Automatic identification method for network security check of power system

Abstract

The invention discloses a power system network security check automatic identification method, which comprises the following steps: S1, sensing the dynamic change of a power system network topology in real time through a self-adaptive dynamic topology sensing module, accurately identifying boundary equipment, and laying a foundation for subsequent security check; s2, dynamically associating a multi-dimensional risk assessment module; s3, optimizing an intelligent decision engine module through multiple targets; and S4, a visual interaction and emergency linkage module is adopted. According to the method, the automation and intelligence level of network security check of the power system is remarkably improved, breakthrough innovation is particularly achieved in the aspects of dynamic topological response, multi-type attack collaborative evaluation and multi-target decision optimization in a complex power grid environment, and the method has wide market application prospects and is worthy of popularization and application. The method can be widely applied to network security protection of key power infrastructures such as 500kV and above hub substations, regional power dispatching centers, new energy power stations and the like.

Description

Technical Field

[0001] This invention relates to the field of power system network security technology, and in particular to an automatic identification method for power system network security verification. Background Technology

[0002] Traditional power system network security verification methods have three major drawbacks: First, they rely on static network topology models, which cannot perceive dynamic network changes in real time, resulting in a boundary device identification accuracy of less than 65%; second, they use a single risk assessment indicator, which is difficult to deal with complex network attacks; and third, they lack intelligent decision-making mechanisms, resulting in low verification efficiency and a false alarm rate as high as 30%.

[0003] While existing technologies (such as CN119449429A) propose automatic identification methods for power system network security verification, they fail to address the issues of dynamic topology awareness and multi-dimensional risk fusion. Furthermore, current technical solutions still suffer from the following unresolved technical challenges: In dynamic topology sensing, the traditional RSTP algorithm has a topology update delay of more than 30 seconds when the number of nodes exceeds 500, which cannot meet the millisecond-level topology response requirements of large substations. Multi-dimensional risk assessment only achieves quantification of independent dimensions and does not consider the dynamic correlation between dimensions under different attack types. For example, the synergistic risk of DDoS attacks and device vulnerability exploitation cannot be accurately assessed. In multi-objective optimization scenarios (such as simultaneously achieving rapid risk management and minimizing business impact), intelligent decision-making algorithms are prone to getting trapped in local optima, resulting in insufficient practicality of decision-making solutions.

[0004] Therefore, there is an urgent need for a power system network security verification method that can overcome the above-mentioned technical bottlenecks and achieve rapid dynamic topology response, multi-dimensional risk collaborative assessment, and intelligent decision-making global optimization. Summary of the Invention

[0005] The purpose of this invention is to solve the above-mentioned technical problems by proposing an automatic identification method for power system network security verification.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: An automatic identification method for power system network security verification includes an adaptive dynamic topology sensing module, a dynamic correlation multi-dimensional risk assessment module, a multi-objective optimization intelligent decision engine module, and a visualization interaction and emergency response module. The identification method includes the following steps: S1 uses an adaptive dynamic topology sensing module to sense the dynamic changes in the power system network topology in real time, accurately identify boundary devices, and lay the foundation for subsequent security verification. S2, through dynamic association of multi-dimensional risk assessment modules, conducts multi-dimensional risk collaborative assessment of network attacks faced by the power system, forming a comprehensive risk understanding; S3, through the multi-objective optimization intelligent decision engine module, generates the globally optimal security decision scheme based on the risk assessment results in S2; S4, through its visual interaction and emergency response modules, enables the visualization of network topology and risk status, and simultaneously triggers multi-terminal emergency response mechanisms.

[0007] Preferably, the adaptive dynamic topology sensing module includes a dynamic topology construction method based on edge computing nodes and the ARSTP algorithm, comprising: deploying edge computing nodes in each area of ​​the substation, with each node covering a radius of no more than 50 meters, supporting low-latency communication with network devices, with a communication latency of ≤10 milliseconds; the edge nodes collecting device MAC addresses, IP addresses, port status, and device load rate data in real time, and using data compression algorithms to reduce data transmission volume; improving the traditional RSTP algorithm by introducing a "node priority dynamic adjustment mechanism," allocating different priorities according to device importance, and prioritizing the processing of high-priority node data during topology updates; and designing a "redundant link pre-computation strategy" to pre-calculate backup links for critical nodes, and directly calling the pre-computation results when the main link fails, thereby shortening the topology convergence time.

