Digital power grid network security protection efficiency quantitative evaluation method, system, equipment and medium

Abstract

The invention discloses a digital power grid network security protection efficiency quantitative evaluation method, system, equipment and medium, and belongs to the technical field of digital power grid network security, and the method comprises the steps: constructing a digital power grid network threat situation deduction graph, and constructing a digital power grid network threat situation deduction graph through a reverse construction algorithm facing key equipment and a forward construction algorithm facing whole network topology; acquiring a complete threat path by adopting depth-first and breadth-first search strategies respectively; based on the threat situation deduction graph, establishing a network real-time threat event stack through a threat event real-time analysis algorithm, performing threat event matching and time-space correlation analysis, and constructing a real-time threat situation deduction graph; a multi-level quantitative evaluation system is established, and evaluation indexes of a threat event, a threat path, a threat target and a whole-network threat situation are gradually and recursively calculated by calculating four dimensions of an asset value degree, a threat event influence degree, a successful support rate and a concealment degree. The problem that digital power grid network security protection efficiency is difficult to quantitatively evaluate is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of digital power grid network security, and particularly relates to a digital power grid network security protection effectiveness quantitative evaluation method, system, device and medium. BACKGROUND

[0002] As an important carrier of the power system, digital power grid realizes intelligent operation and management of the power grid through digital technology. With the deepening of the construction of digital power grid, the power grid system is facing increasingly complex network security threats. Traditional power systems mainly focus on physical security, while digital power grid introduces a large number of information communication technologies, making network attacks an important factor threatening the safe operation of the power grid.

[0003] In the field of digital power grid, large-scale smart grid systems not only involve extensive geographical distribution, but also require high real-time performance to ensure the stability and safety of power supply. In the face of increasingly severe network attack threats, the security protection technology of digital power grid is particularly important. From the perspective of system theory and control theory, the network security defense system of digital power grid is a large-scale complex system with monitoring and regulation as the core. The system integrates distributed data from sensors and databases through multi-level information fusion, and identifies and actively responds to potential network attacks in real time.

[0004] Currently, the network security protection of digital power grid mainly adopts traditional security protection means, such as firewalls, intrusion detection systems, and other passive defense measures. These methods have problems such as response lag, false positive rate, etc. when facing complex network attacks. At the same time, the existing security evaluation methods mostly use qualitative analysis, lack of quantitative evaluation indicators and scientific evaluation system, and are difficult to accurately reflect the real security state and protection effectiveness of digital power grid.

[0005] In the prior art, network security situation awareness mainly focuses on single-point threat detection and static risk assessment, lacking dynamic modeling of threat propagation paths and real-time analysis of network-wide threat situation. Traditional evaluation methods are often based on experience judgment or simple statistical analysis, which cannot accurately quantify the influence of various threat factors on power grid security, nor can they provide scientific data support for decision makers. SUMMARY

[0006] In view of the above problems, the present application is proposed.

[0007] Therefore, the technical problem solved by the present application is: how to solve the problem that the prior art lacks threat situation modeling methods for the characteristics of digital power grid, and cannot accurately predict the network threat propagation path and scientifically evaluate the protection effectiveness.

[0008] To solve the above technical problems, the application provides the following technical scheme: a digital power grid network security protection efficiency quantitative evaluation method, which comprises the following steps: constructing a digital power grid network threat situation deduction graph, starting from a threat target state through a reverse construction algorithm for key equipment, reversely searching an intrusion path by using a depth-first search strategy, starting from an initial state through a forward construction algorithm for a whole network topology, and forwardly searching all potential intrusion paths of the whole network power system by an attacker by using a breadth-first search strategy;

[0009] Based on the threat situation deduction graph, a network real-time threat event stack is established through a threat event real-time analysis algorithm, each network real-time threat event is sequentially traversed, threat events in the threat situation deduction graph are matched with real-time threat events, a space-time correlation relationship of network threats is analyzed, and timestamps of threat states and threat events are updated;

[0010] A multi-level quantitative evaluation system from threat events to a whole network threat situation is established, threat events are quantitatively evaluated through calculation of four dimensions of asset value degree, threat event influence degree, threat event success support rate and threat event concealment degree, and threat state transition atomic sequence evaluation indexes, threat path evaluation indexes, threat target evaluation indexes and whole network threat situation evaluation indexes are gradually recursively calculated based on threat event evaluation indexes.

[0011] As a preferred scheme of the digital power grid network security protection efficiency quantitative evaluation method, the method comprises the following steps: the construction of the digital power grid network threat situation deduction graph comprises the following steps: taking a threat target state as a starting point through a reverse construction algorithm, judging a threat event threat situation of the target, querying network vulnerability information, adding threat state nodes meeting a premise state to the threat situation deduction graph until an initial state node is reached or the number of state transitions exceeds a maximum value;

[0012] An initial state set is established through a forward construction algorithm, a threat event threat situation of an initial state node is judged, threat state node information reached after an intrusion is queried, whether the threat state node is in a threat finite set is judged, and the process is continued until no network vulnerability threat event is generated or the number of state transitions exceeds a maximum value.

[0013] As a preferred scheme of the digital power grid network security protection efficiency quantitative evaluation method, the threat event real-time analysis algorithm comprises the following steps: defining a variable to satisfy a situation judgment function to judge a threat state and a threat event satisfying situation, defining a timestamp function to record a threat event and a threat state occurrence time, and defining a time window to filter invalid and expired threat events;

[0014] The time and space correlation of the threat events is analyzed, the threat state and the timestamp of the threat event are updated, and a real-time threat situation deduction diagram is output by traversing each threat event in a network real-time threat event stack.

[0015] As a preferred scheme of the digital power grid network security protection efficiency quantitative evaluation method, the establishment of the multi-level quantitative evaluation system from the threat event to the whole network threat situation includes calculating the asset value degree by combining the asset value vector and the asset value weight, defining the threat event influence degree based on the attack classification and the corresponding level, calculating the threat event success support rate by matching the network vulnerability information and the vulnerability information used by the threat event, and calculating the threat event concealment degree by synthesizing the device influence function, the user influence function and the intrusion degree function.

