Method and system for evaluating network security state of power monitoring system
By using a Naive Bayes classification model to evaluate network traffic in a power monitoring system, the problem of highly concealed targeted network attacks is solved, enabling effective assessment and risk identification of the network security status of the power monitoring system.
Patent Information
- Application Number
- CN202511279047.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-09-09
- Publication Date
- 2025-12-12
AI Technical Summary
Existing power monitoring systems are ill-equipped to effectively protect against targeted cyberattacks, especially APT attacks, which are highly covert and difficult for existing risk detection mechanisms to detect malicious traffic.
A Naive Bayes classification model is used to evaluate the network traffic of the power monitoring system. By collecting historical and actual traffic samples, a Naive Bayes classification model is constructed, and the network security status is evaluated and abnormal behavior is identified by using prior probability and conditional probability distribution.
It enables the assessment of the network concealment risks of power monitoring systems, enhances the defense capabilities against targeted network attacks, and can promptly identify potential network security risks.
Smart Images
Figure CN121125222A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network security technology for power monitoring systems, and specifically relates to a method for assessing the network security status of power monitoring systems. Background Technology
[0002] In the process of network security protection for power monitoring systems, establishing a security defense line at the network boundary can resist most external network attacks and ensure the safe and stable operation of the power monitoring system. However, facing targeted network attacks, mainly APT (Advanced Persistent Threat) attacks, existing power monitoring systems are unable to ensure effective protection. In targeted network attacks, attackers use a variety of attack methods to achieve their attack objectives and try to conceal their attack traces as much as possible to avoid detection. During the launch of a targeted network attack, attackers break down the attack behavior into multiple stages, use various attack methods to break through network boundaries, use stealth techniques to lie dormant within the network for a long time, move laterally to expand the attack depth to approach the attack target, escalate privileges to control critical assets, and ultimately damage network equipment or steal sensitive information.
[0003] Although targeted network attacks are complex and highly covert, they generate abnormal network access behavior during their execution. Therefore, detecting abnormal traffic can help combat targeted network attacks. Existing technologies for network security status assessment mainly include the following methods:
[0004] Electronic Testing, 2022, 36(04) discloses a network security status assessment method based on graph models. Based on graph model theory, it analyzes and studies network security status assessment from the perspectives of network security, assessment and analysis methods, and existing problems. This includes path analysis, criticality analysis, threat analysis, and situational analysis.
[0005] The Journal of Air Force Engineering University (Natural Science Edition), 2019, 20(05) published a mission-oriented network risk assessment model [J]. The model takes the mission as the core and determines the network risk level as an aggregation function of the risk values of all assets called in each stage of mission advancement, providing a feasible and accurate fine-grained model for risk assessment.
[0006] The journal *Small & Microcomputer Systems*, 2015, 36(08) proposed a network security situation assessment method based on Hidden Markov Models (HMM) and information entropy. In the situation information acquisition and processing stage, this method directly calculates the network security status probability value using HMM, avoiding problems such as unifying the format of multi-source heterogeneous data. In the situation assessment stage, it utilizes the characteristics of the HMM forward algorithm to approximately calculate the joint probability, avoiding the difficulty of directly calculating prior probabilities. Simultaneously, it introduces joint information entropy to describe the network security situation. The fluctuation range of the entropy value can more clearly and accurately illustrate the trend and stability of the network security status, and the magnitude of the entropy value can effectively indicate the accuracy of the assessment conclusion.
[0007] However, the malicious traffic of targeted cyberattacks is highly covert; attackers can hide this malicious traffic within normal business traffic, making it difficult to trigger existing risk detection mechanisms. Therefore, being able to perceive abnormal network security and equipment security status from a probabilistic perspective within the normal business traffic of power monitoring systems, based on a Naive Bayes classification model, can help determine whether there are hidden risks. This is of great significance for power monitoring systems to defend against targeted cyberattacks. Summary of the Invention
[0008] The technical problem to be solved by this invention is: how to assess the network concealment risk of power monitoring systems.
