Network security early warning method and system based on multi-source data

Abstract

The invention discloses a network security early warning method and system based on multi-source data, relates to the field of power grid security, and solves the technical problems that in power grid security management, it is difficult to carry out prospective early warning on security attacks suffered by power grid equipment, and potential situation reminding of attack early warning by spatial geometric features of attackers is neglected. According to the method, the threat prediction model is established based on the historical attack record, and the time range and potential propagation equipment of the next attack after the current attack are identified based on the threat prediction model; determining an importance factor of the equipment based on the basic information, and determining a severity factor of the attack based on the attack information; determining a potential threat factor of each device based on the potential propagation device of the next attack, the importance factor and the severity factor; determining an early warning level of each device in a next attack time range based on the potential threat factor of each device, and sending early warning information to a manager based on the early warning level; the accuracy of power grid safety early warning can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of power grid security, in particular to a network security early warning method and system based on multi-source data. BACKGROUND

[0002] With the rapid development of information technology, the security threat of network space is increasingly serious, and the network attack means is constantly evolving, becoming more complex and hidden. The development of smart grid makes the power system architecture more open and diversified, increasing the risk of network attacks. At the same time, the network security problem of distribution network system is increasingly prominent, and network viruses and data leakage pose a threat to the safe operation of the power grid.

[0003] At present, most of the network security early warning methods based on multi-source data are difficult to conduct forward-looking early warning on the security attacks suffered by the power grid equipment in the power grid security management, and only maintain the power grid equipment when and after the attack, increasing the cost of resisting attacks. At the same time, most of the network security early warning methods based on multi-source data ignore the potential situation reminder of the spatial geometric features of the attacked to the attack early warning, and are difficult to perceive the information of the next attack according to the spatial geometric features of the attacked, reducing the accuracy of network security early warning.

[0004] Therefore, the present application discloses a network security early warning method and system based on multi-source data to solve the above technical problems. SUMMARY

[0005] The present application aims to at least solve one of the technical problems existing in the prior art. To this end, the present application proposes a network security early warning method and system based on multi-source data to solve the technical problems that it is difficult to conduct forward-looking early warning on the security attacks suffered by the power grid equipment in the power grid security management, and ignore the potential situation reminder of the spatial geometric features of the attacked to the attack early warning.

[0006] To achieve the above-mentioned purpose, the first aspect of the present application provides a network security early warning method based on multi-source data, comprising: obtaining attack information and basic information of the attacked; wherein the basic information includes device type and historical attack times; the attack information includes vulnerability severity level, number and geographic location of affected devices; establishing a threat prediction model based on historical attack records, identifying the time range and potential propagation devices of the next attack based on the threat prediction model, determining the importance factor of the device based on the basic information, determining the severity factor of the attack based on the attack information, and determining the potential threat factor of each device based on the potential propagation devices of the next attack, the importance factor and the severity factor; wherein the historical attack records include attacker IP, manually input vulnerability scan results and network device connection relationship; Determine the early warning level of each device in the time range of the next attack based on the potential threat factors of each device, and send early warning information to the manager based on the early warning level.

[0007] Preferably, the attack information and the basic information of the attacked device are obtained, including: When the grid recorded device is attacked, the vulnerability severity level of the current attack and the number of affected devices in the current attack are extracted from the security monitoring storage database; the geographical location of the affected devices in the current attack, the type of the attacked device and the historical attack times are extracted from the device information storage database.

[0008] Preferably, the threat prediction model is established based on the historical attack records, including: Extract the attacker IP, manually input vulnerability scan results, network device connection relationship, corresponding next attack time range and potential propagation device of each attack in the historical attack record; wherein the potential propagation device is obtained by experts according to the attacker IP, manually input vulnerability scan results and network device connection relationship; Integrate the attacker IP, manually input vulnerability scan results and network device connection relationship of each attack in the historical attack record, and the corresponding next attack time range and potential propagation device into a plurality of training data and test data; use the training data to train the artificial intelligence model, use the test data to test the trained artificial intelligence model, and adjust the artificial intelligence model according to the test result; finally obtain the threat prediction model with input of attacker IP, manually input vulnerability scan results and network device connection relationship, and output of next attack time range and potential propagation device; wherein the artificial intelligence model includes BP neural network model and RBF neural network model; wherein the vulnerability scan results include vulnerability location and vulnerability type, and the network device connection relationship includes device list, connection mode, network topology structure and key path.