[0016] Based on the threat event evaluation index, the threat state transition atomic sequence evaluation index is calculated by combining the threat event success support rate and the weight, the threat path evaluation index is calculated by considering all threat state transition atomic sequence evaluation indexes on the path, the threat target evaluation index is calculated by combining the intrusion path selection probability, and the whole network threat situation evaluation index is obtained by summing the threat situation evaluation indexes of all threat targets in the whole network.

[0017] As a preferred scheme of the digital power grid network security protection efficiency quantitative evaluation method, the calculation of the threat event success support rate includes searching for whether the necessary vulnerability used by the threat event exists in the network state node, and if all necessary vulnerabilities are not contained, the threat event success support rate is zero.

[0018] If all necessary vulnerabilities are contained, further search is performed to determine whether other vulnerabilities exist, if the other vulnerabilities exist, the threat event success support rate is the accumulation of the weight of the other vulnerabilities, and if the other vulnerabilities do not exist, the threat event success support rate is 1.

[0019] As a preferred scheme of the digital power grid network security protection efficiency quantitative evaluation method, the calculation of the threat event concealment degree includes defining the device influence function according to the degree of detection device alarm caused by the network security state change, defining the user influence function according to the degree of user awareness caused by the network security state change, and defining the intrusion degree function according to the intrusion degree caused by the threat event.

[0020] When the device is not alarmed or the user is not aware, the threat event concealment degree is 1, and when the device is alarmed or the user is aware, the threat event concealment degree is the product of the intrusion degree and the average value of the device influence and the user influence.

[0021] As a preferred scheme of the digital power grid network security protection efficiency quantitative evaluation method, wherein: further comprising calculating the early warning success rate, defense success rate, average disposal time and tactical decision accuracy timeliness of the digital power grid network security protection based on the quantitative evaluation result, forming a comprehensive protection efficiency evaluation index system.

[0022] The application provides a digital power grid network security protection efficiency quantitative evaluation system.

[0023] To solve the above technical problems, the application provides the following technical scheme: a digital power grid network security protection efficiency quantitative evaluation system, comprising: a threat situation construction module, configured to construct a digital power grid network threat situation deduction graph, starting from a threat target state through a reverse construction algorithm facing key equipment, searching an intrusion path in reverse through a depth-first search strategy, and starting from an initial state through a forward construction algorithm facing a whole network topology, searching all potential intrusion paths of the attacker to the whole network power system in forward through a breadth-first search strategy;

[0024] A real-time analysis module is configured to establish a network real-time threat event stack through a threat event real-time analysis algorithm based on the threat situation deduction graph, sequentially traverse each network real-time threat event, match the threat event in the threat situation deduction graph with the real-time threat event, analyze the space-time correlation relationship of the network threat and update the time stamp of the threat state and the threat event;

[0025] A quantitative evaluation module is configured to establish a multi-level quantitative evaluation system from the threat event to the whole network threat situation, quantitatively evaluate the threat event through calculation of four dimensions of asset value degree, threat event influence degree, threat event success support rate and threat event concealment degree, and gradually recursively calculate a threat state transition atomic sequence evaluation index, a threat path evaluation index, a threat target evaluation index and a whole network threat situation evaluation index based on a threat event evaluation index.

[0026] The application provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the digital power grid network security protection efficiency quantitative evaluation method when executing the computer program.

[0027] The application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the steps of the digital power grid network security protection efficiency quantitative evaluation method.

[0028] The application has the beneficial effects that: the application is constructed by bidirectional threat situation deduction graph, solves the problem of incomplete coverage of traditional one-way threat analysis, and the reverse construction algorithm ensures the accurate identification of the threat path of the key equipment, and the forward construction algorithm realizes the complete coverage of the whole network threat situation. The threat event real-time analysis algorithm converts the static threat graph into a dynamic threat situation through space-time correlation analysis, realizes the real-time tracking and prediction of the threat evolution process, and solves the problem of poor timeliness of the traditional method. The multi-level quantitative evaluation system starts from four core dimensions of threat events, realizes the quantitative evaluation from local to whole through recursive calculation, and converts the qualitative threat analysis into quantitative efficiency evaluation. BRIEF DESCRIPTION OF DRAWINGS

[0029] In order to more clearly illustrate the technical solutions of the embodiments of the application, the drawings needed to be used in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0030] Figure 1 A general flowchart of a digital power grid network security protection efficiency quantitative evaluation method provided by an embodiment of the application.

[0031] Figure 2 A network threat real-time analysis algorithm diagram of a digital power grid network security protection efficiency quantitative evaluation method provided by an embodiment of the application.

[0032] Figure 3 A diagram of quantitative evaluation from local to whole in a logical order step by step of a digital power grid network security protection efficiency quantitative evaluation method provided by an embodiment of the application.

[0033] Figure 4 A threat event success support rate measurement algorithm diagram of a digital power grid network security protection efficiency quantitative evaluation system provided by an embodiment of the application. DETAILED DESCRIPTION

[0034] In order to make the above-mentioned purposes, features and advantages of the application more obvious and easy to understand, the specific embodiments of the application will be described in detail below with reference to the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the application, rather than all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor should be within the protection scope of the application.

[0035] Embodiment 1, refer to Figures 1-4 For an embodiment of the application, the embodiment provides a digital power grid network security protection efficiency quantitative evaluation method, which comprises:

[0036] S100: Constructing a digital power grid network threat situation deduction graph, starting from a threat target state through a reverse construction algorithm for key equipment, using a depth-first search strategy to search for intrusion paths in reverse, and starting from an initial state through a forward construction algorithm for the entire network topology, using a breadth-first search strategy to search for all potential intrusion paths of the attacker to the entire network power system;

[0037] S200: Based on the threat situation deduction graph, a network real-time threat event stack is established through a threat event real-time analysis algorithm, each network real-time threat event is iterated in turn, the threat events in the threat situation deduction graph are matched with the real-time threat events, the spatio-temporal correlation of network threats is analyzed and the timestamps of threat states and threat events are updated;

[0038] S300: A multi-level quantitative evaluation system from threat events to the entire network threat situation is established, threat events are quantitatively evaluated through calculation of asset value, threat event impact, threat event success support rate and threat event concealment, and based on threat event evaluation indexes, threat state transition atomic sequence evaluation indexes, threat path evaluation indexes, threat target evaluation indexes and entire network threat situation evaluation indexes are recursively calculated.