[0009] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:
[0010] A method for assessing the network security status of a power monitoring system, comprising:
[0011] Step 1: Collect sample data, including historical traffic sample data and actual traffic sample data;
[0012] The historical traffic samples include normal traffic samples and abnormal traffic samples, and the abnormal traffic samples include abnormal traffic that simulates targeted network attacks.
[0013] Step 2: Construct a Naive Bayes classification model using labeled historical traffic. Statistically obtain the prior probability distribution and conditional probability distribution of the collected historical sample data set according to the label distribution and the distribution of each sample. The Naive Bayes classification model is then constructed from the prior probability distribution and conditional probability distribution.
[0014] Step 3: By training a set of labeled historical traffic samples, a detection and evaluation model based on Naive Bayes classification is obtained. The detection and evaluation model is used to calculate the normal probability evaluation value and the abnormal probability evaluation value of different network security statuses in the actual traffic samples. By comparing the magnitude of the normal probability evaluation value and the abnormal probability evaluation value, the network security status is evaluated.
[0015] The aforementioned method for assessing the network security status of a power monitoring system,
[0016] In step one, the data obtained in one acquisition cycle is a sample D. The sample is stored in the form of a statistical matrix, and matrix D is a matrix of size D. A matrix, where N is the total number of devices in the network, and the elements in matrix D are... Indicates the first The device sends to the first The number of accesses initiated by each device; in the historical traffic sample collection section, multiple historical traffic samples are collected to form a historical traffic sample set, and each sample is marked as normal or abnormal based on whether abnormal traffic is added during the collection period.
[0017] In the aforementioned method for assessing the network security status of a power monitoring system, the Naive Bayes classification model in step two is represented as follows:
[0018]
[0019] Where S represents the network security status, with normal s + and abnormal s - Two possible values, where D is a given sample. Let represent the probability distribution of the network security state S given a sample of network states D. The prior probability distribution representing the network security status can be calculated based on the label distribution of historical traffic samples. Let S represent the probability distribution of sample D given probability distribution S. Let represent the probability distribution of sample D, which is constant given sample D.
[0020] The aforementioned method for assessing the network security status of a power monitoring system includes the following parameters in its Naive Bayes classification model:
[0021] Parameter 1: Logarithm of the prior probability that the network state is normal ;
[0022] Parameter 2: Logarithm of the prior probability that the network state is anomalous ;
[0023] Parameter 3: Logarithmic matrix of access frequency under normal network conditions ;
[0024] Parameter 4: Logarithmic matrix of access frequency under abnormal network conditions .
[0025] The aforementioned method for assessing the network security status of a power monitoring system, for the logarithmic matrix of access frequency under normal conditions... The construction process is as follows:
[0026] 1) The target logarithm matrix is the frequency logarithm matrix under normal conditions of the final output. Define the target logarithm matrix. It is an N x N matrix;
[0027] 2) Initialize the target logarithmic matrix Assign the value 1 to all elements;
[0028] 3) Store the frequency denominator as a variable. The frequency denominator variable is initialized to 2.
[0029] 4) Traverse each access behavior in the normal samples and determine the main device for each access behavior. and object equipment For each access behavior, the frequency denominator variable Corresponding elements of the target logarithmic matrix Increment by one for each, and the denominator variable is the result of the iteration. The value is the total number of normal samples + 2, and the target logarithm matrix. Each element stored in the database represents the number of specific directional access actions plus 1.
[0030] 5) Traverse the target logarithmic matrix and for each element Iterate over the values of , and let At this point, the target logarithmic matrix Construct a logarithmic matrix of access frequencies under normal conditions.
