Method and system for cross-source safety intelligent monitoring and dynamic response of power system based on mimicry defense

Abstract

The invention provides an electric power system cross-source safety intelligent monitoring and dynamic response method and system based on mimicry defense, and relates to the technical field of electric power system network safety. According to the method, multi-source data are acquired by deploying an acquisition agent and a sensor and are encrypted and transmitted, parallel analysis and threat judgment are realized by utilizing a heterogeneous executor pool and dynamic scheduling, an attack chain is identified by combining cross-domain association modeling, disposal is performed according to grades, credible recovery is supported, and reinforcement learning and federated learning are assisted to optimize a strategy and resource allocation. And lightweight adaptation is realized through intensity control in a resource limited scene, a closed-loop safety system covering data acquisition, threat analysis, dynamic disposal and continuous evolution is formed, and the detection accuracy, response efficiency and robustness of a power system are improved.

Description

Technical Field

[0001] This invention relates to the field of power system network security technology, and in particular to a method and system for intelligent monitoring and dynamic response of cross-source security in power systems based on mimicry defense. Background Technology

[0002] With the rapid development of power systems towards digitalization and intelligence, their network architecture is becoming increasingly complex, and the types and number of connected devices are also increasing dramatically. While this trend improves the operational efficiency and flexibility of power systems, it also presents unprecedented cybersecurity challenges. Traditional power system security protection systems often focus on boundary protection and passive defense based on known threat characteristics, making it difficult to cope with increasingly rampant unknown vulnerabilities, advanced persistent threats (APTs), and complex attacks such as internal malicious behaviors. In particular, in new power systems, the interaction and linkage of modules such as sources, grids, loads, and storage, as well as the cross-domain flow of massive heterogeneous data, make security boundaries increasingly blurred and the attack surface continuously expanding. Therefore, building a new security defense system that can proactively adapt to dynamically changing security environments, intelligently perceive potential threats in cross-source heterogeneous data, and quickly make dynamic responses has become crucial to ensuring the safe and stable operation of power systems. Mimicry defense, as an emerging proactive defense technology, constructs a dynamic, heterogeneous, and redundant execution environment, making it difficult for attackers to launch effective attacks by exploiting the static nature and similarity of the system, providing a new approach to solving the above challenges.

[0003] Currently, the protection technologies used in the field of power system cybersecurity have ensured the operation of the system to a certain extent, but they still have many limitations and are difficult to cope with increasingly complex and intelligent cyberattacks.

[0004] Static threshold monitoring is a commonly used method in power system network security monitoring. This technology monitors indicators such as network traffic, device status, and user behavior by setting fixed thresholds. When the monitored data exceeds or falls below the preset threshold, the system issues an alarm. For example, in industrial internet security detection, security detection equipment extracts real-time traffic characteristics such as IP address, port, protocol type, signature, packet direction, packet length, packet quantity, and Uniform Resource Locator (URL), and matches these characteristics with a security detection rule set to determine if network attack behavior exists. The advantage of this method is its simplicity and intuitiveness, and it has a certain detection capability for known and easily identifiable attack behaviors. However, its disadvantages are also significant: First, threshold setting often relies on experience, making it difficult to adapt to complex and ever-changing network environments and attack methods, easily leading to false positives or false negatives; second, static thresholds cannot effectively deal with unknown attacks and advanced persistent threats (APTs) such as slow penetration, because these attacks often do not trigger obvious threshold alarms in a short period; third, attackers can bypass detection by carefully crafting attack payloads to keep their behavioral characteristics within the threshold range. Therefore, relying solely on static threshold monitoring technology is insufficient to meet the power system's demand for high-precision, high-real-time safety monitoring.

[0005] Traditional network security monitoring systems often employ a single data source analysis architecture, relying primarily on a specific type of data source for security analysis and threat assessment. For example, some systems may mainly analyze network traffic data, while others focus on host logs or security device alerts. In power systems, although the construction of multi-level network security management platforms is emphasized, the data fusion and collaborative analysis capabilities between different levels or different business systems still need to be strengthened at the implementation level. The limitation of a single data source analysis architecture lies in its narrow perspective, making it difficult to form a comprehensive and accurate understanding of the network security situation. Attackers often employ multi-stage, multi-method combined attack approaches, and their attack traces may be scattered across different data sources. Analyzing only a single data source may fail to fully reconstruct the attack chain, leading to misjudgment or underestimation of threats. For example, an attack against a power control system may simultaneously involve abnormal traffic at the network layer, suspicious processes at the host layer, and illegal operations at the application layer. A single data source analysis architecture struggles to correlate this scattered information, thus failing to detect and respond to complex attack behaviors in a timely manner. Furthermore, different data sources vary in quality and reliability, and relying solely on a single data source may lead to biased analysis results.

[0006] Passive response mechanisms are a typical characteristic of traditional network security protection systems. Under this mechanism, security measures are often only activated after an attack has occurred and been detected. For example, when an intrusion detection system (IDS) detects malicious traffic, it issues an alert. Security personnel analyze and assess the alert information, confirm the attack, and then take appropriate measures, such as isolating infected hosts, patching system vulnerabilities, and updating firewall rules. While emergency plans and response procedures are necessary, this "better late than never" passive response model has significant drawbacks. First, there is a time delay between the occurrence of an attack, its detection, and its final handling; attackers may have already caused damage or stolen sensitive data during this period. Second, passive responses often rely on known attack characteristics or vulnerability information, and their effectiveness is limited against zero-day attacks or new attack methods. Third, frequent security incident responses consume significant human and material resources and are unlikely to fundamentally improve the system's security capabilities. As a critical infrastructure, the power system has extremely high requirements for real-time performance and reliability; a passive response mechanism is insufficient to meet its needs for proactive defense and continuous security.

[0007] Mimicry defense, as an emerging proactive defense technology, is based on the core idea of ​​constructing a Dynamic Heterogeneous Redundancy (DHR) architecture. It leverages heterogeneity, redundancy, and dynamism to increase the difficulty of attacks and reduce the probability of success. In recent years, mimicry defense technology has been practically applied and validated in areas such as routers and web servers, achieving certain results. For example, some research has designed web servers based on mimicry defense models, implementing a multi-layered "dynamic heterogeneous redundancy" structure, and verifying its effectiveness and feasibility through security and performance testing. In the power system field, the introduction of mimicry defense technology to enhance proactive defense capabilities has also begun to be explored, but some limitations remain. First, existing research mostly focuses on specific devices or subsystems, lacking a holistic solution for the entire power system and across multiple business scenarios. Second, the construction and management of heterogeneous executors is a complex issue. How to ensure true heterogeneity between executors, avoid "same-origin" problems, and how to efficiently perform dynamic scheduling and adjudication still require in-depth research. Third, the mimicry defense mechanism itself incurs certain performance overhead and resource consumption. Achieving lightweight adaptation in resource-constrained power edge computing scenarios is a challenge. Furthermore, how to effectively integrate mimicry defense with the existing security protection system of the power system to achieve synergistic effects, and how to quantitatively evaluate the security gains of mimicry defense systems are also urgent problems to be solved.

[0008] A comprehensive analysis of existing power system network security technologies reveals the following main drawbacks:

[0009] (1) Limitations of static and passive defense:

[0010] The current cybersecurity protection system for power systems still largely relies on static, passive defense mechanisms. These mechanisms, primarily based on known attack characteristics and pre-defined rules, are ill-suited to effectively counter unknown threats, zero-day vulnerabilities, and emerging attack methods such as Advanced Persistent Threats (APTs). Attackers can exploit unknown vulnerabilities and backdoors to bypass traditional defenses and attack critical functional areas of the power system, leading to serious consequences. This reactive, "lock the stable door after the horse has bolted" approach leaves the system vulnerable to new types of attacks, resulting in a high level of security risk.

[0011] (2) Insufficient data collection and analysis capabilities:

[0012] Many existing power system security monitoring solutions suffer from a lack of diversity in data collection, primarily relying on alarm logs from security devices. They lack comprehensive collection and fusion analysis of multi-source, heterogeneous information such as network traffic, business data, and device status. This results in insufficient dimensions for security analysis, making it difficult to grasp the overall network security situation and effectively uncover potential risks and unknown threats hidden in complex data relationships. Simultaneously, data analysis capabilities are relatively weak, relying heavily on traditional rule matching and threshold alarms, lacking intelligent analysis and correlation analysis capabilities based on big data and artificial intelligence. This leads to low analysis efficiency and difficulty in quickly and accurately identifying and locating security events.

[0013] (3) The initial stage and limitations of mimicry defense application:

[0014] While mimicry defense technology offers new insights into power system security, its application in the power industry is still in its early stages and faces some limitations. For example, the construction and deployment costs of mimicry defense systems are high, and the management and scheduling strategies for heterogeneous executors also present challenges, especially in resource-constrained edge computing scenarios, where its applicability requires further research and optimization. Some existing mimicry scheduling strategies may not be fully adaptable to continuous real-time network attack and defense confrontations, or may sacrifice some system performance while improving security. How to deeply integrate mimicry defense technology with specific business scenarios of power systems to achieve efficient and reliable proactive defense still requires further exploration.

[0015] (4) Lack of intrinsic security and dynamic self-adaptive capabilities:

[0016] Traditional security measures are mostly add-ons, failing to achieve deep, intrinsic integration with the power system's infrastructure and business applications. This "patching" approach to security construction cannot fundamentally improve the system's security capabilities. Furthermore, existing systems lack dynamic adaptability; security policies are often rigid and cannot be adjusted and optimized in real time according to changes in the network threat landscape, thus failing to effectively counter attackers' constantly evolving attack methods and strategies.

[0017] (5) Security challenges in resource-constrained scenarios:

[0018] With the development of the power Internet of Things (IoT), a large number of edge devices and sensors are being connected to the network. These devices typically have limited computing power, storage capacity, and power consumption. Deploying complex security mechanisms in such resource-constrained scenarios presents significant challenges. Traditional security solutions are difficult to apply directly to these edge devices, necessitating the design of lightweight security measures to ensure security without impacting normal device operation and business functions.