[0039] It should be noted that as the core carrier of new power systems, digital power grids have network security threats with complex attack paths, fast threat propagation speed and wide influence range. Traditional security evaluation methods mainly rely on single-point detection and static analysis, and cannot cope with distributed attacks and dynamic threat evolution. Key equipment in digital power grids such as SCADA systems (Supervisory Control And Data Acquisition), intelligent terminals, communication gateways and other nodes are numerous and interconnected. Once a node is compromised, the threat can quickly spread to other key equipment through network topology, causing a chain reaction. At the same time, digital power grids have very high real-time requirements, and threat detection and response must be completed within milliseconds, which puts higher requirements on the quantitative evaluation of security protection effectiveness.

[0040] Therefore, in view of the above-mentioned key problems of digital power grid network security protection such as threat situation modeling difficulty, insufficient real-time analysis capability and lack of quantitative evaluation system, through the steps of S100-S300, a bidirectional search threat situation deduction model is constructed, comprehensive coverage and accurate prediction of attack paths are achieved; a real-time threat analysis mechanism is established to dynamically track the threat evolution process and update the threat state in time; a multi-level quantitative evaluation system is constructed to progressively evaluate from threat events to the entire network situation, and scientific quantification and accurate evaluation of the effectiveness of digital power grid network security protection are achieved.

[0041] Embodiment 2, which is an embodiment of the present application, provides a digital power grid network security protection effectiveness quantitative evaluation method based on the previous embodiment, comprising: step S100 of constructing a digital power grid network threat situation deduction graph, step S100 comprising steps A1-A2:

[0042] A1: starting from a threat target state, judging whether a threat event threatens the target, querying network vulnerability information, and adding a threat state node meeting the premise state to the threat situation deduction graph until the initial state node is reached or the maximum number of state transitions is exceeded;

[0043] Specifically, the reverse construction algorithm for threat targets can effectively reduce the size of the network threat situation deduction graph and improve the search efficiency of the algorithm by defining the maximum number of state transitions MAXSTEP, as the number of threat states in the actual network environment is limited, while ensuring that no threat states are missed.

[0044] Target state , a single threat target state node representing a specific attack end state that an attacker hopes to achieve; threat target set , a set containing multiple target states , which is the sum of all potential threat target states; linked list ; a data structure for storing the threat target set, which adopts a linked list form to facilitate dynamic addition and deletion of threat target states; threat target ; a specific attack object or attack intention of an attacker, which may correspond to one or more target states; threat target state set ST, a set of threat target states dynamically maintained during algorithm execution, used for intersection judgment with the state transition function set;

[0045] Put the threat target set containing the target state into the linked list , take a target state from the head of the linked list, judge whether the threat target state has been met, if it has been met, it means that the state has been traversed, and it is put back into the linked list ; if it is not met, proceed to the next step.

[0046] The premise state of the threat target composes the state transition function set { }. Search the finite set of threat events ET to find all threat event sets { } that lead to , and iterate with the threat event set { }. Judge the state transition function set { and threat target state set whether intersect, if intersect, add this threat event to the DG dynamic graph (Dynamic Graph, refers to the data structure of threat situation deduction graph), and update the corresponding state node; if not intersect, forward recursion of target state, state transition times plus 1, algorithm iteration; in the iteration process, judge state transition function set } is empty, if not empty, return to continue iteration; if empty, proceed to the next step. Judge whether the threat event set } is empty, if not empty, return to continue iteration; if empty, add the current threat state to The initial state set of the threat is represented by the initial state node set D0, which represents the starting state node set of the threat analysis.

[0047] It should be noted that the reverse construction algorithm needs to establish a data structure management of threat state nodes during execution, each threat state node contains state identifier, threat type classification, premise condition set, influence range parameter and state transition probability matrix.

[0048] In the search process, the algorithm maintains a dynamically updated threat state priority queue, and sorts the search path according to the importance of the threat target and the attack complexity. At the same time, a state node access marking mechanism is established to avoid circular search and repeated calculation, and the search efficiency is improved by marking the accessed state nodes.

[0049] In the construction of state transition function set, the algorithm needs to consider the trigger condition and execution probability of threat event, the trigger condition of threat event is described by logical expression, and the logical expression description includes system state condition, time constraint condition and resource availability condition. The execution probability is estimated based on historical attack data, and the dynamic adjustment probability value is adjusted. When the threat event set is empty, the algorithm automatically backtracks to the upper state node and continues to search other possible threat paths.

[0050] A2: Establish the initial state set by the forward construction algorithm, judge the threat of threat events to the initial state node, query the threat state node information reached after intrusion, judge whether the threat state node is in the threat finite set, until there is no threat event of network vulnerability or the state transition times exceed the maximum value.

[0051] Specifically, the forward construction algorithm starts by adding the initial state node to the initial state node set D0. Within the range of the maximum state transition times MAXSTEP, judge whether the reachable threat state has been satisfied. If it is satisfied, it means that the state has been traversed and it is put back into the reachable state node set Dr; if it is not satisfied, get the threat events that can be triggered to the reachable state node​ A set of threat events is generated. It is determined whether the reachable state node is in the threat finite set ST, if not, the reachable node is added to the threat finite set ST and the temporary set Stemp, and the algorithm iteration is performed; if yes, the corresponding threat event and state node are added to the DG, and after the algorithm iteration is completed, the threat situation deduction graph of the global network is output.

[0052] The results of the forward construction algorithm and the reverse construction algorithm are fused to form a complete threat situation deduction graph. The fusion process first converts the graphs constructed in the two directions into a standardized directed graph format. Node fusion uses an attribute matching algorithm to calculate the similarity through the threat type, impact range, and state characteristics of the nodes, identify duplicate nodes, and merge them. In the edge fusion process, for threat event edges with the same start and end nodes, a probability weighted average method is used to calculate the transition probability after fusion.

[0053] The fused threat situation deduction graph is verified for completeness. The verification process includes path connectivity checking to ensure that there is a reachable path from the initial state to each threat target; loop detection to identify and process loop structures in the graph; consistency checking to verify the logical consistency of the forward and reverse construction results. After verification is complete, a standardized threat situation deduction graph data structure is generated.

