Power grid-oriented security situation awareness and active defense method, system and device
By processing real-time data and performing AI/ML analysis on the power grid OT network, behavioral baselines are constructed, anomalies are identified, and threats are assessed. This solves the problems of real-time visibility and delayed response in power grid network security protection, enabling proactive defense and rapid response, and improving power grid security and operation and maintenance efficiency.
Patent Information
- Application Number
- CN202511567267.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-30
- Publication Date
- 2026-01-27
AI Technical Summary
The existing power grid network security protection system is unable to deeply analyze industrial control protocols when facing complex network attacks, lacks real-time and refined OT network visibility, resulting in a lag in passive defense response, difficulty in adapting to dynamic threat environments, and a lack of intelligent threat prediction and proactive defense capabilities.
By acquiring OT traffic data packets in real time, processing and analyzing the data, a baseline of normal behavior for power grid OT equipment and networks is constructed, abnormal behavior is identified, and threat detection and assessment are performed in conjunction with AI/ML technologies to provide a power grid network security situation map and achieve proactive defense.
It enables real-time, in-depth insights into OT networks, shortens threat response time, prevents attack spread, reduces the impact on the stable operation of the power grid, enhances security transparency, and meets the compliance requirements of critical information infrastructure.
Smart Images
Figure CN121418162A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of power grid network security technology, specifically to a method, system, and device for power grid security situation awareness and proactive defense. Background Technology
[0002] In traditional power grid operating environments, network security primarily relies on physical isolation and perimeter-based defense measures, such as firewalls, intrusion detection systems, and antivirus software. However, this primarily targets security threats to traditional IT networks and assumes strict physical isolation between the Operational Technology (OT) network and external networks. Furthermore, some data acquisition and monitoring systems and industrial control systems incorporate basic access control and authentication mechanisms. In power grids, industrial control systems used for monitoring and control, such as data acquisition and monitoring systems, typically employ proprietary communication protocols, and their security design did not initially adequately consider the increasingly complex cyberattack scenarios.
[0003] However, with the digital and intelligent transformation of the power grid, the increasing number of intelligent devices, remote operation and maintenance interfaces, and the convergence of IT and OT technologies, maintaining "gap isolation" is becoming increasingly difficult. The increasingly close connection between OT and IT networks provides attackers with new penetration paths. Existing general-purpose cybersecurity products typically cannot deeply analyze the industrial control protocols used in power grid OT networks, making it impossible to identify malicious commands, abnormal operations, or specific attack behaviors targeting these protocols. Existing solutions struggle to provide real-time, in-depth insights into device behavior, communication patterns, and operational commands within the OT network, resulting in the inability to promptly detect abnormal traffic, unauthorized device connections, or malicious operational commands.
[0004] Furthermore, traditional security measures are mostly passive defenses based on known signatures, which are ineffective against zero-day attacks, advanced persistent threats (APTs), and customized attacks targeting industrial control systems. Once an attack occurs, response and handling are often delayed, potentially severely impacting the stable operation of the power grid. Power grid assets are numerous and complex, with a constantly changing operating environment; traditional security solutions struggle to flexibly adapt to new threat patterns and attack techniques, lacking intelligent threat prediction and proactive defense capabilities. In the event of a security incident, there is a lack of effective means to quickly assess the scope and potential harm of an attack on power grid operations, making it difficult to formulate precise loss mitigation and recovery strategies. Summary of the Invention
[0005] To address the major problems existing in the power grid network security protection system, such as insufficient understanding of industrial control protocols, lack of real-time and refined OT network visibility, delayed passive defense response, and difficulty in adapting to dynamic threat environments, this invention discloses a security situation awareness and proactive defense method, system, and device for power grids.
[0006] A method for security situation awareness and proactive defense for power grids includes the following steps:
[0007] Real-time acquisition of traffic data from the control and operation technology network yields traffic data packets, including OT traffic data packets;
[0008] The traffic data packets are processed and analyzed to obtain structured data;
[0009] By learning and training on the structured data, a baseline for the normal behavior of power grid OT devices and networks is constructed.
[0010] The OT traffic data packets are compared with the normal behavior baseline to identify abnormal behavior;
[0011] Complete threat detection, conduct a comprehensive assessment of detected abnormal behaviors or threats, and further perform risk classification and prioritization;
[0012] Provides a cybersecurity situational awareness map for the power grid, alerts on abnormal behavior or threats, and generates reports.