[0009] Preferably, the time range of the next attack and the potential propagation device after the current attack are identified based on the threat prediction model, including: Extract the attacker IP, manually input vulnerability scan results and network device connection relationship of the current attack, input the attacker IP, manually input vulnerability scan results and network device connection relationship into the threat prediction model, and obtain the time range of the next attack and the potential propagation device.

[0010] Preferably, the importance factor of the device is determined based on the basic information, including: The device type of the grid recorded device is extracted in sequence, and the device level BD of the current device is extracted from the device type level database based on the device type; wherein the device level BD is valued as 1, 2 or 3; extracting a historical attack times LG, determining the importance factor YZ of the device based on the device level BD and the historical attack times LG through calculation formula (1); The calculation formula (1) is: ; In the formula, BLG is a standard attack times set artificially, which is generally a proportional value of the average value of all device attack times recorded by the power grid, and the proportion is set artificially, such as 50%.

[0011] Preferably, the severity factor of the current attack based on the attack information comprises: obtaining the number N of affected devices of the current attack and a geographical position set L of each affected device; based on the spatial coordinates in the geographical position set L determining a spatial distribution factor KZ of the affected devices, the spatial distribution factor KZ satisfies calculation formula (2); determining a location aggregation degree coefficient WD based on the spatial distribution factor KZ, the location aggregation degree coefficient WD satisfies calculation formula (3); determining a severity factor AZ of the current attack based on the location aggregation degree coefficient WD, the vulnerability severity level V and the number of affected devices, the severity factor AZ satisfies calculation formula (4); The geographical position set L is: ; In the formula, i is the number of affected devices, represents the spatial coordinates of the ith affected device; The calculation formula (2) is: ; In the formula, is the centroid coordinates of all affected devices; The calculation formula (3) is: ; In the formula, is an amplitude adjustment coefficient set according to experience, and The value of is [0.5, 1], which is used to adjust the influence of aggregation degree on severity; The calculation formula (4) is: ; In the formula, , and are proportional adjustment coefficients set according to the importance of the vulnerability severity level, the number of affected devices and the geographical position, and , ; The number of affected devices in a single attack recorded in the historical data is the largest.

[0012] Preferably, the potential propagation device, the importance factor and the severity factor of the next attack are used to determine the potential threat factor of each device, including: A1: extracting the importance factor YZ of each device, and extracting the devices in turn, when the extracted device is an affected device in the current attack, a first update value G1 is obtained by calculation formula (5) based on the severity factor AZ, and the importance factor YZ of the affected device is updated by the first update value G1; when the extracted device is not an affected device in the current attack, the importance factor YZ of the device is updated by zero; A2: extracting the devices in turn, when the extracted device is a potential propagation device of the next attack corresponding to the current attack, a second update value G2 is obtained by calculation formula (6), and the importance factor YZ of the potential propagation device is updated by the second update value G2; when the extracted device is not a potential propagation device of the next attack corresponding to the current attack, the importance factor YZ of the device is updated by zero; A3: marking the updated importance factor YZ of each device after step A1 and step A2 as a potential threat factor; The calculation formula (5) is: ; In the formula, The influence limiting value of the severity factor AZ set artificially, which is generally 2 times the average value of the calculated value in the historical data; The calculation formula (6) is: ; In the formula, The influence expansion coefficient of the potential propagation device set artificially, which is generally [1, 2].

[0013] Preferably, the potential threat factor of each device is used to determine the early warning level of each device in the time range of the next attack, including: extracting the potential threat factor of each device in turn, when the potential threat factor is greater than threat factor one, the early warning level of the current device in the time range of the next attack is set to level one; When the potential threat factor is not greater than threat factor one and is greater than threat factor two, the early warning level of the current device in the time range of the next attack is set to level two; wherein, threat factor one and threat factor two are obtained according to the historical potential threat factor, and threat factor one is greater than threat factor two; the early warning level includes level one, level two and level three; When the potential threat factor is not greater than threat factor two, the current device is set to a third alert level in the time range of the next attack.

[0014] Preferably, the warning information is sent to the manager based on the alert level, including: The alert level of each device is extracted, and the device with a first alert level is marked as a key protection device, and the manager is sent warning information that the key protection device needs to be protected in advance; The device with a second alert level is marked as a general protection device, and the manager is sent warning information that attention needs to be paid to the security protection of the general protection device; The device with a third alert level is marked as a security device, and the manager is sent warning information that the security device needs to be kept attention and ensured stable.