[0019] In summary, existing power system cybersecurity technologies exhibit numerous shortcomings when facing increasingly complex and intelligent cyberattacks, including static passivity, data silos, insufficient intelligence, lack of inherent security, and difficulty adapting to resource-constrained scenarios. Therefore, there is an urgent need for a new security monitoring and response technology that can integrate multi-source data, possess dynamic proactive defense capabilities, and adapt to different application scenarios. Summary of the Invention

[0020] To overcome the shortcomings of existing technologies, the purpose of this invention is to provide a method and system for intelligent monitoring and dynamic response of cross-source security in power systems based on mimicry defense. This system forms a closed-loop security system encompassing data acquisition, threat analysis, dynamic handling, and continuous evolution through five key components: cross-source perception, mimicry decision-making, hierarchical response, closed-loop optimization, and edge adaptation. This improves detection accuracy, shortens response latency, enhances system robustness, and expands applicability to resource-constrained environments, thereby achieving comprehensive proactive defense of power systems in complex network attack and defense environments.

[0021] To achieve the above objectives, the present invention provides the following solution:

[0022] A smart monitoring and dynamic response method for cross-source security of power systems based on mimicry defense includes:

[0023] Deploy acquisition agents and sensors to obtain cross-source raw data and generate the first dataset. Perform dynamic encryption and source integrity authentication based on data sensitivity and real-time requirements. The key is generated, distributed and rotated by the key management center in cooperation with the edge to obtain trusted data packets.

[0024] A pool of heterogeneous execution entities that are different but functionally equivalent is constructed. The execution entities are dynamically scheduled according to their historical performance, heterogeneity, threat status, and system load, and randomness is introduced. The selected execution entities analyze the trusted data packets in parallel, obtain a set of multiple analysis results, and form a threat determination result by an adjudication mechanism. The attack chain is identified through cross-domain threat correlation modeling, and the analysis information is fed back.

[0025] Based on the threat assessment results and attack chain analysis, differentiated handling is implemented. For low-level events, alarms, enhanced monitoring and policy adjustments are performed, while for high-level events, isolation, elimination and service switching are performed. When necessary, trusted hardware is used to complete trusted recovery from the bottom layer to the system, and handling receipts and operational metrics are generated.

[0026] The system monitors the operational status and aggregates the threat assessment results, handling receipts, and operational metrics. It uses reinforcement learning to optimize the mimicry scheduling parameters, thresholds, and response logic, employs federated learning for global situational analysis and model updates, generates a set of policy parameters and resource allocation instructions based on load and threat levels, and distributes the set of policy parameters to the cross-source perception layer, mimicry decision layer, and dynamic response layer to update the collection and encryption policies, execution body scheduling weights and adjudication thresholds, and handling classification thresholds and action templates, respectively. It also performs elastic configuration and switching of the computing, storage, and bandwidth of edge and central nodes according to the resource allocation instructions.

[0027] In resource-constrained scenarios, full-stage trusted verification is performed. Based on load and threat assessment, the collection frequency and analysis intensity are adjusted, lightweight algorithms and measurement schemes are selected, and intensity control instructions are output. These intensity control instructions are used to control the sampling frequency of the collection agent, the number of heterogeneous executors enabled / model complexity, and the measurement cycle, so as to reduce the impact on business while meeting security objectives.

[0028] According to specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0029] First, it effectively addresses the shortcomings of static and passive defense.

[0030] Existing power system security protection relies on fixed rules and static thresholds, resulting in slow response to unknown attacks or dynamically evolving threats. This invention, through a mimicry defense framework, introduces a heterogeneous execution pool and a dynamic scheduling mechanism to achieve continuous switching and randomization of security detection paths, making them difficult for attackers to predict and significantly improving the system's proactive defense capabilities in complex adversarial environments.

[0031] Second, it breaks through the limitations of data silos and insufficient analytical dimensions.

[0032] Traditional solutions often focus on a single data source, such as network traffic or device logs, resulting in a lack of a holistic perspective in threat detection. This invention collects and fuses multimodal data from the network, control system, and physical environment through a cross-source perception layer, and processes it within a unified trusted transmission framework. This allows threat assessment to consider evidence from different levels simultaneously, significantly improving the accuracy and comprehensiveness of the analysis.

[0033] Third, it solves the problem of fragmented and insufficiently integrated existing mimicry defense applications.

[0034] While the concept of mimicry defense has been applied, it is mostly limited to local nodes and lacks systematic integration. This invention, in the power system scenario, unifies mimicry scheduling, adjudication mechanisms, cross-domain threat correlation modeling, and hierarchical response into a closed-loop architecture. This not only enhances defense strength but also ensures consistency and controllability throughout the entire chain from monitoring to response.

[0035] Fourth, it addresses the shortcomings of lacking continuous optimization and dynamic adaptation.

[0036] Existing solutions are mostly statically deployed and cannot automatically adjust to changes in the operating environment and threat landscape. This invention uses a closed-loop optimization mechanism combining reinforcement learning and federated learning to achieve adaptive updates of scheduling parameters, thresholds, and response logic. These are then dynamically distributed to each layer via policy parameter sets and resource allocation instructions, enabling continuous evolution and optimization of the system as the environment changes.

[0037] Fifth, it addresses the application difficulties in resource-constrained scenarios.

[0038] Traditional complex security algorithms are difficult to run on edge or low-performance devices. This invention specifically designs an edge adaptation and strength control mechanism, which selects lightweight algorithms and trust measurement schemes through load and threat assessment, and uses strength control instructions to adjust the collection frequency, number of executors, and model complexity. This reduces interference with critical business operations while ensuring core security objectives, thus expanding the applicability of this invention. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 A flowchart of the method provided in an embodiment of the present invention;

[0041] Figure 2 This is a flowchart of the cross-source sensing layer provided in an embodiment of the present invention;

[0042] Figure 3 A flowchart of the mimicry decision-making layer provided in an embodiment of the present invention;

[0043] Figure 4 A flowchart of the dynamic response layer provided in an embodiment of the present invention;

[0044] Figure 5 A flowchart illustrating the closed-loop feedback mechanism provided in this embodiment of the invention;

[0045] Figure 6This is a schematic diagram of the system structure provided in an embodiment of the present invention. Detailed Implementation

[0046] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] The purpose of this invention is to provide a method and system for intelligent monitoring and dynamic response of cross-source security in power systems based on mimicry defense, which significantly improves the security and reliability of power systems.

[0048] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0049] Figure 1 The method flowchart provided in the embodiments of the present invention is as follows: Figure 1 As shown, this invention provides a method for intelligent monitoring and dynamic response of cross-source security in power systems based on mimicry defense, comprising:

[0050] Step 100: Deploy acquisition agents and sensors to obtain cross-source raw data and generate the first dataset. Based on data sensitivity and real-time requirements, perform dynamic encryption and source integrity authentication. The key is generated, distributed, and rotated by the key management center in cooperation with edge negotiation to obtain trusted data packets.

[0051] Step 200: Construct a pool of heterogeneous execution entities that are different in implementation but functionally equivalent. Dynamically schedule them according to historical performance, heterogeneity, threat status and system load, and introduce randomness. The selected execution entities analyze the trusted data packets in parallel to obtain a set of multi-path analysis results. The decision mechanism forms a threat determination result, and the attack chain is identified through cross-domain threat correlation modeling. The analysis information is then fed back.

[0052] Step 300: Implement differentiated handling based on the threat assessment results and attack chain analysis. For low-level events, perform alarms, enhanced monitoring and policy adjustments. For high-level events, perform isolation, cleanup and service switching. When necessary, rely on trusted hardware to complete trusted recovery from the bottom layer to the system, and generate handling receipts and operational metrics.

[0053] Step 400: Monitor the operational status and aggregate the threat judgment results, the handling receipts, and operational metrics. Use reinforcement learning to optimize the mimicry scheduling parameters, thresholds, and response logic. Use federated learning for global situational analysis and model updates. Generate a set of policy parameters and resource allocation instructions based on load and threat level. Distribute the set of policy parameters to the cross-source perception layer, mimicry decision layer, and dynamic response layer to update the collection and encryption policies, execution body scheduling weights and adjudication thresholds, and handling classification thresholds and action templates, respectively. Perform flexible configuration and switching of computing, storage, and bandwidth for edge and central nodes according to the resource allocation instructions.

[0054] Step 500: Perform full-stage trusted verification in resource-constrained scenarios, adjust the collection frequency and analysis intensity based on load and threat assessment, select lightweight algorithms and measurement schemes, output intensity control instructions, and use the intensity control instructions to control the sampling frequency of the collection agent, the number of heterogeneous execution entities enabled / model complexity, and measurement cycle, so as to reduce the impact on business while meeting security objectives.

[0055] The technical solution proposed in this invention is a multi-layered, modular, and intelligent comprehensive defense system. Its overall architecture design fully considers the business characteristics, security requirements, and future development trends of the power system, aiming to build a proactive, intelligently perceptive, rapidly responding, and continuously optimizing security protection platform by deeply integrating mimicry defense concepts with advanced information technology. This technical solution mainly consists of four core parts: a cross-source perception layer, a mimicry decision-making layer, a dynamic response layer, and a closed-loop feedback mechanism. These parts work collaboratively to form a complete "perception-decision-response-optimization" security closed loop. Furthermore, this embodiment also features a specially designed lightweight adaptation module to address the special needs of resource-constrained scenarios at the power system edge. This architecture not only emphasizes the independence and professionalism of functions at each vertical level but also focuses on information interaction and collaborative linkage between horizontal modules, ensuring the uniformity of security strategies and the efficiency of their execution. Through this systematic design, it can effectively address the diverse and persistent network attack threats faced by the power system, ensuring the safety and stability of the entire process of power production, transmission, distribution, and use.

