Digital power grid supply chain safety risk assessment method, system and device based on artificial intelligence and medium

Abstract

The invention discloses a digital power grid supply chain safety risk assessment method, system and device based on artificial intelligence and a medium, and belongs to the technical field of electric power safety, and the method comprises the steps: obtaining the dependency relationship data of an open source component of a digital power grid system, and constructing an initial dependency graph; calculating a confidence score for each dependency edge in the initial dependency graph; determining a noise filtering threshold value, and generating a filtered dependency graph; based on the filtered dependency graph, performing propagation calculation on component risks by adopting a graph neural network, and outputting a risk propagation value of each component; respectively extracting a code feature vector, a security feature vector and a power industry context feature vector of each component; fusing the code feature vector, the security feature vector and the power industry context feature vector to generate a component comprehensive risk vector; and determining the risk rating of each component according to the risk propagation value and the component comprehensive risk vector. According to the invention, the accuracy and reliability of digital power grid open source software supply chain security risk identification are improved.

Description

Technical Field

[0001] This invention relates to the field of power safety technology, specifically to a method, system, equipment, and medium for assessing the security risks of a digital power grid supply chain based on artificial intelligence. Background Technology

[0002] Currently, in the power industry, critical business systems such as Supervisory Control and Data Acquisition (SCADA) systems, Energy Management Systems (EMS), and Distribution Management Systems (DMS) are widely developed using open-source software frameworks, forming a network of component dependencies. With the widespread application of the IEC 61850 communication standard and the in-depth development of smart grid technology, the power system's reliance on open-source software continues to deepen, and the security of the software supply chain is directly related to the stable operation of the power grid. Existing software component analysis techniques are mainly designed for general software environments and lack specific security assessment mechanisms for the power system's unique industrial control protocols, real-time communication requirements, and safe and stable operation standards.

[0003] Existing technologies have significant shortcomings in assessing the security risks of the open-source software supply chain for digital power grids. First, traditional dependency analysis methods lack effective filtering mechanisms for noise in component dependency information within power systems, failing to accurately identify the true propagation paths of security risks. Second, general vulnerability assessment systems fail to fully consider the business continuity requirements and N-1 security criterion of the power industry, resulting in a mismatch between risk level classifications and the actual operational needs of the power grid. Third, existing solutions lack the ability to extract deep features from power communication protocol interfaces, substation control systems, and other power-specific components, making it impossible to accurately assess the potential impact of component failures on the safe and stable operation of the power grid. Furthermore, traditional risk assessment methods often employ static analysis models, making it difficult to achieve dynamic propagation modeling of supply chain risks and global risk quantification assessment, thus failing to meet the technical requirements for real-time security monitoring of digital power grids. Summary of the Invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by this invention is: how to achieve accurate identification of component dependencies in the open-source software supply chain of digital power grids, deep extraction of safety features of power-specific components, global propagation modeling of supply chain security risks, and quantitative assessment of risk levels that meet the requirements of power system operation by using a noise filtering mechanism for confidence assessment, a multi-dimensional feature fusion method specific to the power industry, and a risk propagation model based on graph neural networks.

[0006] To address the aforementioned technical problems, this invention provides the following technical solution: a digital power grid supply chain security risk assessment method based on artificial intelligence, comprising: acquiring open-source component dependency relationship data of a digital power grid system and constructing an initial dependency graph; calculating a confidence score for each dependency edge in the initial dependency graph; determining a noise filtering threshold based on the confidence score, filtering dependency edges below the noise filtering threshold, and generating a filtered dependency graph; based on the filtered dependency graph, using a graph neural network to perform component risk propagation calculations and outputting the risk propagation value of each component; extracting the code feature vector, security feature vector, and power industry context feature vector for each component; fusing the code feature vector, security feature vector, and power industry context feature vector to generate a comprehensive component risk vector; and determining the risk rating of each component based on the risk propagation value and the comprehensive component risk vector.

[0007] As a preferred embodiment of the artificial intelligence-based digital power grid supply chain security risk assessment method described in this invention, the confidence score is determined based on the semantic similarity and version consistency between components. Specifically, the semantic similarity between components is calculated based on the vectorized representation of the component functional description text; the version consistency between components is calculated based on the compatibility matching degree of the component version numbers; and the semantic similarity and version consistency are linearly combined according to a first weighting parameter and a second weighting parameter to obtain the confidence score.

[0008] As a preferred embodiment of the artificial intelligence-based digital power grid supply chain security risk assessment method described in this invention, the determination of the noise filtering threshold includes: calculating the statistical distribution of the confidence scores of all dependency edges in the initial dependency graph; setting a first noise tolerance parameter and a second noise tolerance parameter according to the requirements for safe and stable operation of the power system, wherein the first noise tolerance parameter corresponds to the control subsystem that directly affects power grid dispatching, and the second noise tolerance parameter corresponds to the monitoring subsystem that assists in power grid operation; and calculating the noise filtering threshold based on the mean and standard deviation of the statistical distribution, combined with the first noise tolerance parameter or the second noise tolerance parameter.

[0009] As a preferred embodiment of the AI-based digital power grid supply chain security risk assessment method described in this invention, the risk propagation calculation of the graph neural network includes: constructing a multi-layer graph convolutional network, where each layer updates the hidden state representation of the current node based on the characteristics of neighboring nodes and edge weights; determining propagation parameters based on the role level of components in power system operation, assigning a first propagation parameter to control system components affecting power grid security and stability, and assigning a second propagation parameter to data acquisition components supporting power grid operation; and obtaining the stability risk propagation value of each component through iterative calculation.

[0010] As a preferred embodiment of the artificial intelligence-based digital power grid supply chain security risk assessment method described in this invention, the extraction of the code feature vector includes: parsing the program interface information of the components, extracting function call relationships and API dependency patterns; counting the call frequency of power communication protocol interfaces in the function call relationships, wherein the power communication protocol interfaces include substation communication interfaces and power grid dispatch communication interfaces; converting the call frequency and the API dependency patterns into numerical feature representations to generate the code feature vector.

[0011] As a preferred embodiment of the artificial intelligence-based digital power grid supply chain security risk assessment method described in this invention, the extraction of the security feature vector includes: obtaining vulnerability database records of components, wherein the vulnerability database records include CVE numbers affecting the operational security of the power system and corresponding CVSS scores; extracting the impact level of vulnerabilities on the continuity of power grid services and vulnerability remediation status identifiers from the vulnerability database records; and numerically encoding the impact level and the vulnerability remediation status identifiers to generate the security feature vector reflecting the security risks of the power system.

[0012] As a preferred embodiment of the AI-based digital power grid supply chain security risk assessment method described in this invention, the determination of the risk rating includes: setting a first risk threshold and a second risk threshold according to the N-1 safety criterion of the power system and the reliability requirements of power grid operation; the first risk threshold corresponds to the identification standard for high-risk components that cause power grid failures, and the second risk threshold corresponds to the identification standard for medium-risk components that affect the local operation of the power grid; calculating the power system risk score of the component based on the risk propagation value and the component's comprehensive risk vector, combined with the potential impact of component failures on the safe operation of the power grid; when the power system risk score exceeds the first risk threshold, the component is marked as high-risk; when the power system risk score is between the second risk threshold and the first risk threshold, the component is marked as medium-risk; when the power system risk score is lower than the second risk threshold, the component is marked as low-risk.

[0013] This invention provides an artificial intelligence-based digital power grid supply chain security risk assessment system.

[0014] To address the aforementioned technical problems, the present invention further provides the following technical solution: an artificial intelligence-based digital power grid supply chain security risk assessment system, comprising: a data acquisition module for acquiring open-source component dependency data of a digital power grid system and constructing an initial dependency graph; a confidence score calculation module for calculating a confidence score for each dependency edge in the initial dependency graph; a graph filtering module for determining a noise filtering threshold based on the confidence score, filtering dependency edges below the noise filtering threshold, and generating a filtered dependency graph; a risk propagation module for performing component risk propagation calculations using a graph neural network based on the filtered dependency graph, and outputting the risk propagation value for each component; a feature extraction module for extracting code feature vectors, security feature vectors, and power industry context feature vectors for each component; a feature fusion module for fusing the code feature vectors, security feature vectors, and power industry context feature vectors to generate a comprehensive component risk vector; and a risk rating module for determining the risk rating of each component based on the risk propagation value and the comprehensive component risk vector.