[0015] The second aspect of the present application provides a network security warning system based on multi-source data, comprising: a security analysis module, and a data acquisition module and a security warning module connected with the security analysis module; The data acquisition module is used for acquiring attack information and basic information of the attacked person; wherein the basic information includes device type and historical attack times; the attack information includes vulnerability severity level, number of affected devices and geographical location; The security analysis module is used for establishing a threat prediction model based on historical attack records, identifying the time range of the next attack and the potential propagation device after this attack based on the threat prediction model, determining the importance factor of the device based on the basic information, determining the severity factor of the attack based on the attack information, and determining the potential threat factor of each device based on the potential propagation device of the next attack, the importance factor and the severity factor; wherein the historical attack record includes attacker IP, manually input vulnerability scan result and network device connection relationship; The security warning module is used for determining the alert level of each device in the time range of the next attack based on the potential threat factor of each device, and sending warning information to the manager based on the alert level.

[0016] Compared with the prior art, the present application has the following advantages: 1. This invention establishes a threat prediction model based on historical attack records, identifies the timeframe and potential propagation devices for the next attack after the current attack, determines the importance factors of devices based on basic information, and determines the severity factors of the current attack based on attack information; determines the potential threat factors of each device based on the potential propagation devices, importance factors, and severity factors for the next attack; determines the warning level of each device within the timeframe of the next attack based on the potential threat factors of each device, and sends warning information to managers based on the warning level. This invention can solve the technical problems in power grid security management, such as the difficulty in providing proactive warnings of security attacks on power grid equipment and the neglect of the potential situational awareness of the spatial geometric characteristics of the attacked party in attack warnings; this invention can improve the scientific nature and accuracy of power grid security warnings.

[0017] 2. This invention achieves a multi-level quantitative and comprehensive assessment of the impact of attacks by introducing a comprehensive analysis of multiple dimensions, including quantity, spatial distribution, and vulnerability severity. This provides a more scientific and accurate basis for decision-making in network security incident response. Unlike traditional assessment methods that rely solely on the number of affected devices or vulnerability levels, this algorithm incorporates spatial geometric features and clustering factors into its mathematical model. This effectively captures the distribution patterns of attacks in geographic space, thereby revealing the spread characteristics of attacks in specific areas and even across regions. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the operation steps of the present invention; Figure 2 A schematic diagram illustrating the operational steps for determining the severity factor of this attack according to the present invention; Figure 3 This is a schematic diagram of the system modules of the present invention. Detailed Implementation

[0020] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Please see Figure 1The first aspect of this invention provides a network security early warning method based on multi-source data, comprising: Obtain attack information and basic information about the attacked device; the basic information includes device type and number of historical attacks; the attack information includes vulnerability severity level, number of affected devices, and geographical location. A threat prediction model is established based on historical attack records. The model identifies the time range and potential propagation devices for the next attack after the current attack. The importance factors of devices are determined based on basic information, and the severity factors of the current attack are determined based on attack information. The potential threat factors of each device are determined based on the potential propagation devices, importance factors, and severity factors for the next attack. The historical attack records include attacker IPs, manually entered vulnerability scan results, and network device connection relationships. Based on the potential threat factors of each device, the warning level of each device within the time range of the next attack is determined, and warning information is sent to the administrator based on the warning level.

[0022] This application obtains attack information and basic information about the victim, including: When a device recorded by the power grid is attacked, the vulnerability severity level of this attack, manually calibrated, and the number of devices affected in this attack are extracted from the security monitoring storage database; the geographical location of the affected devices in this attack, as well as the type of device attacked and the number of historical attacks, are extracted from the device information storage database.

[0023] This application establishes a threat prediction model based on historical attack records, including: Extract the attacker's IP address, manually entered vulnerability scan results, and network device connectivity for each attack from historical attack records, as well as the timeframe and potential propagation devices for the next attack; among them, the potential propagation devices are obtained by experts based on the attacker's IP address, manually entered vulnerability scan results, and network device connectivity. This process integrates attacker IPs, manually entered vulnerability scan results, network device connection relationships, and the corresponding timeframe and potential propagation devices for the next attack from historical attack records into training and testing data. The training data is used to train the artificial intelligence model, and the testing data is used to test the trained model. The model is then adjusted based on the testing results. The final result is a threat prediction model with attacker IPs, manually entered vulnerability scan results, and network device connection relationships as inputs, and the timeframe and potential propagation devices for the next attack as outputs. The artificial intelligence model includes a BP neural network model and an RBF neural network model. The vulnerability scan results include vulnerability location and type, and the network device connection relationships include device list, connection method, network topology, and critical path.