[0031] In the aforementioned method for assessing the network security status of a power monitoring system, step three involves using actual traffic samples as input to solve a Naive Bayes classification model, obtaining the conditional probability relationships between different network security statuses, and calculating the evaluation value for normal samples. Compared with the evaluation value of abnormal samples The calculation formula is:
[0032]
[0033]
[0034] in, and These are the prior probability distributions of labels for historical normal samples and abnormal samples, obtained by statistically analyzing label frequency distributions; the prior probabilities of labels for historical normal samples are stored separately. Prior probability distribution of anomalous sample labels and As a parameter used in the calculation of sample evaluation values; and These are actual samples under normal and abnormal network security conditions, respectively. The probability of all events occurring;
[0035] Based on the naive assumption, the normal sample evaluation value Compared with the evaluation value of abnormal samples Represented as:
[0036]
[0037]
[0038] in, and These are devices operating under normal and abnormal network security conditions, respectively. Access device The probability is based on the prior probability of historical samples, calculated by determining the access frequency of historical samples; the probability is also calculated for devices under normal and abnormal network security conditions. Access device probability and frequency logarithmic value and As a parameter in the evaluation value calculation; For the sample medium equipment Access device The frequency of events is determined by statistical analysis of actual samples. The sample was determined by the naive assumption. All equipment Access device The conditional probabilities of the events occurring are respectively and N is the total number of devices in the network;
[0039] Comparison with normal sample assessment values Compared with the evaluation value of abnormal samples The size of the sample is used to determine the network security status reflected by the current sample. This indicates that the probability of the current network status being normal is greater than the probability of it being abnormal, and the network security status is normal; otherwise, the network security status is abnormal.
[0040] The aforementioned method for assessing the network security status of a power monitoring system further includes:
[0041] Step 4: If the current network status is identified as abnormal, further screen whether specific devices in the network are in an abnormal state.
[0042] The aforementioned method for assessing the network security status of a power monitoring system utilizes a Naive Bayes classification model to further determine the security status of critical equipment, and uses the Naive Bayes formula to calculate the probability of different network security statuses of the critical equipment:
[0043]
[0044] in For equipment The distribution of network security status includes normal. and abnormal Two possible values, For equipment Relevant traffic samples, take sample D lines and Represents a given flow sample network devices under the condition safe status The probability distribution, express The prior probability distribution is calculated based on the label distribution of historical traffic samples. Indicates in Distribution conditions The distribution Indicates sample The distribution, in a given In the case of constants;
[0045] The sample is considered All access behavior events included in ( The two groups are independent of each other, that is:
[0046]
[0047]
[0048] in For the sample One of the interactive behavior events, Total interactions , For equipment Related traffic sample normal events, For equipment The logarithm of the relevant traffic sample anomaly events is obtained as follows:
[0049]
[0050]
[0051] equipment Normal state assessment value and abnormal state assessment value The calculation formulas are as follows:
[0052]
[0053]
[0054] in, and respectively equipment Access device Number of times and equipment Access device The number of times; , These are the backups under normal conditions. Access device Frequency logarithm and equipment Access device The frequency logarithm is taken from the aforementioned calculated and stored access frequency logarithm matrix under normal network security conditions. row and number List; , These are backups under abnormal conditions. Access device Frequency logarithm and equipment Access device The frequency logarithm is taken from the aforementioned calculated and stored frequency logarithm matrix of access under abnormal network security conditions. row and number List;
[0055] like Then the equipment status The value is normal; otherwise, the device... status The value is abnormal.
[0056] A computer system includes a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method described above.
[0057] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.
[0058] The technical effects achieved by this invention are as follows: The network security status assessment method for power monitoring systems of this invention models network traffic from the perspective of conditional probability, proposing a Naive Bayes-based network security status assessment method for power monitoring systems. By comparing the probabilities of different network security states within a sample collection period, the security status of the power monitoring system's cyberspace can be assessed. First, a certain amount of normal traffic information is collected to train the Naive Bayes classification model. Then, actual traffic samples are collected over a certain period. Combining this with the Bayes classification model, the network security status within the sample collection period can be assessed, serving as a basis for assessing whether persistent network attacks exist in the network, thus strengthening the power monitoring system's defense capabilities against targeted network attacks. Attached Figure Description
[0059] To more clearly illustrate the technical solutions and advantages of the present invention, the accompanying drawings used in the embodiments will be briefly described below.