[0015] The present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, characterized in that the processor executes the computer program to implement the steps of the artificial intelligence-based digital power grid supply chain security risk assessment method.

[0016] The present invention provides a computer-readable storage medium having a computer program stored thereon, characterized in that the computer program, when executed by a processor, implements the steps of the aforementioned artificial intelligence-based digital power grid supply chain security risk assessment method.

[0017] The beneficial effects of this invention are as follows: This invention effectively identifies and eliminates erroneous information in the dependencies between power system components through noise filtering based on confidence level assessment, thus solving the problem of misjudging risk propagation paths in the power grid environment using traditional dependency analysis methods. By integrating code feature vectors, security feature vectors, and power industry context feature vectors into a multi-dimensional feature extraction method, it achieves deep security feature identification of power-specific software modules such as power communication protocol interfaces and substation control components, while also compensating for the insufficient applicability of general vulnerability assessment systems in the power field. Based on a graph neural network-based risk propagation calculation model, combined with the N-1 security criterion of the power system and the reliability requirements of power grid operation, it realizes global propagation modeling and quantitative assessment of supply chain security risks in the component dependency network, thereby overcoming the limitations of traditional static risk analysis methods. By combining component risk ratings with the actual impact on the safe and stable operation of the power grid, a risk level classification standard conforming to the characteristics of power system operation is established, thereby achieving open-source software supply chain security risk assessment and continuity assurance of power business. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart illustrating an artificial intelligence-based digital power grid supply chain security risk assessment method according to an embodiment of the present invention;

[0020] Figure 2 A schematic diagram of the overall structure of an artificial intelligence-based digital power grid supply chain security risk assessment system provided in one embodiment of the present invention;

[0021] Figure 3 A computer device diagram illustrating an artificial intelligence-based digital power grid supply chain security risk assessment method provided in one embodiment of the present invention. Detailed Implementation

[0022] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0023] Example 1, referring to Figure 1 This is the first embodiment of the present invention, which provides an artificial intelligence-based digital power grid supply chain security risk assessment method, including:

[0024] S100: Obtain the dependency data of open-source components of the digital power grid system and construct an initial dependency graph;

[0025] S200: Calculate the confidence score for each dependency edge in the initial dependency graph;

[0026] S300: Determine the noise filtering threshold based on the confidence score, filter out dependency edges below the noise filtering threshold, and generate a filtered dependency graph.

[0027] S400: Based on the filtered dependency graph, a graph neural network is used to calculate the propagation of component risks and output the risk propagation value of each component;

[0028] S500: Extract the code feature vector, security feature vector, and power industry context feature vector of each component respectively;

[0029] S600: Integrates code feature vectors, security feature vectors, and power industry context feature vectors to generate a comprehensive risk vector for components;

[0030] S700: Determine the risk rating of each component based on the risk propagation value and the component's comprehensive risk vector.

[0031] It should be noted that core business systems in digital power grid systems, such as SCADA, EMS, and DMS, extensively utilize open-source components to build functional modules, forming a hierarchical network of component dependencies. The power system operating environment places extremely high demands on software reliability; any component failure can trigger a chain reaction, affecting the stable operation of the power grid. Current software component analysis methods cannot effectively address the lack of or errors in component dependency information in power systems, leading to risk assessment results that deviate from reality. Power communication protocol interfaces such as IEC 61850, Modbus, and DNP3 undertake data exchange functions in substation automation systems; any security vulnerabilities in these interfaces will directly threaten the security of power grid control. Traditional vulnerability assessment systems use the common CVSS scoring standard, failing to incorporate the N-1 security criteria of the power system and the reliability requirements of power grid operation, thus failing to accurately reflect the actual impact of vulnerabilities on the continuity of power services.

[0032] Therefore, to address the aforementioned issues of inaccurate dependency identification and insufficient targeted risk assessment, steps S100 to S700 are used to establish a noise filtering mechanism based on confidence assessment to eliminate erroneous information in component dependencies and improve the accuracy of risk propagation path identification. A multi-dimensional feature extraction method integrating power communication protocol interface characteristics, grid business continuity impacts, and power system safety operation requirements is constructed to achieve precise quantification of safety risks for power-specific components. Based on graph neural networks, a propagation model of supply chain security risks in component dependency networks is established. Combined with power system safety level requirements and the impact range of grid faults, this enables component risk level classification and intelligent safety risk assessment that conforms to the operational characteristics of the power industry.

[0033] Example 2, refer to Figure 1 This is the second embodiment of the present invention, which provides a method for assessing the security risks of a digital power grid supply chain based on artificial intelligence.

[0034] S100: Obtain the dependency data of open source components of the digital power grid system and construct the initial dependency graph.

[0035] It should be noted that the dependency data of open-source components in the digital power grid system is obtained by scanning the package management files in the SCADA, EMS, and DMS systems. The scanning process first identifies the open-source component information in the system deployment manifest, including component name, version number, dependency declaration, and interface description. Each component is treated as a node in the graph, and the dependencies between components are treated as directed edges, forming an initial dependency graph with a directed acyclic graph structure. Nodes contain attributes such as component identifier, functional description, version information, and deployment location, while edges contain attributes such as dependency type, call frequency, and interface relationships.

[0036] In one alternative implementation, open-source component dependency data can be obtained through static code analysis. Static code analysis tools parse import statements, package declarations, and function calls in source code files to extract direct dependencies between components. For example, for Java projects, dependency declarations in the pom.xml and build.gradle files are parsed; for Python projects, package dependency information in the requirements.txt and setup.py files is parsed. By recursively analyzing transitive dependencies, a complete dependency graph is constructed.

[0037] In another alternative implementation, dependency data can be obtained through runtime monitoring. During power system operation, system call tracing and API call monitoring record the actual interactions between components. Monitoring agents capture runtime behaviors such as inter-process communication, file access, and network connections, generating dynamic dependency data. Runtime monitoring can uncover implicit dependencies that static analysis cannot identify, including dependencies caused by reflection calls, plugin loading, and configuration-driven dependencies.

[0038] In another alternative implementation, dependency data can be obtained through software bill of materials (BOM) analysis. The BOM file records all third-party components used in the system and their version information. By parsing the SPDX, CycloneDX, or SWID format BOM file, the component list and license information can be extracted. This BOM analysis method is suitable for commercially deployed power systems and can quickly identify open-source components included in the system.

[0039] The process of constructing the initial dependency graph includes graph structure standardization and attribute normalization. Graph structure standardization unifies dependency data from different sources into a standard graph representation format, eliminating data format differences. Attribute normalization standardizes component names, version numbers, and dependency types, resolving the issue of different naming conventions for the same component. For example, openssl, OpenSSL, and openssl-devel are unified into standard component identifiers, and 1.1.1k, 1.1.1k-1, and 1.1.1k-fips are unified into a standard version format.

[0040] S200: Calculate the confidence score for each dependency edge in the initial dependency graph.

[0041] In step S200, the confidence score is determined based on the semantic similarity and version consistency between components, including steps A1 to A3:

[0042] Step A1: Calculate the semantic similarity between components. The semantic similarity is determined based on the vectorized representation of the component function description text.

[0043] It should be noted that the component function description text is sourced from the official documentation, README file, and API documentation of the software package. The semantic similarity calculation process is as follows: The function description text is preprocessed, including stop word filtering, stemming, and terminology standardization. The preprocessed text is then converted into word vector representations, and numerical vectors are generated using the TF-IDF algorithm or word embedding model. The cosine similarity between the function description vectors of two components is calculated to obtain a semantic similarity score. Semantic similarity reflects the degree of relevance between component functions; components with similar functions are more likely to have genuine dependencies.

[0044] In one alternative implementation, semantic similarity calculations can be enhanced using a domain-specific dictionary. A power system terminology dictionary is constructed, including specialized vocabulary such as power grid terms, communication protocol names, and control commands. During text vectorization, specialized terms are assigned higher weight values ​​to improve the accuracy of identifying power-related functions. For example, component description text containing SCADA terminology receives additional weighting during vectorization; power communication protocol terms such as IEC61850, Modbus, and DNP3 receive similar treatment; and power business terms such as data acquisition, remote control, and fault diagnosis are also given priority consideration in the calculations. The domain dictionary is constructed based on power industry standard documents and professional manuals to ensure the completeness and accuracy of terminology coverage.