[0056] like Figure 2As shown, the cross-source sensing layer is the foundation of the entire technical solution, responsible for collecting a wide range of security-related multimodal data from various levels and aspects of the power system. These data sources are diverse, including traffic data and log information from traditional IT network devices (such as routers, switches, and firewalls), operational data from industrial control systems (such as communication messages and status parameters from SCADA systems, PLCs, and RTUs), sensing data and operation logs from various smart terminals (such as smart meters, smart sensors, and cameras), and even physical environment data (such as temperature, humidity, and access control records). The core task of this layer is to ensure the comprehensiveness, real-time nature, and reliability of the data.

[0057] The data acquisition process is a core component of the cross-source sensing layer, designed to efficiently and reliably acquire raw data covering all aspects of the power system. This process typically begins with the identification and access of data sources. The system needs to support various standard and non-standard data interfaces and communication protocols to accommodate diverse equipment types and data formats within the power system. For example, network traffic data can be collected via mirror ports, network splitters, or by deploying traffic probes; device logs can be collected using protocols such as Syslog and SNMP; and industrial control system data may require specific drivers or OPC interfaces. The acquired raw data undergoes initial formatting and timestamping to ensure consistency and traceability. Subsequently, the data is filtered and deduplicated to remove irrelevant and redundant information, reducing the burden on subsequent processing and analysis. In some cases, to meet real-time analysis needs, some preprocessing work (such as simple feature extraction or anomaly detection) may be performed near the data acquisition point. The acquired data is then categorized and prioritized according to its source, type, and sensitivity, providing a basis for subsequent dynamic encryption and transmission strategies. The entire data acquisition process needs to be highly available and fault-tolerant to ensure that critical data can still be acquired to the maximum extent possible even if some acquisition points or links fail.

[0058] Due to the sensitivity and importance of power system data, the cross-source sensing layer must employ robust encryption mechanisms to ensure data confidentiality and integrity during data transmission. The dynamic encryption mechanism proposed in this invention does not use a single encryption algorithm or fixed key in a static manner. Instead, it dynamically selects and switches encryption algorithms, key lengths, and encryption modes based on factors such as the data source, type, sensitivity level, current network threat landscape, and the security of the transmission path. For example, for highly sensitive control commands or critical status data, a hybrid encryption method combining stronger asymmetric encryption algorithms (such as RSA and ECC) with symmetric encryption algorithms (such as AES) can be used, along with a dynamic key exchange protocol. For general monitoring data, symmetric encryption algorithms with lower computational overhead can be employed. The dynamic encryption mechanism also includes dynamic key management and update strategies, such as time-based key rotation, data volume-based key updates, or event-triggered key updates. Furthermore, to address potential future threats such as quantum computing, the mechanism should also have the capability to smoothly upgrade to quantum-resistant encryption algorithms. The encryption process includes not only encrypting the data content but also authenticating the data source and verifying data integrity (such as HMAC) to ensure that data is not eavesdropped on, tampered with, or forged during transmission. This dynamic and adaptive encryption strategy can flexibly balance security strength and system overhead while ensuring data security.

[0059] like Figure 3 As shown, the mimicry decision layer is the core innovation of this embodiment. It draws on and develops the concept of mimicry defense, constructing a dynamic, heterogeneous, and redundant analysis and decision-making environment to achieve deep intelligent analysis and accurate threat determination of data uploaded from the cross-source perception layer. The main functional modules of this layer include the construction of a heterogeneous execution pool, the implementation of dynamic scheduling strategies, and the correlation modeling of cross-domain threats.

[0060] The heterogeneous execution entity pool is the foundation for the mimicry decision layer's defensive capabilities. This pool consists of multiple functionally equivalent but internally diverse threat analysis modules (i.e., execution entities). These execution entities can be based on different analysis algorithms (such as signature-based detection, anomaly-based detection, machine learning models, and deep learning models), different platform architectures (such as x86, ARM, and domestic platforms), different operating systems, or different software versions. For example, the pool can include rule-based execution entities, behavior-based execution entities, deep neural network (DNN)-based execution entities, and graph neural network (GNN)-based execution entities. Each execution entity can independently analyze the input data and output its judgment results regarding the presence, type, and level of a threat. Heterogeneity is key to mimicry defense; by introducing diversity, it makes it difficult for attackers to find a universal attack method to breach all execution entities at once. The construction of the execution entity pool is an ongoing process, requiring the continuous incorporation of new and more advanced threat analysis technologies and models, while eliminating outdated or ineffective execution entities to maintain the pool's dynamism and advancement. In addition, to ensure the reliability and trustworthiness of the executor, it is necessary to establish corresponding measurement and management mechanisms, such as security auditing of the executor's code and monitoring of the executor's running behavior.

[0061] Dynamic scheduling is a key mechanism for the mimicry decision layer to achieve its "dynamic" characteristics. This strategy dynamically selects a set of executors from a heterogeneous pool to perform parallel analysis of the currently input cross-source data. The goal of scheduling is to improve analysis efficiency, reduce resource consumption, and increase the difficulty for attackers to predict system behavior while ensuring analytical accuracy. Scheduling strategies can be based on various factors, such as the historical performance of executors (prioritizing executors with high detection accuracy and low false positive rates over a period of time), the heterogeneity of executors (selecting combinations of executors with significant differences to improve coverage of diverse attacks), the current threat landscape (selecting targeted executor combinations based on perceived threat types or attack characteristics), system load (selecting executors with relatively low computational load or reducing the number of parallel executors when the system load is high), and the introduction of randomness (introducing a degree of randomness during scheduling makes it difficult for attackers to predict the next executor combination to be scheduled, thus increasing attack uncertainty). The scheduling strategy itself can also be dynamically adjusted and optimized, for example, through reinforcement learning algorithms to continuously optimize the scheduling decision model based on historical scheduling results and system feedback. After the selected executor groups independently analyze the data, their outputs are submitted to the adjudication mechanism. The adjudication mechanism comprehensively evaluates the outputs of multiple executors based on preset rules (such as majority voting, weighted voting, and consistency checks) to form a final decision. If the adjudication results are inconsistent, it may trigger alarms, further analysis, or executor cleanup and reconstruction.

[0062] To effectively address the increasingly complex cross-domain, multi-stage attacks in power systems, the mimicry decision layer introduces cross-domain threat association modeling technology, particularly utilizing advanced analysis methods such as Graph Neural Networks (GNNs). The various components in a power system (such as sensors, controllers, servers, and network devices) and their interactions can be naturally represented as a graph structure. GNNs can effectively learn and mine the complex dependencies and potential attack patterns within this graph data. By fusing alarm information, abnormal events, and inter-entity relationship information (such as communication relationships, data flow, and physical connections) from different data sources (such as network traffic, host logs, and industrial control protocols) to construct a heterogeneous information network, and then using a GNN model to analyze this network, GNNs can learn the embedded representations of nodes (entities) and edges (relationships), thereby identifying hidden attack paths, attacker intent, and affected critical assets that are difficult to detect from a single data source perspective. For example, an seemingly isolated abnormal connection on a network, if associated with a suspicious process startup event on a host and an abnormal parameter modification command in a control system, may be identified by the GNN model as part of a complex APT attack chain. In this way, the mimicry decision layer can not only perform point-based threat detection, but also perform threat hunting and attack scenario reconstruction from a global perspective, thereby improving the ability to identify and respond to high-level and organized attacks.

[0063] like Figure 4 As shown, the dynamic response layer is a crucial link in the system's execution of security policies, containment of attack impacts, and restoration of normal system operation. It receives threat assessment results (including threat type, threat level, affected assets, etc.) from the mimicry decision layer and automatically or semi-automatically executes corresponding response actions based on preset hierarchical handling logic and trusted recovery mechanisms. The design goal of this layer is to handle security incidents quickly, accurately, and with minimal impact, maximizing the continuity of power services.

[0064] For security incidents deemed low-risk by the mimicry decision-making layer, the dynamic response layer typically adopts relatively mild measures to avoid unnecessary disruption to normal business operations. These measures include:

[0065] Alarms and notifications: Send alarm information to security operations and maintenance personnel, and record the time, source, type, and affected objects of the event in detail for subsequent analysis and auditing.

[0066] Enhanced monitoring: Closer monitoring of systems, devices, or user accounts involved in low-risk events to collect more relevant data in order to further determine their true intentions and potential risks.

[0067] Policy Adjustment: Fine-tune relevant security policies based on the characteristics of the event, such as temporarily tightening the access control list (ACL) of a certain port, or increasing the detection sensitivity for a specific behavior.

[0068] Information verification: Try to verify the authenticity of the event through other channels, such as contacting the relevant users to confirm their actions, or checking the logs of other related systems.

[0069] Automated script execution: For some known, low-risk events that can be handled automatically (such as certain types of scanning probes), preset automated scripts can be executed for initial response, such as temporarily blocking the source IP for a period of time.

[0070] The handling of low-risk incidents emphasizes timely alerts and logging to provide data support for security analysis, while avoiding overreaction that could affect system availability.

[0071] When the mimicry decision-making layer determines that a high-risk security incident has occurred, such as a confirmed system intrusion, malware activity, or tampering with critical control commands, the dynamic response layer will initiate more decisive and forceful measures to quickly isolate the threat, prevent its spread, and minimize damage. These measures may include:

[0072] Network isolation: Immediately isolate the infected device or network segment from the network, prevent it from communicating with other internal systems or external networks, and cut off the attacker's control channels and data leakage paths.

[0073] Process termination and service shutdown: Terminate the execution of malicious processes, stop the attacked or exploited services, and prevent attackers from gaining further privileges or performing malicious operations.

[0074] Account Disabling: Disables user accounts that have been controlled or abused by attackers to prevent them from using legitimate identities for lateral movement or privilege escalation.

[0075] Malicious code removal: Attempt to automatically or manually remove malware, backdoors, etc. from the system.

