes:

[0021] determining a node variable related to the 5G network security threat of the new energy station;

[0022] constructing a directed acyclic graph of the causal relationship between the nodes;

[0023] determining a conditional probability table of each node by using a maximum likelihood estimation method, and adopting Laplace smoothing processing when the sample quantity is zero.

[0024] Preferably, the Laplace smoothing processing avoids the case that the probability calculation is zero by correcting the sample quantity, and introduces the number of node values as a parameter during correction.

[0025] Preferably, the early warning module divides the threat level by using a fuzzy comprehensive evaluation method, and realizes the division by synthetic operation of the weight vector of the evaluation index and the fuzzy evaluation matrix; the early warning mode includes short message notification, email reminder and system pop-up window.

[0026] Compared with the prior art, the new energy station 5G network security risk evaluation system has the following beneficial effects:

[0027] 1. The new energy station 5G network security risk evaluation system, by fusing a multi-layer perceptron and fuzzy logic reasoning to construct a hybrid model, with the learning ability of the multi-layer perceptron to complex data patterns and the processing advantage of fuzzy logic reasoning to uncertain information, can more accurately identify the current security threats that have occurred, and at the same time, combined with the prediction model of time series analysis and Bayesian network, by mining the change law in historical data and conducting probability reasoning, it can effectively predict potential network security threats in the future, providing a reliable basis for the new energy station to prevent risks in advance.

[0028] 2. The new energy station 5G network security risk evaluation system, through the early warning module, the detected security threats and the predicted potential threats are graded and warned, using multiple ways such as SMS notification, email reminder, system pop-up window, etc., to ensure that relevant personnel can know the risk situation in the first time. Different levels of threats correspond to different warning methods and processing procedures, which helps to quickly start the corresponding emergency mechanism, maximizes the reduction of the impact of security risks on the normal operation of the new energy station, and ensures the stability of power supply.

[0029] 3. The new energy station 5G network security risk evaluation system covers data collection, analysis, prediction, early warning and storage, etc., forming a complete network security risk evaluation closed loop, through real-time monitoring, accurate evaluation and effective prediction of various security risks in the 5G network, helping the new energy station to establish a proactive defense security system, improving the resistance to security incidents such as network attacks and data breaches, and providing network security protection for the stable operation of the new energy station. BRIEF DESCRIPTION OF DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0031] Fig. 1 The network security risk evaluation system architecture of the present application;

[0032] Fig. 2 The risk evaluation step flowchart of the present application. DETAILED DESCRIPTION

[0033] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative effort belong to the scope of protection of the present application.

[0034] Please refer to Figs. 1-2 The present application provides a technical solution: a new energy station 5G network security risk evaluation system, comprising a data acquisition module, a data analysis module, a threat prediction module, an early warning module and a database module.

[0035] Data acquisition module: deploy network probes in the 5G network of the new energy station, and collect network traffic data in real time, including source IP address, destination IP address, port number, traffic size, packet number and other information. At the same time, install sensors on each device to collect device operating status data such as temperature, voltage, current, CPU usage, memory usage, etc. In addition, collect user behavior data and security event data through the log system, such as user login time, login IP address, operation record, security alarm information, etc. The data acquisition module will preliminarily process the collected data, remove duplicate and invalid data, and store them in a unified format.

[0036] Data analysis module: input the collected data into a hybrid model of multilayer perceptron and fuzzy logic reasoning for analysis. Multilayer perceptron learns from a large amount of historical data to establish a mapping relationship between network traffic, device status, user behavior and security threats. Fuzzy logic reasoning is used to handle uncertainty and ambiguity in data to improve the accuracy of analysis results. For example, for network traffic data, when a certain IP address initiates a large number of connection requests in a short period of time, and the target ports of the connection requests are concentrated, the multilayer perceptron may judge it as a suspected DDoS attack, but there is a certain uncertainty. At this time, fuzzy logic reasoning can further judge whether the behavior is a real DDoS attack according to the occurrence probability of similar situations in historical data and other related factors such as the reputation of the IP address.