[0045] In another alternative implementation, semantic similarity can be calculated based on component category tags. Components in a software package repository typically have functional category tags, such as communication-library, database-connector, cryptography-toolkit, etc. Semantic similarity is calculated by comparing the overlap of component category tags; components belonging to the same functional category have higher semantic similarity values. The category tag similarity calculation uses the Jaccard similarity algorithm, calculating the ratio of the intersection to the union of two component tag sets. The tag method is computationally efficient and suitable for large-scale dependency analysis scenarios.

[0046] In another alternative implementation, semantic similarity can be calculated through functional interface matching. The API interface definitions of the components are parsed, extracting interface features such as function names, parameter types, and return value types. The degree of matching between the interface features of the two components is calculated; the component with stronger interface compatibility has higher semantic similarity. Interface matching analysis includes function signature comparison, data type compatibility checks, and call pattern recognition. For example, two network communication components that both provide similar interface functions such as connect, send, and receive have a high semantic similarity value.

[0047] Step A2: Calculate the version consistency between components. The version consistency is determined based on the compatibility and matching degree of the component version numbers.

[0048] Version consistency assesses the compatibility between component versions. Version number parsing first decomposes the version string into three numerical parts: major version number, minor version number, and revision number. Compatibility matching calculation follows semantic versioning specifications: identical major version numbers indicate backward API compatibility; differences in minor version numbers indicate feature extensions while maintaining compatibility; and differences in revision number numbers indicate bug fixes. The version consistency score is determined based on the impact of version differences; smaller version differences indicate better compatibility and a higher consistency score.

[0049] In one alternative implementation, version consistency can be enhanced with version lifecycle analysis to improve calculation accuracy. This involves collecting the release history and maintenance status information of components to identify long-term supported (LTS) versions, actively maintained (EMS) versions, and deprecated versions. Dependencies between LTS versions have higher version consistency scores, EMS versions maintain a standard consistency score, and deprecated versions have significantly lower consistency scores. For example, the OpenSSL 1.1.1 series, as an LTS version, has high version consistency with Apache HTTP Server components using the same series, but lower consistency with components using the deprecated OpenSSL 1.0.2 version. Version lifecycle information is obtained through the software's official website and security bulletins.

[0050] In another alternative implementation, version consistency can be calculated based on security patch status. Analyzing known vulnerabilities and security patch application status of component versions, combinations of versions that have patched critical security vulnerabilities receive higher consistency scores. Security status assessments of component versions are obtained by querying national vulnerability databases and CVE databases. Version combinations with better security patch integrity are more suitable for collaborative deployment in power systems, thus receiving higher version consistency scores. Version security status analysis also includes factors such as patch release intervals and patch response speed.

[0051] In another alternative implementation, version consistency can be enhanced through dependency conflict detection. This involves analyzing potential dependency conflicts that may arise from different version combinations in actual deployments, including library file conflicts, symbol redefinitions, and runtime errors. Version compatibility test cases are then constructed to verify the actual operational stability of the component version combinations. Version combinations that pass compatibility testing receive higher consistency scores, while those with known conflicts have lower consistency scores. Compatibility test data is derived from test reports from the open-source community and deployment experience in the power industry.

[0052] Step A3: Based on the first weighted parameter and the second weighted parameter, perform a linear combination of semantic similarity and version consistency to obtain the confidence score.

[0053] Linear combination calculation performs a weighted summation of semantic similarity and version consistency according to preset weighting parameters. The first weighting parameter controls the contribution weight of semantic similarity in the final confidence calculation, while the second weighting parameter controls the contribution weight of version consistency. The weighting parameters are set based on the safety and stability requirements and functional matching needs of the power system. In critical control systems with extremely high safety requirements, the weight of version consistency is usually set higher, emphasizing the importance of version compatibility and stability. In data analysis systems with high functional scalability requirements, the weight of semantic similarity is relatively higher, emphasizing functional matching and interface compatibility.

[0054] For example, in the component dependency analysis of relay protection equipment in a substation automation system, the version consistency weight is set to 0.7 and the semantic similarity weight is set to 0.3, highlighting the importance of version stability in safety-critical systems. For the dependency analysis of the load forecasting module in an energy management system, the semantic similarity weight is set to 0.6 and the version consistency weight is set to 0.4, placing greater emphasis on the matching degree of algorithm functions. The confidence score is calculated as a continuous value from 0 to 1; the closer the score is to 1, the higher the confidence level of the dependency, while a score closer to 0 indicates that the dependency may be erroneous or mismatched.

[0055] In one alternative implementation, the weighting parameters can be adjusted based on the component type. Different functional types of components have varying sensitivities to semantic matching and version compatibility; communication protocol components prioritize version compatibility, while data processing components focus more on functional compatibility. A mapping relationship between component types and weighting parameters is established, and appropriate weight configurations are automatically selected based on the component types participating in the calculation.

[0056] S300: Determine the noise filtering threshold based on the confidence score, filter out dependency edges below the noise filtering threshold, and generate a filtered dependency graph.

[0057] Determining the noise filtering threshold in step S300 includes steps B1 to B3:

[0058] Step B1: Calculate the statistical distribution of confidence scores for all dependency edges in the initial dependency graph.

[0059] Statistical distribution calculation performs a comprehensive data analysis on all dependency edge confidence scores obtained in step S200. The calculation process includes determining statistical indicators such as the mean, standard deviation, median, quartiles, and extreme values ​​of the confidence scores. Frequency distribution histograms and cumulative probability distribution curves of the confidence scores are plotted to identify the central tendency and dispersion characteristics of the scores. Statistical distribution analysis can reveal the difference patterns in confidence scores between normal and abnormal dependencies, providing a quantitative data basis for subsequent threshold setting.

[0060] Normal component dependencies typically exhibit high confidence scores because genuine dependencies demonstrate good semantic matching and version compatibility. In contrast, spurious dependencies resulting from configuration errors, version conflicts, or false positives tend to have lower confidence scores. Statistical analysis can identify the normal distribution range and outlier ranges of confidence scores, providing a criterion for noise identification.

[0061] In one alternative implementation, statistical distribution analysis can employ kernel density estimation to improve analytical accuracy. Kernel density estimation generates a smooth, continuous probability density curve of confidence scores by selecting an appropriate kernel function and bandwidth parameter. Compared to traditional histogram analysis, kernel density estimation is more robust to outliers in the data and provides a more accurate description of the distribution characteristics. The probability density curve can more accurately identify multimodal distribution patterns of confidence scores and distinguish the distribution characteristics of different types of dependencies.

[0062] In another alternative implementation, a hierarchical statistical analysis method can be used to address the differences in confidence distribution among different subsystems. The initial dependency graph is grouped according to the functional modules of the power system, and the confidence statistical characteristics of the dependencies within the control, monitoring, and communication subsystems are calculated separately. Differences in component types and dependency patterns among different subsystems result in different statistical characteristics in their confidence distributions. Hierarchical analysis can provide a more accurate statistical basis for different subsystems, supporting the formulation of differentiated noise filtering strategies.

[0063] In another alternative implementation, statistical analysis can be combined with time series data for dynamic distribution modeling. Dependency data at different stages of system operation is collected, and the trend of confidence score distribution over time is analyzed. Events such as system upgrades, configuration changes, and component updates can affect the confidence distribution characteristics of dependencies. Dynamic distribution modeling can identify the impact of system evolution on the confidence distribution, providing time-dimensional reference information for adaptive threshold adjustment.

[0064] Step B2: Set the first noise tolerance parameter and the second noise tolerance parameter according to the requirements for safe and stable operation of the power system. The first noise tolerance parameter corresponds to the control subsystem that directly affects the power grid dispatch, and the second noise tolerance parameter corresponds to the monitoring subsystem that assists in the operation of the power grid.

[0065] The requirements for the safe and stable operation of a power system dictate the differentiated accuracy requirements for dependencies among different functional subsystems. The control subsystem includes core functional modules that directly affect the grid's operational status, such as generator control, transmission line dispatching, substation automation, and distribution network management. Any failure in the control subsystem can lead to serious consequences such as grid frequency fluctuations, voltage instability, or power outages; therefore, the accuracy requirements for component dependencies are extremely stringent. The monitoring subsystem includes supporting functional modules such as status monitoring, data acquisition, historical data storage, and operational report generation, primarily undertaking auxiliary functions for information collection, analysis, and display.