[0008] Preferably, in the dynamic association multi-dimensional risk assessment module: the attack type-risk dimension dynamic weight mapping method is as follows: an attack type-risk dimension weight mapping table is established, covering common attack types such as DDoS attacks, SQL injection attacks, and vulnerability exploitation attacks. The weights of traffic anomaly, business relevance, and equipment vulnerability risk dimensions are adjusted according to the identified attack types. At the same time, the weights are dynamically corrected according to the severity of the attack. When the CVSS score is ≥9.0, it is considered an extremely dangerous attack. Under extremely dangerous attacks, the weights of each related dimension are increased by 20% overall. The power system attack chain integrity assessment model based on the MITREATT&CK framework is as follows: a power system-specific attack chain model is constructed, including six stages: initial access, execution, persistence, privilege escalation, lateral movement, and data theft. By analyzing the performance of attack behavior at each stage, the integrity of the attack chain is assessed, and combined with multi-dimensional risk values, a comprehensive risk assessment result is generated.

[0009] Preferably, in the multi-objective optimization intelligent decision engine module, the method for constructing the three-dimensional objective function of "risk handling efficiency - business impact - resource consumption" is as follows: Risk handling efficiency T is defined as the time from risk detection to handling completion, measured in seconds, with the objective being to minimize T; business impact I is defined as the proportion of affected businesses to the total number of businesses during the handling process, ranging from 0 to 1, with the objective being to minimize I; resource consumption R is defined as the computational and network resources consumed during the handling process, ranging from 0 to 1, with the objective being to minimize R; the objective function expression is constructed as: MinimizeF(T,I,R)=αT+βI+γR, where α, β, and γ are weight coefficients, dynamically adjusted according to business importance; the basic values ​​of the three-dimensional objective function weight coefficients are α=0.3, β=0.4, and γ=0.3; in the scheduling business scenario, β is increased to 0.5, α is adjusted to 0.2, and γ remains at 0.3; in the new energy power station scenario, γ is adjusted to 0.4, α=0.3, and β=0.3. The implementation process of the PSO-GA hybrid intelligent decision-making algorithm is as follows: Initialization: Generate a certain number of particles, each containing risk disposal measures and resource allocation scheme parameters; PSO global search: Update particle velocity and position based on the historical best position and the group's best position; GA local optimization: Perform crossover and mutation operations on the better particle group obtained by PSO search; Iteration termination: When the number of iterations reaches a preset value or the objective function value converges (the difference between two iterations ≤ 0.01), output the optimal decision scheme.

[0010] Preferably, in the visualization interaction and emergency linkage module: the 3D stereoscopic topology visualization construction method is as follows: using the 3DForce-Directed layout algorithm, combined with the physical scene of the power substation, a stereoscopic network topology map is constructed, with different security zones distinguished by different colors, the production control area being blue and the management information area being yellow, and boundary devices being highlighted with different colors according to risk level, high risk being red, medium risk being orange, and low risk being yellow; the risk tracing map generation method based on attack chain data is as follows: based on attack chain data and device communication logs, a risk tracing map is constructed, displaying the source node of the attack, propagation path, affected devices, and attack behavior details, supporting backtracking of the attack process by time dimension; the multi-terminal emergency linkage triggering mechanism is as follows: when the risk value exceeds the threshold, multi-terminal emergency linkage is automatically triggered; the multi-terminal emergency linkage communication protocol is as follows: local linkage activates the substation on-site audible and visual alarm device, alarm... The alarm volume is ≥80 decibels, and the light flashing frequency is 1 time / second. The mobile terminal pushes alarm information to the maintenance personnel's mobile APP via an encrypted communication protocol. The dispatch terminal sends risk alarm data to the power dispatch center, with a data transmission delay of ≤5 seconds. The local audible and visual alarm device activates within 1 second after the risk value exceeds the threshold, the mobile terminal alarm information push is completed within 2 seconds, and the dispatch terminal alarm data transmission is completed within 3 seconds. A risk threshold of ≥90 points is set as extremely high risk, a high risk threshold of ≥80 points, and a medium risk threshold of ≥60 points. The threshold for triggering multi-terminal emergency linkage is ≥80 points. The multi-terminal emergency linkage communication protocol is as follows: Local linkage activates the substation's on-site audible and visual alarm device (alarm volume ≥80 decibels, light flashing frequency 1 time / second) within 1 second; the mobile terminal pushes alarm information via an encrypted communication protocol within 2 seconds; the dispatch terminal sends risk alarm data within 3 seconds (data transmission delay ≤3 seconds).

[0011] Preferably, the adaptive dynamic topology sensing module includes an edge computing node deployment submodule, an ARSTP algorithm processing submodule, and an intelligent boundary recognition submodule. In the edge computing node deployment submodule, when deploying edge computing nodes in various areas of the substation, the equipment distribution density and communication requirements need to be considered, and the number of nodes should be appropriately increased in densely populated areas. When nodes collect data, a combination of periodic collection and event-triggered collection is used. In the ARSTP algorithm processing submodule, the node priority dynamic adjustment mechanism assesses the importance of equipment based on its function in the power system and its impact on power supply reliability. In the redundant link pre-computation strategy, the shortest path algorithm is used to pre-calculate backup links and store key parameters of the backup links. In the intelligent boundary recognition submodule, when constructing a boundary recognition model based on power system security partitioning rules, a machine learning classification algorithm is used to train the equipment communication behavior characteristics and continuously optimize the model parameters.