[0024] Specifically, the steps for testing the trained AI model using validation data and adjusting the AI ​​model based on the validation results are as follows: The attacker's IP address, manually entered vulnerability scan results, and network device connection relationships from each attack in the test data are input into the trained artificial intelligence model to obtain the corresponding time range and potential propagation devices for the next attack. The time range and potential propagation devices for the next attack are compared with those corresponding to the test data. If the proportion of the same time range in both time ranges is within a certain threshold (threshold 1), and the similarity ratio of the two potential propagation devices is within a certain threshold (threshold 2), no parameter adjustment is needed, and the next set of test data is tested. If there are cases outside the thresholds, the corresponding parameters are adjusted until all corresponding proportions are within the thresholds, and the next set of test data is tested. When the proportions obtained from all test data are within the thresholds, and the number of test data points accounts for 90% or more of the total test data, a threat prediction model is obtained, with the input being the attacker's IP address, manually entered vulnerability scan results, and network device connection relationships, and the output being the time range and potential propagation devices for the next attack. The proportion thresholds include proportion threshold one and proportion threshold two; the two time ranges are the time range of the next attack output by the AI ​​model during training and the time range of the next attack in the test data; the two potential propagation devices are the potential propagation devices of the next attack output by the AI ​​model during training and the potential propagation devices of the next attack in the test data; the proportion of the same time range in the two time ranges in proportion threshold one is: the value of the same time range multiplied by 2, divided by the total value of the two time ranges.

[0025] It should be noted that the time range of the next attack is a time range centered on the specific time of the next attack, with a fixed duration; the fixed duration is determined manually and is generally set to 2 hours.

[0026] It should be noted that the potential propagation devices are determined by experts based on attacker IPs, manually entered vulnerability scan results, and network device connection relationships. For example, when do attacker IPs in a certain region typically attack which devices? What security risks do different vulnerability locations and types bring, and which devices are more susceptible to being affected? Different device lists, connection methods, network topologies, and critical paths will place which devices in important positions, making them vulnerable to attack.

[0027] It should be noted that the attacker's IP address was extracted from firewall logs.

[0028] It should be noted that the vulnerability scan results include vulnerability location and vulnerability type. Vulnerability location indicates which devices or systems it exists in, such as a service on a server; vulnerability type indicates the category of vulnerability, such as buffer overflow, SQL injection, or cross-site scripting attack.

[0029] It should be noted that network device connectivity includes a device list, connection method, network topology, and critical path. The device list refers to all devices in the network, such as servers, switches, routers, firewalls, and terminal devices. The connection method specifies which ports, IP addresses, or protocols connect the devices. The network topology is the physical or logical structure of the network, such as star, ring, tree, or hybrid topology. The critical path is the key path for data transmission within the network, such as the path from the internet to an internal server.

[0030] This application uses a threat prediction model to identify the timeframe and potential propagation devices for the next attack after this attack, including: Extract the attacker's IP address, manually entered vulnerability scan results, and network device connection relationships from this attack. Input these data into the threat prediction model to obtain the time range and potential propagation devices for the next attack.

[0031] The importance factors of the equipment determined in this application based on basic information include: Extract the equipment type of the power grid record equipment in sequence, and extract the equipment level BD of the current equipment from the equipment type level database based on the equipment type; where the equipment level BD can be 1, 2 or 3. Extract the historical attack count LG, and determine the importance factor YZ of the device based on the device level BD and the historical attack count LG using formula (1); The calculation formula (1) is: ; In the formula, BLG is the standard number of attacks set manually, which is generally the percentage of the average number of attacks recorded by all devices in the power grid. The percentage is set manually, such as 50%.

[0032] It is worth noting that this method can effectively quantify the importance of equipment, providing a scientific basis for prioritizing equipment and allocating resources, thereby optimizing the security protection strategy of the power grid system. Secondly, by introducing dynamic calculations of equipment level and historical attack counts, this method can more accurately reflect the risk level of equipment in actual operation, helping to promptly identify and address potential security threats. Furthermore, the use of the natural logarithm function and exponential operations in the calculation formula makes the calculation of importance factors more flexible, adapting to changes in different equipment types and attack scenarios. This method not only improves the accuracy of equipment risk assessment but also provides strong support for the security management and decision-making of the power grid system, possessing significant engineering application value.

[0033] It should be noted that the device type level (BD) of the current device is extracted from the device type level database based on the device type. The device type level database is as follows: When the equipment type is core equipment, such as transformers, circuit breakers, and disconnect switches, the equipment level BD is level 3, and the value of BD is 3. When the equipment type is important equipment, such as surge arrester or voltage transformer, the equipment level BD is level 2, and the value of BD is 2. When the equipment type is general equipment, such as low-voltage switches, cables, and distribution boxes, the equipment level BD is level 1, and the value of BD is 1.