[0066] The setting of the first noise tolerance parameter follows the N-1 safety criterion and stable operation standard of the power system. The N-1 criterion requires that the system can maintain safe and stable operation even under the failure of any single device; therefore, the control subsystem must have extremely high reliability. The first noise tolerance parameter is typically set to 0.5 to 1.0 times the standard deviation of the statistical distribution, ensuring that only high-confidence dependencies are preserved. The second noise tolerance parameter considers the functional characteristics of the monitoring subsystem and the scope of fault impact, allowing for moderate data uncertainty to maintain the monitoring coverage of the system. The second noise tolerance parameter is set to 1.0 to 2.0 times the standard deviation of the statistical distribution, maintaining good data integrity while ensuring basic accuracy.

[0067] For example, in a load distribution control module of a dispatch automation system, the first noise tolerance parameter is set to 0.8 standard deviations to strictly control the reliability of dependencies and ensure the accurate execution of dispatch instructions. In a power quality monitoring system, the second noise tolerance parameter is set to 1.5 standard deviations to maintain the coverage integrity of monitoring points while ensuring the basic reliability of monitoring data. Parameter settings need to comprehensively consider multiple factors such as system security, operating efficiency, and maintenance costs.

[0068] In one alternative implementation, the noise tolerance parameter can be dynamically adjusted based on the power grid operating status. During normal power grid operation, the noise tolerance can be appropriately relaxed to improve the comprehensiveness of system analysis. During power grid fault handling or critical operation execution, the noise tolerance should be tightened to ensure the accuracy of critical decisions. The dynamic adjustment mechanism is based on power grid operating mode identification and risk level assessment, automatically adjusting parameter values ​​through real-time monitoring of power grid status indicators.

[0069] In another alternative implementation, a parameter optimization mechanism based on historical fault data can be established. Historical fault cases and dependency analysis results from the power system are collected to analyze the impact of different noise tolerance parameter settings on fault prediction accuracy. Statistical analysis identifies the optimal parameter configuration, finding the best balance between false alarm rate and false negative rate. Historical data-driven parameter optimization can improve the actual effect of noise filtering and reduce analytical bias caused by improper parameter settings.

[0070] Step B3: Calculate the noise filtering threshold based on the mean and standard deviation of the statistical distribution, combined with the first noise tolerance parameter or the second noise tolerance parameter.

[0071] The noise filtering threshold calculation combines the statistical distribution characteristics obtained in step B1 with the noise tolerance parameter determined in step B2. For dependencies in the control subsystem, the threshold is determined by multiplying the statistical distribution mean minus the standard deviation by the first noise tolerance parameter. For dependencies in the monitoring subsystem, the threshold is determined by multiplying the statistical distribution mean minus the standard deviation by the second noise tolerance parameter. The calculated threshold serves as the criterion for retaining and removing dependency edges; dependency edges with confidence scores below the corresponding threshold are identified as noise dependencies and removed from the initial dependency graph.

[0072] The filtered dependency graph retains high-confidence genuine dependencies, effectively eliminating spurious dependencies caused by configuration errors, version mismatches, feature conflicts, or data collection errors. The filtering process also includes graph connectivity verification to ensure that critical components remain connected through valid dependency paths after filtering. If the filtering operation causes important functional modules to become isolated nodes, the rationality of the threshold setting needs to be reassessed, or alternative connection paths need to be found.

[0073] For example, assume the initial dependency graph has a mean confidence score of 0.75 and a standard deviation of 0.15. For a scheduling control system, with a first noise tolerance parameter set to 0.8, the noise filtering threshold for the control subsystem is calculated as 0.75 - (0.15 × 0.8), resulting in 0.63. For a condition monitoring system, with a second noise tolerance parameter set to 1.5, the noise filtering threshold for the monitoring subsystem is calculated as 0.75 - (0.15 × 1.5), resulting in 0.525. Control system dependency edges with confidence scores below 0.63 and monitoring system dependency edges with confidence scores below 0.525 will be filtered out and removed.

[0074] S400: Based on the filtered dependency graph, a graph neural network is used to calculate the propagation of component risks and output the risk propagation value of each component.

[0075] Based on the filtered dependency graph, a graph neural network is used to calculate the risk propagation of components, outputting the risk propagation value for each component. The risk propagation calculation of the graph neural network includes steps C1 to C3:

[0076] Step C1: Construct a multi-layer graph convolutional network. Each layer of the graph convolutional network updates the hidden state representation of the current node based on the features of neighboring nodes and edge weights.

[0077] The multi-layer graph convolutional network uses the filtered dependency graph generated in step S300 as its input structure. Each component node contains an initial feature vector, and each retained dependency edge contains corresponding weight information. The graph convolution operation updates the hidden state representation of the current node by aggregating the feature information of neighboring nodes. The first graph convolutional layer processes the basic feature information of the components, including component type identifier, version number encoding, functional description vector, and deployment location information. Subsequent graph convolutional layers gradually aggregate the feature information of more distant neighboring nodes, learning the indirect dependencies between components and the multi-hop risk propagation path.

[0078] The specific computation process of each graph convolution layer is divided into two core stages: message passing and feature aggregation. In the message passing stage, each component node sends feature messages to its directly connected neighbor nodes. The message content is determined based on the sending node's current hidden state and the weights of the connecting edges. Message computation uses a combination of linear transformations and nonlinear activation functions to map node features to the message space. In the feature aggregation stage, each node collects incoming messages from all neighbor nodes and performs feature fusion through summation, averaging, or maximization operations to generate an updated representation of the node's hidden state.

[0079] For example, for a relay protection device component in a substation automation system, its initial feature vector includes device type code, firmware version information, protection function description, and installation location identifier. In the first layer of graph convolution, the relay protection device receives feature messages from communication components, data acquisition components, and control logic components. The communication component transmits network protocol compatibility information, the data acquisition component transmits sensor interface status information, and the control logic component transmits algorithm implementation feature information. The relay protection device weights and aggregates the received multi-source feature information, updating its implicit state representation to reflect dependencies with related components.

[0080] The design of the number of layers in a graph convolutional network (GCNN) needs to balance computational complexity and feature representation capability. Too few layers may fail to adequately capture the impact of long-distance dependencies, while too many layers can lead to over-smoothing of features and increased computational overhead. A typical GCNN structure uses 3 to 5 layers, which can effectively model multi-level dependencies between components in a power system. Residual connections and layer normalization techniques can be added between each layer to improve the stability and convergence performance of network training.

[0081] Step C2: Determine the propagation parameters based on the role level of the components in the power system operation, assign the first propagation parameter to the control system components that affect the safety and stability of the power grid, and assign the second propagation parameter to the data acquisition components that support the operation of the power grid.

[0082] The classification of component roles is based on their importance within the power system's functional architecture and the scope of their impact from failures. Control system components include core functional modules directly involved in grid control decision-making and execution, such as generator excitation control, transmission line protection, transformer voltage regulation control, load dispatch management, and fault isolation execution. Failures in control system components directly affect the grid's frequency stability, voltage regulation, power balance, and safety protection functions, potentially leading to cascading failures and widespread blackouts. Data acquisition components include supporting modules responsible for data collection, processing, and display, such as power measurement, condition monitoring, environmental sensing, historical data recording, and information display. Failures in data acquisition components primarily affect operational monitoring and analytical decision-making capabilities, and typically do not directly threaten the real-time safe operation of the power grid.

[0083] The first propagation parameter reflects the high-risk propagation capability and amplification effect of the control system components. Security vulnerabilities or functional defects in the control components can spread risk impacts throughout the power grid system through control commands and operational execution. The first propagation parameter value is typically set in the range of 1.2 to 1.5, indicating that the risk signals generated by the control components are moderately amplified during propagation. The second propagation parameter reflects the standard risk propagation capability of the data acquisition components. Problems with the data acquisition components mainly affect information quality and monitoring effectiveness, with a relatively limited risk propagation range. The second propagation parameter value is set in the range of 0.8 to 1.0, indicating that the risk impact of the data acquisition components propagates at a normal level or with slight attenuation.

[0084] For example, in the digital protection and control system of a 500 kV substation, the differential protection device of the main transformer is assigned a first propagation parameter of 1.3, reflecting its crucial role in the safe operation of the substation. Maloperation or failure to operate of the main transformer differential protection directly affects the safety and stability of the power grid; the risk impact needs to be amplified to reflect its severity. The power quality monitoring device of the same substation is assigned a second propagation parameter of 0.9, reflecting its role as a monitoring support function. Failure of the power quality monitoring device does not directly endanger power grid safety, but it does affect the accurate understanding of the operating status and the formulation of optimization decisions.