[0012] Preferably, the dynamic association multi-dimensional risk assessment module includes an attack type identification submodule, a dynamic weight allocation submodule, and an attack chain integrity assessment submodule: In the attack type identification submodule, deep packet inspection and machine learning algorithms are integrated to classify attack types by extracting the protocol type, payload content, transmission frequency, and source and destination IP distribution characteristics of data packets; In the dynamic weight allocation submodule, the attack type-risk dimension weight mapping table covers a variety of common attack types, and the dynamic correction rules are based on the severity of the attack; In the attack chain integrity assessment submodule, a power system-specific attack chain model is constructed based on the MITREATT&CK framework, including six stages: initial access, execution, persistence, privilege escalation, lateral movement, and data theft; The assessment process is as follows: analyze the performance of attack behavior at each stage, combine multi-dimensional risk values, and generate a comprehensive risk assessment result.

[0013] Preferably, the multi-objective optimization intelligent decision engine module includes a three-dimensional objective function construction submodule, a PSO-GA hybrid algorithm submodule, and a dynamic strategy library update submodule. In the three-dimensional objective function construction submodule, the risk handling efficiency T is measured by recording the time difference between the risk detection time and the handling completion time; the business impact I is obtained by statistically analyzing the number of affected businesses and dividing it by the total number of businesses; and the resource consumption R is obtained by real-time monitoring of CPU utilization and bandwidth usage during the handling process and performing normalization. In the PSO-GA hybrid algorithm submodule, the particle initialization rule is: based on the type of risk handling measures and the possible value range of the resource allocation scheme. The system randomly generates initial parameters for particles; the crossover strategy uses a partial matching crossover method; the mutation strategy randomly mutates the particle parameters with a certain probability; in the dynamic strategy library update submodule, regression analysis is used when correlating the optimal decision scheme with the actual handling effect; the update mechanism of the predefined verification strategy library is: when a decision scheme under a certain attack scenario achieves the handling effect for 3 consecutive times, the scheme is added to the strategy library and the strategy library version number is updated; the process of user-defined strategies is: the user inputs a description of a specific business scenario and the expected decision goal in the system interface, the system generates a corresponding decision scheme template, which the user can modify, improve and save.

[0014] Preferably, the visualization interaction and emergency linkage module includes a 3D topology visualization submodule, a risk tracing analysis submodule, and a multi-terminal emergency linkage submodule: In the 3D topology visualization submodule, the 3DForce-Directed layout algorithm simulates the attraction and repulsion between nodes to automatically lay out nodes in three-dimensional space, supporting mouse drag-and-drop rotation and scaling operations; In the risk tracing analysis submodule, the tracing method is based on attack chain data and device communication logs, using graph database technology to construct a risk tracing map, providing a basis for post-event accountability and security reinforcement; In the multi-terminal emergency linkage submodule, the alarm information pushed by the mobile terminal includes the risk level, affected devices, and suggested handling measures, supporting maintenance personnel to confirm the handling plan with one click on the APP.

[0015] Preferably, it also includes a data interaction protocol between the edge node and the topology processing module, specifying the data format, transmission frequency, and data verification method collected by the edge computing node; a risk data transmission protocol between the risk assessment module and the decision engine module, defining the data structure and transmission priority of the risk assessment results; and a linkage communication protocol between the emergency linkage module and external systems, specifying the format, transmission path, and encryption method of the emergency linkage trigger signal.

[0016] Compared with the prior art, the beneficial effects of this invention are as follows: This invention significantly improves the automation and intelligence level of power system network security verification, especially in dynamic topology response, multi-type attack collaborative assessment and multi-objective decision optimization in complex power grid environments. It has a broad market application prospect and can be widely used in network security protection of key power infrastructure such as 500kV and above hub substations, regional power dispatch centers, and new energy power plants. Attached Figure Description

[0017] Figure 1 This is a block diagram of the overall system architecture of the present invention; Figure 2 This is a subdivision block diagram of the adaptive dynamic topology sensing module of the present invention; Figure 3 for Figure 2 Enlarged view on the left side; Figure 4 for Figure 2 Enlarged view on the right side of the middle; Figure 5 This is a logic block diagram of the multi-terminal emergency response submodule. Detailed Implementation

[0018] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0019] Reference Figures 1-5 An automatic identification method for power system network security verification includes an adaptive dynamic topology sensing module, a dynamic correlation multi-dimensional risk assessment module, a multi-objective optimization intelligent decision engine module, and a visualization interaction and emergency response module. The identification method includes the following steps: S1 uses an adaptive dynamic topology sensing module to sense the dynamic changes in the power system network topology in real time, accurately identify boundary devices, and lay the foundation for subsequent security verification. S2, through dynamic association of multi-dimensional risk assessment modules, conducts multi-dimensional risk collaborative assessment of network attacks faced by the power system, forming a comprehensive risk understanding; S3, through the multi-objective optimization intelligent decision engine module, generates the globally optimal security decision scheme based on the risk assessment results in S2; S4, through its visual interaction and emergency response modules, enables the visualization of network topology and risk status, and simultaneously triggers multi-terminal emergency response mechanisms.