[0076] System rollback and recovery: For tampered system files or configurations, use backups to restore them; if the system is severely damaged, a system-level rollback operation may be required to restore it to a known clean state.

[0077] Hardware-level trusted recovery: In extreme cases, if software-level recovery cannot guarantee the trustworthiness of the system, it may be necessary to initiate a trusted recovery mechanism based on a hardware root of trust (such as TPM / TCM) to ensure that the system is restored to the expected safe state from both hardware and software.

[0078] Activate emergency response plan: Based on the severity and scope of the incident, activate the corresponding cybersecurity emergency response plan and coordinate resources from all parties for collaborative handling.

[0079] The handling of high-risk incidents emphasizes speed and decisiveness, prioritizing the control of threat spread and the protection of core business operations, and may sacrifice the availability of some non-critical functions or services if necessary.

[0080] like Figure 5 As shown, the closed-loop feedback mechanism is a key component in ensuring the system's continuous optimization and adaptive capabilities. It is responsible for monitoring the overall system's operational status, evaluating the effectiveness of security strategies, analyzing the characteristics of attack events, and dynamically adjusting system parameters, optimizing decision-making models, and rationally allocating resources accordingly, forming a virtuous cycle of continuous learning and improvement.

[0081] Reinforcement Learning (RL) is widely used in closed-loop feedback mechanisms to optimize dynamic scheduling strategies in the mimicry decision-making layer, hierarchical handling logic in the dynamic response layer, and data acquisition and encryption strategies in the cross-source perception layer. The system can be viewed as an agent, whose behavioral space includes various selectable scheduling schemes, response actions, or policy parameters. The environment consists of the power system's network state, threat landscape, and its own operational metrics (such as detection rate, false alarm rate, and response latency). The agent learns optimal behavioral strategies by interacting with the environment and receiving rewards (positive rewards for successfully detecting and preventing attacks, and negative rewards for false alarms or missed detections). For example, in mimicry scheduling, RL models can learn which combinations of heterogeneous agents, under specific threat scenarios, can achieve the highest detection accuracy with minimal overhead. In dynamic response, RL models can learn which combination of response measures can most effectively control losses and quickly restore service for different types of attacks. Through continuous trial and error and learning, reinforcement learning algorithms can help systems find better strategies in complex and dynamic environments, thereby improving the system's adaptability and intelligence.

[0082] To overcome the limitations of a single system's data volume and scope, and to protect the data privacy of all participants, a closed-loop feedback mechanism can employ Federated Learning (FL) technology for global security situation analysis and threat intelligence sharing. Within the Federated Learning framework, multiple power security systems (as clients) deployed in different regions or at different levels, based on mimicry defense, can collaboratively train a global threat detection or situation assessment model under the coordination of a central server (or peer nodes). Each client trains its model locally using locally collected and labeled data and uploads model updates (such as gradients or model parameters) to the central server, rather than the raw data itself. The central server aggregates these model updates, generating an improved global model, which is then distributed to all clients. This approach enables the system to learn from a wider range of data, improving the model's generalization ability and its ability to identify new threats, while avoiding the risks of centralized storage and leakage of sensitive data. For example, through federated learning, a global APT attack identification model covering the entire power company can be built. Even if some branches encounter rare attack methods, the experience they have learned can be shared with other branches through the global model, thereby improving the collaborative defense capabilities of the entire power system.

[0083] The technical solution proposed in this invention, through the deep integration of mimicry defense mechanisms and cross-source data intelligent analysis technology, can bring significant benefits to power systems in multiple aspects, comprehensively enhancing their network security protection capabilities. First, it significantly enhances the detection and defense capabilities against unknown threats and advanced persistent threats (APTs). The dynamic heterogeneous redundancy architecture and multi-modal adjudication mechanism of mimicry defense make it difficult for attackers to cause substantial damage to the system using a single vulnerability or backdoor, effectively resisting new threats based on unknown vulnerabilities, zero-day attacks, and other emerging threats. Second, it improves the comprehensiveness and accuracy of threat perception. The cross-source perception layer integrates multimodal heterogeneous data, combined with cross-domain threat correlation modeling based on graph neural networks (GNNs) in the mimicry decision layer, enabling analysis of security events from a broader perspective and deeper level. This effectively identifies covert attacks and complex attack chains that are difficult to detect from a single data source, thereby reducing false positive and false negative rates. Third, it achieves intelligent, adaptive dynamic response and trusted recovery. The dynamic response layer classifies and handles threats according to their level, and combined with a hardware-level trusted recovery mechanism, it can quickly and effectively curb the spread of attacks, minimize losses, and ensure the continuity and reliability of power services. Furthermore, the system possesses the capability for continuous optimization and evolution. The closed-loop feedback mechanism, through techniques such as reinforcement learning and federated learning, continuously optimizes the system's security strategies and model parameters, enabling the system to adaptively respond to the ever-changing network threat environment and improve overall defense effectiveness. Finally, the solution balances resource utilization efficiency with applicability to edge scenarios. Dynamic resource allocation methods and lightweight adaptation schemes allow the system to optimize resource utilization while ensuring security, and effectively apply it to resource-constrained edge devices, expanding the coverage of proactive defense.

[0084] The implementation of this invention mainly revolves around various levels of the overall system architecture, ensuring the realization of the functions of each module and their collaborative work.

[0085] At the cross-source sensing layer, data acquisition implementation first requires deploying diverse data acquisition agents and sensors at key nodes in the power system. These agents need to support multiple communication protocols and data formats to adapt to the data output of different devices and systems within the power system. For example, traffic mirroring devices and network probes are deployed at network boundaries and core switching nodes to capture network traffic data; lightweight log acquisition agents are installed on servers and hosts to collect system logs, security logs, and application logs in real time; real-time operating data and alarm information are collected from industrial control equipment through standard industrial protocol interfaces; and status data and environmental parameters are collected from edge devices such as smart meters and sensors through IoT protocols. The collected raw data undergoes preliminary cleaning, formatting, timestamp alignment, and normalization to convert it into a unified internal data format. For data transmission, a dynamic encryption mechanism is employed. Based on data sensitivity and real-time requirements, symmetric encryption algorithms (such as AES, SM4) or asymmetric encryption algorithms (such as RSA, ECC, SM2) are dynamically selected for data encryption. Key management employs a combination of a centralized Key Management Center (KMC) and distributed edge key negotiation to ensure the secure generation, distribution, storage, and regular updating of keys. At the same time, digital signatures or Message Authentication Code (MAC) technologies are used to ensure the integrity and authenticity of the data.

[0086] The core of the mimicry decision-making layer is the construction and management of a heterogeneous execution pool and the realization of intelligent dynamic scheduling. The construction of the heterogeneous execution pool requires careful selection or development of executions that are functionally equivalent but significantly different in implementation. These differences can be reflected in multiple levels, including operating systems (such as Linux, Windows, and domestic operating systems), hardware platforms (such as x86, ARM, and domestic CPUs), and analysis algorithms (such as signature-based rule engines, machine learning-based anomaly detection models, and deep learning-based threat identification models). Each execution needs to undergo rigorous testing and verification to ensure its functional correctness and performance meet requirements. The dynamic scheduling module is responsible for selecting a group of executions from the heterogeneous execution pool to process input data based on the current system load, threat intelligence, historical performance of the executions, and preset scheduling algorithms (such as random scheduling, dissimilarity-based scheduling, and reinforcement learning-based adaptive scheduling). The input agent distributes the data to the selected executions for parallel analysis. The arbitrator module collects the output results of each execution and uses majority voting, weighted voting, or consensus algorithms to form the final threat determination. Meanwhile, the cross-domain threat correlation modeling module (such as one based on GNN) performs correlation analysis on events from different data sources, identifies complex attack chains, and feeds the analysis results back to the adjudicator to assist in decision-making.

[0087] The key to implementing the dynamic response layer lies in establishing a robust hierarchical handling logic and a reliable trusted recovery mechanism. The hierarchical handling logic automatically or semi-automatically executes corresponding response actions based on the threat level (e.g., low, medium, high) and threat type output by the mimicry decision layer. For low-risk events, the system may automatically log, send alarms to maintenance personnel, or execute pre-set simple handling scripts (e.g., temporarily blocking suspicious IPs). For medium-risk events, this may involve isolating affected hosts, stopping suspicious services, and adjusting security policies. For high-risk events, such as confirmed system intrusions or malware activity, the system will immediately initiate strong response measures, including but not limited to: completely isolating infected network segments, terminating malicious processes, removing malicious code, disabling compromised accounts, initiating system rollback, or switching to a backup system. The implementation of the trusted recovery mechanism relies on pre-established trusted benchmarks and a comprehensive backup strategy. After a system attack, a clean backup image can be used for system recovery, and the integrity and trustworthiness of the recovered system can be verified through a hardware root of trust (e.g., TPM / TCM), ensuring that the system is restored to a known secure state from both hardware and software. The execution of response actions can be accomplished by calling the API of the underlying security device (such as firewall, IDS / IPS) or through the system's built-in response engine.

[0088] The implementation of the closed-loop feedback mechanism aims to achieve continuous system optimization and self-adaptation. Policy optimization is mainly achieved through reinforcement learning (RL) algorithms. The system models the security monitoring and response process as a Markov decision process (MDP). The RL agent learns the optimal defense strategy based on rewards or penalties obtained through interaction with the environment (i.e., the power system network and attack scenarios), including optimizing mimicry scheduling parameters, adjusting threat judgment thresholds, and improving dynamic response logic. Global situational analysis and threat intelligence sharing are achieved through federated learning (FL) technology. Multiple local security systems deployed in different regions act as FL clients, jointly training a global threat detection model or situational assessment model under the scheduling of a central coordination server, without sharing local raw data, thereby improving overall defense capabilities while protecting data privacy. The resource dynamic allocation module intelligently schedules and allocates computing, storage, and network bandwidth resources based on the current system load, threat level, and optimization objectives (such as minimizing response time and maximizing detection rate), ensuring that critical tasks are prioritized and improving overall resource utilization efficiency.