[0085] The allocation of propagation parameters also needs to consider the degree of functional coupling and substitutability between components. Components with redundant backups can have their propagation parameter values ​​appropriately reduced, while single-point critical components without backup schemes should have their propagation parameter values ​​increased. The setting of propagation parameters needs to be comprehensively determined based on the actual operating experience of the power system, historical failure case analysis, and risk assessment results to ensure that the risk propagation calculation results can accurately reflect the actual differences in importance of each component.

[0086] Step C3: Obtain the stable risk propagation value of each component through iterative calculation.

[0087] The iterative computation process, through multiple rounds of message passing and feature update operations, gradually converges the implicit state representations of each component node to a stable risk propagation value. In the initial iteration phase, the risk value of each component node is primarily determined based on its own security state and vulnerability information. Components with known security vulnerabilities are assigned higher initial risk values, while components that have undergone security verification have lower initial risk values. In subsequent iterations, the risk value of a node is influenced by the risk states of its neighboring nodes; high-risk components propagate risk signals to their associated components through dependencies.

[0088] The risk propagation mechanism employs a weighted summation approach. Each node calculates the weighted sum of the risks of its neighbors in each iteration, with weights determined by the confidence scores of dependent edges and propagation parameters. The intensity of risk propagation gradually decreases with increasing dependency path length, but components located on critical propagation paths are still significantly affected by the risk. The iterative process continues until the change in risk values ​​for all nodes is less than a preset convergence threshold, typically set to an absolute change in risk value between two consecutive iterations of less than 0.001.

[0089] For example, consider the energy management system of a regional power grid dispatch center. The system includes a real-time database component, a load forecasting algorithm component, a security analysis and calculation component, and a human-machine interface component. Assume the real-time database component has an SQL injection vulnerability, with an initial risk value of 0.8. In the first iteration, the load forecasting algorithm component, which relies on the real-time database, receives risk propagation, and its risk value increases from the initial 0.1 to 0.3. The security analysis and calculation component, due to its reliance on load forecasting results, experiences a risk value increase from 0.2 to 0.4 in the second iteration. The human-machine interface component, as an information display module, is relatively less affected by the risk, with its risk value increasing from 0.1 to 0.15. After five iterations, the risk values ​​of each component tend to stabilize: the real-time database remains at 0.8, the load forecasting algorithm stabilizes at 0.35, the security analysis and calculation stabilizes at 0.45, and the human-machine interface stabilizes at 0.18.

[0090] The stable risk propagation value comprehensively reflects the security status of a component and the degree of risk exposure at its network location. Components with direct security vulnerabilities maintain a higher risk value, while components connected through multi-level dependencies receive varying degrees of risk impact depending on the propagation path and intensity. The final risk propagation value provides a quantitative assessment basis for subsequent risk rating and security decisions, helping operations personnel identify high-risk components that require priority attention and handling, as well as their impact scope.

[0091] S500: Extract the code feature vector, security feature vector, and power industry context feature vector of each component respectively.

[0092] The extraction of code feature vectors in step S500 includes steps D1 to D3:

[0093] Step D1: Parse the program interface information of the component and extract function call relationships and API dependency patterns.

[0094] Program interface information parsing is achieved through a combination of static code analysis and interface documentation parsing. Static code analysis tools scan the component's source code files, header files, and interface definition files, identifying function declarations, method signatures, and API call statements. The parsing process extracts interface characteristic information such as function names, parameter types, return value types, and call paths. Function call relationship analysis constructs a call graph structure, recording direct and indirect call relationships between functions. API dependency pattern identification identifies the component's usage patterns of external library functions, system calls, and third-party service interfaces.

[0095] Interface resolution primarily involves the interface calls related to the core functions of the power system. Power system components typically include specific types of API calls, such as data acquisition interfaces, control command interfaces, communication protocol interfaces, and human-machine interface interfaces. Data acquisition interfaces are responsible for acquiring real-time data from sensors, smart meters, and monitoring equipment. Control command interfaces are used to send operating commands to circuit breakers, voltage regulators, and protection devices. Communication protocol interfaces enable information exchange and coordination between different devices. Human-machine interface interfaces provide monitoring and operational functions for maintenance personnel.

[0096] For example, in a substation automation system's data acquisition component, interface parsing identifies function calls related to the IEC 61850 communication standard, including key interfaces such as `IedConnection_create` for establishing device connections, `IedConnection_readDataObjectValue` for reading data object values, and `ClientReportControlBlock_setCallback` for setting report callbacks. It also identifies function calls related to the Modbus protocol, such as `modbus_new_tcp` for creating TCP connections and `modbus_read_registers` for reading register data. Interface call analysis confirms that this component possesses multi-protocol communication capabilities and data acquisition functions.

[0097] API dependency pattern analysis employs graph theory algorithms to construct a function call dependency graph, identifying function nodes and call paths. By calculating the in-degree and out-degree of function nodes, it identifies frequently called core functions and control functions that call other functions extensively. Dependency pattern analysis also includes call depth analysis, calculating the longest call path from the entry function to a leaf function, reflecting the component's functional complexity and hierarchical structure.

[0098] Step D2: Count the call frequency of the power communication protocol interface in the function call relationship. The power communication protocol interface includes the substation communication interface and the power grid dispatch communication interface.

[0099] The identification of power communication protocol interfaces is based on matching the function naming rules and interface characteristics of power industry standard protocols. Substation communication interfaces mainly include manufacturing message specifications, general object-oriented substation events, and sampled value transmission protocol interfaces defined by the IEC 61850 standard. IEC 61850 interface functions are typically named with prefixes such as Ied, Mms, Goose, and SampledValues ​​to achieve standardized communication between substation equipment. Power grid dispatch communication interfaces mainly include remote terminal unit communication protocols such as IEC 60870-5-101, IEC 60870-5-104, and DNP3, as well as information exchange interfaces related to CIM models.

[0100] Call frequency statistics employ a combination of code execution path analysis and runtime monitoring. Static analysis traverses all possible code execution paths to calculate the theoretical number of calls for each protocol interface function under different execution scenarios. Runtime monitoring inserts monitoring code at key function entry points to record the function call frequency and call patterns during actual operation. Call frequency data includes statistical indicators such as average call frequency, peak call frequency, and call time distribution.

[0101] For example, statistical analysis of real-time data exchange components in an energy management system revealed that the IEC 61850 related interfaces are called 150 times per second, primarily for data object reading and event reporting. The DNP3 protocol interface is called 80 times per second, mainly for data acquisition from remote terminal units and the issuance of control commands. The CIM model interface is called 20 times per minute, primarily for updating grid topology information and synchronizing equipment models. Call frequency analysis can identify the main communication load and protocol preferences of the components.

[0102] The distinction between substation communication interfaces and power grid dispatch communication interfaces is based on their communication range and functional purpose. Substation communication interfaces primarily serve information exchange between devices within a single substation; their communication range is relatively limited, but real-time requirements are high. Power grid dispatch communication interfaces primarily serve remote communication between the dispatch center and multiple substations; their communication range is wide, but they can tolerate a certain degree of transmission delay. The frequency of use of different interface types reflects the functional positioning and scope of the component within the power system.

[0103] Step D3: Convert call frequency and API dependency patterns into numerical feature representations to generate code feature vectors.

[0104] Numerical feature transformation converts the qualitative descriptive information obtained in steps D1 and D2 into a numerical vector format that can be processed by machine learning algorithms. Call frequency features are normalized, mapping the call frequencies of different protocol interfaces to a numerical range of 0 to 1, eliminating the impact of differences in call magnitude between different components. API dependency pattern features employ graph embedding algorithms, converting the function call graph into a fixed-dimensional vector representation. Commonly used graph embedding methods include node-2 vectors, graph convolutional networks, and random walk algorithms.

[0105] The code feature vector is constructed using a block-based concatenation approach, combining different types of features into a unified vector representation. The feature vector typically includes components such as protocol interface frequency feature blocks, function call pattern feature blocks, and code complexity feature blocks. The protocol interface frequency feature block records the standardized call frequencies of various power communication protocols. The function call pattern feature block uses a graph embedding algorithm to convert the call relationship graph into a fixed-length numerical vector. The code complexity feature block includes quantitative indicators such as the number of lines of code, the number of functions, call depth, and loop complexity.