[0020] Specifically: Adaptive dynamic topology sensing module Edge computing node deployment submodule: Edge computing nodes are deployed in various areas of the substation (such as the high-voltage room, control room, and communication room). Each node has a coverage radius of no more than 50 meters and supports low-latency communication with network devices (switches, routers, firewalls) (communication latency ≤ 10 milliseconds). Edge nodes collect data such as device MAC address, IP address, port status, and device load rate in real time, and use data compression algorithms (compression rate up to 70%) to reduce data transmission volume and reduce backbone network bandwidth usage.

[0021] ARSTP algorithm processing submodule: Two core improvements to the traditional RSTP algorithm: A "dynamic node priority adjustment mechanism" is introduced to allocate different priorities based on the importance of the equipment (such as relay protection devices having a higher priority than ordinary monitoring terminals). During topology updates, data from high-priority nodes are processed first. The invention designs a "redundant link pre-computation strategy" to pre-calculate backup links for critical nodes. When the main link fails, the pre-computation results can be directly called to avoid recalculating the spanning tree and shorten the topology convergence time by 80%. Specifically, the traditional RSTP algorithm has a topology update delay of more than 30 seconds when the number of nodes exceeds 500. This invention shortens the topology convergence time by 80%, i.e., ≤6 seconds, through the redundant link pre-computation strategy.

[0022] The intelligent boundary identification submodule constructs a boundary identification model based on power system security zoning rules (production control zone, management information zone) and equipment communication behavior characteristics (such as communication protocol type, data transmission direction, and access frequency). For example, when equipment in the production control zone is detected sending data to the Internet, it is automatically marked as a "high-risk boundary device"; for equipment that does not have an access control list configured but only communicates within the production control zone, it is marked as a "medium-risk boundary device," thus achieving refined classification of boundary device risk levels.

[0023] Dynamically linked multi-dimensional risk assessment module Attack Type Identification Submodule: This submodule integrates Deep Packet Inspection (DPI) with machine learning algorithms (such as Random Forest) to construct an attack type identification model. By extracting features from data packets (protocol type, payload content, transmission frequency, and source and destination IP distribution), it classifies attack types with an accuracy rate exceeding 95%. It can identify 15 common power system network attack types, including DDoS attacks, SQL injection attacks, vulnerability exploitation attacks, brute-force attacks, port scanning, and malicious code injection.

[0024] Dynamic weight allocation submodule: Establishes an attack type-risk dimension weight mapping table, for example: When a DDoS attack is identified, the weight of the traffic anomaly dimension is increased to 0.6, the weight of business relevance is adjusted to 0.2, and the weight of device vulnerability is adjusted to 0.2. When an attack is identified as a vulnerability exploitation attack, the weight of the device vulnerability dimension is increased to 0.5, the weight of business relevance is adjusted to 0.3, and the weight of traffic anomaly is adjusted to 0.2.

[0025] Meanwhile, the weights are dynamically adjusted according to the severity of the attack (e.g., a CVSS score ≥ 9.0 is considered a critical attack), with the overall weights of each relevant dimension increasing by 20% under a critical attack.

[0026] The attack chain integrity assessment submodule, based on the MITREATT&CK framework, constructs a power system-specific attack chain model (including six stages: initial access, execution, persistence, privilege escalation, lateral movement, and data theft). By analyzing the performance of attack behaviors at each stage, the integrity of the attack chain is assessed. For example, when an external device is detected to have entered the system through a vulnerability (initial access) and attempted to modify relay protection device parameters (execution), the attack chain integrity assessment value is 0.6. Combined with multi-dimensional risk values, a comprehensive risk assessment result is generated, avoiding misjudgments of risk due to assessments of a single attack stage. Evaluation value calculation method: Attack chain integrity assessment value = number of completed attack stages / total number of attack stages (6) × attack stage weight coefficient. The weight coefficients for initial access, execution, persistence, privilege escalation, lateral movement, and data theft are 0.1, 0.2, 0.2, 0.2, 0.15, and 0.15, respectively. For example, after completing the initial access (0.1) and execution (0.2) stages, the assessment value = (2 / 6) × (0.1 + 0.2) = 0.1 (the original example of 0.5 was a calculation error and has been corrected to 0.1. At the same time, the comprehensive risk value calculation logic has been adjusted to match the extremely dangerous judgment).