[0089] Given the resource constraints of edge devices in power systems (such as smart terminals and edge computing nodes), the implementation of this invention requires lightweight adaptation. The full-stage trusted verification mechanism employs a streamlined secure startup process and lightweight integrity measurement methods on edge devices, such as using computationally inexpensive hash algorithms and hardware-based roots of trust, ensuring that the edge device remains in a trusted state throughout its startup and operation. The load-threat assessment model dynamically adjusts the intensity and resource consumption of security monitoring on the edge side based on the device's real-time load (CPU, memory, power consumption) and the perceived threat level. For example, when the load is high or the threat is low, the data acquisition frequency can be appropriately reduced or a simpler analysis algorithm can be used; conversely, monitoring and analysis capabilities are enhanced. Data acquisition and encryption algorithms also select lightweight solutions suitable for low-power, low-computing-capacity devices. In this way, while ensuring the basic security needs of edge devices, the impact of security mechanisms on the normal business functions of the devices is minimized.

[0090] In practical implementation, the technical solutions of this invention can be appropriately modified and adjusted according to actual application scenarios and needs. For example, in the cross-source perception layer, if the cost of collecting certain data sources is too high or the technical difficulty is too great, sampling collection or relying on indirect data sources for analysis can be temporarily adopted as a stopgap measure. The data encryption mechanism can also be adjusted according to actual security needs and compliance requirements, selecting different combinations of encryption algorithms, or even using plaintext transmission in specific internal security areas (not recommended, only considered in extremely trusted environments). In the mimicry decision-making layer, the construction of the heterogeneous execution pool can be adjusted according to available technologies and resources. For example, initially, fewer types of heterogeneous executions can be used, and then gradually expanded as technology develops. The dynamic scheduling strategy can also be simplified or complicated according to the actual attack and defense effects, for example, gradually upgrading from simple polling scheduling to intelligent scheduling based on reinforcement learning. If the training and deployment costs of the GNN model are too high, rule-based or traditional machine learning correlation analysis methods can be used as a transition in the initial stage. In the dynamic response layer, the logic of graded handling can be adjusted according to the importance and tolerance of specific business. For example, for some non-critical business systems, the response threshold for high-risk events can be appropriately relaxed. Trusted recovery mechanisms can also select different recovery granularities and techniques based on backup strategies and recovery time objectives (RTO) requirements. In closed-loop feedback mechanisms, the depth and breadth of reinforcement learning and federated learning applications can be adjusted according to data volume and computing resources. Initially, rule-based strategy adjustments and limited information sharing can be adopted. For lightweight adaptations, if edge device resources are extremely limited, even only the core trusted verification and basic threat awareness functions can be retained, while complex analysis and decision-making tasks are moved to the cloud or regional central nodes. These variant solutions aim to provide flexibility to adapt to the construction of power system cybersecurity of different scales and needs.

[0091] The key innovations of this invention are mainly reflected in the following aspects, which together constitute the core competitiveness of this technical solution.

[0092] (1) Multimodal data dynamic encryption acquisition technology across the source sensing layer.

[0093] The first key innovation of this invention lies in its cross-source sensing layer technology for comprehensive, real-time, and dynamic acquisition and intelligent encrypted transmission of multimodal heterogeneous data from power systems. Traditional power system security monitoring often relies on a single data source, making it difficult to form a global perspective. This invention achieves broad coverage and deep integration of multimodal data, including network traffic, equipment logs, operating status, environmental parameters, and video surveillance, through diverse sensing agents and sensors deployed across various aspects of the power system (including IT networks, industrial control networks, IoT edge computing, and the physical environment). More importantly, the data acquisition process is not static or fixed but can dynamically adjust the acquisition strategy based on the current threat landscape and business needs. For example, it can automatically increase the acquisition frequency and depth of specific data sources when potential risks are detected. Regarding data transmission, this invention employs a dynamic encryption mechanism, dynamically selecting and switching encryption algorithms, key lengths, and encryption modes based on the importance and sensitivity of the data. Combined with secure key management and integrity verification, this ensures the confidentiality, integrity, and freshness of data during acquisition and transmission, providing a solid and reliable data foundation for subsequent intelligent analysis and proactive defense.

[0094] (2) Dynamic scheduling of heterogeneous execution entities and cross-domain threat modeling in the mimicry decision layer.

[0095] The second key innovation of this invention lies in the mimicry decision-making layer's integration of mimicry defense mechanisms with advanced artificial intelligence technology. This enables intelligent dynamic scheduling of heterogeneous executors and deep correlation modeling of cross-domain threats. Traditional mimicry defense scheduling strategies may be relatively simple, failing to fully utilize the characteristics of heterogeneous executors. This invention constructs a pool of heterogeneous executors comprising various algorithms, models, and platforms, and introduces an intelligent dynamic scheduling strategy based on reinforcement learning and other technologies. This allows for adaptive selection of the optimal combination of heterogeneous executors for parallel analysis based on real-time threat intelligence and system status, maximizing defense effectiveness while balancing performance overhead. Furthermore, addressing the complexity of cross-domain attacks on power systems, this invention innovatively applies advanced analysis techniques such as graph neural networks (GNNs) to cross-domain threat correlation modeling. This enables the mining of potential complex attack chains and coordinated attack behaviors from massive, multi-source heterogeneous data, significantly improving the ability to identify complex attacks such as advanced persistent threats (APTs) and enhancing situational awareness. This deep integration of mimicry defense and intelligent analysis endows the decision-making layer with not only strong intrinsic security capabilities but also superior threat insight.

[0096] (3) Hierarchical handling of dynamic response layer and hardware-level trusted recovery mechanism.

[0097] The third key innovation of this invention lies in its dynamic response layer, which implements intelligent and hierarchical handling logic based on threat assessment and integrates a hardware-level trusted recovery mechanism. This ensures that the system can quickly and securely recover to a known trusted state after an attack. Traditional security responses are often passive and delayed, and the recovery process struggles to guarantee system integrity. The dynamic response layer of this invention automatically executes differentiated response measures based on the threat level and type output by the mimicry decision layer, ranging from mild alerts and logging to strong isolation, blocking, and service switching, achieving precise and appropriate responses. More importantly, this invention introduces a hardware-level trusted recovery mechanism. Relying on hardware roots of trust such as Trusted Platform Modules (TPM) or Trusted Cryptographic Modules (TCM), it can verify and restore system integrity from the hardware level after a severe attack or failure, ensuring that each layer of the system software stack recovers to the expected, tamper-proof, and secure state. This combination of hierarchical handling and trusted recovery not only effectively curbs the impact of attacks and minimizes losses but also fundamentally guarantees the continuity and reliability of critical power services, enhancing the overall resilience of the system.

[0098] (4) Trusted measurement and dynamic resource optimization for lightweight adaptation on the edge side.

[0099] The fourth key innovation of this invention lies in its lightweight adaptation scheme for resource-constrained scenarios at the power system edge, achieving full-stage trusted verification and dynamic resource optimization based on a load-threat assessment model. With the development of the power Internet of Things (IoT), massive resource-constrained edge devices have become a weak link in security protection. This invention, through the design of a lightweight trusted measurement module and a secure startup process, ensures that edge devices are in a trusted state at every stage from startup to operation, effectively resisting the implantation of malicious firmware and software. Simultaneously, it innovatively proposes a load-threat assessment model, which dynamically adjusts security monitoring strategies and resource allocation based on the real-time load and threat level of the edge devices. While ensuring basic security requirements, it intelligently balances security protection strength with system resource consumption, avoiding excessive impact of security mechanisms on the normal business functions of edge devices. This lightweight adaptation scheme enables the effective application of advanced proactive defense concepts such as mimicry defense in resource-constrained edge environments, expanding the coverage of proactive defense and providing key technical support for building an end-to-end power system security protection system.

[0100] The technical solution of this invention is itself a highly integrated system, but its core modules and technical ideas can also be combined with other existing or emerging technologies to form more powerful or targeted security solutions. For example, the dynamic encrypted acquisition technology of the cross-source perception layer can be combined with blockchain technology to record the collected key security data or operation logs on the blockchain in the form of encrypted hashes. Utilizing the immutability and traceability of the blockchain, a trusted defense evidence chain can be built, providing stronger support for post-event auditing and attack tracing. The heterogeneous execution dynamic scheduling and cross-domain threat modeling of the mimicry decision layer can be combined with quantum machine learning technology. The powerful parallel processing capability of quantum computing is expected to accelerate the training and inference process of complex threat models, further improving the detection generalization ability and response speed for unknown and variant threats. The hierarchical handling and trusted recovery mechanism of the dynamic response layer can be combined with software-defined networking (SDN) and network function virtualization (NFV) technologies. Through the SDN controller, flexible scheduling of network traffic and rapid policy distribution can be achieved, while NFV enables on-demand deployment and elastic scaling of security functions, thereby more efficiently executing response actions such as isolation, diversion, and scrubbing. Lightweight edge-side adaptation solutions can be deeply integrated with technologies such as 5G and edge computing. Leveraging the low latency and high bandwidth of 5G, they improve the collaborative efficiency between edge and central nodes, while simultaneously pushing more security analysis and decision-making capabilities to the edge, achieving faster local response and lower bandwidth consumption. Furthermore, the entire system can be integrated with threat intelligence sharing platforms and Security Orchestration Automation and Response (SOAR) platforms to enable broader threat intelligence input and more automated security operation processes. These combined solutions are not replacements for existing solutions, but rather functional enhancements and application extensions built upon them, allowing for flexible selection and deployment based on specific business needs and security challenges.

[0101] Although this invention proposes an active, intelligent, and collaborative power system security monitoring and response system based on mimicry defense, in practical applications, the overall design direction may be subject to some changes depending on factors such as specific technology maturity, cost budget, and deployment environment.