[0013] As one possible implementation, the process of processing and analyzing traffic data packets to obtain structured data includes the following steps:
[0014] The traffic data packets are processed by port number matching, protocol feature pattern matching, and heuristic analysis to obtain standard protocol messages;
[0015] The standard protocol message is parsed into fields using a structured parser, byte stream operations, and bit operations.
[0016] The formula for parsing a standard protocol message into fields is:
[0017]
[0018] Among them, F i Offset represents the field parsed from a standard protocol message. i Indicates the starting byte offset in the message, M represents the standard protocol message, and Length... i F represents i Length, Type i F represents i Data type;
[0019] The state of a communication session is tracked using finite state machines and session tables.
[0020] The formula for how the communication session state changes with time and events is:
[0021]
[0022] Among them, S t+1 S represents the state of the communication session at time t+1. t E represents the state of the communication session at time t. t This represents the event received at time t;
[0023] The meaning of fields is parsed through a rule engine and mapping table to obtain structured data, which is then aggregated into a big data platform for storage and management.
[0024] As one possible implementation, the process of learning and training on the structured data to construct a baseline for the normal behavior of power grid OT devices and networks includes the following steps:
[0025] Automatically discover equipment assets in the power grid by passively monitoring flow, and establish asset topology and configuration baselines;
[0026] By learning and training on structured data of OT network communication and equipment operation, a baseline for the normal behavior of power grid OT equipment and networks is constructed.
[0027] As one possible implementation, the construction of the normal behavior baseline includes the following steps:
[0028] Acquire and clean structured data;
[0029] The structured data is then converted into a numerical feature vector.
[0030] The formula for transforming numerical eigenvectors is:
[0031]
[0032] Among them, F t N represents the numerical characteristic value calculated within the time window t. t f represents the number of events or data points captured within the time window t. i This represents the original feature value corresponding to the i-th event or data point within the time window;
[0033] The numerical feature vectors are trained using an unsupervised learning algorithm to obtain cluster centers;
[0034] The formula for training numerical feature vectors is:
[0035]
[0036] Where K represents the number of clusters, C j Let X represent the j-th cluster, and let C represent the cluster. j The feature vector in Denotes the centroid of the j-th cluster;
[0037] The patterns and periodicity of learning behavior over time were used to obtain statistical thresholds;
[0038] The formula for calculating the statistical threshold is:
[0039]
[0040] Where UCL represents the upper control limit, LCL represents the lower control limit, Mean(F) represents the mean of dataset F, StdDev(F) represents the standard deviation of dataset F, and L is a constant;
[0041] The trained numerical feature vectors, cluster centers, and statistical thresholds constitute the baseline for normal behavior.
[0042] As one possible implementation, comparing the OT traffic data packets with the normal behavior baseline to identify abnormal behavior includes the following steps:
[0043] For the real-time incoming DPI parsing data, feature engineering is used to extract real-time feature vectors;
[0044] By using a baseline model, the degree of deviation between the real-time feature vector and the normal behavior pattern is calculated to obtain an anomaly score;
[0045] Based on the clustering model, the shortest distance from the real-time feature vector to the cluster centroid is calculated;
[0046] Based on the time series model, the prediction error between the real-time observed value and the predicted value of the current feature is calculated;
[0047] Standardized residuals are calculated based on statistical models;
[0048] Reconstruction error is calculated based on neural networks;
[0049] Based on the anomaly detection algorithm, an anomaly score is output.
[0050] The calculated abnormal score is compared with a preset threshold. If it exceeds the preset threshold, it is judged as abnormal behavior.
[0051] As one possible implementation method,
[0052] The formula for calculating the shortest distance from the real-time feature vector to the cluster centroid is as follows:
[0053]
[0054] Among them, S cluster (X current ) represents the current data point X current Distance to the nearest cluster center Let K represent the centroid of the j-th cluster, K represent the number of clusters, and j represent the index of the cluster.