[0106] For example, the code feature vector construction process of a certain power quality monitoring component is as follows: The protocol interface frequency feature block includes values ​​such as IEC 61850 interface call frequency (0.75), Modbus interface call frequency (0.45), and DNP3 interface call frequency (0.20). The function call pattern feature block uses a node-2 vector algorithm to convert the call graph containing 120 function nodes into a 128-dimensional embedding vector. The code complexity feature block includes indicators such as normalized code lines (0.60), number of functions (0.55), maximum call depth (0.40), and cyclomatic complexity (0.50). The final code feature vector dimension is the protocol interface feature dimension plus the graph embedding vector dimension plus the complexity feature dimension, typically a high-dimensional vector of 150 to 200 dimensions.

[0107] Eigenvector standardization ensures that the eigenvalues ​​of different components are within the same numerical range, preventing certain features from dominating subsequent analysis due to their larger values. Standardization methods can include min-max standardization, zero-mean standardization, or quantile standardization. The standardized code eigenvectors serve as the numerical representation of components at the code level, used for subsequent feature fusion and risk assessment calculations.

[0108] The extraction of the security feature vector in step S500 includes steps E1 to E3:

[0109] Step E1: Obtain the vulnerability database records of the component. The vulnerability database records include the CVE numbers and corresponding CVSS scores that affect the operational safety of the power system.

[0110] Access to vulnerability database records is achieved by querying the National Vulnerability Database, the General Vulnerability Disclosure Database, and the Power Industry-Specific Security Database. The National Vulnerability Database provides officially recognized security vulnerability information, including detailed vulnerability descriptions, impact scope, and remediation recommendations. The General Vulnerability Disclosure Database includes publicly disclosed software vulnerabilities globally, offering broad coverage, but requires filtering for records related to the power system. The Power Industry-Specific Security Database collects and organizes information on security issues specific to power control systems, communication protocols, and specialized equipment.

[0111] The CVE number serves as a unique identifier for a vulnerability, providing standardized naming and classification. Each CVE record contains basic information such as the vulnerability discovery time, affected products, vulnerability type, and severity. The CVSS scoring system quantitatively assesses vulnerabilities from three dimensions: exploitability, impact, and environmental factors, generating a numerical score from 0 to 10. A higher CVSS score indicates a more severe vulnerability, requiring priority for handling and remediation.

[0112] For example, for a power system component based on the OpenSSL encryption library, a vulnerability database query revealed CVE-2022-0778 (a memory leak vulnerability related to the TLS handshake), with a CVSS score of 7.5, classifying it as a high-risk vulnerability. This vulnerability allows attackers to cause server memory leaks by crafting special TLS handshake packets, potentially exposing sensitive power grid operation data. Simultaneously, a buffer overflow vulnerability, CVE-2021-3711, was discovered, with a CVSS score of 9.8, classifying it as a critical vulnerability that could lead to remote code execution and complete system control. Vulnerability database queries provide a comprehensive understanding of the security threats and risk levels faced by the component.

[0113] Vulnerability data screening requires precise matching based on the actual usage environment and configuration of the components. Different versions of the same software may have different vulnerability distributions, necessitating precise searching based on specific version numbers. The exploitability of vulnerabilities is also related to the system's network environment, access control, and protection measures, requiring risk assessment based on the actual deployment.

[0114] Step E2: Extract the impact level of the vulnerability on power grid business continuity and the vulnerability remediation status identifier from the vulnerability database records.

[0115] The assessment of the continuity impact level of power grid operations is based on the scope and duration of potential service disruptions caused by vulnerabilities. Impact levels are typically categorized into three levels: system-level impact, regional impact, and local impact. System-level impact refers to vulnerabilities that could lead to the disruption of the entire power grid system's operation or pose a security threat, such as the paralysis of the dispatching system or the failure of the protection system. Regional impact refers to vulnerabilities affecting the power supply or equipment operation in a specific area, such as substation communication disruptions or distribution network failures. Local impact refers to vulnerabilities that only affect the normal operation of a single device or functional module and do not have serious consequences for the overall system.

[0116] The vulnerability remediation status indicates the current progress of vulnerability resolution and available remediation solutions. Remediation statuses include categories such as "Remediated," "In Progress," "Planned," and "No Remediation Solution." A "Remediated" status indicates that the software vendor has released a security patch or update, and users can resolve the security issue by upgrading. A "Planned" status indicates that the vendor is developing a remediation solution but has not yet officially released it. A "Planned" status indicates that the vendor has confirmed the vulnerability and plans to fix it in a subsequent version. A "No Remediation Solution" status indicates that there is currently no effective remediation method for the vulnerability, and other security measures are needed for protection.

[0117] For example, the impact level of the aforementioned CVE-2022-0778 vulnerability on power grid business continuity is assessed as regional, because this vulnerability could lead to the eavesdropping of encrypted communications between substations and dispatch centers, affecting the power grid monitoring and control capabilities in certain areas. The vulnerability's remediation status is marked as fixed, and OpenSSL has released version 1.1.1w to fix it. The impact level of the CVE-2021-3711 buffer overflow vulnerability is assessed as system-level, because remote code execution could potentially gain complete control of critical power equipment, threatening the safe and stable operation of the entire power grid.

[0118] Impact level assessment also needs to consider the technical difficulty and required conditions for exploiting vulnerabilities. Vulnerabilities with low technical difficulty and simple exploitation conditions pose a higher actual threat and should be given a higher impact level assessment. Impact level assessment needs to be comprehensively judged in conjunction with the actual architecture and security protection measures of the power system to ensure that the assessment results can accurately reflect the actual risk level of the vulnerability.

[0119] Step E3: Numerically encode the impact level and vulnerability remediation status identifiers to generate a security feature vector reflecting the security risks of the power system.

[0120] The numerical coding process converts qualitative impact levels and remediation status information into quantitative numerical representations. Impact level coding uses ordinal coding: local impact is coded as 1, regional impact as 2, and system-level impact as 3, with higher values ​​indicating more severe impact. Vulnerability remediation status coding considers the timeliness and effectiveness of remediation: 1 for remediated, 2 for remediation in progress, 3 for planned remediation, and 4 for no remediation plan, with higher values ​​indicating higher security risk.

[0121] The security feature vector is constructed using a multi-dimensional comprehensive coding approach, integrating multiple security indicators such as CVSS score, impact level, remediation status, and vulnerability count. The CVSS score is used directly as a continuous numerical feature, reflecting the standardized severity of vulnerabilities. Impact level and remediation status are used as discrete classification features, converted into numerical vectors through one-hot encoding or ordinal encoding. The total number of security threats faced by the vulnerability count component is standardized through logarithmic transformation.

[0122] For example, the security feature vector of a power grid data acquisition component includes the following elements: the component has three known vulnerabilities with CVSS scores of 7.5, 9.8, and 4.2, respectively. The highest CVSS score of 9.8 is used as the severity feature, and the average CVSS score of 7.17 is used as the overall risk feature. The impact level includes one system-level impact and two regional-level impacts, with the highest impact level coded as 3. The impact level distribution is coded as 1 system-level, 2 regional-level, and 0 local-level. The remediation status includes two remediated and one in progress, with the remediation status coded as a remediation rate of 0.67 and an average remediation urgency of 1.33. The final security feature vector is a multivariate numerical vector containing dimensions such as the highest CVSS score, average CVSS score, total number of vulnerabilities, highest impact level, number of vulnerabilities at each level, remediation completion rate, and average remediation status.

[0123] Standardization of safety feature vectors ensures that different safety indicators participate in subsequent calculations with the same weight. Standardization methods need to consider the non-linear characteristics of safety risks; differences in high-risk values ​​are more significant than differences in low-risk values. Methods such as logarithmic standardization or piecewise linear standardization can be used to highlight the discriminative power of high-risk regions. The standardized safety feature vector serves as a numerical representation of the component's safety status, providing quantitative input for the safety dimension of comprehensive risk assessment.

[0124] S600: It integrates code feature vectors, security feature vectors, and power industry context feature vectors to generate a comprehensive risk vector for components.