[0102] This invention emphasizes the "dynamic" nature of mimicry defense, namely, increasing the uncertainty of the attack surface by dynamically scheduling heterogeneous executors. One possible direction for this change is to adopt a Static Heterogeneous Redundancy (SHR) architecture as an alternative or transitional solution. In an SHR architecture, the system also consists of multiple functionally equivalent but heterogeneous executors, but the combination and operating modes of these executors are relatively fixed, or their switching frequency is much lower than that of dynamic mimicry defense. This approach can also utilize heterogeneity to some extent to resist certain attacks targeting specific platforms and reduce the risk of common-mode failures. Its advantages are relatively simple implementation, low scheduling overhead, and low potential impact on system stability. However, compared with dynamic mimicry defense, the effectiveness of the SHR architecture in dealing with continuous and intelligent attacks may decrease as attackers gradually gain a better understanding of the system's static characteristics. Therefore, this direction for change may be more suitable for scenarios with extremely high real-time requirements, high sensitivity to the uncertainty introduced by dynamic scheduling, or limited initial investment costs. Subsequently, the system can gradually evolve from SHR to dynamic mimicry defense based on actual needs.

[0103] This invention incorporates the concept of edge-cloud collaboration, allowing mimicry decision-making and intelligent analysis to be performed at the edge or in the cloud. One possible direction for this approach is to emphasize a cross-domain defense architecture centered on centralized analysis. In this architecture, the cross-source perception layer still handles extensive data collection, but large amounts of raw or pre-processed data are aggregated to a regional or global centralized analysis platform. The core functions of the mimicry decision-making layer, such as the heterogeneous execution pool, dynamic scheduling, and GNN correlation analysis, are primarily deployed on a powerful central cloud platform. The advantage of this approach is that it can concentrate superior computing resources for complex threat analysis and model training, making it easier to achieve global situational awareness and unified policy management. However, its disadvantages are also significant, including high dependence on network bandwidth, data transmission latency potentially affecting real-time response, and the possibility of the entire defense system being paralyzed if the central node is compromised. Therefore, this approach may be more suitable for scenarios with good network conditions, extremely high requirements for global collaboration, and severely limited edge node resources. To compensate for these shortcomings, edge nodes can be endowed with certain local rapid response and simple decision-making capabilities on top of centralized analysis.

[0104] As an extremely simplified approach, a return to a single-data-source protection system based on traditional cryptographic techniques could be considered. This approach essentially abandons the core ideas of mimicry defense and cross-source data fusion, instead relying on traditional, proven cryptographic techniques (such as strong encryption, digital signatures, and authentication) to protect specific critical data sources or communication links. For example, end-to-end encryption and authentication can be applied to control commands in SCADA systems, or strict access control and data integrity protection can be implemented for communication between critical servers. The advantages of this approach are relatively mature technology, potentially lower deployment and maintenance costs, and the ability to provide effective protection for specific, well-defined security risks. However, its disadvantages include an inability to cope with unknown threats and complex cross-domain attacks, a lack of overall situational awareness, and difficulty adapting to dynamically changing threat environments. This approach may only be suitable for systems with low security requirements, simple structures, or as a supplementary measure to localized hardening of existing systems, and differs significantly from the proactive, intelligent, and collaborative defense concept proposed in this invention.

[0105] While maintaining the core idea of ​​this invention, there are also some possible variations for the specific technical features at each level, in order to adapt to different implementation conditions and optimization goals.

[0106] At the cross-source sensing layer, the specific implementation of data acquisition technologies can be flexibly selected and combined based on the type of data source and the on-site environment. For example, for network traffic data acquisition, in addition to commonly used port mirroring and network splitters (TAPs), network traffic telemetry technologies (such as IPFIX, NetFlow, and sFlow) can be considered. These technologies can provide richer traffic metadata while reducing the amount of raw packet data transmitted. For host log acquisition, in addition to deploying agents, for legacy systems that do not support agents, agentless log acquisition technologies can be considered, such as remotely capturing logs via WMI, SSH, or API interfaces. For industrial control system data acquisition, if standard protocol interfaces are unavailable or unstable, it may be necessary to develop customized protocol parsers or drivers, or to obtain proprietary data interfaces through cooperation with equipment manufacturers. In terms of physical environment data acquisition, in addition to directly connecting sensors, wireless sensor networks (WSNs) or Internet of Things (IoT) platforms can be used for data aggregation and forwarding. In dynamic encryption mechanisms, if there are difficulties in implementing national cryptographic algorithms or standard algorithms such as AES, it is advisable to use open-source cryptographic libraries (such as OpenSSL). Alternatively, in certain internal trusted network areas, for non-critical data, a weaker encryption algorithm or even no encryption can be temporarily used as a transition (the risks need to be carefully assessed).

[0107] The dynamic scheduling strategy of the mimicry decision layer is one of the core innovations, and the specific algorithm can be adjusted according to actual needs and computational resources. Besides the adaptive scheduling algorithm based on reinforcement learning, the following alternatives or supplementary solutions can also be considered:

[0108] Rule-based scheduling: Scheduling is performed according to a pre-defined rule base. For example, when a specific type of attack is detected, heterogeneous combinations of executors with a high detection rate for that type of attack are prioritized for scheduling. Rules can be defined by security experts and updated based on experience.

[0109] Scheduling based on genetic algorithms: The scheduling problem is modeled as an optimization problem, and the genetic algorithm is used to search for the optimal combination of heterogeneous executors to maximize the defense effect or minimize resource consumption.

[0110] Game theory-based scheduling: As mentioned in some embodiments of this invention, the attack and defense process is modeled as a game model (such as differential game), and the optimal scheduling strategy is obtained by solving the equilibrium solution. This strategy can better take into account the attacker's behavior patterns.

[0111] Hybrid scheduling strategy: Combining the advantages of multiple scheduling algorithms. For example, simple scheduling based on polling or randomness is used when the system is initialized or when there is a lack of sufficient historical data; as a certain amount of data is accumulated, intelligent scheduling based on reinforcement learning or genetic algorithms is gradually introduced.

[0112] Reputation-based scheduling: A reputation score is maintained for each heterogeneous executor, and dynamically updated based on its historical detection accuracy, false alarm rate, response speed, and other indicators. Executors with higher reputation scores are prioritized during scheduling.

[0113] The replacement or combination of these algorithms aims to balance the level of intelligence in scheduling, computational overhead, and implementation complexity to adapt to different application scenarios.

[0114] The trusted recovery mechanism of the dynamic response layer is the key to ensuring system resilience. However, in some scenarios with resource constraints or lack of technical conditions, some degradation solutions can be considered. Hardware-level trusted recovery relies on hardware trust roots such as TPM / TCM. If the device does not support it or the deployment cost is too high, it can be degraded to software-level trusted recovery. Software-level trusted recovery mainly relies on clean backup images and software integrity verification tools (such as file integrity monitoring FIM). By restoring system files and configurations from the backup and verifying the hash values of key components, the purity of the system is ensured. Although its security is not as good as hardware-level trusted recovery, it can also cope with common malware infections and system tampering to a certain extent. Another degradation solution is snapshot-based recovery. Using the snapshot function of virtualization technology or storage systems, snapshots of the system or key applications are taken regularly, and when a security event occurs, it can be quickly rolled back to the previous snapshot point. This method has a relatively fast recovery speed, but it may face the risk of the snapshot itself being contaminated or data loss caused by rollback. For data recovery, if the cost of real-time backup and off-site disaster recovery is too high, regular offline backup or incremental backup can be considered, sacrificing a certain recovery point objective (RPO) to reduce costs and complexity. These degradation solutions need to be weighed among security, cost, recovery time, and data loss risk.

[0115] As an optional implementation method, with the rapid development of the new power system (dominated by new energy, with deep integration of power generation, grid, load, and energy storage), its network architecture will become more complex, business scenarios will be more diverse, and cross-domain data interactions will be more frequent. The cross-source security intelligent monitoring and response system based on mimic defense proposed by this invention can be further extended to a cross-domain collaborative defense system for the entire new power system. This means that not only security nodes need to be deployed in traditional links such as power generation, transmission, transformation, distribution, and power consumption, but also emerging elements such as new energy power stations (such as wind farms, photovoltaic power stations), energy storage power stations, electric vehicle charging networks, virtual power plants, and demand response platforms need to be incorporated into a unified security protection framework. By constructing a cross-regional, cross-business, and cross-hierarchy security information sharing and collaborative response mechanism, such as using federated learning for the aggregation and distribution of global threat intelligence, or through standardized interfaces to achieve linkage responses between different security domains, a deep defense capability covering all links of "source-grid-load-storage" can be formed. This expansion needs to consider the differences and compatibility of security policies between different domains, as well as the management and authentication challenges brought by the access of a large number of heterogeneous devices.

[0116] To enhance the traceability and audit reliability of security incidents, this invention can be deeply integrated with blockchain technology to construct a trusted chain of defensive evidence. Specifically, key security logs collected from the cross-source perception layer, decision-making results from the mimicry decision-making layer, actions taken by the dynamic response layer, and policy adjustment records from the closed-loop feedback mechanism can be hashed and recorded on the blockchain as transactions. The decentralized, immutable, and traceable characteristics of blockchain ensure the integrity and credibility of this security-related data, preventing attackers from tampering with or deleting evidence. This is crucial for post-incident attack tracing, liability determination, compliance auditing, and security policy optimization. For example, when a security incident occurs, the attack path, system response process, and related operation logs can be clearly reconstructed by querying records on the blockchain. Furthermore, based on smart contracts, automated security policy execution and alarm notifications can be achieved, further improving the efficiency of security operations. This integration needs to consider blockchain performance bottlenecks (such as transaction throughput and confirmation latency) and data privacy protection.