[0055] The formula for calculating the prediction error of the current feature is:
[0056]
[0057] Among them, S ts (F current ) represents the current feature F current The prediction error, F current This represents the actual value of the current feature. This represents the predicted value of the current feature;
[0058] The formula for calculating the standardized residual is:
[0059]
[0060] Among them, S stat (F current ) represents the current feature F current The standardized residual, F current This represents the actual value of the current feature. The mean of feature F is represented. The standard deviation of characteristic F;
[0061] The formula for calculating the reconstruction error is:
[0062]
[0063] Among them, S ae (X) current ) represents the current data point X current The reconstruction error, X current This represents the actual value of the current data point, while the predicted value represents the predicted value of the current data point.
[0064] As one possible implementation, the process of completing threat detection and comprehensively assessing the detected abnormal behavior or threats, further performing risk rating and prioritization, includes the following steps:
[0065] By integrating internal and external threat intelligence platforms, real-time traffic characteristics or suspicious behaviors can be correlated and analyzed with threat intelligence to achieve threat detection.
[0066] The detected abnormal behavior or threat is assessed, and risk level and priority are determined by combining three key elements: asset importance, threat severity, and potential impact.
[0067] The assessment of detected abnormal behavior or threats includes the following steps:
[0068] The three key elements are quantified and graded.
[0069] Risk score calculation and combination logic, wherein the risk score includes a comprehensive impact score and a final risk score;
[0070] The formula for calculating the overall impact score is:
[0071]
[0072] Where CI_score represents the overall impact score, AI_score represents the score of a specific indicator A, and PI_score represents the score of a specific indicator P.
[0073] The final risk score is calculated using the following formula:
[0074]
[0075] Wherein, R_score represents the final risk score, TS_score represents the score based on time series data, and CI_score represents the overall impact score;
[0076] Based on predefined response strategies and threat assessment results, corresponding defense actions are automatically triggered.
[0077] A power grid security situation awareness and proactive defense system includes:
[0078] The data acquisition module is used to acquire traffic data of the control and operation technology network in real time to obtain traffic data packets, including OT traffic data packets;
[0079] The data processing module is used to process and analyze the traffic data packets to obtain structured data;
[0080] The normal behavior baseline construction module constructs the normal behavior baseline of power grid OT equipment and network by learning and training on the structured data;
[0081] An abnormal behavior detection module is used to compare the OT traffic data packets with the normal behavior baseline to identify abnormal behavior;
[0082] The risk rating module is used to complete threat detection and comprehensively evaluate the detected abnormal behaviors or threats, and further perform risk rating and priority ranking.
[0083] The human-computer interaction and display module provides a power grid network security situation map, provides alerts for abnormal behavior or threats, and generates reports.
[0084] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the following method:
[0085] Real-time acquisition of traffic data from the control and operation technology network yields traffic data packets, including OT traffic data packets;
[0086] The traffic data packets are processed and analyzed to obtain structured data;
[0087] By learning and training on the structured data, a baseline for the normal behavior of power grid OT devices and networks is constructed.
[0088] The OT traffic data packets are compared with the normal behavior baseline to identify abnormal behavior;
[0089] Complete threat detection, conduct a comprehensive assessment of detected abnormal behaviors or threats, and further perform risk classification and prioritization;
[0090] Provides a cybersecurity situational awareness map for the power grid, alerts on abnormal behavior or threats, and generates reports.
[0091] A power grid security situation awareness and proactive defense device includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the following method:
[0092] Real-time acquisition of traffic data from the control and operation technology network yields traffic data packets, including OT traffic data packets;
[0093] The traffic data packets are processed and analyzed to obtain structured data;
[0094] By learning and training on the structured data, a baseline for the normal behavior of power grid OT devices and networks is constructed.
[0095] The OT traffic data packets are compared with the normal behavior baseline to identify abnormal behavior;
[0096] Complete threat detection, conduct a comprehensive assessment of detected abnormal behaviors or threats, and further perform risk classification and prioritization;
[0097] Provides a cybersecurity situational awareness map for the power grid, alerts on abnormal behavior or threats, and generates reports.
[0098] This invention, by adopting the above technical solutions, has significant technical effects:
[0099] 1. This invention uses AI (Artificial Intelligence) / ML (Machine Learning) technology to detect abnormal behavior, combined with an automated response mechanism, to significantly shorten threat response time and effectively prevent the spread of attacks;
[0100] 2. This invention fills the gap in OT network security protection by deeply analyzing industrial control protocols to identify protocol-level attacks and abnormal operations that traditional security equipment cannot detect; it provides real-time insight into the equipment assets, communication behavior, and operation commands of the power grid OT network, transforming passive defense into proactive awareness and improving security transparency.