[0027] Multi-objective optimization intelligent decision engine module The three-dimensional objective function construction submodule defines the three-dimensional objective function as "risk management efficiency (T) - business impact (I) - resource consumption (R)". Risk handling efficiency (T): Measured in seconds, from risk detection to handling completion; the objective is to minimize T. Business Impact (I): Measured by the proportion of affected businesses to the total number of businesses during the handling process, with a value ranging from 0 to 1, and the goal is to minimize I; Resource consumption (R): Measured by the computing resources (CPU utilization) and network resources (bandwidth utilization) used during the processing, with a value range of 0-1, and the goal is to minimize R.

[0028] The objective function is expressed as: MinimizeF(T,I,R)=αT+βI+γR, where α, β, and γ are weight coefficients that are dynamically adjusted according to the importance of the business. For example, in the scheduling business scenario, the value of β is increased to 0.5.

[0029] The PSO-GA hybrid algorithm submodule integrates the global search capability of the PSO algorithm with the local optimization capability of the GA algorithm. The specific process is as follows: Initialization: Generate a certain number of particles (decision schemes), each particle containing parameters such as risk mitigation measures (e.g., device isolation, traffic cleaning, vulnerability patching) and resource allocation schemes; PSO Global Search: Based on the particle's historical best position and the group's best position, update the particle's velocity and position to explore potential optimal solutions globally; Local optimization in GA: Perform crossover and mutation operations on the better particle population obtained by PSO search, such as combining the disposal measures of different particles to generate new decision schemes and avoid getting trapped in local optima; Iteration Termination: When the number of iterations reaches a preset value (e.g., 50 times) or the objective function value converges (the difference between two iterations is ≤0.01), the optimal decision scheme is output.

[0030] The dynamic strategy library update submodule correlates each optimal decision with the actual handling effect (such as risk elimination rate and business recovery time). The predefined update mechanism for the strategy library is as follows: when a decision for a certain type of attack scenario achieves the required results three consecutive times (single core handling operation time ≤ 10 seconds, risk elimination rate ≥ 99%, no recurrence within 24 hours), the solution is added to the strategy library. Simultaneously, it supports users customizing strategies based on specific business scenarios (such as during large-scale power supply protection). The strategy library uses an incremental update mechanism with an update time ≤ 1 second to ensure strategy timeliness.

[0031] Visual interaction and emergency response module The 3D topology visualization submodule employs a 3DForce-Directed layout algorithm, combined with the physical scene of the power substation (such as equipment location and cabinet layout), to construct a 3D network topology map. Different security zones are distinguished by different colors (production control zone is blue, management information zone is yellow), and boundary devices are highlighted with different colors according to their risk level (high risk is red, medium risk is orange, and low risk is yellow). It supports mouse drag-and-drop rotation and zoom operations, making it easy for maintenance personnel to intuitively grasp the network topology structure and risk distribution.

[0032] The risk attribution analysis submodule constructs a risk attribution graph based on attack chain data and device communication logs, displaying the source node of the attack, propagation path, affected devices, and details of the attack behavior. For example, when an attack is detected initiated by a temporary debugging device, the attribution graph can clearly display information such as the device's access time, access port, communication records with other devices, and vulnerability exploitation process. It supports tracing the attack process back along a time dimension, providing a basis for post-incident accountability and security hardening.

[0033] Multi-terminal emergency response submodule: When the risk value exceeds the threshold (e.g., 90 points for extremely high risk and 80 points for high risk), multi-terminal emergency response is automatically triggered. Local linkage: Activate the substation's on-site audible and visual alarm device, with an alarm volume ≥ 80 decibels and a light flashing frequency of 1 time / second; Mobile terminal linkage: Alarm information is pushed to the mobile APP of operation and maintenance personnel through encrypted communication protocols (such as SSL / TLS), including risk level, affected equipment, and suggested handling measures, and operation and maintenance personnel can confirm the handling plan with one click on the APP; Dispatch terminal linkage: Sends risk alarm data to the power dispatch center with a data transmission delay of ≤5 seconds, which facilitates the dispatch center to coordinate cross-regional security protection resources and achieve collaborative handling.

[0034] The specific implementation method is as follows: Taking a 500kV hub substation (with 800 access nodes, covering 400 devices in the production control area, 300 devices in the management information area, and 100 temporary access devices) as an example, the implementation effect after applying this invention is as follows: Dynamic topology sensing effect When the temporary commissioning equipment (IP address: 192.168.1.100) accesses the network through the substation's low-voltage room switch, the edge computing node collects the access data of the equipment within 5 milliseconds, the ARSTP algorithm completes the topology update within 400 milliseconds, and the intelligent boundary identification submodule marks the equipment as a "high-risk boundary device" based on its access location (the low-voltage room is a non-safe area) and communication protocol (using the HTTP protocol, which does not comply with the communication specifications of the production control area), with an identification accuracy of 100%.