[0060] Figure 1 This is a flowchart of the network security status assessment method for a power monitoring system in Example 1 of the present invention.
[0061] Figure 2 The flowchart of the calculation of the Naive Bayes classification model in Example 1 of this invention is shown.
[0062] Figure 3 This is a flowchart illustrating the process of using a Naive Bayes classification model to determine the safety status of critical equipment in Example 1 of this invention. Detailed Implementation
[0063] The present invention will be further described below with reference to specific embodiments and accompanying drawings.
[0064] Example 1
[0065] like Figure 1 As shown, this embodiment provides a method for assessing the network security status of a power monitoring system. It assesses the network security status by statistically analyzing network traffic information and evaluating the probability of abnormal traffic. When the network security status assessment indicates an anomaly, it evaluates critical equipment, including:
[0066] Step 1: Collect sample data, including historical traffic sample data and actual traffic sample data.
[0067] The historical traffic samples include normal traffic samples and abnormal traffic samples. Abnormal traffic simulating targeted network attacks is added to the abnormal traffic samples.
[0068] Normal traffic samples and abnormal traffic samples are labeled for use in training the prediction model in the model training module.
[0069] The actual traffic sample data collection refers to network traffic sample data collected during the actual operation of network services.
[0070] This invention employs a network traffic collection method to capture network traffic information. Since the primary focus is on the distribution of access behavior between devices in the network, only the number of network accesses between devices needs to be collected. The data obtained in one collection period constitutes a sample D, which is stored in the form of a statistical matrix. Matrix D is a matrix of size... A matrix, where N is the total number of devices in the network, and the elements in matrix D are... Indicates the first The device sends to the first The number of accesses initiated by each device. In the historical traffic sample collection section, multiple historical traffic samples are collected to form a historical traffic sample set. Each sample is labeled as normal or abnormal based on whether abnormal traffic was included in the collection period. The actual traffic sample collection section only collects one sample from the current period and does not include network status labeling information.
[0071] Step two, as Figure 2 As shown, a Naive Bayes classification model is constructed using labeled historical traffic. The prior probability distribution and conditional probability distribution are obtained by statistically analyzing the collected historical sample data set according to the label distribution and the distribution of each sample. The Naive Bayes classification model is then constructed from these prior probability distributions and conditional probability distributions, as follows:
[0072]
[0073] Where S represents the network security status, with normal s + and abnormal s - Two possible values, where D is a given sample. Let represent the probability distribution of the network security state S given a sample of network states D. The prior probability distribution representing the network security status can be calculated based on the label distribution of historical traffic samples. Let S represent the probability distribution of sample D given probability distribution S. Let represent the probability distribution of sample D, which is constant given sample D.
[0074] To calculate the probability distribution of the network state S given a sample D, it is necessary to calculate the prior probability distribution of the network security state separately. Given a network state sample D, the probability distribution of the network security state S. The probability distribution of sample D Classification tasks are relatively... and ,and Since it is a constant, it is only necessary to calculate the prior probability distribution of the network security status. Given a network security state S, the probability distribution of network state sample D. The prior probability distribution of network security status. This can be easily obtained through statistical analysis of historical data label distribution. The following details the probability distribution of network state sample D given a network security state S. The calculation method.