[0101] 3. When subjected to cyberattacks, the system can quickly assess the impact and take precise defensive measures to minimize the impact on the stable operation of the power grid, ensure the continuity of power supply, and automate the detection, assessment and response processes. This reduces reliance on human experience, improves operation and maintenance efficiency, reduces operating costs, and meets the increasingly stringent compliance requirements of the state and industry for the cybersecurity protection of critical information infrastructure. Attached Figure Description
[0102] Figure 1 This is a flowchart illustrating the power grid security situation awareness and proactive defense method described in this invention.
[0103] Figure 2 This is an overall schematic diagram of the power grid security situation awareness and active defense system described in this invention. Detailed Implementation
[0104] The present invention will be further described below with reference to the accompanying drawings and embodiments. The following embodiments are explanations of the present invention, but the present invention is not limited to the following embodiments.
[0105] Example 1:
[0106] A method for security situation awareness and proactive defense for power grids, such as Figure 1 As shown, it includes the following steps:
[0107] S100. Real-time acquisition of traffic data from the control and operation technology network to obtain traffic data packets, wherein the traffic data packets include OT traffic data packets;
[0108] S200: Perform data processing and analysis on the traffic data packets to obtain structured data;
[0109] S300. By learning and training the structured data, a baseline for the normal behavior of power grid OT equipment and networks is constructed.
[0110] S400. Compare the OT traffic data packet with the normal behavior baseline to identify abnormal behavior;
[0111] S500: Complete threat detection, conduct a comprehensive assessment of detected abnormal behaviors or threats, and further perform risk classification and prioritization.
[0112] The S600 provides a network security situation map for the power grid, provides alerts for abnormal behavior or threats, and generates reports.
[0113] In this embodiment, step S100 involves acquiring real-time traffic data from the control and operation technology network to obtain traffic data packets. These traffic data packets include OT traffic data packets, specifically comprising:
[0114] Passive field safety probes are deployed at key communication nodes at all levels of the power grid. These safety probes collect all traffic in the OT network in a non-intrusive, real-time manner through network mirroring or TAP (Test Access Point).
[0115] In this embodiment, the data processing and analysis of traffic data packets in step S200 to obtain structured data includes the following steps:
[0116] S210: The traffic data packets are processed by port number matching, protocol feature pattern matching, and heuristic analysis to obtain standard protocol messages;
[0117] S220: Parses standard protocol messages into fields using a structured parser, byte stream operations, and bit operations;
[0118] The formula for parsing a standard protocol message into fields is:
[0119]
[0120] Among them, F i Offset represents the field parsed from a standard protocol message. i Indicates the starting byte offset in the message, M represents the standard protocol message, and Length... i F represents i Length, Type i F represents i Data type;
[0121] S230: Tracks the state of a communication session using finite state machines and session table techniques;
[0122] The formula for how the communication session state changes with time and events is:
[0123]
[0124] Among them, S t+1 S represents the state of the communication session at time t+1. t E represents the state of the communication session at time t. t This represents the event received at time t;
[0125] S240: The meaning of the fields is parsed through the rule engine and mapping table to obtain structured data, and the structured data is aggregated into the big data platform for storage and management.
[0126] In this embodiment, step S300, which involves learning and training the structured data to construct a baseline for the normal behavior of power grid OT devices and networks, includes the following steps:
[0127] S310: Automatically discovers equipment assets in the power grid by passively monitoring flow, and establishes asset topology and configuration baselines;
[0128] S320: By learning and training on structured data of OT network communication and equipment operation, a baseline for the normal behavior of power grid OT equipment and networks is constructed.