[0117] Faced with increasingly complex and rapidly evolving cyberattacks, especially APT attacks that exploit unknown vulnerabilities or employ highly covert techniques, traditional machine learning models may face challenges in terms of generalization ability and robustness in threat detection. To further enhance the threat detection capabilities of this invention, the introduction of Quantum Machine Learning (QML) technology can be considered. Quantum computing has the potential to surpass classical computers in handling certain types of problems. QML algorithms, such as Quantum Support Vector Machines (QSVM) and Quantum Neural Networks (QNN), are expected to demonstrate advantages in feature space mapping and pattern recognition. By applying QML to heterogeneous executors in the mimicry decision layer (especially machine learning-based executors), or to train more powerful cross-domain threat correlation models (such as quantum graph neural networks), it may be possible to extract deeper and more abstract features from complex, high-dimensional cross-source data, thereby significantly improving the detection accuracy and generalization ability against unknown threats and variant attacks. Of course, the practical application of QML technology is still in its early stages, and attention needs to be paid to its algorithm maturity, hardware dependencies, and interpretability.

[0118] Energy efficiency is a crucial consideration in power systems, particularly in edge computing nodes and IoT devices. The closed-loop feedback mechanism of this invention incorporates dynamic resource allocation, which can be further integrated with energy efficiency optimization. This means that resource scheduling and allocation should consider not only security requirements and performance goals but also energy consumption as a key optimization indicator. For example, on edge devices, when the load is low and the threat level is not high, CPU frequency can be dynamically adjusted, unnecessary hardware modules can be shut down, or a low-power mode can be entered to reduce energy consumption. When scheduling heterogeneous executors, in addition to considering their detection capabilities and heterogeneity, their computational energy consumption can also be evaluated, prioritizing executors with higher energy efficiency. By introducing a reinforcement learning-based energy efficiency optimization algorithm, the system can autonomously learn the optimal energy-saving strategy under different load and threat scenarios, achieving a balance between security protection and green energy conservation. This collaborative design helps reduce the overall operating cost of power system security protection systems and meets the requirements of sustainable development.

[0119] To ensure the system of this invention can seamlessly interface with various existing equipment, systems, and platforms in the power industry and promote its widespread application within the power ecosystem, standardized interface design is crucial. This includes standardization of data acquisition interfaces (such as supporting commonly used industrial IoT protocols like OPC UA, MQTT, and DDS), standardization of threat intelligence sharing interfaces (such as using STIX / TAXII formats), and standardization of API interfaces with other security management systems, operation and maintenance management platforms, and cloud platforms. Defining clear, open, and interoperable interface specifications reduces the difficulty and cost of system integration, encouraging third-party developers and partners to expand functionality and innovate applications based on this system. Deep integration into the power ecosystem also means close alignment with the business processes and security standards of the power industry, such as supporting the requirements of power monitoring system security protection regulations and providing threat models and response plan templates tailored to the characteristics of the power industry. Actively participating in the formulation and promotion of industry standards can further enhance the system's versatility and influence, driving the overall improvement of power system cybersecurity.

[0120] Corresponding to the above methods, such as Figure 6 As shown, this embodiment also provides a smart monitoring and dynamic response system for cross-source security of power systems based on mimicry defense, including:

[0121] The cross-source sensing and trusted transmission unit is used to deploy acquisition agents and sensors, acquire cross-source raw data and generate the first dataset, and perform dynamic encryption and source integrity authentication based on data sensitivity and real-time requirements. The key is generated, distributed and rotated by the key management center in cooperation with the edge negotiation to obtain trusted data packets.

[0122] The mimicry decision-making and threat assessment unit is used to construct a pool of heterogeneous execution entities that are different but functionally equivalent. It dynamically schedules the selected execution entities according to their historical performance, heterogeneity, threat status, and system load, and introduces randomness to enable them to analyze the trusted data packets in parallel, obtain a set of multi-path analysis results, and form a threat determination result by an adjudication mechanism. It also identifies attack chains through cross-domain threat correlation modeling and feeds back the analysis information.

[0123] The graded handling and trusted recovery unit is used to implement differentiated handling based on the threat determination results and attack chain analysis. For low-level events, it performs alarms, monitoring enhancement and policy adjustment; for high-level events, it performs isolation, clearing and service switching; and when necessary, it relies on trusted hardware to complete trusted recovery from the bottom layer to the system, and generates handling receipts and operational metrics.

[0124] The closed-loop optimization and resource scheduling unit is used to monitor the operating status and aggregate the threat judgment results, the handling receipts and operating metrics. It uses reinforcement learning to optimize the mimicry scheduling parameters, thresholds and response logic, and uses federated learning to perform global situational analysis and model updates. It generates a set of policy parameters and resource allocation instructions based on load and threat level, and distributes the set of policy parameters to the cross-source perception layer, mimicry decision layer and dynamic response layer to update the collection and encryption policies, execution body scheduling weights and adjudication thresholds, and handling classification thresholds and action templates, respectively. It also performs elastic configuration and switching of the computing, storage and bandwidth of edge and central nodes according to the resource allocation instructions.

[0125] The edge adaptation and intensity control unit is used to perform full-stage trusted verification in resource-constrained scenarios. It adjusts the collection frequency and analysis intensity based on load and threat assessment, selects lightweight algorithms and measurement schemes, outputs intensity control instructions, and uses these instructions to control the sampling frequency of the collection agent, the number of heterogeneous executors enabled / model complexity, and measurement cycle, so as to reduce the impact on business while meeting security objectives.

[0126] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0127] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for intelligent monitoring and dynamic response of cross-source security in power systems based on mimicry defense, characterized in that, include: Deploy acquisition agents and sensors to obtain cross-source raw data and generate the first dataset. Perform dynamic encryption and source integrity authentication based on data sensitivity and real-time requirements. The key is generated, distributed and rotated by the key management center in cooperation with the edge to obtain trusted data packets. A pool of heterogeneous execution entities that are different but functionally equivalent is constructed. The execution entities are dynamically scheduled according to their historical performance, heterogeneity, threat status, and system load, and randomness is introduced. The selected execution entities analyze the trusted data packets in parallel, obtain a set of multiple analysis results, and form a threat determination result by an adjudication mechanism. The attack chain is identified through cross-domain threat correlation modeling, and the analysis information is fed back. Based on the threat assessment results and attack chain analysis, differentiated handling is implemented. For low-level events, alarms, enhanced monitoring and policy adjustments are performed, while for high-level events, isolation, elimination and service switching are performed. When necessary, trusted hardware is used to complete trusted recovery from the bottom layer to the system, and handling receipts and operational metrics are generated. The system monitors the operational status and aggregates the threat assessment results, handling receipts, and operational metrics. It uses reinforcement learning to optimize the mimicry scheduling parameters, thresholds, and response logic, employs federated learning for global situational analysis and model updates, generates a set of policy parameters and resource allocation instructions based on load and threat levels, and distributes the set of policy parameters to the cross-source perception layer, mimicry decision layer, and dynamic response layer to update the collection and encryption policies, execution body scheduling weights and adjudication thresholds, and handling classification thresholds and action templates, respectively. It also performs elastic configuration and switching of the computing, storage, and bandwidth of edge and central nodes according to the resource allocation instructions. In resource-constrained scenarios, full-stage trusted verification is performed. Based on load and threat assessment, the collection frequency and analysis intensity are adjusted, lightweight algorithms and measurement schemes are selected, and intensity control instructions are output. These intensity control instructions are used to control the sampling frequency of the collection agent, the number of heterogeneous executors enabled / model complexity, and the measurement cycle, so as to reduce the impact on business while meeting security objectives.

2. The intelligent monitoring and dynamic response method for cross-source security of power systems based on mimicry defense as described in claim 1, characterized in that, Deploy data acquisition agents and sensors to obtain cross-source raw data and generate the first dataset. Based on data sensitivity and real-time requirements, perform dynamic encryption and source integrity authentication. Keys are generated, distributed, and rotated by the key management center in conjunction with edge negotiation, resulting in trusted data packets, including: Data acquisition agents and sensors are deployed at the network boundary, core switching nodes, servers and hosts, industrial control equipment, and IoT edge devices of the power system to complete the access and initialization configuration of various communication protocols and data formats. Among them, network traffic is acquired through mirror ports, network splitters, or traffic probes, device logs are collected through Syslog or SNMP, industrial control data is accessed through OPC interfaces or specific drivers, and IoT data is accessed through corresponding IoT protocols. The collected cross-source raw data undergoes preliminary processing, including formatting, timestamp marking and alignment, cleaning and normalization, filtering of irrelevant information and removal of duplicate data. Lightweight preprocessing is also performed near the collection point to meet real-time requirements, resulting in processed data. The processed data is classified and prioritized according to its source, data type, and data sensitivity to form the first dataset for subsequent transmission and analysis; The encryption scheme is dynamically selected based on data sensitivity, real-time requirements, current network threat situation, and transmission path security. At least one of the following methods—symmetric encryption algorithm, asymmetric encryption algorithm, and a combination of the two—is used to encrypt the first dataset. Perform source authenticity and integrity verification on data before or after encryption, including at least authenticating the source identity and using digital signatures or message authentication codes to complete integrity verification; The key management center, in conjunction with edge key negotiation, completes key generation, distribution, storage, and updating. Key rotation is triggered at least based on time conditions, data volume conditions, or security event conditions. Encrypted and authenticated data, along with necessary security metadata, is encapsulated into a transmittable trusted data packet.