[0125] The code feature vector, security feature vector, and power industry context feature vector extracted in step S500 are fused to generate a comprehensive component risk vector. Feature fusion employs a weighted linear combination approach, assigning corresponding weight coefficients based on the importance of different feature dimensions in power system risk assessment. The code feature vector reflects the component's functional implementation and interface usage patterns, the security feature vector reflects the security threats and protection status faced by the component, and the power industry context feature vector reflects the component's business importance and operating environment characteristics within the power system.

[0126] The construction of contextual feature vectors in the power industry is based on the position and role of components within the power system's functional architecture. Contextual features include dimensions such as the component's business criticality, system hierarchy position, fault impact scope, and alternative availability. Business criticality assesses the component's contribution to the core business functions of the power system, including key business areas such as generation control, transmission and distribution management, customer services, and security protection. System hierarchy position identifies the component's level within the power system architecture, including different levels such as the physical equipment layer, communication network layer, data processing layer, and application service layer. Fault impact scope assesses the system's potential impact and the number of users affected by a component failure. Alternative availability assesses the system's backup capacity and recovery methods in the event of a component failure.

[0127] For example, for a real-time database component in a dispatch automation system, its power industry context feature vector is constructed as follows: Business criticality score is 0.9, because the real-time database is the fundamental data source for power grid status monitoring and dispatch decisions. System hierarchical location is encoded as the data processing layer, with a hierarchy importance weight of 0.8. Fault impact scope assessment is regional impact, with an impact scope encoding of 0.7. Alternative availability assessment is partial backup, with an availability encoding of 0.6. The context feature vector also includes deployment environment characteristics, such as security environment indicators like network isolation level (0.8), access control strength (0.9), and monitoring coverage (0.7).

[0128] Feature fusion calculation employs three weight matrices to linearly transform the code feature vector, security feature vector, and context feature vector, respectively, and then the transformation results are weighted and summed. The weight matrix design considers the correlation and complementarity between features to avoid information redundancy and feature conflicts. The weight of code features is typically set to 0.3, the weight of security features to 0.4, and the weight of context features to 0.3. The specific weight allocation is determined based on risk assessment experience and historical data analysis of power systems. The fused comprehensive risk vector typically has 80 to 120 dimensions, encompassing comprehensive risk characteristics of components across three dimensions: code implementation, security status, and business environment.

[0129] S700: Determine the risk rating of each component based on the risk propagation value and the component's comprehensive risk vector.

[0130] The determination of risk rating in step S700 includes steps F1 and F2:

[0131] Step F1: Set a first risk threshold and a second risk threshold according to the N-1 safety criteria of the power system and the reliability requirements of power grid operation. The first risk threshold corresponds to the identification criteria for high-risk components that cause power grid failures, and the second risk threshold corresponds to the identification criteria for medium-risk components that affect the local operation of the power grid.

[0132] The N-1 safety principle for power systems requires that the power grid maintain safe and stable operation even under the fault of any single device or line, without cascading failures or large-scale blackouts. Based on the N-1 safety principle, setting the first risk threshold requires identifying critical components where single-point failures could disrupt system safety and stability. High-risk components leading to grid failures typically include control systems of key main grid equipment, regional grid dispatching systems, protection systems of important substations, and communication systems of inter-regional interconnections. Failures in these components can trigger cascading effects, impacting widespread power supply and system stability.

[0133] Power grid reliability requirements ensure that the power system can continuously and stably supply electricity to users, meeting power quality standards and power supply continuity indicators. Setting a second risk threshold requires identifying components whose failures may affect local power grid operation but do not jeopardize the overall system security. Medium-risk components affecting local power grid operation include monitoring equipment in individual substations, automation devices in the distribution network, metering systems on the user side, and support equipment for auxiliary functions. Failures in these components primarily affect the power supply quality and operational efficiency of local areas; basic power services can be maintained through backup equipment and emergency measures.

[0134] The first risk threshold is typically set at the 90th quantile of the risk score distribution, ensuring that only the top 10% of components with the highest risk levels are identified as high-risk. The second risk threshold is set at the 70th quantile of the risk score distribution, identifying components with above-average risk levels as medium-risk. Threshold settings need to be calibrated in conjunction with actual operating experience of the power system and historical fault statistics to ensure that the risk classification results match the actual impact of faults.

[0135] For example, based on historical operational data analysis of a regional power grid, the risk scores of all components in the system range from 0.1 to 0.95. By analyzing historical failure cases and their impact, a first risk threshold of 0.75 is set, corresponding to critical components that require the activation of emergency plans and external support after a failure. A second risk threshold of 0.55 is set, corresponding to generally important components whose failures can be resolved through internal adjustments and backup equipment. The threshold setting also needs to consider the impact of seasonal variations and load level changes on risk assessment.

[0136] Step F2: Based on the risk propagation value and the component's comprehensive risk vector, and combined with the potential impact of component failure on the safe operation of the power grid, calculate the power system risk score of the component.

[0137] The power system risk scoring calculation integrates risk information from three dimensions: the risk propagation value from step S400, the component comprehensive risk vector from step S600, and the component failure impact level. The risk propagation value reflects the risk exposure level and propagation range of a component within its dependent network. The component comprehensive risk vector reflects the component's own technical risks and safety status. The failure impact level assesses the direct and indirect consequences of component failures on grid operation.

[0138] The potential impact of component failures on grid safety is assessed using Failure Mode and Effects Analysis (FMEA). Typical failure modes of components are analyzed, including different types of failures such as functional failure, performance degradation, misoperation, and exploitation of security vulnerabilities. The impact path and intensity of each failure mode on grid operation are evaluated, considering time factors such as failure probability, detection time, isolation time, and recovery time. The impact assessment also needs to consider the system operating conditions at the time of the failure, such as load levels, weather conditions, equipment maintenance status, and operating modes.

[0139] The power system risk score is calculated using a weighted summation method. The risk propagation value has a weight of 0.4, the comprehensive risk vector has a weight of 0.4, and the fault impact score has a weight of 0.2. The calculation formula is: Power system risk score = 0.4 times the risk propagation value + 0.4 times the vector norm of the comprehensive risk vector + 0.2 times the fault impact score. The weight allocation considers the importance and reliability of different risk dimensions. The risk propagation value and comprehensive risk vector, as the main risk indicators, receive higher weights, while the fault impact score, as an auxiliary correction factor, receives lower weights.

[0140] For example, the power system risk score calculation process for a relay protection device in a 110 kV substation is as follows: The risk propagation value of the device is 0.68, reflecting its important position in the protection system's dependent network. The L2 norm of the comprehensive risk vector is 0.72, comprehensively reflecting the code complexity of the protection algorithm, known security vulnerabilities, and business criticality. The fault impact score is 0.80, reflecting the serious impact of the protection device's malfunction or failure to operate on the safe operation of the substation. The final power system risk score is calculated as 0.4 multiplied by 0.68, plus 0.4 multiplied by 0.72, plus 0.2 multiplied by 0.80, resulting in 0.72.

[0141] When the power system risk score exceeds the first risk threshold, the component is marked as high risk; when the power system risk score is between the second risk threshold and the first risk threshold, the component is marked as medium risk; when the power system risk score is below the second risk threshold, the component is marked as low risk.

[0142] Risk rating classification is determined based on a comparison of the power system risk score with preset thresholds. High-risk components are those with risk scores exceeding the first risk threshold. These components pose a high level of security threat or functional defects, and their failures could severely impact the safe and stable operation of the power grid. High-risk components require priority for security hardening, vulnerability patching, or functional upgrades, and, if necessary, the development of specific emergency plans and backup measures. Medium-risk components are those with risk scores between the first and second risk thresholds. These components have certain security vulnerabilities or performance issues, but under normal circumstances, they will not pose a fatal threat to the overall system security. Low-risk components are those with risk scores below the second risk threshold. These components are in relatively good safety condition, and their failures have a limited impact; they can be managed through routine maintenance and monitoring.

[0143] Risk rating results provide crucial information for power system safety management and operation and maintenance decisions. High-risk components should be included as key monitoring targets, with increased inspection frequency and condition monitoring density, and priority given to safety assessments and vulnerability remediation. Medium-risk components should undergo regular safety inspections and performance assessments to promptly identify and address potential issues. Low-risk components can be managed according to routine maintenance plans, with a focus on long-term technological evolution and upgrade needs.