[0129] The establishment of the normal behavioral baseline includes the following steps:
[0130] S321: Acquire and clean structured data;
[0131] S322: Convert the structured data into a numerical feature vector;
[0132] The formula for transforming numerical eigenvectors is:
[0133]
[0134] Among them, F t N represents the numerical characteristic value calculated within the time window t. t f represents the number of events or data points captured within the time window t. i This represents the original feature value corresponding to the i-th event or data point within the time window;
[0135] S323: The numerical feature vectors are trained using an unsupervised learning algorithm to obtain cluster centers;
[0136] The formula for training numerical feature vectors is:
[0137]
[0138] Where K represents the number of clusters, C j Let X represent the j-th cluster, and let C represent the cluster. j The feature vector in Denotes the centroid of the j-th cluster;
[0139] S324: The patterns and periodicity of learning behavior over time are used to obtain statistical thresholds;
[0140] The formula for calculating the statistical threshold is:
[0141]
[0142] Where UCL represents the upper control limit, LCL represents the lower control limit, Mean(F) represents the mean of dataset F, StdDev(F) represents the standard deviation of dataset F, and L is a constant;
[0143] S325: The trained numerical feature vectors, cluster centers, and statistical thresholds constitute the baseline for normal behavior.
[0144] In this embodiment, step S400, which compares the OT traffic data packet with the normal behavior baseline to identify abnormal behavior, includes the following steps:
[0145] S410: Parse the real-time incoming DPI (Deep Packet Inspection) data and extract real-time feature vectors using feature engineering.
[0146] S420: Using a baseline model, calculate the degree of deviation between the real-time feature vector and the normal behavior pattern to obtain an anomaly score;
[0147] S430: Based on the clustering model, calculate the shortest distance from the real-time feature vector to the cluster centroid; the formula for calculating the shortest distance from the real-time feature vector to the cluster centroid is:
[0148]
[0149] Among them, S cluster (X current ) represents the current data point X current Distance to the nearest cluster center Let K represent the centroid of the j-th cluster, K represent the number of clusters, and j represent the index of the cluster.
[0150] S440: Based on a time series model, calculate the prediction error between the real-time observed value and the predicted value of the current feature;
[0151] The formula for calculating the prediction error of the current feature is:
[0152]
[0153] Among them, S ts (F current ) represents the current feature F current The prediction error, F current This represents the actual value of the current feature. This represents the predicted value of the current feature.
[0154] S450: Calculate standardized residuals based on statistical models;
[0155] The formula for calculating the standardized residual is:
[0156]
[0157] Among them, S stat (F current ) represents the current feature F current The standardized residual, F current This represents the actual value of the current feature. The mean of feature F is represented. The standard deviation of characteristic F is represented.
[0158] S460: Reconstruction error is calculated based on neural network;
[0159] The formula for calculating the reconstruction error is:
[0160]
[0161] Among them, S ae (X) current ) represents the current data point X current The reconstruction error, X current This represents the actual value of the current data point, while the predicted value represents the predicted value of the current data point.
[0162] S470: Based on an anomaly detection algorithm, outputs anomaly scores;
[0163] S480: Compare the calculated abnormal score with a preset threshold. If the score exceeds the preset threshold, it is determined to be abnormal behavior.
[0164] In this embodiment, step S500, which involves completing threat detection and comprehensively assessing the detected abnormal behavior or threats, further performs risk rating and priority ranking, and includes the following steps:
[0165] S510: Integrates internal and external threat intelligence platforms to correlate real-time traffic characteristics or suspicious behaviors with threat intelligence for threat detection.
[0166] S520: Assess detected anomalous behavior or threats, and classify and prioritize risks based on three key elements: asset importance, threat severity, and potential impact.
[0167] S4530: The assessment of detected anomalous behavior or threats includes the following steps:
[0168] S540: Quantify and classify the three key elements.
[0169] Asset importance: Measures the criticality of the attacked OT asset in the operation of the power grid.
[0170] Threat severity: Measures the danger inherent in the detected threat itself.
[0171] Potential impact: Measures the potential consequences for the power grid should a threat be successfully exploited.
[0172] S550: Risk score calculation and combination logic, wherein the risk score includes a comprehensive impact score and a final risk score;
[0173] The formula for calculating the overall impact score is:
[0174]
[0175] Where CI_score represents the overall impact score, AI_score represents the score of a specific indicator A, and PI_score represents the score of a specific indicator P.
[0176] The final risk score is calculated using the following formula:
[0177]
[0178] Where R_score represents the final risk score, TS_score represents the score based on time series data, and CI_score represents the comprehensive impact score.