[0034] Please see Figure 2 In this application, the severity factor of the attack is determined based on attack information, including: Obtain the number N of devices affected by this attack and the set L of geographical locations of each affected device; based on the spatial coordinates in the set L... Determine the spatial distribution factor KZ of the affected equipment, wherein the spatial distribution factor KZ satisfies the calculation formula (2); The location aggregation coefficient WD is determined based on the spatial distribution factor KZ, and the location aggregation coefficient WD satisfies the calculation formula (3); The severity factor AZ of this attack is determined based on the location clustering coefficient WD, the vulnerability severity level V, and the number of affected devices. The severity factor AZ satisfies the calculation formula (4). The set of geographical locations L is: ; In the formula, i is the number of the affected device. Represents the spatial coordinates of the i-th affected device; The calculation formula (2) is: ; In the formula, The centroid coordinates of all affected devices; The calculation formula (3) is: ; In the formula, The amplitude adjustment coefficient is set based on experience, and The value of is [0.5, 1], which is used to adjust the effect of aggregation degree on severity; The calculation formula (4) is: ; In the formula, , and A proportional adjustment factor set based on the perceived importance of the vulnerability severity level, the number of affected devices, and the geographical location. , ; This represents the largest number of devices affected by a single attack recorded in historical data.

[0035] It is worth noting that this step, by introducing a comprehensive analysis of multiple dimensions such as quantity, spatial distribution, and vulnerability severity, achieves a multi-level quantitative and three-dimensional assessment of the attack's impact, thus providing a more scientific and accurate decision-making basis for cybersecurity incident response. Unlike traditional assessment methods that rely solely on the number of affected devices or vulnerability severity, this algorithm incorporates spatial geometric features and clustering factors into its mathematical model. This effectively captures the geographical distribution patterns of attacks, revealing the spread characteristics of attacks in specific areas and even across regions. When the distribution of affected devices is relatively concentrated, the spatial distribution factor KZ is small, and the location clustering coefficient WD is large. The algorithm automatically increases the risk weight of this area to reflect the potentially severe chain reactions caused by localized concentrated attacks. Conversely, when the attack is dispersed and has a wider impact, KZ increases and WD decreases, reflecting the wide-area diffusion characteristics of the attack and helping security managers distinguish the spatial attributes of different types of attacks. Simultaneously, the algorithm introduces... , , and Adjustable parameters ensure both the universality and flexibility of the evaluation results. The model can be adaptively optimized based on actual business scenarios, device density, attack frequency, and vulnerability severity distribution, ensuring its adaptability and accuracy in different network environments. During the comprehensive calculation process, This approach reflects the relative scale of attacks within a historical data context, giving the assessment results time-series reference value and dynamically reflecting the current attack's position within the overall security landscape. The introduction of the V-factor ensures an accurate representation of the technical severity of the vulnerabilities themselves, thus achieving an organic integration of quantity, space, and technical risks. The algorithm's comprehensiveness and scalability are further demonstrated by its ability to integrate with threat intelligence systems, device asset inventories, and geographic information systems to form an intelligent security situation assessment platform. Through the quantitative characterization of spatial distribution and clustering characteristics, decision-makers can intuitively identify attack hotspots and potential critical nodes, providing data support for subsequent defense strategy deployment and emergency resource allocation. Furthermore, this method can automatically adjust the severity factor (AZ) results with real-time data updates, enabling dynamic assessment and trend prediction at different attack stages, thus playing a crucial role in security management aspects such as attack detection, risk warning, and post-incident tracing. Overall, this severity assessment algorithm, which integrates multiple dimensions, has a clear structure, reasonable calculations, and strong interpretability. It not only improves the scientific rigor and accuracy of security risk assessment but also establishes a quantitative foundation for sustainable optimization of network security protection systems, possessing significant engineering application value and practical guiding significance.

[0036] It should be noted that the centroid coordinates The calculation method is as follows: .

[0037] It should be noted that the proportional adjustment coefficient Because: The data being used is calculated based on the geographical location of the affected equipment. The number of devices affected is what is being measured. The factor multiplied is the vulnerability severity level; for this attack, because vulnerability severity has the greatest impact on the attack, the scaling factor is adjusted accordingly. The maximum setting, when considering the calculation data related to the number of affected devices and their geographical locations, generally indicates the severity of the attack indirectly, but more directly reflects the impact of the attack compared to calculation data related to the geographical locations of affected devices. Therefore, the proportional adjustment coefficient in this invention... The value is greater than the proportional adjustment coefficient. .

