Power network security event association analysis method, system and equipment based on space-time diagram network, and medium

Abstract

The invention relates to the technical field of power network security, in particular to a time-space diagram network-based power network security event association analysis method, system and device and a medium, and the method comprises the steps: collecting various data in a power network through constructing a data collection model, and processing the data through a data preprocessing model; constructing a graph structure by using a space-time graph model, fusing a time dimension, and extracting space and time features; constructing an association rule mining model, mining association rules of the spatial-temporal features, and finally generating a visual report; by introducing the space-time diagram network theory, the space-time correlation characteristics between the security events are accurately captured, and the accuracy of correlation analysis is improved; compared with the prior art, the method has higher real-time performance, new security threats and attack modes can be found in time, and the protection capability of a power network is enhanced; the space-time diagram network model has good expandability and can adapt to a larger-scale and more complex power network environment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power network security, and in particular to a power network security event correlation analysis method, system, device and medium based on a space-time graph network. BACKGROUND

[0002] At present, the power network security event correlation analysis method based on a space-time graph network has combined the space-time graph network theory and the power network security characteristics. This method realizes the correlation analysis of power network security events by constructing a space-time graph model, extracting space-time features, and mining correlation rules. With the continuous development of power network security, this method is widely used in identifying potential security threats and attack patterns in power networks, especially in dynamically capturing and analyzing security events in complex network environments, and it has shown its unique advantages.

[0003] However, the existing method still has some problems in actual application. First, the existing method is not accurate enough and cannot effectively capture the space-time correlation characteristics between security events, resulting in low accuracy of the analysis results. Second, the real-time problem is more prominent, and the existing method cannot immediately discover new security threats and attack patterns, thereby affecting the security protection capability of the power network. In addition, the existing method has poor scalability and cannot effectively cope with larger and more complex power network environments. Moreover, the existing visualization effect is weak and it is difficult to intuitively display the correlation between security events, limiting the user's comprehensive understanding of the security situation and decision-making ability. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, the present application provides a power network security event correlation analysis method and system based on a space-time graph network, which solves the deficiencies of the existing method in accuracy, real-time performance, scalability and visualization effect, and can more accurately capture the space-time correlation characteristics between security events, discover new security threats and attack patterns in real time, and improve the security protection capability of the power network.

[0006] To solve the above technical problems, the present application provides the following technical solutions:

[0007] In a first aspect, the present application provides a power network security event correlation analysis method based on a space-time graph network, comprising:

[0008] A data collection model is constructed to collect data on the power network, and a data preprocessing model is developed after the collection is completed to preprocess the collected data through the data preprocessing model;

[0009] A graph structure is constructed by a space-time graph model, and a time dimension is integrated to construct a space-time feature extraction model to extract space and time features.

[0010] An association rule mining model is constructed to mine the association rules of the space-time features, and after the mining is completed, an association analysis result visualization and report model is constructed to visually display and generate a report.

[0011] As a preferred scheme of the power network security event association analysis method based on the space-time graph network, the data collection model includes collecting data from the devices, nodes and security systems of the power network and collecting data through a sensor monitoring method.

[0012] As a preferred scheme of the power network security event association analysis method based on the space-time graph network, the data preprocessing model includes preprocessing data and evaluating the quality of the data during cleaning, and the data cleaning is automatically performed by using scripts and programs.

[0013] The data preprocessing includes cleaning, denoising and missing value processing of the collected raw data.

[0014] The evaluation of the quality of the data during cleaning includes missing value processing to delete and fill the missing values, and the filling includes mean and median filling.

[0015] As a preferred scheme of the power network security event association analysis method based on the space-time graph network, the space-time graph model includes graph structure modeling and integration of the time dimension, which includes:

[0016] The graph structure modeling includes modeling the devices, nodes and connection relationships in the power network as a graph structure.

[0017] The integration of the time dimension includes adding corresponding time dimension information to each time point.

[0018] As a preferred scheme of the power network security event association analysis method based on the space-time graph network, the construction of the space-time feature extraction model includes space feature extraction, time feature extraction and space-time feature fusion, which includes:

[0019] The space feature extraction includes using a graph neural network model of a graph convolution network to extract the space features of the nodes and edges in the graph.

[0020] The time feature extraction includes using a time series model of a time convolution network and a long short-term memory network to extract the dynamic change features of the security events in time.