[0075] Because variable S has a normal value s + and outliers - Given a network security state S, the probability distribution of a network state sample D with two possible values. Including normal sample probability distribution and probability distribution of abnormal samples Two distributions. When variable S takes the value of the normal value s. + When the probability distribution of a normal sample is obtained, it can be calculated by the following formula:
[0076]
[0077] in, For a single network interaction event in sample D, to facilitate the calculation of the joint probability distribution in the above equation, a naive assumption is proposed: They are independent of each other. It represents the total number of network interactions in sample D. ,in Indicates the first The device sends to the first The number of accesses initiated by each device; therefore, the above formula can be further written as:
[0078]
[0079] As shown in the above formula, the probability of sample D occurring under normal network conditions can be obtained by multiplying the probability of each access behavior occurring under normal network conditions, where... It is the prior probability, that is, the frequency in historical samples, which can be obtained by statistics from historical traffic sample sets.
[0080] Similarly, we can deduce that the variable S takes the value of the abnormal sample s. - When, the probability distribution of outliers in sample D is:
[0081]
[0082] The conditional probabilities in the above two equations are calculated as decimal product, which is computationally difficult and the result is close to 0. To simplify the calculation, the probabilities need to be logarithmically transformed. Taking the logarithm of both sides of the equations yields:
[0083]
[0084]
[0085] The classification objective is to compare conditional probability distributions. The probability that the network state is normal given that sample D occurs. And the probability that the network state is abnormal given that sample D exists. The magnitude relationship. And the probability distribution of sample D in the calculation formula. Given a specific sample, it is a constant, and its value does not affect and The size relationship. The original classification task can be simplified to comparison. The distribution of the values is defined, therefore the evaluation value is defined. For normal sample evaluation values, The evaluation value for outlier samples is calculated using the following formula:
[0086]
[0087]
[0088] in, and These are the prior probability distributions of labels for historical normal and abnormal samples, which can be obtained by statistically analyzing the label frequency distributions and stored separately. and logarithm and As a parameter used in the calculation of sample evaluation values; and These are the prior probability distributions of each interaction behavior under the labels of historical normal samples and abnormal samples, respectively, which can be obtained by statistically analyzing the access frequency under different labels. The latter part of the above two equations is the sum of the logarithms of the prior probabilities, which is the logarithm of the access frequency under different labels in the historical traffic samples. To store the values of the logarithm of the access frequency, we define the access frequency logarithm matrix under normal conditions. Logarithmic matrix of access frequency under abnormal conditions , where matrix elements and These represent equipment under normal and abnormal conditions, respectively. For equipment Logarithm of access frequency.
[0089] To calculate For example, For pre-stored parameters, the cumulative calculation method iterates through every access event in the actual traffic. This access event is for the device. To the equipment A single access will retrieve the matrix. The OK Column elements Substitute the current accumulated value. Similarly, it can be derived from... and Calculate .
[0090] The above calculation process involves a logarithmic matrix of access frequencies under normal conditions. Logarithmic matrix of access frequency under abnormal conditions This can be calculated from historical traffic samples. The historical traffic samples are divided into two sub-samples: traffic samples under normal conditions and traffic samples under abnormal conditions. The required logarithmic matrix of access frequency under normal conditions can be constructed from these two sub-samples respectively. Logarithmic matrix of access frequency under abnormal conditions .
[0091] For the logarithmic matrix of access frequency under normal conditions Logarithmic matrix of access frequency under abnormal conditions The calculation, in order to For example, the construction process is as follows:
[0092] 1) Define the target logarithm matrix: The target logarithm matrix is the frequency logarithm matrix under normal conditions of the final output. It is an N x N matrix.
[0093] 2) Initialization of the target logarithm matrix: Initialize the target logarithm matrix. Assign the value 1 to all elements.
[0094] 3) Frequency denominator initialization: Since all access frequencies have the same denominator under normal conditions, the frequency denominator is stored as a variable. The frequency denominator variable is initialized to 2.
[0095] 4) Access Behavior Counting: Traverse each access behavior in the normal samples and determine the main device for each access behavior. and object equipment For each access behavior, the frequency denominator variable Corresponding elements of the target logarithmic matrix Increment by one for each, and the denominator variable is the result of the iteration. The value is the total number of normal samples + 2, and the target logarithm matrix. Each element stored in the database represents the number of specific directional access actions plus 1.