[0038] It should be noted that the vulnerability severity level V can take the following values: 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.

[0039] This application determines the potential threat factor of each device based on the potential propagation device, importance factor, and severity factor for the next attack, including: A1: Extract the importance factor YZ of each device, extract the devices in sequence. When the extracted device is an affected device in this attack, obtain an update value G1 based on the severity factor AZ using formula (5), and update the importance factor YZ of the affected device using the update value G1. When the extracted device is not an affected device in this attack, update the importance factor YZ of the device by adding zero. A2: Extract devices sequentially. When the extracted device is a potential propagation device for the next attack corresponding to this attack, obtain the secondary update value G2 through formula (6), and update the importance factor YZ of the potential propagation device through the secondary update value G2; when the extracted device is not a potential propagation device for the next attack corresponding to this attack, update the importance factor YZ of the device by adding zero. A3: Mark each device as a potential threat factor based on the updated importance factor YZ after steps A1 and A2; The calculation formula (5) is as follows: ; In the formula, The impact limit of the severity factor AZ, which is set manually, is generally calculated from historical data. Twice the average value; The calculation formula (6) is as follows: ; In the formula, The amplification factor for the potential propagation device set by the user is generally set to [1,2].

[0040] It is worth noting that this step, by introducing a dynamic update mechanism for the device importance factor YZ, combined with the impact of the current attack and the characteristics of the potential propagation devices in the next attack, can achieve a more comprehensive and accurate quantification of the device risk status during the threat assessment process. In traditional threat assessment, device risk is often judged based solely on static device importance or a single attack impact indicator, which easily overlooks the propagation path and potential impact of the attack, resulting in a one-sided assessment result. In step A1, this method combines the importance factor and severity factor AZ of the affected device, and introduces a limit value DAZ through formula (5) to avoid excessive amplification or distortion of the severity factor, thus reflecting the actual damage to the device in this attack and maintaining the stability of the assessment result in one update process; in step A2, for potential propagation devices, the impact amplification coefficient is used. By updating its importance factors a second time, the risk of devices that may participate in the next round of attacks or play a key role in the attack chain can be predicted in advance. This ensures that the assessment system can assign reasonable and more forward-looking weights to these devices before potential threats occur.

[0041] Furthermore, this method, through the superposition of primary and secondary updates, ensures that the final potential threat factor not only encompasses the direct impact of existing attacks but also integrates potential attack propagation risks, forming a comprehensive evaluation framework that is both temporally consistent and spatially covers the attack source to potential propagation paths. This evaluation approach effectively improves the granularity of threat assessment, significantly enhancing the interpretability and applicability of the results while maintaining computational simplicity, thereby providing a more realistic and reliable basis for subsequent security decisions, resource allocation, and defense strategy formulation. In practical applications, this method can be flexibly adjusted for different types of network devices, industrial control equipment, or critical infrastructure, with manually set limits (DAZ) and expansion coefficients. It can be optimized based on historical attack data, security policies, and industry characteristics, making the assessment model both universal and targeted. At the same time, because its update process is based on explicit mathematical formulas and traceable parameters, it is transparent and can be easily embedded into scenarios such as threat monitoring systems and intrusion response platforms for automated execution. This ensures that security teams can quickly obtain accurate assessment results of potential device threat factors when facing complex attack chains and multi-level propagation risks, thereby significantly improving the effectiveness and foresight of the overall protection system.

[0042] It should be noted that updating the importance factor YZ of the device by adding zero means updating the value without changing it.

[0043] This application determines the warning level of each device within the time frame of the next attack based on the potential threat factors of each device, including: Extract the potential threat factors of each device in sequence. When the potential threat factor is greater than threat factor one, set the warning level of the current device to level one within the time range of the next attack. When the potential threat factor is no greater than threat factor one but greater than threat factor two, the warning level of the current device within the time range of the next attack is set to level two; where threat factor one and threat factor two are both obtained based on historical potential threat factors, and threat factor one is greater than threat factor two; the warning levels include level one, level two and level three; When the potential threat factor is no greater than threat factor two, the warning level of the current device within the time range of the next attack will be set to level three.

[0044] This application sends warning information to managers based on the warning level, including: Extract the warning level of each device, mark the device with the warning level of Level 1 as the key protection device, and send the warning information to the manager that the key protection device needs to be protected in advance; Equipment with a warning level of 2 is marked as general protection equipment, and a warning message is sent to the administrator that attention should be paid to the safety protection of general protection equipment; Devices with a warning level of three are marked as safe devices, and warning messages are sent to managers requiring them to pay close attention to these safe devices and ensure their stability.