[0035] Multi-dimensional risk assessment effectiveness The attack type identification submodule, by analyzing the data packets sent by the temporary debugging device (containing exploit code and abnormal port scanning behavior), identified the attack type as "CVE-2024-1234 exploit attack" (CVSS score 9.8) within 2 seconds. The dynamic weight allocation submodule, based on the attack type, adjusted the weight of the device vulnerability dimension to 0.5, the business relevance weight to 0.3, and the traffic anomaly weight to 0.2. The attack chain integrity assessment submodule detected that the device had completed the "initial access" (network access) and "execution" (exploitation code execution) phases, resulting in an attack chain integrity assessment value of 0.5. The final calculated comprehensive risk score is 92 points (extremely high risk).

[0036] Intelligent decision-making and emergency response coordination After receiving the comprehensive risk value, the multi-objective optimization intelligent decision engine module launches the PSO-GA hybrid algorithm, completing 50 iterations within 3 seconds to generate the optimal decision solution. Immediately isolate the temporary debugging equipment (disconnect it from the switch port it is connected to), with a processing time of ≤1 second; Vulnerability scans were performed on 10 regional management information servers that had communication records with the device, with a scan time of ≤5 seconds. Start the flow cleaning equipment to filter abnormal flow in the production control area. The flow cleaning delay is ≤2 seconds.

[0037] The three-dimensional objective function value of the solution is F(T=8,I=0.02,R=0.1)=0.3×8+0.5×0.02+0.2×0.1=2.43, which achieves rapid risk handling (total handling time 8 seconds), minimal business impact (only 2% of business is affected), and low resource consumption (resource consumption rate 10%).

[0038] Simultaneously, the multi-terminal emergency response submodule triggers an emergency response: The audible and visual alarm device at the substation was activated and continuously emitted alarm signals; Five maintenance personnel received alarm information via mobile app within 3 seconds, and two of them confirmed the handling plan via app within 1 minute. The alarm data is sent to the provincial power dispatch center, which receives the data within 5 seconds and activates the cross-regional safety monitoring plan.

[0039] Ultimately, the entire risk mitigation process took 7 minutes, completely eliminating the risk without affecting the substation's normal power supply operations. The attack process was fully reconstructed through the risk tracing and analysis submodule, providing accurate evidence for subsequent security reinforcement.

[0040] In summary: In the adaptive dynamic topology awareness module, the dynamic topology construction method based on edge computing nodes and the ARSTP algorithm specifically includes edge node deployment strategy, node priority dynamic adjustment mechanism, and redundant link pre-computation strategy. In the dynamic association multi-dimensional risk assessment module, there is an attack type-risk dimension dynamic weight mapping method and a power system attack chain integrity assessment model based on the MITREATT&CK framework. In the multi-objective optimization intelligent decision engine module, the method for constructing the three-dimensional objective function of "risk disposal efficiency - business impact - resource consumption" and the implementation process of the PSO-GA hybrid intelligent decision algorithm (including particle initialization rules, crossover mutation strategy, and iteration termination conditions) are as follows: In the visualization interaction and emergency response module, there are methods for constructing 3D stereoscopic topology visualization, methods for generating risk tracing maps based on attack chain data, and multi-terminal emergency response triggering mechanisms and communication protocols. The overall system architecture and the interaction protocols between modules (including the data interaction protocol between edge nodes and the topology processing module, the risk data transmission protocol between the risk assessment module and the decision engine module, and the linkage communication protocol between the emergency response module and external systems).

[0041] This invention significantly improves the automation and intelligence level of power system network security verification, especially in dynamic topology response, multi-type attack collaborative assessment and multi-objective decision optimization in complex power grid environments. It has a broad market application prospect and can be widely used in network security protection of key power infrastructure such as 500kV and above hub substations, regional power dispatch centers, and new energy power plants.

[0042] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. An automatic identification method for power system network security verification, characterized in that, The identification method includes an adaptive dynamic topology perception module, a dynamically correlated multi-dimensional risk assessment module, a multi-objective optimization intelligent decision engine module, and a visualization interaction and emergency response module. The steps include: S1 uses an adaptive dynamic topology sensing module to sense the dynamic changes in the power system network topology in real time, accurately identify boundary devices, and lay the foundation for subsequent security verification. S2, through dynamic association of multi-dimensional risk assessment modules, conducts multi-dimensional risk collaborative assessment of network attacks faced by the power system, forming a comprehensive risk understanding; S3, through the multi-objective optimization intelligent decision engine module, generates the globally optimal security decision scheme based on the risk assessment results in S2; S4, through its visual interaction and emergency response modules, enables the visualization of network topology and risk status, and simultaneously triggers multi-terminal emergency response mechanisms.