[0054] In this embodiment, the threat event real-time analysis algorithm in step S200 includes the following steps B1-B2:

[0055] B1: Define a variable satisfaction condition function to determine the satisfaction condition of the threat state and the threat event, define a timestamp function to record the occurrence time of the threat event and the threat state, and define a time window to filter invalid and expired threat events;

[0056] Specifically, a variable satisfaction condition function D(x) is defined. The state node set includes an initial state node set D0 and an undetermined state node set UDr, D0 is the initial state node set, representing the initial security state of the network, and UDr is the undetermined state node set, representing the node whose state is uncertain and the elements of the threat event set De of the utilization node exist in three states (TRUE, FALSE, HYP). The variable satisfaction condition function D(x) is used to determine the satisfaction condition of the threat state or the threat event, where TRUE indicates that the variable has been satisfied, FALSE indicates that the variable has not been satisfied, and HYP indicates that the variable is assumed to be satisfied. The determination results of the threat state and the threat event are as follows: ; ;

[0057] wherein, ​is a set of threat events; is a threat state decision function for determining the satisfaction of a threat state s.

[0058] Based on the structured data of the threat situation deduction diagram, a spatio-temporal correlation analysis database of threat events is established. The spatio-temporal correlation analysis database describes the relationship between threat events through a multi-dimensional feature vector, including the time dimension of the order, duration and frequency of occurrence, the spatial dimension of the network topology distance, the overlap degree of the influence range and the similarity of the propagation path.

[0059] B2: Traverse each threat event in the real-time threat event stack of the network, analyze the spatio-temporal correlation relationship of the threat event, update the timestamps of the threat state and the threat event, and output the real-time threat situation deduction diagram.

[0060] Specifically, a timestamp function T(x) is defined. In a complete intrusion process, for a step of intrusion, the network threat event may occur multiple times, causing multiple alarms of the security monitoring device. In order to determine and record the occurrence time of the latest threat event and threat state, a timestamp function T(x) needs to be set.

[0061] For the timestamp function of the network threat event and the timestamp function of the network threat state , meet , then the timestamp of the network threat event can be expressed as , ; the timestamp of the network threat state can be expressed as: ; ; ;

[0062] wherein, is a network threat event; is a set of network threat states; is a timestamp function of the network threat state; is a timestamp function of the network threat event; is the current time; is a threat event stack; is a threat state stack; is a network threat event prerequisite state; is a set of exploitable network threat states; is not limited by time; is a network threat event; is a network threat event; is a prerequisite condition set of the threat state s'; is a timestamp function of the threat state s'. is a threat state; is an instance representing a threat event, which is a specific implementation of the network threat event e; is a specific occurrence time of the threat event instance , that is, a timestamp at which the threat event is detected or occurs in the actual system.

[0063] define a time window . The time window is the maximum time interval during which the intrusion behavior takes effect. For some invalid and expired threat events, the size of the time window is set to Δ , if is satisfied, it indicates that some invalid and expired threat events with too large a time span are generated, which lose their value and should be filtered out. If is satisfied, it indicates that the two consecutive threat events are valid. is the absolute value of the time difference between the occurrence times of the two consecutive threat events; the network threat real-time analysis algorithm is described as Figure 2 .

[0064] First, a stack of network real-time threat events is established, each network real-time threat event is traversed in turn, the threat events in the DG are matched with the real-time threat events, various spatio-temporal correlation relationships of the network threat are analyzed and processed accordingly, and finally the threat state and the timestamp of the threat event are updated and input into the DG to construct a network real-time threat situation deduction graph (RTDG), and when the stack of network real-time threat events is empty, the algorithm stops.

[0065] The evaluation method of the present application is based on the established network threat situation deduction graph, and is quantitatively evaluated in a logical order from local to global, as shown in Figure 3 .

[0066] The real-time threat situation deduction graph is constructed and dynamically updated at the same time, and the dynamic update includes two modes of incremental update and full update. The incremental update is suitable for the case where the number of threat events is small, and only the state information of the affected nodes and edges is updated. The full update is suitable for the case where the threat situation changes significantly, and the state distribution of the entire threat situation deduction graph is recalculated.

[0067] A threat event priority ranking is established, and the threat events are ranked according to their urgency, impact range and processing complexity. High-priority threat events are given priority to enter the processing queue to ensure that critical threats can be responded to in a timely manner. At the same time, a threat event aggregation mechanism is established to merge similar threat events for processing, reducing repeated calculation and analysis overhead.

[0068] In the present embodiment, a multi-level quantitative evaluation system from threat events to the entire network threat situation is established in step S300, including the following steps C1-C4:

[0069] C1: Calculate asset value degree by combining asset value vector with asset value weight, define threat event impact degree based on attack classification and corresponding level, calculate threat event success support rate by matching network vulnerability information with vulnerability information used by threat event, calculate threat event concealment degree by combining device impact function, user impact function and intrusion degree function;

[0070] Specifically, four indexes related to threat event evaluation index and their quantitative calculation methods.

[0071] (1) Asset value degree : Reflects the value of the network entity that is exploited by the intrusion.

[0072] (2) Threat event impact degree : Embodies the effectiveness and destructiveness of the threat event.

[0073] (3) Threat event success support rate : Reflects the probability of success of the threat event in exploiting vulnerability information.

[0074] (4) Threat event concealment degree : Embodies the degree of concealment of the threat event in the intrusion process.

[0075] Asset value degree:

[0076] Assets are the objects on which threat events act, and the evaluation of threat events cannot be separated from the measurement of asset value degree. Assets with high value degree bring greater benefits to intruders, and therefore often become the focus of various threats. Select a part of the basic evaluation index set related to asset value degree for level measurement, as shown in the following table. This evaluation index set includes three indexes: confidentiality impact (ConI), integrity impact (IntI) and availability impact (AvaI).

[0077] Asset value reflects the value of the network entity that is invaded. According to the CVSS basic evaluation index set, the following definitions are made. CVSS is the Common Vulnerability Scoring System, a standardized method for evaluating the severity of network security vulnerabilities; refer to Table 1, Table 1: CVSS partial basic evaluation index measurement set

[0078] Define asset value vector V. Asset value vector V = [ConI, IntI, AvaI], indicating that asset value is composed of three components: confidentiality value, integrity value and availability value, and the total amount of asset value is obtained by calculating the sum of the three components.