[0037] Data preprocessing: standardize the collected data and convert the data into a format suitable for multilayer perceptron processing. The standardization formula is: Where x is the original data, μ is the mean of the data, and σ is the standard deviation of the data.

[0038] Multilayer perceptron training: input the preprocessed data into the multilayer perceptron for training. The output layer of the multilayer perceptron uses the Sigmoid activation function, and the formula is: where z is the input of the output layer. The network parameters are adjusted by the backpropagation algorithm to minimize the prediction error of the model.

[0039] Fuzzy logic reasoning: The output of the multilayer perceptron is taken as the input of fuzzy logic reasoning and is processed by fuzzification. Fuzzification uses a triangular membership function, and for an input variable x, its membership function is:

[0040] When a ≤ x ≤ b, When b < x ≤ c, Otherwise, μ A (x) = 0, where a, b, and c are parameters of the membership function.

[0041] Then, reasoning is performed according to fuzzy rules to obtain fuzzy conclusions, and finally, defuzzification is performed to convert the fuzzy conclusions into specific evaluation results.

[0042] Threat prediction module: Based on the combination of time series analysis and Bayesian network prediction model, potential network security threats in the future are predicted. First, historical network traffic data, device status data, etc. are analyzed using time series analysis method to establish a time series model to predict the trend of these data in the future. Then, the time series prediction results are taken as input, combined with Bayesian network to infer the causal relationship and probability between various factors, and predict the type, time and impact range of possible security incidents. For example, through time series analysis, it is predicted that network traffic will increase significantly in the next week, and Bayesian network analysis finds that there are a large number of unpatched vulnerabilities in the network recently, and there are active attack sources in the external network environment. Combining these factors, it is predicted that a DDoS attack against new energy stations may occur in the next week, and the attack may cause some devices to malfunction, affecting power supply.

[0043] Time series analysis: ARIMA model is used to analyze and predict historical network traffic data. The formula of ARIMA model is: φ(B)(1-B) d y t = θ(B)ε t , where φ(B) is the autoregressive coefficient polynomial, θ(B) is the moving average coefficient polynomial, B is the lag operator, d is the difference order, y t is the time series data, and ε t is the white noise sequence. Through estimation and test of model parameters, the best ARIMA model is determined, and the model is used to predict the trend of future network traffic.

[0044] Bayesian network construction:

[0045] Determine node variables: According to the knowledge of network security field and historical data, filter out the factors related to the 5G network security threats of new energy station as the node variables of Bayesian network, such as "network traffic anomaly", "device vulnerability exists", "external attack source active", "DDoS attack occurs", etc.

[0046] Build network structure: Determine the causal relationship between nodes through expert experience and data mining method, and build the directed acyclic graph of Bayesian network. For example, "external attack source active" may cause "network traffic anomaly", and "network traffic anomaly" and "device vulnerability exists" may jointly cause "DDoS attack occurs".

[0047] Determine conditional probability table: Use maximum likelihood estimation method to determine the conditional probability table of each node. For discrete node variables, assume that the sample data is independent and identically distributed, and for node X and its parent nodes Y1, Y2, …, Y n , the maximum likelihood estimation formula of the conditional probability P(X=x|Y1=y1,Y2=y2,…,Y n =y n ) is: Where N(x,y1,…,y n ) represents the number of X=x and Y1=y1,…,Y n =y n in the sample, and N(y1,…,y n ) represents the number of Y1=y1,…,Y n =y n in the sample.

[0048] When N(y1,…,y n )=0, use Laplace smoothing processing, the formula is Where k is the number of values of node X.

[0049] Threat prediction: input the prediction result of time series analysis into the Bayesian network, and perform probability inference according to the Bayesian formula to get the probability of future occurrence of various security events.

[0050] Warning module: when the data analysis module detects security threats or the threat prediction module predicts potential threats, the warning module will classify according to the severity of the threat and use the corresponding warning method to issue an alarm. For first-level threats, such as ongoing severe DDoS attacks, the warning module will immediately notify the system administrator through SMS and pop up a red alert window in the monitoring system, prompting the administrator to take emergency measures as soon as possible. For second-level threats, such as predicted medium-scale attacks that may occur in the next few hours, the warning module will send an email to the relevant technical personnel and display a yellow alert in the system, reminding the technical personnel to prepare in advance.