3. The intelligent monitoring and dynamic response method for cross-source security of power systems based on mimicry defense as described in claim 1, characterized in that, A pool of heterogeneous execution entities, each distinct yet functionally equivalent, is constructed. These entities are dynamically scheduled based on historical performance, heterogeneity, threat profile, and system load, incorporating randomness. The selected execution entities perform parallel analysis of trusted data packets, yielding a multi-path analysis result set. A decision-making mechanism then generates a threat assessment result. Furthermore, cross-domain threat correlation modeling identifies attack chains, and the analysis information is fed back, including: Establish a heterogeneous execution pool and register the implementation differences, functional equivalence, applicable data types, computing resource requirements, and historical performance indicators of each execution. Obtain current threat situation indicators and system load indicators, and combine them with the historical performance indicators and the heterogeneity measurement between execution entities to form scheduling input; Based on the scheduling input, a scheduling score containing a randomness factor is generated. A set of target executors is selected according to the score, and an analysis task for the trusted data packet is issued to the target executors. The target executor performs parallel analysis on the trusted data packet in an isolated execution environment, outputting analysis results containing discrimination conclusions and relevant indicators, which are then aggregated to form the multi-path analysis result set; The threat determination result is obtained by comprehensively judging the set of multi-path analysis results using an adjudication mechanism. Based on the multi-path analysis result set and the threat determination result, cross-domain threat correlation modeling is performed to identify attack chains and generate correlation analysis receipts; The correlation analysis receipt and the threat determination result are fed back to update the scheduling weight, execution body activation strategy and adjudication threshold, and are used for subsequent processing.

4. The intelligent monitoring and dynamic response method for cross-source security of power systems based on mimicry defense according to claim 1, characterized in that, Based on the threat assessment results and attack chain analysis, differentiated handling is implemented. For low-level events, alerts, enhanced monitoring, and policy adjustments are performed; for high-level events, isolation, cleanup, and service switching are implemented. When necessary, trusted hardware is used to complete trusted recovery from the underlying layer to the system, generating handling receipts and operational metrics, including: It receives threat assessment results and attack chain analysis information output by the mimicry decision layer, analyzes the threat type, threat level and affected assets, and uses them to drive the graded handling process; Based on a pre-defined hierarchical handling logic, a handling path is selected, where low-risk events and high-risk events trigger different sets of response actions respectively; For low-risk events, implement alerts and notifications, enhance monitoring and policy adjustments, and perform information verification and automated script processing when necessary to provide audit logs and data support while ensuring availability; For high-risk events, implement network isolation, process termination and service suspension, account disabling, malicious code removal and system rollback, and switch to backup system and activate emergency plan when necessary to quickly contain the spread and protect core business. When software layer recovery is insufficient to guarantee trustworthiness, a trustworthy recovery of the software stack from the bottom layer to the system is implemented by relying on the hardware root of trust of the trusted platform module or trusted cryptographic module to ensure the integrity and trustworthiness of the recovered system. After the handling is completed, the handling receipt is generated and the operation metrics are recorded; the operation metrics include at least the handling logs such as event time, source, type and affected objects, as well as operation indicators for closed-loop evaluation.

5. The intelligent monitoring and dynamic response method for cross-source security of power systems based on mimicry defense according to claim 1, characterized in that, The system monitors operational status and aggregates threat assessment results, handling receipts, and operational metrics. It employs reinforcement learning to optimize mimicry scheduling parameters, thresholds, and response logic. Federated learning is used for global situational analysis and model updates. Based on load and threat levels, a set of policy parameters and resource allocation instructions are generated. These policy parameter sets are then distributed to the cross-source perception layer, mimicry decision-making layer, and dynamic response layer to update collection and encryption strategies, execution entity scheduling weights and adjudication thresholds, and handling classification thresholds and action templates, respectively. The system also performs elastic configuration and switching of computing, storage, and bandwidth for edge and central nodes according to the resource allocation instructions, including: Establish a runtime status monitoring and aggregation module to periodically collect load indicators, latency indicators, throughput indicators and security event indicators, and perform time alignment and normalization with the threat judgment results, the handling receipts and the runtime metrics to form a closed-loop training dataset. Based on the closed-loop training dataset, a state representation is constructed, and an action space and reward definition including mimicry scheduling parameters, thresholds and response logic are set to drive the reinforcement learning agent to perform policy iteration and output optimized mimicry scheduling parameters, thresholds and response logic. A federated learning framework is adopted in multiple deployment domains. Each deployment domain performs local training and generates model update quantities without sharing the original data. The coordinator aggregates the model update quantities to obtain the global situation model and corresponding update weights. Based on the reinforcement learning output and the global situation model, a set of strategy parameters and resource allocation instructions are generated. The set of strategy parameters is used to update the acquisition and encryption strategies of the cross-source perception layer, the execution body scheduling weight and adjudication threshold of the mimicry decision layer, and the handling classification threshold and action template of the dynamic response layer. The resource allocation instructions are used to flexibly configure and switch the computing, storage and bandwidth of edge nodes and central nodes according to load and threat level. The strategy parameter set and the resource allocation instruction are sent to the corresponding layer and the corresponding node and executed. The execution confirmation and the effective time are recorded to obtain the configuration effective receipt. The system evaluates the running status after the configuration takes effect. When the performance or security metrics fail to reach the preset threshold, it triggers a rollback to the previous stable version and records the reason for use in subsequent strategy iterations and model updates.

6. The intelligent monitoring and dynamic response method for cross-source security of power systems based on mimicry defense according to claim 1, characterized in that, In resource-constrained scenarios, full-stage trusted verification is performed. Based on load and threat assessment, the collection frequency and analysis intensity are adjusted. Lightweight algorithms and measurement schemes are selected, and intensity control commands are output. These commands are used to control the sampling frequency of the collection agent, the number of heterogeneous executors enabled / model complexity, and the measurement cycle, in order to reduce the impact on business while meeting security objectives. This includes: When the computing resources, storage resources, or network bandwidth of an edge node are lower than a preset threshold, or when a resource-constrained device type is identified, the edge adaptation process is triggered. Trust measurement and integrity verification are performed on the startup phase, configuration phase, operation phase and data phase to obtain trust verification results, which are used to determine whether subsequent strength adjustments are allowed to take effect. Collect and calculate load indicators and security status indicators to form the input for strength decision-making; Based on the credible verification results and intensity decision input, target intensity levels are generated under a preset mapping relationship, resulting in the collection intensity target, analysis intensity target, and measurement intensity target. From the set of lightweight acquisition strategies, the set of lightweight analysis algorithms, and the set of lightweight measurement schemes, select a scheme that matches the target intensity level and determine the parameter range for execution; Generate intensity control commands within the specified parameter range; The intensity control command is sent to the acquisition agent, the mimicry decision layer and the trust measurement module. The acquisition agent adjusts the sampling frequency and local preprocessing intensity accordingly, the mimicry decision layer adjusts the number of heterogeneous executors and model complexity accordingly, and the trust measurement module adjusts the measurement cycle and measurement depth accordingly. After the instruction takes effect, key performance indicators and key safety indicators are evaluated. If any indicator fails to reach the preset threshold, the system is rolled back to the previous stable strength setting and the reason is recorded. Generate an intensity adjustment receipt and update the running metrics. Feedback the receipt and the running metrics to the policy optimization module for subsequent policy iteration and model updates.

7. The intelligent monitoring and dynamic response method for cross-source security of power systems based on mimicry defense according to claim 6, characterized in that, The load metrics and security posture metrics include processor utilization, storage usage, link bandwidth, end-to-end latency, and current threat level.

8. The intelligent monitoring and dynamic response method for cross-source security of power systems based on mimicry defense according to claim 6, characterized in that, The intensity control instructions include at least the sampling frequency, the number of heterogeneous executors enabled, the model complexity, and the measurement period.

9. The intelligent monitoring and dynamic response method for cross-source security of power systems based on mimicry defense according to claim 1, characterized in that, Federated learning is used for global situational analysis and model updates, including: Edge nodes and central nodes perform local training and generate model update quantities based on the threat determination results, the handling receipts, and the running metrics, without sharing cross-source raw data and trusted data packets. The federated learning framework aggregates the model updates to obtain a global situation model and update weights; the update weights are then distributed to edge nodes and center nodes to update the local models and participate in the generation of the policy parameter set in subsequent cycles.

10. A smart monitoring and dynamic response system for cross-source security of power systems based on mimicry defense, characterized in that, include: The cross-source sensing and trusted transmission unit is used to deploy acquisition agents and sensors, acquire cross-source raw data and generate the first dataset, and perform dynamic encryption and source integrity authentication based on data sensitivity and real-time requirements. The key is generated, distributed and rotated by the key management center in cooperation with the edge negotiation to obtain trusted data packets. The mimicry decision-making and threat assessment unit is used to construct a pool of heterogeneous execution entities that are different but functionally equivalent. It dynamically schedules the selected execution entities according to their historical performance, heterogeneity, threat status, and system load, and introduces randomness to enable them to analyze the trusted data packets in parallel, obtain a set of multi-path analysis results, and form a threat determination result by an adjudication mechanism. It also identifies attack chains through cross-domain threat correlation modeling and feeds back the analysis information. The graded handling and trusted recovery unit is used to implement differentiated handling based on the threat determination results and attack chain analysis. For low-level events, it performs alarms, monitoring enhancement and policy adjustment; for high-level events, it performs isolation, clearing and service switching; and when necessary, it relies on trusted hardware to complete trusted recovery from the bottom layer to the system, and generates handling receipts and operational metrics. The closed-loop optimization and resource scheduling unit is used to monitor the operating status and aggregate the threat judgment results, the handling receipts and operating metrics. It uses reinforcement learning to optimize the mimicry scheduling parameters, thresholds and response logic, and uses federated learning to perform global situational analysis and model updates. It generates a set of policy parameters and resource allocation instructions based on load and threat level, and distributes the set of policy parameters to the cross-source perception layer, mimicry decision layer and dynamic response layer to update the collection and encryption policies, execution body scheduling weights and adjudication thresholds, and handling classification thresholds and action templates, respectively. It also performs elastic configuration and switching of the computing, storage and bandwidth of edge and central nodes according to the resource allocation instructions. The edge adaptation and intensity control unit is used to perform full-stage trusted verification in resource-constrained scenarios. It adjusts the collection frequency and analysis intensity based on load and threat assessment, selects lightweight algorithms and measurement schemes, outputs intensity control instructions, and uses these instructions to control the sampling frequency of the collection agent, the number of heterogeneous executors enabled / model complexity, and measurement cycle, so as to reduce the impact on business while meeting security objectives.

Images