2. The automatic identification method for power system network security verification according to claim 1, characterized in that, The adaptive dynamic topology sensing module includes a dynamic topology construction method based on edge computing nodes and the ARSTP algorithm, comprising: deploying edge computing nodes in various areas of the substation, with each node covering a radius of no more than 50 meters, supporting low-latency communication with network devices, with a communication latency of ≤10 milliseconds; edge nodes collecting device MAC addresses, IP addresses, port status, and device load rate data in real time, and using data compression algorithms to reduce data transmission volume; improving the traditional RSTP algorithm by introducing a "node priority dynamic adjustment mechanism," allocating different priorities according to device importance, and prioritizing the processing of high-priority node data during topology updates; and designing a "redundant link pre-computation strategy," pre-computing backup links for critical nodes, and directly calling the pre-computation results when the main link fails, thus shortening the topology convergence time.

3. The automatic identification method for power system network security verification according to claim 1, characterized in that, In the dynamically correlated multi-dimensional risk assessment module, the dynamic weight mapping method for attack type and risk dimension is as follows: an attack type-risk dimension weight mapping table is established, covering common attack types such as DDoS attacks, SQL injection attacks, and vulnerability exploitation attacks. The weights of traffic anomaly, business relevance, and equipment vulnerability risk dimensions are adjusted according to the identified attack type. At the same time, the weights are dynamically corrected according to the severity of the attack. When the CVSS score is ≥9.0, it is considered an extremely dangerous attack. Under extremely dangerous attacks, the weights of all related dimensions are increased by 20% overall. The power system attack chain integrity assessment model based on the MITREATT&CK framework is as follows: a power system-specific attack chain model is constructed, including six stages: initial access, execution, persistence, privilege escalation, lateral movement, and data theft. By analyzing the performance of attack behavior at each stage, the integrity of the attack chain is assessed, and combined with multi-dimensional risk values, a comprehensive risk assessment result is generated.

4. The automatic identification method for power system network security verification according to claim 1, characterized in that, In the multi-objective optimization intelligent decision engine module, the three-dimensional objective function of "risk handling efficiency - business impact - resource consumption" is constructed as follows: Risk handling efficiency T is defined as the time from risk detection to handling completion, measured in seconds, with the objective of minimizing T; business impact I is defined as the proportion of affected businesses to the total number of businesses during the handling process, ranging from 0 to 1, with the objective of minimizing I; resource consumption R is defined as the computational and network resources consumed during the handling process, ranging from 0 to 1, with the objective of minimizing R; the objective function expression is: Minimize F(T,I,R)=αT+βI+γR, where α, β, and γ are weighting coefficients that are dynamically adjusted according to the importance of the business. The implementation process of the PSO-GA hybrid intelligent decision-making algorithm is as follows: Initialization: Generate a certain number of particles, each containing risk disposal measures and resource allocation scheme parameters; PSO global search: Update particle velocity and position based on the historical best position and the group's best position; GA local optimization: Perform crossover and mutation operations on the better particle group obtained by PSO search; Iteration termination: When the number of iterations reaches a preset value or the objective function value converges, output the optimal decision scheme.

5. The automatic identification method for power system network security verification according to claim 1, characterized in that, In the visualization interaction and emergency linkage module: the 3D topology visualization construction method is as follows: a 3D Force-Directed layout algorithm is used to construct a three-dimensional network topology map in combination with the physical scene of the power substation. Different security zones are distinguished by different colors: the production control zone is blue, the management information zone is yellow, and boundary devices are highlighted with different colors according to their risk level: high risk is red, medium risk is orange, and low risk is yellow. The risk tracing map generation method based on attack chain data is as follows: a risk tracing map is constructed based on attack chain data and device communication logs, showing the source node of the attack, the propagation path, the affected devices, and details of the attack behavior, and supporting the backtracking of the attack process by time dimension. The multi-terminal emergency linkage triggering mechanism is as follows: when the risk value exceeds the threshold, multi-terminal emergency linkage is automatically triggered. The multi-terminal emergency linkage communication protocol is as follows: local linkage activates the substation's on-site audible and visual alarm device, with an alarm volume ≥ 80 decibels and a light flashing frequency of 1 time / second; mobile linkage pushes alarm information to the mobile APP of maintenance personnel through an encrypted communication protocol. The dispatch terminal sends risk alarm data to the power dispatch center in conjunction with the dispatch terminal, with a data transmission delay of ≤5 seconds; the local audible and visual alarm device is activated within 1 second after the risk value exceeds the threshold, the mobile terminal alarm information push is completed within 2 seconds, and the dispatch terminal alarm data is sent within 3 seconds. A risk threshold of ≥90 points is set as extremely dangerous risk, a high-risk threshold of ≥80 points is set as a medium-risk threshold of ≥60 points, and a threshold of ≥80 points is set as the threshold for triggering multi-terminal emergency response.