[0051] Database module: A secure and reliable database management system, such as Oracle database, is selected to store the collected data, analysis results, prediction models, and system configuration information, etc. The database module adopts strict access control policies, only authorized users can access and modify the data in the database. At the same time, the database is backed up regularly to prevent data loss. In terms of data storage, different types of data are stored in a classified manner, indexes are established, and the efficiency of data query and retrieval is improved. For example, network traffic data is stored in a table, and indexes are established according to time, source IP address, etc. fields, making it convenient and fast to query the network traffic from a certain IP address in a certain time period.

[0052] It should be noted that, in this text, relational terms such as first and second are used only to distinguish one entity or operation from another, and do not necessarily require or imply any actual such relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or equipment. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or equipment including the element.

[0053] Although embodiments of the present application have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A new energy station 5G network security risk assessment system, characterized in that, The application relates to a new energy station 5G network security threat prediction system, which comprises the following modules: a data acquisition module for acquiring network traffic data, equipment state data, user behavior data and security event data in a new energy station 5G network, and pre-processing and formatting the acquired data; a data analysis module connected with the data acquisition module, which uses a hybrid model of a multi-layer perception and fuzzy logic reasoning to analyze the pre-processed data, so as to evaluate the current security threats; a threat prediction module connected with the data analysis module and the data acquisition module, which uses a prediction model combining time series analysis and a Bayesian network to predict potential network security threats in the future according to historical data and current network states; an early warning module connected with the data analysis module and the threat prediction module, which is used for issuing an alarm when a security threat is detected or a potential threat is predicted, and grading the early warning according to the severity of the threat; a database module connected with the data acquisition module, the data analysis module, the threat prediction module and the early warning module, which is used for storing the acquired data, analysis results, prediction models and system configuration information.

2. The new energy station 5G network security risk evaluation system according to claim 1, characterized in that: The data acquisition module acquires data through network probes, sensors and log systems, and realizes the pre-processing of the acquired data by removing repeated data and invalid data.

3. The new energy station 5G network security risk evaluation system according to claim 1, characterized in that: The specific processing steps of the data analysis module include: standardizing the acquired data; inputting the standardized data into a multi-layer perception for training, and using a Sigmoid activation function for the output layer of the multi-layer perception; using the output of the multi-layer perception as the input of fuzzy logic reasoning, using a triangular membership function for fuzzy processing, and obtaining specific evaluation results according to fuzzy rules.

4. The new energy station 5G network security risk evaluation system according to claim 1, characterized in that: The triangular membership function calculates the membership value in sections according to the value range of the input variable, wherein the parameters a, b and c are the boundary values of the membership function.

5. The new energy station 5G network security risk assessment system according to claim 1, characterized in that: The time series analysis in the threat prediction module uses an ARIMA model to analyze and predict time series data through an autoregressive coefficient polynomial, a moving average coefficient polynomial, a lag operator and a difference order.

6. The new energy station 5G network security risk assessment system according to claim 1, characterized in that: The construction of the Bayesian network in the threat prediction module includes: determining the node variables related to the security threats of the new energy station 5G network; constructing a directed acyclic graph of the causal relationship between the nodes; using a maximum likelihood estimation method to determine the conditional probability table of each node, and using Laplace smoothing processing when the sample number is zero.

7. The new energy station 5G network security risk assessment system according to claim 1, characterized in that: The Laplace smoothing processing avoids the case that the probability calculation is zero by correcting the sample number, and introduces the number of node values as a parameter during the correction.

8. The new energy station 5G network security risk assessment system according to claim 1, characterized in that: The early warning module divides the threat level by using a fuzzy comprehensive evaluation method, and realizes the synthesis operation through the weight vector of the evaluation index and the fuzzy evaluation matrix; the early warning mode includes short message notification, email reminder and system pop-up window.

Images