[0021] The spatio-temporal feature fusion includes fusing the spatial features and the temporal features to generate a spatio-temporal embedding representation of the node.

[0022] As a preferred scheme of the power network security event correlation analysis method based on the spatio-temporal graph network, the constructing the correlation rule mining model includes the spatio-temporal feature-based correlation rule mining and the correlation rule evaluation and optimization, which includes:

[0023] The spatio-temporal feature-based correlation rule mining includes mining the correlation rules between the security events by using the generated spatio-temporal embedding representation.

[0024] The correlation rule evaluation and optimization includes evaluating and optimizing the mined correlation rules.

[0025] As a preferred scheme of the power network security event correlation analysis method based on the spatio-temporal graph network, the constructing the correlation analysis result visualization and report model includes the visualization display and the report generation, which includes:

[0026] The visualization display includes visualizing the correlation analysis results to present the correlation relationships between the security events.

[0027] The report generation includes presenting the correlation analysis results in the form of a report to understand the network security status and potential threats.

[0028] In a second aspect, the present application provides a power network security event correlation analysis system based on a spatio-temporal graph network, which includes:

[0029] A data collection module, which constructs a data collection model to collect data on the power network, and formulates a data preprocessing model after the collection is completed, and pre-processes the collected data through the data preprocessing model.

[0030] A spatio-temporal graph modeling module, which constructs a spatio-temporal graph model to construct a graph structure through the spatio-temporal graph model, and integrates a time dimension, and constructs a spatio-temporal feature extraction model to extract spatial and temporal features.

[0031] A correlation analysis module, which constructs a correlation rule mining model to mine the correlation rules of the spatio-temporal features, and after the mining is completed, constructs a correlation analysis result visualization and report model to perform a visualization display and generate a report.

[0032] In a third aspect, the present application provides an electronic device, which includes:

[0033] A memory and a processor.

[0034] The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions, which realize the steps of the power network security event correlation analysis method based on a spatio-temporal graph network.

[0035] In a fourth aspect, the present application provides a computer readable storage medium storing computer executable instructions, which realize the steps of the power network security event correlation analysis method based on a spatio-temporal graph network when executed by a processor.

[0036] Compared with the prior art, the present application has the following beneficial effects: by introducing the spatio-temporal graph network theory and combining the security characteristics of the power network, the present application can more accurately capture the spatio-temporal correlation characteristics between security events, significantly improving the accuracy of security event correlation analysis. In the aspects of data collection, spatio-temporal modeling, and feature extraction, the present application has higher real-time performance, can instantly discover new security threats and attack patterns, and thus enhances the protection capability of the power network. In addition, the spatio-temporal graph network model of the present application has good scalability, can adapt to larger-scale and more complex power network environments, and improves its application capability in dynamic power networks. Through the visual display of the correlation analysis results, users can intuitively understand the relationship between security events and potential threats, effectively improving the decision-making efficiency and system response speed, and ultimately ensuring the safe operation of the power network. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0038] Figure 1 The overall flowchart of the power network security event correlation analysis method based on a spatio-temporal graph network according to an embodiment of the present application. DETAILED DESCRIPTION

[0039] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings of the specification. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.

[0040] Embodiment 1, refer to Figure 1For an embodiment of the present application, a power network security event correlation analysis method based on a spatio-temporal graph network is provided, comprising:

[0041] S1: A data collection model is constructed to collect data on the power network, and a data preprocessing model is formulated after the collection is completed, and the collected data is preprocessed through the data preprocessing model.

[0042] It should be noted that constructing the data collection model includes collecting data from the devices, nodes and security systems of the power network and collecting data through sensor monitoring.

[0043] Further, the data collection collects security event data from each device, node and security system of the power network, including event time, event type, event source IP, event target IP, event involved port, event involved service and detailed description of the event.

[0044] The data is collected through sensor monitoring, and is collected through smart meter acquisition, SCADA system monitoring, big data acquisition platform, cloud computing and edge computing combination, network security event data collection, device log data collection and user behavior data collection.

[0045] It should also be noted that the data preprocessing model includes preprocessing the data and evaluating the quality of the data during cleaning, and automatically cleaning, using scripts and programs to realize data cleaning automation.

[0046] Further, the data preprocessing includes cleaning, denoising and missing value processing of the collected raw data to improve data quality, while extracting key information to provide a basis for subsequent feature extraction and correlation analysis.