[0096] 5) Calculation of frequency logarithm: Traversing the target logarithm matrix and for each element Iterate over the values of , and let At this point, the target logarithmic matrix Construct a logarithmic matrix of access frequencies under normal conditions.
[0097] Similarly, the frequency logarithm matrix under abnormal conditions can be obtained. .
[0098] The frequency logarithm matrix under normal conditions obtained from the above process and frequency logarithmic matrix under abnormal conditions Two frequency matrices, which store the logarithm of the frequency of one-way access between any two devices under normal or abnormal conditions.
[0099] The Naive Bayes classification model, calculated from historical traffic samples, contains four parameters:
[0100] Parameter 1: Logarithm of the prior probability that the network state is normal ;
[0101] Parameter 2: Logarithm of the prior probability that the network state is anomalous ;
[0102] Parameter 3: Logarithmic matrix of access frequency under normal network conditions ;
[0103] Parameter 4: Logarithmic matrix of access frequency under abnormal network conditions .
[0104] Step 3: By training a set of labeled historical traffic samples, a detection and evaluation model based on Naive Bayes classification is obtained. The detection and evaluation model is used to calculate the normal probability evaluation value and the abnormal probability evaluation value of different network security statuses in the actual traffic samples. By comparing the magnitude of the normal probability evaluation value and the abnormal probability evaluation value, the network security status is evaluated.
[0105] The actual traffic sample is a separate sample matrix D, with the same matrix form as the historical traffic sample. Using the actual traffic sample as input, a Naive Bayes classification model is solved to obtain the conditional probability relationships between different network security states. The formula for calculating the network security state assessment value E is:
[0106]
[0107]
[0108] In other words, in the Naive Bayes classification model, parameters 1, 3, and sample D can be used to calculate the evaluation value of normal samples. The abnormal sample evaluation value can be calculated using parameters 2, 4, and sample D. Compare the assessment values of normal samples. Compared with the evaluation value of abnormal samples The size of the value can be used to determine the network security status reflected by the current sample. If This indicates that the probability of the current network status being normal is greater than the probability of it being abnormal, meaning the network security status is normal; otherwise, the network security status is abnormal.
[0109] Example 2
[0110] This embodiment provides a method for assessing the network security status of a power monitoring system, which, based on the steps of embodiment 1, further includes:
[0111] Step 4: After the above process, it can be determined whether the current network is in a safe state. The overall security status of the network can be judged. If the current network status is found to be abnormal, it is necessary to further screen whether the specific devices in the network are in an abnormal state. The devices that need to be screened for abnormality in the power monitoring system are referred to as key devices.
[0112] Similar to the network security status assessment methods described above, the Naive Bayes classification model can be used to further determine the security status of critical equipment. The probabilities of different network security states of critical equipment are calculated using the Naive Bayes formula:
[0113]
[0114] in For equipment The distribution of network security status includes normal. and abnormal Two possible values, For equipment Relevant traffic samples, take sample D lines and Column composition, Represents a given flow sample network devices under the condition safe status The probability distribution, express The prior probability distribution can be calculated based on the label distribution of historical traffic samples. Indicates in Distribution conditions The distribution Indicates sample The distribution, in a given In the case of , it is a constant.