[0045] Please see Figure 3 A second aspect of the present invention provides a network security early warning system based on multi-source data, comprising: a security analysis module, and a data acquisition module and a security early warning module connected to the security analysis module; Data acquisition module: used to acquire attack information and basic information about the attacked device; the basic information includes device type and number of historical attacks; the attack information includes vulnerability severity level, number of affected devices, and geographical location. Security Analysis Module: Used to build threat prediction models based on historical attack records; identify the time range and potential propagation devices of the next attack after the current attack based on the threat prediction model; determine the importance factors of devices based on basic information; determine the severity factors of the current attack based on attack information; and determine the potential threat factors of each device based on the potential propagation devices, importance factors, and severity factors of the next attack. Among them, historical attack records include attacker IP, manually entered vulnerability scan results, and network device connection relationships. Security warning module: It is used to determine the warning level of each device within the time range of the next attack based on the potential threat factors of each device, and send warning information to the administrator based on the warning level.

[0046] Some of the data in the above formula are calculated by removing dimensions and taking their numerical values. The formula is the closest to the real situation obtained by software simulation of a large amount of collected data. The preset parameters and preset thresholds in the formula are set by those skilled in the art according to the actual situation or obtained through simulation of a large amount of data.

[0047] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A network security early warning method based on multi-source data, characterized in that, include: Obtain attack information and basic information about the attacked device; the basic information includes device type and number of historical attacks; the attack information includes vulnerability severity level, number of affected devices, and geographical location. A threat prediction model is established based on historical attack records. The model identifies the time range and potential propagation devices for the next attack after the current attack. The importance factors of devices are determined based on basic information, and the severity factors of the current attack are determined based on attack information. The potential threat factors of each device are determined based on the potential propagation devices, importance factors, and severity factors for the next attack. The historical attack records include attacker IPs, manually entered vulnerability scan results, and network device connection relationships. Based on the potential threat factors of each device, the warning level of each device within the time range of the next attack is determined, and warning information is sent to the administrator based on the warning level.

2. The network security early warning method based on multi-source data according to claim 1, characterized in that, The acquisition of attack information and basic information of the attacked party includes: When a device recorded by the power grid is attacked, the vulnerability severity level of this attack, manually calibrated, and the number of devices affected in this attack are extracted from the security monitoring storage database; the geographical location of the affected devices in this attack, as well as the type of device attacked and the number of historical attacks, are extracted from the device information storage database.

3. The network security early warning method based on multi-source data according to claim 1, characterized in that, The threat prediction model based on historical attack records includes: Extract the attacker's IP address, manually entered vulnerability scan results, and network device connectivity for each attack from historical attack records, as well as the timeframe and potential propagation devices for the next attack; among them, the potential propagation devices are obtained by experts based on the attacker's IP address, manually entered vulnerability scan results, and network device connectivity. This process integrates attacker IPs, manually entered vulnerability scan results, network device connection relationships, and the corresponding timeframe and potential propagation devices for the next attack from historical attack records into training and testing data. The training data is used to train the artificial intelligence model, and the testing data is used to test the trained model. The model is then adjusted based on the testing results. The final result is a threat prediction model with attacker IPs, manually entered vulnerability scan results, and network device connection relationships as inputs, and the timeframe and potential propagation devices for the next attack as outputs. The artificial intelligence model includes a BP neural network model and an RBF neural network model. The vulnerability scan results include vulnerability location and type, and the network device connection relationships include device list, connection method, network topology, and critical path.

4. The network security early warning method based on multi-source data according to claim 1, characterized in that, The threat prediction model identifies the timeframe and potential propagation devices for the next attack after this attack, including: Extract the attacker's IP address, manually entered vulnerability scan results, and network device connection relationships from this attack. Input these attacker's IP address, manually entered vulnerability scan results, and network device connection relationships into the threat prediction model to obtain the time range and potential propagation devices for the next attack.

5. The network security early warning method based on multi-source data according to claim 1, characterized in that, The determination of equipment importance factors based on basic information includes: Extract the equipment type of the power grid record equipment in sequence, and extract the equipment level BD of the current equipment from the equipment type level database based on the equipment type; where the equipment level BD can be 1, 2 or 3. Extract the historical attack count LG, and determine the importance factor YZ of the device based on the device level BD and the historical attack count LG using formula (1); The calculation formula (1) is: ； In the formula, BLG represents the standard number of attacks.