[0179] Risk rating scheme:
[0180]
[0181] Priority ranking: Based on risk level, and within the same level, it can be further refined according to the time of occurrence, the number of assets affected, etc.
[0182] S560: Automatically triggers corresponding defense actions based on predefined response strategies and threat assessment results.
[0183] Specific response strategy classifications:
[0184] 1. Alarm and notification strategy: Ensure that relevant personnel receive information as soon as possible, including instant notifications, multi-level alarm escalation, and customized alarm content.
[0185] 2. Traffic control and isolation strategies: Limit threat spread and protect critical assets. Actions include source IP / MAC address blocking, VLAN isolation, and port disabling, and typically need to be coordinated with industrial security gateways, firewalls, switches, etc.
[0186] 3. Situational Feedback and Adaptive Strategies: Based on threat information, the system adjusts its own defensive posture in real time. Actions include dynamically adjusting DPI rules, updating behavioral baselines, and coordinating with honeypot / decoy systems.
[0187] 4. Information Collection and Evidence Gathering Strategy: Collect relevant evidence to support subsequent analysis and tracing. Actions include enhanced logging, full-traffic Pcap capture, and device status snapshots.
[0188] 5. Linkage and Coordination Strategy: Seamlessly integrate safety incident information into the power grid operation and maintenance management process. Actions include automatically creating work orders, updating the CMDB, and integrating with the SOC / SIEM platform.
[0189] Example of automated defense action:
[0190] Alarm notifications: Timely send alarms to maintenance personnel through multiple channels (SMS, email, platform pop-ups).
[0191] Traffic blocking / isolation: In conjunction with security devices, it can precisely block or isolate suspicious traffic or infected devices.
[0192] Equipment status protection: Sending safety commands to industrial control equipment to put it into a safe or controlled state.
[0193] Log recording and evidence collection: Automatically collects and records relevant event logs and network packets.
[0194] Human-machine collaboration mechanism: For high-risk or critical operations, the system can provide a semi-automatic response, that is, requesting human confirmation before executing critical defensive actions.
[0195] In this embodiment, step S600 provides a power grid network security situation map, provides alerts for abnormal behavior or threats, and generates reports. Specifically, it provides an intuitive and real-time power grid network security situation map, including network topology, device status, traffic trends, attack distribution, alarm event list, and threat heatmap, helping maintenance personnel to fully understand the security status. Alarm and event management: It provides detailed alarm information, event tracing analysis, and event handling process management functions. Report generation: It generates security operation reports and threat analysis reports regularly or on demand.
[0196] This invention fills a gap in OT network security protection by deeply analyzing industrial control protocols to identify protocol-level attacks and abnormal operations that traditional security equipment cannot detect. It provides real-time insights into the equipment assets, communication behavior, and operational commands of the power grid's OT network, transforming passive defense into proactive awareness and enhancing security transparency. Through AI (Artificial Intelligence) / ML (Machine Learning) technologies for abnormal behavior detection, combined with an automated response mechanism, it significantly shortens threat response time and effectively prevents attack spread. When subjected to cyberattacks, the system can quickly assess the impact and take precise defensive measures, minimizing the impact on the stable operation of the power grid and ensuring the continuity of power supply. The automated detection, assessment, and response processes reduce reliance on human experience, improve operational efficiency, lower operating costs, and meet increasingly stringent national and industry compliance requirements for the cybersecurity protection of critical information infrastructure.
[0197] Example 2:
[0198] A security situation awareness and proactive defense system for power grids, such as Figure 2 As shown, it includes: a data acquisition module 100, a data processing module 200, a normal behavior baseline construction module 300, an abnormal behavior detection module 400, a risk rating module 500, and a human-computer interaction and display module 600.
[0199] The data acquisition module 100 is used to acquire traffic data of the control and operation technology network in real time to obtain traffic data packets, wherein the traffic data packets include OT traffic data packets;
[0200] The data processing module 200 is used to process and analyze the traffic data packets to obtain structured data;
[0201] The normal behavior baseline construction module 300 constructs the normal behavior baseline of power grid OT equipment and network by learning and training on the structured data;
[0202] The abnormal behavior detection module 400 is used to compare the OT traffic data packet with the normal behavior baseline to identify abnormal behavior;
[0203] The risk rating module 500 is used to complete threat detection and comprehensively evaluate the detected abnormal behaviors or threats, and further perform risk rating and priority ranking.