[0079] The asset value weight μ is defined. The asset value weight is the proportion of the three components of the asset value vector in the total asset value, which can be expressed as μ = [ConI, IntI, AvaI]T. The calculation method of each weight value is: ;

[0080] Wherein, ConI represents the confidentiality asset value weight, IntI represents the integrity asset value weight, AvaI represents the availability asset value weight, and satisfies: ; ConI is the confidentiality impact; IntI is the integrity impact; AvaI is the availability impact.

[0081] The greater the ConI, IntI, and AvaI index impacts of the basic evaluation index measurement set, the greater the corresponding index level measurement value, and the greater the threat to the asset. Therefore, the asset value degree V is obtained by combining the asset value vector V and the asset value weight μ, and the calculation formula is: ;

[0082] Wherein, i=1, 2, 3 respectively represent the three components of the asset value vector: confidentiality value, integrity value, and availability value, μ represents the asset value weight, and I represents the level measurement of the three components of the asset value.

[0083] Based on the threat event assessment index, the index is obtained by multiplying the four dimensions (asset value degree V(e), threat event impact degree I(e), success support rate P(e), and concealment degree H(e)) calculated in the foregoing steps, that is: ;

[0084] Wherein, is the assessment index of the i th threat event; represents the sum of the asset value degrees of the i th threat event affecting the device, represents the impact degree of the i th threat event, represents the success support rate of the i th threat event, represents the concealment degree of the i th threat event.

[0085] The threat state transition atomic sequence assessment index is calculated in combination with the threat event success support rate and the weight, the threat path assessment index is calculated considering all threat state transition atomic sequence assessment indexes on the path, the threat target assessment index is calculated in combination with the intrusion path selection probability, and the global threat situation assessment index is obtained by summing the threat situation assessment indexes of all threat targets in the global network. ​

[0086] Specifically, network threat event impact degree Associated with the effectiveness of the threat event and the impact caused by the threat event, referring to the definition method of attack classification and its corresponding level in Snort user manual, the threat event impact degree is divided into high, medium, low and very low four levels, and the level measurement values are defined as 4, 3, 2 and 1 respectively. All threat events correspond to 34 attack types, of which 10 attack types have high threat event impact degree, 16 attack types have medium threat event impact degree, 7 attack types have low threat event impact degree, and 1 attack type has very low threat event impact degree, as shown in the following table. Referring to Table 2, Table 2 Attack classification and its threat event impact degree level:

[0087] The calculation of the four quantitative dimensions establishes a unified numerical normalization and weight distribution mode. Asset value degree, threat event impact degree, success support rate and concealment degree adopt different quantitative methods and numerical ranges, and need to be normalized to the same numerical interval. The normalization process adopts the minimum-maximum standardization method, which maps the values of each dimension to the [0, 1] interval.

[0088] The coupling relationship between the dimensions is established, and the mutual influence degree between the dimensions is quantified. Asset value degree and threat event impact degree have a positive correlation, and the impact caused by attacks on high-value assets is more serious. Success support rate and concealment degree have a negative correlation, and attacks that are easy to succeed usually have poor concealment and are easy to be detected. Through correlation analysis, the coupling coefficients between the dimensions are determined, and a correction matrix is established to adjust the dimension values calculated separately.

[0089] The determination of dimension weight adopts historical data driving. Through questionnaire survey, the importance ranking of each dimension is obtained, and the weight distribution is determined by combining statistical analysis of historical attack cases. In the weight distribution process, the special needs of different application scenarios are considered, such as the key infrastructure protection scenario which pays more attention to asset value degree, and the real-time monitoring scenario which pays more attention to success support rate.

[0090] C2: Calculate the threat event success support rate, including finding out whether the necessary vulnerabilities for the threat event are included in the network state node, if not, the threat event success support rate is zero;

[0091] If all necessary vulnerabilities are included, further check whether there are other vulnerabilities, if there are, the cumulative weight of other vulnerabilities is taken as the threat event success support rate, if not, the threat event success support rate is 1.

[0092] Specifically, the vulnerability information existing in the network is matched with the vulnerability information exploited by the threat event to obtain a threat event success support rate P(e). The vulnerability information vul exploited by the threat event comes from the part about vulnerability in the established ontology-based threat situation knowledge base. According to the threat degree caused by the vulnerability, vul can be divided into necessary vulnerability and other vulnerability. The necessary vulnerability refers to the vulnerability information that must be relied on for the successful occurrence of the threat event; the other vulnerability refers to the vulnerability information that may be needed in addition to the necessary vulnerability, and each of the other vulnerabilities has a certain weight ω, indicating the degree of influence on the successful implementation of the threat event, and the sum of all weights is 1. The threat event success support rate measurement algorithm is as shown in the following formula. Figure 4 The threat event success support rate measurement algorithm is as shown in the following formula.

[0093] The calculation of the threat event success support rate depends on the accurate vulnerability information database. A vulnerability information management system is established, which includes vulnerability discovery, evaluation, classification and update and other functional modules. The vulnerability discovery obtains the latest vulnerability information through automatic vulnerability scanning, security notification subscription and analysis, and adjusts the scoring results in combination with the specific system environment and configuration.

[0094] The classification management of the vulnerability information adopts a multi-dimensional label system, including vulnerability type, affected component, exploitation difficulty, repair status and the like. The version control of the vulnerability information is established to record the change history and update track of the vulnerability information. When the vulnerability information changes, the system automatically recalculates the success support rate of the affected threat event, ensuring the accuracy of the evaluation results.

[0095] The distinction between the necessary vulnerability and the other vulnerability is based on the attack mechanism analysis of the threat event. The necessary vulnerability is a sufficient condition for the successful implementation of the threat event, and the lack of any necessary vulnerability will lead to the failure of the attack. The other vulnerability is an auxiliary condition for improving the attack success rate, and the weight value is determined according to the contribution degree to the attack success. The weight allocation process adopts the analytic hierarchy process to determine the relative importance of each vulnerability through the judgment matrix.