[0115] The sample is considered All access behavior events included in ( The two groups are independent of each other, that is:
[0116]
[0117]
[0118] in For the sample One of the interactive behavior events, Total interactions , For equipment Related traffic sample normal events, For equipment Related traffic sample anomaly events. Taking the logarithm yields:
[0119]
[0120]
[0121] Then the equipment Normal state assessment value and abnormal state assessment value They are respectively:
[0122]
[0123]
[0124] equipment Normal state assessment value and abnormal state assessment value The calculation formulas are as follows:
[0125]
[0126] in, and respectively equipment Access device Number of times and equipment Access device The number of times; , These are the backups under normal conditions. Access device Frequency logarithm and equipment Access device The frequency logarithm is taken from the aforementioned calculated and stored access frequency logarithm matrix under normal network security conditions. row and number List; , These are backups under abnormal conditions. Access device Frequency logarithm and equipment Access device The frequency logarithm is taken from the aforementioned calculated and stored frequency logarithm matrix of access under abnormal network security conditions. row and number List;
[0127]
[0128] like Then the equipment status The value is normal; otherwise, the device... status The value is abnormal.
[0129] When the network security status assessment is abnormal, it indicates that there are potential risks in the power monitoring system network. At this time, applying the above-mentioned equipment security status assessment method to each critical device and outputting the set of all devices assessed as abnormal can help locate network security risk points and help investigate targeted network attack events.
[0130] Example 3
[0131] A computer system includes a memory, a processor, and a computer program stored in the memory, the processor executing the computer program to perform the steps of the method as described in Embodiment 1 or 2.
[0132] Example 4
[0133] A computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of the method as described in Embodiment 1 or 2.
[0134] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0135] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0136] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0137] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. A method for assessing the network security status of a power monitoring system, characterized in that, include: Step 1: Collect sample data, including historical traffic sample data and actual traffic sample data; The historical traffic samples include normal traffic samples and abnormal traffic samples, and the abnormal traffic samples include abnormal traffic that simulates targeted network attacks. Step 2: Construct a Naive Bayes classification model using labeled historical traffic. Statistically obtain the prior probability distribution and conditional probability distribution of the collected historical sample data set according to the label distribution and the distribution of each sample. The Naive Bayes classification model is then constructed from the prior probability distribution and conditional probability distribution. Step 3: By training a set of labeled historical traffic samples, a detection and evaluation model based on Naive Bayes classification is obtained. The detection and evaluation model is used to calculate the normal probability evaluation value and the abnormal probability evaluation value of different network security statuses in the actual traffic samples. By comparing the magnitude of the normal probability evaluation value and the abnormal probability evaluation value, the network security status is evaluated.
2. The method for assessing the network security status of a power monitoring system according to claim 1, characterized in that, In step one, the data obtained in one acquisition cycle is a sample D. The sample is stored in the form of a statistical matrix, and matrix D is a matrix of size D. A matrix, where N is the total number of devices in the network, and the elements in matrix D are... Indicates the first The device sends to the first The number of accesses initiated by each device; in the historical traffic sample collection section, multiple historical traffic samples are collected to form a historical traffic sample set, and each sample is marked as normal or abnormal based on whether abnormal traffic is added during the collection period.
3. The method for assessing the network security status of a power monitoring system according to claim 1, characterized in that, In step two, the Naive Bayes classification model is represented as follows: Where S represents the network security status, with normal s + and abnormal s - Two possible values, where D is a given sample. Let represent the probability distribution of the network security state S given a sample of network states D. The prior probability distribution representing the network security status can be calculated based on the label distribution of historical traffic samples. Let S represent the probability distribution of sample D given probability distribution S. Let represent the probability distribution of sample D, which is constant given sample D.
4. The method for assessing the network security status of a power monitoring system according to claim 3, characterized in that, The Naive Bayes classification model includes the following parameters: Parameter 1: Logarithm of the prior probability that the network state is normal ; Parameter 2: Logarithm of the prior probability that the network state is anomalous ; Parameter 3: Logarithmic matrix of access frequency under normal network conditions ; Parameter 4: Logarithmic matrix of access frequency under abnormal network conditions .