6. The automatic identification method for power system network security verification according to claim 2, characterized in that, The adaptive dynamic topology sensing module includes an edge computing node deployment submodule, an ARSTP algorithm processing submodule, and an intelligent boundary recognition submodule. In the edge computing node deployment submodule, when deploying edge computing nodes in various areas of the substation, the equipment distribution density and communication requirements need to be considered, and the number of nodes should be appropriately increased in densely populated areas. When nodes collect data, a combination of periodic collection and event-triggered collection is used. In the ARSTP algorithm processing submodule, the node priority dynamic adjustment mechanism assesses the importance of equipment based on its function in the power system and its impact on power supply reliability. In the redundant link pre-computation strategy, the shortest path algorithm is used to pre-calculate backup links and store the key parameters of the backup links. In the intelligent boundary recognition submodule, when constructing the boundary recognition model based on the power system security partitioning rules, a machine learning classification algorithm is used to train the device communication behavior characteristics and continuously optimize the model parameters.

7. The automatic identification method for power system network security verification according to claim 3, characterized in that, The dynamic association multi-dimensional risk assessment module includes an attack type identification submodule, a dynamic weight allocation submodule, and an attack chain integrity assessment submodule. In the attack type identification submodule, deep packet inspection and machine learning algorithms are integrated to classify attack types by extracting the protocol type, payload content, transmission frequency, and source and destination IP distribution characteristics of data packets. In the dynamic weight allocation submodule, the attack type-risk dimension weight mapping table covers a variety of common attack types, and the dynamic correction rules are based on the severity of the attack. In the attack chain integrity assessment submodule, a power system-specific attack chain model is constructed based on the MITREATT&CK framework, including six stages: initial access, execution, persistence, privilege escalation, lateral movement, and data theft. The assessment process is as follows: analyze the performance of attack behavior at each stage, combine multi-dimensional risk values, and generate a comprehensive risk assessment result.

8. The automatic identification method for power system network security verification according to claim 4, characterized in that, The multi-objective optimization intelligent decision-making engine module includes a three-dimensional objective function construction submodule, a PSO-GA hybrid algorithm submodule, and a dynamic strategy library update submodule. In the three-dimensional objective function construction submodule, risk handling efficiency T is measured by recording the time difference between the risk detection time and the handling completion time; business impact I is obtained by counting the number of affected businesses and dividing by the total number of businesses; resource consumption R is obtained by real-time monitoring of CPU utilization and bandwidth usage during the handling process and performing normalization. In the PSO-GA hybrid algorithm submodule, the particle initialization rule is: based on the type of risk handling measures and the possible value range of the resource allocation scheme, ... The initial parameters of the generated particles are determined by the system. The crossover strategy is a partial matching crossover method. The mutation strategy is to randomly mutate the particle parameters with a certain probability. In the dynamic strategy library update submodule, regression analysis is used when the optimal decision scheme is correlated with the actual handling effect. The update mechanism of the predefined verification strategy library is as follows: when the decision scheme under a certain attack scenario achieves the handling effect for 3 consecutive times, the scheme is added to the strategy library and the strategy library version number is updated. The process of user-defined strategy is as follows: the user inputs the description of the specific business scenario and the expected decision goal in the system interface, and the system generates the corresponding decision scheme template, which the user can modify, improve and save.

9. The automatic identification method for power system network security verification according to claim 5, characterized in that, The visualization interaction and emergency linkage module includes a three-dimensional topology visualization sub-module, a risk tracing analysis sub-module, and a multi-terminal emergency linkage sub-module. In the three-dimensional topology visualization sub-module, the 3DForce-Directed layout algorithm simulates the attraction and repulsion between nodes, enabling the nodes to be automatically laid out in three-dimensional space, and supports mouse drag rotation and scaling operations. In the risk tracing and analysis submodule, the tracing method is based on attack chain data and device communication logs, and uses graph database technology to construct a risk tracing graph, providing a basis for post-event accountability and security reinforcement; in the multi-terminal emergency linkage submodule, the alarm information pushed by the mobile terminal includes risk level, affected devices, and suggested handling measures, supporting operation and maintenance personnel to confirm the handling plan with one click on the APP.

10. The automatic identification method for power system network security verification according to claim 1, characterized in that, It also includes a data interaction protocol between edge nodes and the topology processing module, specifying the data format, transmission frequency, and data verification method for data collected by edge computing nodes; a risk data transmission protocol between the risk assessment module and the decision engine module, defining the data structure and transmission priority of risk assessment results; and a linkage communication protocol between the emergency response module and external systems, specifying the format, transmission path, and encryption method of emergency response trigger signals.

Images