6. The network security early warning method based on multi-source data according to claim 1, characterized in that, The determination of the severity factors of this attack based on attack information includes: Obtain the number N of devices affected by this attack and the set L of geographical locations of each affected device; based on the spatial coordinates in the set L... Determine the spatial distribution factor KZ of the affected equipment, wherein the spatial distribution factor KZ satisfies the calculation formula (2); The location aggregation coefficient WD is determined based on the spatial distribution factor KZ, and the location aggregation coefficient WD satisfies the calculation formula (3); The severity factor AZ of this attack is determined based on the location clustering coefficient WD, the vulnerability severity level V, and the number of affected devices. The severity factor AZ satisfies the calculation formula (4). The set of geographical locations L is: ； In the formula, i is the number of the affected device. Represents the spatial coordinates of the i-th affected device; The calculation formula (2) is: ； In the formula, The centroid coordinates of all affected devices; The calculation formula (3) is: ； In the formula, This is the amplitude adjustment coefficient, and The value of is [0.5, 1], which is used to adjust the effect of aggregation degree on severity; The calculation formula (4) is: ； In the formula, , and A proportional adjustment factor set based on the perceived importance of the vulnerability severity level, the number of affected devices, and the geographical location. , ; This represents the largest number of devices affected by a single attack recorded in historical data.

7. The network security early warning method based on multi-source data according to claim 1, characterized in that, The determination of the potential threat factor for each device based on the potential propagation device, importance factor, and severity factor for the next attack includes: A1: Extract the importance factor YZ of each device, extract the devices in sequence, when the extracted device is an affected device in this attack, obtain an update value G1 based on the severity factor AZ by calculation formula (5), and update the importance factor YZ of the affected device by the update value G1; when the extracted device is not an affected device in this attack, update the importance factor YZ of the device by adding zero. A2: Extract the devices sequentially. When the extracted device is a potential propagation device for the next attack corresponding to this attack, obtain the secondary update value G2 through formula (6), and update the importance factor YZ of the potential propagation device through the secondary update value G2. When the extracted device is not a potential propagation device for the next attack corresponding to this attack, update the importance factor YZ of the device by adding zero. A3: Mark each device as a potential threat factor based on the updated importance factor YZ after steps A1 and A2; The calculation formula (5) is as follows: ； In the formula, The influence limit value for the severity factor AZ; The calculation formula (6) is as follows: ； In the formula, This is the amplification factor of the potential propagation device, which is generally taken as [1,2].

8. The network security early warning method based on multi-source data according to claim 1, characterized in that, The determination of the early warning level for each device within the timeframe of the next attack, based on the potential threat factors of each device, includes: The potential threat factors of each device are extracted sequentially. When the potential threat factor is greater than threat factor one, the warning level of the current device within the time range of the next attack is set to level one. When the potential threat factor is no greater than threat factor one but greater than threat factor two, the warning level of the current device within the time range of the next attack is set to level two; wherein threat factor one and threat factor two are both obtained based on historical potential threat factors, and threat factor one is greater than threat factor two; the warning levels include level one, level two and level three; When the potential threat factor is no greater than threat factor two, the warning level of the current device within the time range of the next attack is set to level three.

9. The network security early warning method based on multi-source data according to claim 8, characterized in that, The sending of warning information to managers based on the warning level includes: Extract the warning level of each device, mark the device with the warning level of Level 1 as the key protection device, and send the warning information to the manager that the key protection device needs to be protected in advance; Equipment with a warning level of 2 is marked as general protection equipment, and a warning message is sent to the administrator that attention should be paid to the safety protection of general protection equipment; Devices with a warning level of three are marked as safe devices, and warning messages are sent to managers requiring them to pay close attention to these safe devices and ensure their stability.

10. A network security early warning system based on multi-source data, used to run the network security early warning method based on multi-source data as described in any one of claims 1 to 9, characterized in that, include: A security analysis module, and a data acquisition module and a security early warning module connected to the security analysis module; The data acquisition module is used to acquire attack information and basic information about the attacked device; the basic information includes device type and number of historical attacks; the attack information includes vulnerability severity level, number of affected devices, and geographical location. The security analysis module is used to: build a threat prediction model based on historical attack records; identify the time range and potential propagation devices of the next attack after the current attack based on the threat prediction model; determine the importance factor of devices based on basic information; determine the severity factor of the current attack based on attack information; and determine the potential threat factor of each device based on the potential propagation devices, importance factor, and severity factor of the next attack. The historical attack records include attacker IP, manually entered vulnerability scan results, and network device connection relationships. The security early warning module is used to determine the early warning level of each device within the time range of the next attack based on the potential threat factors of each device, and to send early warning information to the administrator based on the early warning level.

Images