[0047] Evaluating the quality of the data during cleaning includes deleting and filling missing values, and filling includes mean and median filling; includes missing values, outliers, repeated values, different values and format error values; suitable for numerical data, fill the missing values with the mean or median of the field; mode filling: suitable for classification data, fill the missing values with the mode of the field; before and after value filling: suitable for time series data, fill the missing values with the previous or next valid value; model prediction filling: use machine learning model to predict missing values; take the feature containing missing values as the prediction target (y), and take the other complete features as the input features (X), train a model to learn the mapping relationship of X>y; use this trained model to predict the missing y value.

[0048] And the automated cleaning uses scripts and programs to achieve data cleaning automation, improving cleaning efficiency and accuracy. Regularly running data cleaning scripts ensures the continuous cleaning and usability of data. Manual review of data after automated cleaning ensures the accuracy and reliability of the cleaning results. Record problems and solutions found during the cleaning process to provide a reference for subsequent data cleaning. Continuously improve data cleaning processes and methods based on problems and feedback found during the data cleaning process.

[0049] S2: Build a graph structure through a spatio-temporal graph model, integrate a time dimension, build a spatio-temporal feature extraction model, and extract spatial and temporal features.

[0050] It should be noted that the spatio-temporal graph model includes graph structure modeling and integration of the time dimension.

[0051] Further, the graph structure modeling includes modeling the devices, nodes in the power network, and the connection relationship between them as a graph structure, where the nodes represent devices or nodes, and the edges represent the connection relationship between the devices or nodes.

[0052] Integrating the time dimension includes attaching the corresponding time dimension information to each time point, thereby generating a graph at each time, and the spatio-temporal graph model can capture the dynamic change characteristics of the safety event in time and space.

[0053] It should also be noted that building a spatio-temporal feature extraction model includes spatial feature extraction, temporal feature extraction, and spatio-temporal feature fusion.

[0054] Further, spatial feature extraction includes using a graph neural network model of a graph convolution network to extract spatial features of nodes and edges in the graph, reflecting the spatial correlation between devices or nodes, such as topological structure and physical distance.

[0055] Temporal feature extraction includes extracting the dynamic change characteristics of the safety event in time through a time series model of a time convolution network and a long short-term memory network, reflecting the development trend and periodic changes of the safety event.

[0056] Spatio-temporal feature fusion includes fusing spatial features and temporal features to generate spatio-temporal embedding representations of nodes; and through fusion, it simultaneously captures the correlation characteristics of the safety event in time and space, providing a basis for subsequent association rule mining.

[0057] S3: Build an association rule mining model to mine the association rules of spatio-temporal features. After mining is completed, build a correlation analysis result visualization and reporting model to perform visual display and generate a report.

[0058] It should be noted that the construction of the association rule mining model includes association rule mining based on spatiotemporal features and association rule evaluation and optimization.

[0059] Further, the association rule mining based on spatiotemporal features includes mining the association rules between security events by using the generated spatiotemporal embedding representation; mining the association rules between security events; the above association rules can reveal the spatiotemporal association relationship between different security events; for example, a certain IP address accesses the same port multiple times in a short time, which means that this IP address is trying to launch an attack; specifically, the association rule mining based on spatiotemporal features identifies the association relationship between security events by fusing the spatial and temporal embedding representations of nodes, wherein the temporal distance refers to the time interval of event occurrence, and the spatial distance can be the network topology hop number or the difference in physical / logical location of devices; for example, when the same IP accesses the same port multiple times in a short time or abnormal events occur continuously on adjacent nodes, it can be determined as a potential attack behavior, in addition, it can be extended to multi-source collaborative attack, abnormal user behavior and periodic attack and other scenarios, realizing accurate discovery and analysis of power network security threats.

[0060] The association rule evaluation and optimization includes evaluating and optimizing the mined association rules; to improve the accuracy and effectiveness of the association analysis, and the evaluation indicators include the confidence, support and lift of the rules.

[0061] It should also be noted that the construction of the association analysis result visualization and reporting model includes visualization display and report generation.

[0062] Further, the visualization display includes visualizing the association analysis results to present the association relationship between security events; for example, by drawing an association network graph and a time series graph, helping users to intuitively observe the association relationship between security events.

[0063] The report generation includes presenting the association analysis results in the form of a report to facilitate users to understand the network security situation and potential threats, and the report content includes association rule description, security event statistical information and potential threat evaluation.