[0096] C3: calculating the threat event concealment degree includes defining a device influence function according to the degree of alarm of the detection device caused by the change of the network security state, defining a user influence function according to the degree of user awareness caused by the change of the network security state, and defining an intrusion degree function according to the intrusion degree caused by the threat event;

[0097] When the device is not alarmed or the user is not aware, the threat event concealment degree is 1, and when the device is alarmed or the user is aware, the threat event concealment degree is the product of the intrusion degree and the average value of the device influence and the user influence.

[0098] Specifically, the concealment degree of a threat event in the intrusion process is related to three factors: (1) whether the change of network security state can cause the detection device to alarm; (2) whether the change of network security state can lead to the user's awareness; (3) the degree of intrusion caused by the threat event when the change of network security state causes the detection device to alarm or leads to the user's awareness.

[0099] According to whether the change of network security state can cause the detection device to alarm, the following device influence function is defined: ;

[0100] Wherein, is the device influence function, which quantifies the influence of the threat event on the alarm degree of the detection device; is the device influence coefficient, which represents the case that does not cause alarm or the degree is very small ( 2 ); is the device influence coefficient, which represents the case that causes alarm to a large extent ( );

[0101] In addition to causing the detection device to alarm each time, if the threat event causes a large change in the network security state, it may lead to the user's awareness, so that the user takes corresponding means to prevent it. Therefore, according to whether the change of network security state can lead to the user's awareness, the following user influence function is defined: ;

[0102] Wherein, is the user influence function, which quantifies the influence of the threat event on the user's awareness degree; is the user influence coefficient, which represents the degree of possible user attention ( 1 );

[0103] The degree of intrusion caused by the threat event when the change of network security state of the digital power grid causes the detection device to alarm or leads to the user's awareness is of great significance to the intrusion process when targeting the threat target, so the following intrusion degree function is defined: ;

[0104] Wherein, Degree represents the degree of intrusion when the change of network security state, step represents the number of intrusion steps when the device alarm or user awareness is triggered, and range represents the total number of steps of the intrusion path.

[0105] Combining the above three factors, the concealment degree of a threat event can be represented as: ;

[0106] Wherein, represent the invasion degree of the i-th threat event, represent the device impact coefficient of the i-th threat event, represent the user impact coefficient of the i-th threat event. When , it means that the device is not alarmed or the user is not aware, and the corresponding threat event has better concealment; when , the concealment at this time is the average impact coefficient of the detection device and the user, indicating that the device alarms or the user is aware of the occurrence of the threat event, and the corresponding threat event has poor concealment.

[0107] Secondly, the threat state of the network will be analyzed and evaluated in depth according to the threat event, threat state transition atomic sequence, threat path, threat target and the stage order of the network threat situation, and the quantitative calculation method of various evaluation indexes is specifically given.

[0108] Threat event evaluation index (evaluate index of threat event) depends on asset value degree, threat event impact degree, threat event success support rate and threat event concealment degree. The calculation method of these four factors has been analyzed in detail above, The calculation formula is: ;

[0109] Wherein, is the evaluation index of the i-th threat event; represents the sum of the asset value degree affected by the i-th threat event, represents the impact degree of the i-th threat event, represents the success support rate of the i-th threat event, represents the concealment degree of the i-th threat event.

[0110] Threat state transition atomic sequence is the smallest state transition unit of threat state after being affected by threat event. Threat state transition atomic sequence evaluation index (evaluate index of transactionsequence) represents the impact after the successful occurrence of threat state transition atomic sequence, and the calculation formula is: ;

[0111] Wherein, represents the probability that the threat event leads to the network state node from state to state ,​​​ represents all states premise threat events, represents threat events success support rate, represents threat events success support rate in all threat events success support rate of all arrival states.

[0112] threat path evaluation index (evaluate index of threat path) represents the impact of the threat behavior after invading along a certain path, which needs to consider all threat state transition atomic sequence evaluation indexes , and the calculation formula is: ;

[0113] wherein, represents the impact after the i-th threat state transition atomic sequence succeeds on the threat path. Threat target evaluation index: before the invader attempts to invade the threat target, it first needs to plan a suitable path. It is assumed that the invader can intelligently make a choice and can select a path with relatively low complexity according to the attack complexity of each vulnerable point to implement the invasion. The threat target evaluation index is calculated by selecting the vulnerability attack complexity grading quantization standard, as shown in the vulnerability attack complexity grading quantization standard. Referring to Table 3,

[0114] Table 3 vulnerability attack complexity grading quantization standard:

[0115] Definition 1 state transition atomic target selection probability . For any selected threat state transition atomic sequence v( , , ) in the threat path, the corresponding vulnerability attack complexity of the invader after reaching state is , and the state transition atomic target selection probability is:

[0116] wherein, represents the set of next invasion targets available for the invader after reaching ; is the corresponding vulnerability attack complexity after the invader reaches state ; is the state transition atomic target selection probability; A source state node in a sequence of threat state transition atoms; A threat event in a sequence of threat state transition atoms; A state in a sequence of threat state transition atoms.

[0117] Definition 2. Intrusion path selection probability CP. Let there be n intrusion paths for an intruder to reach a certain threat goal, which can be represented as Path = {Path1, Path2, Path3, …, Pathn}, the likelihood of the intruder selecting any one of the intrusion paths Pathi = {s0, e1, s1, e2, s2, …, sn−1, en, sn} in Path is denoted as CP(Pathi).

[0118] wherein, denotes the state transition atom target selection probability of two consecutive threat states; j is the jth intrusion path; n is the total number of intrusion paths.

[0119] Threat goal evaluation index denotes the sum of the impact caused by the intruder selecting each threat path to intrude on the intended threat goal, which comprehensively considers the possibility of the intruder selecting a threat path and the success rate of reaching the threat goal using the threat path, and the calculation formula is:

[0120] wherein, denotes the probability of the intruder selecting the ith threat path, denotes the impact situation after intruding on the threat goal using the ith threat path; is the success rate of reaching the threat goal.

[0121] Network-wide threat situation evaluation index denotes the sum of the threat situation evaluation indexes of all threat goals in the network,

[0122] the calculation formula is:

[0123] wherein, denotes the evaluation index of the ith threat goal.

[0124] ​​​​The multi-level quantitative evaluation system is constructed, and the data flow and result transmission mode between levels are established. The threat event evaluation index is taken as the basic layer to provide data input for the upper layer evaluation. The threat state transition atomic sequence evaluation index is calculated based on the threat event evaluation index, considering the probability and influence range of state transition.