[0204] The Human-Computer Interaction and Display Module 600 provides a power grid network security situation map, provides alerts for abnormal behavior or threats, and generates reports.
[0205] Various changes and modifications made without departing from the spirit and scope of this invention, and all equivalent technical solutions, also fall within the scope of this invention.
[0206] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.
[0207] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0208] This invention is described with reference to flowchart illustrations and / or block diagrams of the method, terminal device (system), and computer program product according to the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0209] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0210] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0211] It should be noted that:
[0212] The phrase "an embodiment" or "an embodiment" used in this specification means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. Therefore, the phrase "an embodiment" or "an embodiment" appearing in various places throughout the specification does not necessarily refer to the same embodiment.
[0213] Furthermore, it should be noted that the shapes and names of the components in the specific embodiments described in this specification may differ. All equivalent or simple variations made to the structure, features, and principles described in this patent concept are included within the protection scope of this patent. Those skilled in the art to which this invention pertains may make various modifications or additions to the described specific embodiments or use similar methods to substitute them, as long as they do not depart from the structure of this invention or exceed the scope defined in these claims, they should all fall within the protection scope of this invention.
Claims
1. A method for security situation awareness and proactive defense for power grids, characterized in that, Includes the following steps: Real-time acquisition of traffic data from the control and operation technology network yields traffic data packets, including OT traffic data packets; The traffic data packets are processed and analyzed to obtain structured data; By learning and training on the structured data, a baseline for the normal behavior of power grid OT devices and networks is constructed. The OT traffic data packets are compared with the normal behavior baseline to identify abnormal behavior; Complete threat detection, conduct a comprehensive assessment of detected abnormal behaviors or threats, and further perform risk classification and prioritization; Provides a cybersecurity situational awareness map for the power grid, alerts on abnormal behavior or threats, and generates reports.
2. The power grid security situation awareness and proactive defense method according to claim 1, characterized in that, The process of processing and analyzing traffic data packets to obtain structured data includes the following steps: The traffic data packets are processed by port number matching, protocol feature pattern matching, and heuristic analysis to obtain standard protocol messages; The standard protocol message is parsed into fields using a structured parser, byte stream operations, and bit operations. The formula for parsing a standard protocol message into fields is: Among them, F i Offset represents the field parsed from a standard protocol message. i Indicates the starting byte offset in the message, M represents the standard protocol message, and Length i F represents i Length, Type i F represents i Data type; The state of a communication session is tracked using finite state machines and session tables. The formula for how the communication session state changes with time and events is: Among them, S t+1 S represents the state of the communication session at time t+1. t E represents the state of the communication session at time t. t This represents the event received at time t; The meaning of fields is parsed through a rule engine and mapping table to obtain structured data, which is then aggregated into a big data platform for storage and management.
3. The power grid security situation awareness and proactive defense method according to claim 1, characterized in that, The process of learning and training on the structured data to construct a baseline for the normal behavior of power grid OT devices and networks includes the following steps: Automatically discover equipment assets in the power grid by passively monitoring flow, and establish asset topology and configuration baselines; By learning and training on structured data of OT network communication and equipment operation, a baseline for the normal behavior of power grid OT equipment and networks is constructed.
4. The power grid security situation awareness and proactive defense method according to claim 3, characterized in that, The establishment of the normal behavioral baseline includes the following steps: Acquire and clean structured data; The structured data is then converted into a numerical feature vector. The formula for transforming numerical eigenvectors is: Among them, F t N represents the numerical characteristic value calculated within the time window t. t f represents the number of events or data points captured within the time window t. i This represents the original feature value corresponding to the i-th event or data point within the time window; The numerical feature vectors are trained using an unsupervised learning algorithm to obtain cluster centers; The formula for training numerical feature vectors is: Where K represents the number of clusters, C j Let X represent the j-th cluster, and let C represent the cluster. j The feature vector in Denotes the centroid of the j-th cluster; The patterns and periodicity of learning behavior over time were used to obtain statistical thresholds; The formula for calculating the statistical threshold is: Where UCL represents the upper control limit, LCL represents the lower control limit, Mean(F) represents the mean of dataset F, StdDev(F) represents the standard deviation of dataset F, and L is a constant; The trained numerical feature vectors, cluster centers, and statistical thresholds constitute the baseline for normal behavior.