[0144] For example, based on the aforementioned threshold settings and risk score calculations, the relay protection device has a risk score of 0.72, which is lower than the first risk threshold of 0.75 but higher than the second risk threshold of 0.55, and is therefore marked as a medium-risk component. This device requires regular safety checks and functional tests, focusing on the correctness of the protection algorithm and the security of the communication interface, but no immediate emergency measures are needed. The real-time database component of the dispatch automation system has a risk score of 0.82, exceeding the first risk threshold, and is marked as a high-risk component, requiring immediate security hardening and vulnerability patching. The data acquisition terminal of the distribution automation system has a risk score of 0.45, lower than the second risk threshold, and is marked as a low-risk component, which can be managed according to the regular maintenance plan.

[0145] In summary, this invention effectively identifies and eliminates erroneous information in the dependencies between power system components through noise filtering based on confidence level assessment, thus addressing the problem of misjudging risk propagation paths in the power grid environment using traditional dependency analysis methods. By integrating multi-dimensional feature extraction methods that combine code feature vectors, security feature vectors, and power industry context feature vectors, it achieves deep security feature identification of power-specific software modules such as power communication protocol interfaces and substation control components, while also compensating for the insufficient applicability of general vulnerability assessment systems in the power sector. Based on a graph neural network-based risk propagation calculation model, combined with the N-1 security criterion of the power system and the reliability requirements of power grid operation, it achieves global propagation modeling and quantitative assessment of supply chain security risks in the component dependency network, thereby overcoming the limitations of traditional static risk analysis methods. By combining component risk ratings with the actual impact on the safe and stable operation of the power grid, a risk level classification standard conforming to the characteristics of power system operation is established, thereby realizing open-source software supply chain security risk assessment and continuity assurance of power business.

[0146] Example 3, referring to Figure 2 This is the third embodiment of the present invention, which provides an artificial intelligence-based digital power grid supply chain security risk assessment system, comprising:

[0147] The data acquisition module is used to acquire dependency data of open-source components of the digital power grid system and construct an initial dependency graph;

[0148] The confidence score calculation module is used to calculate the confidence score for each dependency edge in the initial dependency graph.

[0149] The graph filtering module is used to determine the noise filtering threshold based on the confidence score, filter out dependency edges below the noise filtering threshold, and generate a filtered dependency graph.

[0150] The risk propagation module is used to calculate the propagation of component risks based on the filtered dependency graph using a graph neural network, and outputs the risk propagation value of each component.

[0151] The feature extraction module is used to extract the code feature vector, security feature vector, and power industry context feature vector of each component respectively.

[0152] The feature fusion module is used to fuse code feature vectors, security feature vectors, and power industry context feature vectors to generate a comprehensive risk vector for the component.

[0153] The risk rating module is used to determine the risk rating of each component based on the risk propagation value and the component's comprehensive risk vector.

[0154] Example 4, refer to Figure 3This is the fourth embodiment of the present invention, which differs from the previous three embodiments in that: if the function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0155] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, a computer-readable medium can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0156] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0157] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0158] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for assessing the security risks of a digital power grid supply chain based on artificial intelligence, characterized in that: include, Obtain dependency data of open-source components of the digital power grid system and construct an initial dependency graph; Calculate a confidence score for each dependency edge in the initial dependency graph; Based on the confidence score, a noise filtering threshold is determined, and dependency edges below the noise filtering threshold are filtered to generate a filtered dependency graph. Based on the filtered dependency graph, a graph neural network is used to calculate the risk propagation of components and output the risk propagation value of each component. Extract the code feature vector, security feature vector, and power industry context feature vector for each component; The code feature vector, the security feature vector, and the power industry context feature vector are fused to generate a comprehensive component risk vector; Based on the risk propagation value and the component comprehensive risk vector, the risk rating of each component is determined.

2. The method for assessing the security risks of a digital power grid supply chain based on artificial intelligence as described in claim 1, characterized in that: The confidence score is determined based on the semantic similarity and version consistency between components, specifically: Calculate the semantic similarity between components, which is determined based on the vectorized representation of the component functional description text; Calculate the version consistency between components, which is determined based on the compatibility and matching degree of component version numbers; The semantic similarity and version consistency are linearly combined based on the first weighting parameter and the second weighting parameter to obtain the confidence score.

3. The method for assessing the security risks of a digital power grid supply chain based on artificial intelligence as described in claim 2, characterized in that: The determination of the noise filtering threshold includes: Calculate the statistical distribution of the confidence scores of all dependency edges in the initial dependency graph; A first noise tolerance parameter and a second noise tolerance parameter are set according to the requirements for safe and stable operation of the power system. The first noise tolerance parameter corresponds to the control subsystem that directly affects power grid dispatch, and the second noise tolerance parameter corresponds to the monitoring subsystem that assists in the operation of the power grid. The noise filtering threshold is calculated based on the mean and standard deviation of the statistical distribution, combined with the first noise tolerance parameter or the second noise tolerance parameter.

4. The method for assessing the security risks of a digital power grid supply chain based on artificial intelligence as described in claim 3, characterized in that: The risk propagation calculation of the graph neural network includes: Construct a multi-layer graph convolutional network, where each layer updates the hidden state representation of the current node based on the features of neighboring nodes and edge weights; The propagation parameters are determined based on the role level of the components in the power system operation. The first propagation parameter is assigned to the control system components that affect the safety and stability of the power grid, and the second propagation parameter is assigned to the data acquisition components that support the operation of the power grid. The stable risk propagation value of each component is obtained through iterative calculation.

5. The method for assessing the security risks of a digital power grid supply chain based on artificial intelligence as described in claim 4, characterized in that: The extraction of the code feature vector includes: Parse the program interface information of the components and extract function call relationships and API dependency patterns; The frequency of calls to the power communication protocol interfaces in the function call relationships is statistically analyzed. The power communication protocol interfaces include substation communication interfaces and power grid dispatch communication interfaces. The call frequency and the API dependency pattern are converted into numerical feature representations to generate the code feature vector.

6. The method for assessing the security risks of a digital power grid supply chain based on artificial intelligence as described in claim 5, characterized in that: The extraction of the security feature vector includes: Obtain the vulnerability database records of the component, which include the CVE numbers and corresponding CVSS scores that affect the operational safety of the power system; Extract the impact level of the vulnerability on power grid business continuity and the vulnerability remediation status identifier from the vulnerability database records; The impact level and the vulnerability repair status identifier are numerically encoded to generate the security feature vector that reflects the security risks of the power system.

7. The method for assessing the security risks of a digital power grid supply chain based on artificial intelligence as described in claim 6, characterized in that: The determination of the risk rating includes: A first risk threshold and a second risk threshold are set according to the N-1 safety criteria of the power system and the reliability requirements of power grid operation. The first risk threshold corresponds to the identification criteria for high-risk components that cause power grid failures, and the second risk threshold corresponds to the identification criteria for medium-risk components that affect the local operation of the power grid. Based on the risk propagation value and the component's comprehensive risk vector, and combined with the potential impact of component failure on the safe operation of the power grid, the power system risk score of the component is calculated. When the power system risk score exceeds the first risk threshold, the component is marked as high risk; When the power system risk score is between the second risk threshold and the first risk threshold, the component is marked as medium risk; When the power system risk score is lower than the second risk threshold, the component is marked as low risk.

8. An artificial intelligence-based digital power grid supply chain security risk assessment system, employing the artificial intelligence-based digital power grid supply chain security risk assessment method as described in any one of claims 1 to 7, characterized in that, include: The data acquisition module is used to acquire dependency data of open-source components of the digital power grid system and build an initial dependency graph; The confidence calculation module is used to calculate a confidence score for each dependency edge in the initial dependency graph; The graph filtering module is used to determine a noise filtering threshold based on the confidence score, filter out dependency edges below the noise filtering threshold, and generate a filtered dependency graph. The risk propagation module is used to perform component risk propagation calculations based on the filtered dependency graph using a graph neural network, and output the risk propagation value of each component. The feature extraction module is used to extract the code feature vector, security feature vector, and power industry context feature vector of each component respectively. The feature fusion module is used to fuse the code feature vector, the security feature vector, and the power industry context feature vector to generate a comprehensive component risk vector; The risk rating module is used to determine the risk rating of each component based on the risk propagation value and the component comprehensive risk vector.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the artificial intelligence-based digital power grid supply chain security risk assessment method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the artificial intelligence-based digital power grid supply chain security risk assessment method according to any one of claims 1 to 7.

Images