[0125] The calculation of the whole network threat situation evaluation index considers the mutual dependence relationship between threat targets. The target dependence relationship graph is established to describe the influence transmission path between threat targets. When a threat target is attacked, its influence may be transmitted to other targets through the dependence relationship. The quantitative of the dependence relationship adopts the influence transmission coefficient, which is determined based on the business association degree and technical coupling degree between targets. The final whole network threat situation evaluation index is calculated by modifying the dependence relationship graph, reflecting the cascading influence effect of the threat.

[0126] C4: Further includes calculating the early warning success rate, defense success rate, average handling time and tactical decision accuracy timeliness of digital power grid network security protection based on the quantitative evaluation results, forming a comprehensive protection effectiveness evaluation index system.

[0127] The specific implementation of calculating the digital power grid network security protection effectiveness index based on the quantitative evaluation results is the whole network threat situation evaluation index obtained in the foregoing steps As the basic input data, the early warning success rate is calculated based on the coupling relationship between the threat event concealment function and the system detection capability, and is quantified by the formula: ;

[0128] wherein PW represents the early warning success rate, is the concealment degree of the i-th threat event (defined in the foregoing C3), represents the response delay time of the detection device to the i-th threat event, and TR represents the standard response time requirement of the threat event. The formula evaluates the probability of early warning failure through the product of the concealment degree and the detection delay time, and the early warning success rate is obtained by subtracting the probability from 1.

[0129] The defense success rate calculation combines the inverse index of the threat event success support rate and the system protection coverage, and is quantified by the formula: ;

[0130] wherein PD represents the defense success rate, is the success support rate of the i-th threat event (calculated in the foregoing C2), represents the protection measure coverage coefficient for the i-th threat event, and N represents the total number of threat events. The relative ease degree of defense is reflected by the reciprocal of the success support rate, and the overall defense effect is evaluated in combination with the protection coverage coefficient.

[0131] The average treatment time is calculated based on the threat path evaluation index and the response process complexity, and the formula is: ;

[0132] wherein MTTR represents the average treatment time, is the evaluation index of the i-th threat path (calculated recursively in the foregoing C1), represents the response process complexity factor corresponding to the i-th threat path, represents the standard time required for treating the i-th threat path. The formula calculates the overall treatment time in a weighted average manner through the threat path evaluation index.

[0133] The tactical decision accuracy timeliness is realized through the comprehensive evaluation of the threat target evaluation index and the decision support system performance parameters, and the calculation formula is: ;

[0134] wherein DA represents the decision accuracy timeliness index, is the evaluation index of the j-th threat target (calculated in the foregoing C1), represents the historical decision accuracy rate for the j-th threat target, represents the average decision time for the j-th threat target. Through the weighting of the threat target importance, the ratio of the historical accuracy rate and the decision time is combined to comprehensively evaluate the decision quality.

[0135] In summary, the reverse construction algorithm realizes the depth-first search of the threat path through the dynamic management of the state transition function set and the threat target set, ensuring that the threat analysis of the key threat target is not missed; the forward construction algorithm realizes the breadth-first traversal of the initial state set, ensuring the complete coverage of the network threat situation. The real-time threat event analysis establishes a space-time correlation analysis framework for threat events through the definition of the variable satisfaction condition judgment function, the timestamp function and the time window, realizes the dynamic update of the real-time threat situation and the automatic filtering of the historical threats. The multi-level quantitative evaluation system realizes the specific implementation of the asset value vector, the attack classification level, the vulnerability matching algorithm and the concealment calculation model, and converts the abstract threat concept into a calculable quantitative index. The threat event success support rate algorithm accurately reflects the actual feasibility of the threat event through the distinction calculation of the necessary vulnerability and other vulnerabilities, and provides accurate data support for the development of protection strategies.

[0136] Embodiment 3, refer to Figure 2 and Figure 4For an embodiment of the present application, the embodiment provides a digital power grid network security protection performance quantitative evaluation system, comprising: a threat situation construction module, configured to construct a digital power grid network threat situation deduction graph, starting from a threat target state through a reverse construction algorithm facing a key device, searching an intrusion path in reverse through a depth-first search strategy, and starting from an initial state through a forward construction algorithm facing a whole network topology, searching all potential intrusion paths of an attacker to a whole network power system in forward through a breadth-first search strategy;

[0137] a real-time analysis module, configured to establish a network real-time threat event stack through a threat event real-time analysis algorithm based on the threat situation deduction graph, sequentially traversing each network real-time threat event, matching a threat event in the threat situation deduction graph with a real-time threat event, analyzing a space-time correlation relationship of a network threat and updating a threat state and a time stamp of the threat event;

[0138] a quantitative evaluation module, configured to establish a multi-level quantitative evaluation system from a threat event to a whole network threat situation, quantitatively evaluating a threat event through calculation of four dimensions of asset value degree, threat event influence degree, threat event success support rate and threat event concealment degree, and gradually recursively calculating a threat state transition atomic sequence evaluation index, a threat path evaluation index, a threat target evaluation index and a whole network threat situation evaluation index based on a threat event evaluation index.

[0139] The embodiment further provides an electronic device suitable for a digital power grid network security protection performance quantitative evaluation method, comprising: a memory and a processor; the memory is configured to store computer executable instructions, and the processor is configured to execute the computer executable instructions to implement the digital power grid network security protection performance quantitative evaluation method proposed in the above embodiment.

[0140] The embodiment further provides a storage medium having a computer program stored thereon, and the program is executed by a processor to implement the digital power grid network security protection performance quantitative evaluation method proposed in the above embodiment.

[0141] The storage medium proposed in the embodiment and the digital power grid network security protection performance quantitative evaluation method proposed in the above embodiment belong to the same inventive concept, and the technical details not described in the embodiment can be referred to the above embodiment, and the embodiment has the same beneficial effects as the above embodiment.

[0142] From the above description of the embodiments, those skilled in the art can clearly understand that the present application can be implemented by means of software and necessary universal hardware, and of course can also be implemented by hardware, but in many cases the former is a better implementation. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a FLASH memory, a hard disk, or an optical disc, and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods of various embodiments of the present application.