[0064] Embodiment 2 is an embodiment of the present application, which provides a power network security event association analysis method based on spatiotemporal graph network. In order to verify the beneficial effects of the present application, economic benefit calculation and simulation experiment are used for scientific demonstration.

[0065] In the power network simulation range, randomly select part of the SQL injection attack, Webshell attack, XSS attack and rebound attack events of the power network as experimental data sources; perform data collection, preprocessing, spatiotemporal modeling, feature extraction, rule mining and visualization verification.

[0066] The experimental process includes data collection and preprocessing, spatio-temporal graph model construction, spatio-temporal feature extraction and fusion, and association rule mining and evaluation.

[0067] Specifically, the original message of the above-mentioned four types of attack event data occurring in the power network is collected through the Internet export network traffic mirror, security device alarm log multi-source channel.

[0068] The power network topology is abstracted as a weighted graph structure, the node represents a device, and the edge represents the physical connection or logical connection relationship; the graph structure is stored by using an adjacency matrix, and the node attribute includes the device type, security level, and risk score.

[0069] According to a fixed time window, a spatio-temporal graph sequence is constructed, a graph is generated in each time period, and the graphs are associated through timestamps to form a dynamic spatio-temporal graph data structure, and the route of the attack event in the time dimension is restored.

[0070] A two-layer graph convolution network (GCN) is used to extract the spatial features of each node, and the activation function is ReLU; the association relationship between devices is analyzed through the topological structure; for example, the attack propagation probability of adjacent nodes.

[0071] A long short-term memory network (LSTM) is used to process time series data; the time sequence features of attack frequency, duration, and interval time are extracted to capture the periodicity of the attack mode.

[0072] An attention mechanism is used to fuse the spatial and temporal features to generate a spatio-temporal embedding vector; the association characteristics of the attack event in the spatio-temporal dimension are comprehensively encoded to provide high-quality input for subsequent rule mining.

[0073] Based on the spatio-temporal embedding vector, the Apriori algorithm is applied to mine high-confidence association rules; for example, the association rule of "the source IP pair initiates N times of SQL injection attempts" and "the target server response status code 503 abnormality" is screened out, and the confidence is 0.83.

[0074] The lift index is introduced to evaluate the effectiveness of the rules, and the core association rules are retained after removing the redundant rules; the rule generalization ability is verified through cross-validation, and the test set accuracy is 80.3%.

[0075] As shown in Table 1, the experimental verification results show that the method has advantages in power network attack event association analysis.

[0076] Table 1 Power network security event attack traffic analysis table

[0077]

[0078]

[0079] Embodiment 3, the above is a schematic scheme of a power network security event correlation analysis method based on a spatio-temporal graph network. It should be noted that the technical scheme of the system for power network security event correlation analysis based on a spatio-temporal graph network is the same as the technical scheme of the power network security event correlation analysis method based on a spatio-temporal graph network described above. The technical details of the power network security event correlation analysis system based on a spatio-temporal graph network in this embodiment are not described in detail, and can be referred to the description of the technical scheme of the power network security event correlation analysis method based on a spatio-temporal graph network described above.

[0080] The embodiment also provides a power network security event correlation analysis system based on a spatio-temporal graph network, comprising:

[0081] A data collection module constructs a data collection model to collect data on the power network, and formulates a data preprocessing model after the collection is completed, and pre-processes the collected data through the data preprocessing model;

[0082] A spatio-temporal graph modeling module constructs a graph structure through a spatio-temporal graph model, and integrates a time dimension to construct a spatio-temporal feature extraction model to extract spatial and temporal features;

[0083] An association analysis module constructs an association rule mining model to mine the association rules of the spatio-temporal features, and after the mining is completed, constructs an association analysis result visualization and reporting model to visually display and generate a report.

[0084] The embodiment also provides an electronic device suitable for the power network security event correlation analysis based on a spatio-temporal graph network, comprising: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions to realize the power network security event correlation analysis method based on a spatio-temporal graph network proposed in the above embodiment.

[0085] The embodiment also provides a storage medium having a computer program stored thereon, and the program is executed by a processor to realize the power network security event correlation analysis method based on a spatio-temporal graph network proposed in the above embodiment.

[0086] The storage medium proposed in the embodiment and the power network security event correlation analysis method based on a spatio-temporal graph network proposed in the above embodiment belong to the same inventive concept, and the technical details not described in detail in the embodiment can be referred to the above embodiment, and the embodiment has the same beneficial effects as the above embodiment.