5. The method for assessing the network security status of a power monitoring system according to claim 4, characterized in that, For the logarithmic matrix of access frequency under normal conditions The construction process is as follows: 1) The target logarithm matrix is the frequency logarithm matrix under normal conditions of the final output. Define the target logarithm matrix. It is an N x N matrix; 2) Initialize the target logarithmic matrix Assign the value 1 to all elements; 3) Store the frequency denominator as a variable. The frequency denominator variable is initialized to 2. 4) Traverse each access behavior in the normal samples and determine the main device for each access behavior. and object equipment For each access behavior, the frequency denominator variable Corresponding elements of the target logarithmic matrix Increment by one for each, and the denominator variable is the result of the iteration. The value is the total number of normal samples + 2, and the target logarithm matrix. Each element stored in the database represents the number of specific directional access actions plus 1. 5) Traverse the target logarithmic matrix and for each element Iterate over the values of , and let At this point, the target logarithmic matrix Construct a logarithmic matrix of access frequencies under normal conditions.
6. The method for assessing the network security status of a power monitoring system according to claim 5, characterized in that, In step three, using actual traffic samples as input, the Naive Bayes classification model is solved to obtain the relationship between the conditional probabilities of different network security states, and the evaluation value of normal samples is calculated. Compared with the evaluation value of abnormal samples The calculation formula is: in, and These are the prior probability distributions of labels for historical normal samples and abnormal samples, obtained by statistically analyzing label frequency distributions; the prior probabilities of labels for historical normal samples are stored separately. Prior probability distribution of anomalous sample labels logarithm and As a parameter used in the calculation of sample evaluation values; and These are actual samples under normal and abnormal network security conditions, respectively. The probability of all events occurring; Based on the naive assumption, the normal sample evaluation value Compared with the evaluation value of abnormal samples The calculation formula is expressed as: in, and These are devices operating under normal and abnormal network security conditions, respectively. Access device The probability is based on the prior probability of historical samples, calculated by determining the access frequency of historical samples; the probability is also calculated for devices under normal and abnormal network security conditions. Access device probability and frequency logarithmic value and As a parameter used in the evaluation value calculation; For the sample medium equipment Access device The frequency of events is determined by statistical analysis of actual samples. The sample was determined by the naive assumption. All equipment Access device The conditional probabilities of the events occurring are respectively and N is the total number of devices in the network; Comparison with normal sample assessment values Compared with the evaluation value of abnormal samples The size of the sample is used to determine the network security status reflected by the current sample. This indicates that the probability of the current network status being normal is greater than the probability of it being abnormal, and the network security status is normal; otherwise, the network security status is abnormal.
7. The method for assessing the network security status of a power monitoring system according to claim 1, characterized in that, Also includes: Step 4: If the current network status is identified as abnormal, further screen whether specific devices in the network are in an abnormal state.
8. The method for assessing the network security status of a power monitoring system according to claim 7, characterized in that, The Naive Bayes classification model is used to further determine the security status of critical equipment, and the probabilities of different network security states of critical equipment are calculated using the Naive Bayes formula: in For equipment The distribution of network security status includes normal. and abnormal Two possible values, For equipment Relevant traffic samples, take sample D lines and Represents a given traffic sample network devices under the condition safe status The probability distribution, express The prior probability distribution is calculated based on the label distribution of historical traffic samples. Indicates in Distribution conditions The distribution, Indicates sample The distribution, in a given In the case of constants; The sample is considered All access behavior events included in ( The two groups are independent of each other, that is: in For the sample An interactive behavior event, Total interactions , For equipment Related traffic sample normal events, For equipment The logarithm of the relevant traffic sample anomaly events is obtained as follows: equipment Normal state assessment value and abnormal state assessment value The calculation formulas are as follows: in, and respectively equipment Access device Number of times and equipment Access device The number of times; , These are the backups under normal conditions. Access device Frequency logarithm and equipment Access device The frequency logarithm; , These are backups under abnormal conditions. Access device Frequency logarithm and equipment Access device The frequency logarithm; like Then the equipment status The value should be normal; otherwise, the device... status The value is abnormal.
9. A computer system comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method as claimed in any one of claims 1-8.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1-8.