[0143] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application but not limit the present application, and although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the technical solutions of the present application, and all of them should be covered in the scope of the claims of the present application.

Claims

1. A method for quantitatively evaluating the network security protection effectiveness of digital power grids, characterized in that: This includes constructing a threat situation simulation map of the digital power grid network, starting from the state of the threat target through a reverse construction algorithm oriented towards key equipment, and using a depth-first search strategy to search for intrusion paths in reverse, while starting from the initial state through a forward construction algorithm oriented towards the entire network topology, and using a breadth-first search strategy to search for all potential intrusion paths of attackers to the entire power system. Based on the threat situation projection map, a network real-time threat event stack is established through a real-time threat event analysis algorithm. Each network real-time threat event is traversed sequentially, and the threat events in the threat situation projection map are matched with the real-time threat events. The spatiotemporal correlation of network threats is analyzed, and the threat status and timestamps of threat events are updated. Establish a multi-level quantitative assessment system from threat events to the overall network threat situation. Quantify threat events by calculating four dimensions: asset value, threat event impact, threat event success rate, and threat event concealment. Based on the threat event assessment index, progressively calculate the threat state transition atomic sequence assessment index, threat path assessment index, threat target assessment index, and overall network threat situation assessment index.

2. The method for quantitative evaluation of the effectiveness of digital power grid network security protection as described in claim 1, characterized in that: The construction of the digital power grid network threat situation simulation map includes: starting from the threat target state using a reverse construction algorithm, judging the threat events that pose a threat to the target, querying network vulnerability information, and adding threat state nodes that meet the prerequisite states to the threat situation simulation map until the initial state node is traversed or the number of state transitions exceeds the maximum value. An initial state set is established through a forward construction algorithm. Threat events are assessed to determine the threat posed to the initial state nodes. Information on the threat state nodes reached after intrusion is queried. It is determined whether the threat state nodes are in the finite threat set, until no network vulnerability is detected by a threat event or the number of state transitions exceeds the maximum value.

3. The method for quantitative evaluation of the effectiveness of digital power grid network security protection as described in claim 2, characterized in that: The real-time threat event analysis algorithm includes defining a variable satisfaction determination function to determine the threat state and threat event satisfaction, defining a timestamp function to record the occurrence time of threat events and threat states, and defining a time window to filter out invalid and expired threat events. Iterate through each threat event in the real-time network threat event stack, analyze the spatiotemporal correlation of threat events, update the threat status and timestamps of threat events, and output a real-time threat situation projection map.

4. The method for quantitative evaluation of the effectiveness of digital power grid network security protection as described in claim 3, characterized in that: The establishment of a multi-level quantitative assessment system from threat events to the overall network threat situation includes: calculating asset value by combining asset value vectors and asset value weights; defining threat event impact based on attack classification and corresponding levels; calculating threat event success support rate by matching network vulnerability information with vulnerability information exploited by threat events; and calculating threat event concealment by combining device impact function, user impact function, and intrusion degree function. Based on the threat event assessment index, the threat state transition atomic sequence assessment index is calculated by combining the threat event success support rate and weight. The threat path assessment index is calculated by considering the assessment indices of all threat state transition atomic sequences on the path. The threat target assessment index is calculated by combining the intrusion path selection probability. The overall network threat situation assessment index is obtained by summing the threat situation assessment indices of all threat targets in the entire network.

5. The method for quantitative evaluation of the effectiveness of digital power grid network security protection as described in claim 4, characterized in that: The calculation of the threat event success support rate includes checking whether the network state nodes have the necessary vulnerabilities to be exploited by the threat event. If not all the necessary vulnerabilities are included, the threat event success support rate is zero. If all necessary vulnerabilities are included, further search for other vulnerabilities. If they exist, the sum of the weights of the other vulnerabilities is used as the success rate of the threat event. If they do not exist, the success rate of the threat event is 1.

6. The method for quantitative evaluation of the effectiveness of digital power grid network security protection as described in claim 4, characterized in that: The calculation of threat event concealment includes defining a device impact function based on the degree to which changes in network security status cause detection devices to alarm, defining a user impact function based on the degree to which changes in network security status cause users to become aware of the situation, and defining an intrusion degree function based on the degree of intrusion caused by the threat event. The threat event concealment level is 1 when the device does not alarm or the user is unaware of it. When the device alarms or the user is unaware of it, the threat event concealment level is the product of the intrusion degree and the average of the device impact and the user impact.

7. The method for quantitative evaluation of the effectiveness of digital power grid network security protection as described in claim 4, characterized in that: It also includes calculating the early warning success rate, defense success rate, average response time, and tactical decision accuracy and timeliness of digital power grid network security protection based on quantitative evaluation results, forming a comprehensive protection effectiveness evaluation index system.

8. A digital power grid network security protection effectiveness quantitative evaluation system, using the digital power grid network security protection effectiveness quantitative evaluation method as described in any one of claims 1 to 7, characterized in that, include: The threat situation construction module is used to build a threat situation projection map of the digital power grid network. It starts from the state of the threat target through a reverse construction algorithm oriented towards key equipment and uses a depth-first search strategy to search for intrusion paths. At the same time, it starts from the initial state through a forward construction algorithm oriented towards the entire network topology and uses a breadth-first search strategy to search for all potential intrusion paths of attackers to the entire power system. The real-time analysis module is used to establish a network real-time threat event stack based on the threat situation projection map and through the real-time threat event analysis algorithm. It sequentially traverses each network real-time threat event, matches the threat events in the threat situation projection map with the real-time threat events, analyzes the spatiotemporal correlation of network threats, and updates the threat status and the timestamp of the threat events. The quantitative assessment module is used to establish a multi-level quantitative assessment system from threat events to the overall network threat situation. It quantitatively assesses threat events by calculating four dimensions: asset value, threat event impact, threat event success support rate, and threat event concealment. Based on the threat event assessment index, it progressively calculates the threat state transition atomic sequence assessment index, threat path assessment index, threat target assessment index, and overall network threat situation assessment index.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method for quantitative evaluation of the effectiveness of digital power grid network security protection as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the method for quantitative evaluation of the effectiveness of digital power grid network security protection as described in any one of claims 1 to 7.

Images