[0087] Those skilled in the art can clearly understand the present application by the above description of the embodiments, and the present application can be realized by software and necessary general hardware, and of course, can also be realized by hardware. Based on such understanding, the technical solutions of the present application or the part that contributes to the prior art can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a FLASH, a hard disk, or an optical disc, and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods of various embodiments of the present application.

[0088] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application but not limit the present application, and although the present application is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, and all should be covered in the scope of the claims of the present application.

Claims

1. A method for power network security incident correlation analysis based on a spatio-temporal graph network, characterized in that, The method comprises the following steps: A data collection model is constructed to collect data on the power network, and a data preprocessing model is formulated after the collection is completed to preprocess the collected data through the data preprocessing model; A graph structure is constructed through a spatio-temporal graph model, and a time dimension is integrated to construct a spatio-temporal feature extraction model to extract spatial and temporal features; An association rule mining model is constructed to mine the association rules of the spatio-temporal features, and after the mining is completed, a correlation analysis result visualization and report model is constructed to visually display and generate a report.

2. The spatiotemporal graph network-based power network security incident correlation analysis method of claim 1, wherein, The data collection model comprises collecting data from the devices, nodes and security systems of the power network and collecting data through a sensor monitoring method.

3. The spatiotemporal graph network-based power network security incident correlation analysis method of claim 2, wherein, The data preprocessing model comprises preprocessing data and evaluating the quality of the data during cleaning, and the cleaning is automatically performed by using scripts and programs to realize data cleaning automation; The data preprocessing comprises cleaning, denoising and missing value processing of the collected raw data; The evaluation of the quality of the data during cleaning comprises deleting and filling missing values during missing value processing, and the filling comprises mean and median filling.

4. The spatiotemporal graph network-based power network security incident correlation analysis method of claim 3, wherein, The graph structure modeling comprises modeling the devices, nodes and connection relationships in the power network into a graph structure; The time dimension integration comprises adding corresponding time dimension information to each time point. The construction of the spatio-temporal feature extraction model comprises spatial feature extraction, temporal feature extraction and spatio-temporal feature fusion, which comprises:

5. The spatiotemporal graph network-based power network security incident correlation analysis method of claim 4, wherein, The spatial feature extraction comprises using a graph neural network model of a graph convolution network to extract spatial features of nodes and edges in the graph; The temporal feature extraction comprises using a time series model of a time convolution network and a long short-term memory network to extract dynamic change features of the security events in time; The spatio-temporal feature fusion comprises fusing the spatial features and the temporal features to generate spatio-temporal embedding representations of the nodes. The construction of the association rule mining model comprises association rule mining based on the spatio-temporal features and association rule evaluation and optimization, which comprises:

6. The spatiotemporal graph network-based power network security incident correlation analysis method of claim 5, wherein, The association rule mining based on the spatio-temporal features comprises using the generated spatio-temporal embedding representations to mine the association rules between the security events; The association rule evaluation and optimization comprises evaluating and optimizing the mined association rules. The construction of the correlation analysis result visualization and report model comprises visualization and report generation, which comprises:

7. The spatiotemporal graph network-based power network security incident correlation analysis method of claim 6, wherein, The visualization comprises visually displaying the correlation analysis results to present the association relationships between the security events; The report generation comprises presenting the correlation analysis results in the form of a report to understand the network security status and potential threats. The method comprises the following steps:

8. A power network security event correlation analysis system based on a spatio-temporal graph network, applying a power network security event correlation analysis method based on a spatio-temporal graph network according to any one of claims 1 to 7, characterized in that, A data collection model is constructed to collect data on the power network, and a data preprocessing model is formulated after the collection is completed to preprocess the collected data through the data preprocessing model; A graph structure is constructed through a spatio-temporal graph model, and a time dimension is integrated to construct a spatio-temporal feature extraction model to extract spatial and temporal features; A correlation analysis result visualization and report model is constructed to visually display and generate a report. The association analysis module constructs an association rule mining model, mines the association rules of the space-time characteristics, and after the mining is completed, constructs an association analysis result visualization and report model, performs visual display, and generates a report. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The computer program is executed by the processor to implement the steps of the power network security event association analysis method based on the spatio-temporal graph network in any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the power network security event association analysis method based on the spatio-temporal graph network in any one of claims 1 to 7.

Images