5. The power grid security situation awareness and proactive defense method according to claim 1, characterized in that, The step of comparing the OT traffic data packets with the normal behavior baseline to identify abnormal behavior includes the following steps: For the real-time incoming DPI parsing data, feature engineering is used to extract real-time feature vectors; By using a baseline model, the degree of deviation between the real-time feature vector and the normal behavior pattern is calculated to obtain an anomaly score; Based on the clustering model, the shortest distance from the real-time feature vector to the cluster centroid is calculated; Based on the time series model, the prediction error between the real-time observed value and the predicted value of the current feature is calculated; Standardized residuals are calculated based on statistical models; Reconstruction error is calculated based on neural networks; Based on the anomaly detection algorithm, an anomaly score is output. The calculated abnormal score is compared with a preset threshold. If it exceeds the preset threshold, it is judged as abnormal behavior.
6. The power grid security situation awareness and proactive defense method according to claim 5, characterized in that, The formula for calculating the shortest distance from the real-time feature vector to the cluster centroid is as follows: Among them, S cluster (X current ) represents the current data point X current Distance to the nearest cluster center Let K represent the centroid of the j-th cluster, K represent the number of clusters, and j represent the index of the cluster. The formula for calculating the prediction error of the current feature is: Among them, S ts (F current ) represents the current feature F current The prediction error, F current This represents the actual value of the current feature. This represents the predicted value of the current feature; The formula for calculating the standardized residual is: Among them, S stat (F current ) represents the current feature F current The standardized residual, F current This represents the actual value of the current feature. The mean of feature F is represented. The standard deviation of characteristic F; The formula for calculating the reconstruction error is: Among them, S ae (X) current ) represents the current data point X current The reconstruction error, X current This represents the actual value of the current data point, while the predicted value represents the predicted value of the current data point.
7. The power grid security situation awareness and proactive defense method according to claim 1, characterized in that, The process of completing threat detection, comprehensively assessing detected abnormal behaviors or threats, and further performing risk rating and prioritization includes the following steps: By integrating internal and external threat intelligence platforms, real-time traffic characteristics or suspicious behaviors can be correlated and analyzed with threat intelligence to achieve threat detection. The detected abnormal behavior or threat is assessed, and risk level and priority are determined by combining three key elements: asset importance, threat severity, and potential impact. The assessment of detected abnormal behavior or threats includes the following steps: The three key elements are quantified and graded. Risk score calculation and combination logic, wherein the risk score includes a comprehensive impact score and a final risk score; The formula for calculating the overall impact score is: Where CI_score represents the overall impact score, AI_score represents the score of a specific indicator A, and PI_score represents the score of a specific indicator P. The final risk score is calculated using the following formula: Wherein, R_score represents the final risk score, TS_score represents the score based on time series data, and CI_score represents the overall impact score; Based on predefined response strategies and threat assessment results, corresponding defense actions are automatically triggered.
8. A security situation awareness and active defense system for power grids, characterized in that, include: By learning and training on the structured data, a baseline for the normal behavior of power grid OT devices and networks is constructed. The OT traffic data packets are compared with the normal behavior baseline to identify abnormal behavior; Complete threat detection, conduct a comprehensive assessment of detected abnormal behaviors or threats, and further perform risk classification and prioritization; Provides a cybersecurity situational awareness map for the power grid, alerts on abnormal behavior or threats, and generates reports. The data acquisition module is used to acquire traffic data of the control and operation technology network in real time to obtain traffic data packets, including OT traffic data packets; The data processing module is used to process and analyze the traffic data packets to obtain structured data; The normal behavior baseline construction module constructs the normal behavior baseline of power grid OT equipment and network by learning and training on the structured data; An abnormal behavior detection module is used to compare the OT traffic data packets with the normal behavior baseline to identify abnormal behavior; The risk rating module is used to complete threat detection and comprehensively evaluate the detected abnormal behaviors or threats, and further perform risk rating and priority ranking. The human-computer interaction and display module provides a power grid network security situation map, provides alerts for abnormal behavior or threats, and generates reports.
9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method according to any one of claims 1 to 7.
10. A power grid security situation awareness and proactive defense device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the method according to any one of claims 1 to 7.