Risk decision engine and method for distributed power system

Abstract

The invention discloses a risk decision engine and method for a distributed power system. The risk decision engine comprises a decision matrix construction module, a strategy generation and conflict detection module and an instruction packaging and sending module. By establishing an equipment evaluation matrix and integrating multi-dimensional data such as network security, service priority and network performance, the problems that in a traditional distributed power system, the risk execution mode is single, risk grading cannot be achieved, service continuity is difficult to guarantee, and the risk response speed is low are solved. According to the method, the strategy matching accuracy is improved by more than 40%, differential actions can be automatically triggered for different threat levels through a four-level risk control strategy, and the extensive problem of a traditional binarization strategy is avoided.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of network security and device management, and relates to a risk decision engine and method for a distributed power system. BACKGROUND

[0002] A new power system takes distributed renewable energy and energy storage resources as the core, and presents typical characteristics of "multiple nodes, wide geographical area, and fragmented access". The connection mode of public networks or virtual private networks keeps these edge nodes connected with the core network, but the lack of end-to-end encryption and device identity authentication leads to a substantial increase in risks such as man-in-the-middle attacks and traffic eavesdropping.

[0003] At present, security devices such as firewalls, intrusion detection systems (IDS), unified threat management (UTM) on the market mainly rely on pre-configured access control lists (ACL) and static rule libraries, and the execution results are often presented in a binary manner of "pass" or "block". In the face of frequently switched communication partners and dynamically adjusted business models in the new power system, it is difficult to achieve risk grading and guarantee business continuity. The security information and event management (SIEM) platform mainly relies on offline log analysis, which often takes several hours or even several days to complete the situation assessment, and obviously cannot meet the requirements of "second-level" or "sub-second-level" risk discovery and response. SUMMARY

[0004] The application aims to solve the problems of single execution mode, inability to grade risks, and difficulty in guaranteeing business continuity in the distributed new power system, and proposes a risk decision engine and method for a distributed power system, which provides key technical support for building a highly flexible and self-healing smart grid.

[0005] The application is implemented by the following technical solutions:

[0006] A risk decision engine for a distributed power system, comprising a decision matrix construction module, a strategy generation and conflict detection module, and an instruction packaging and sending module;

[0007] The decision matrix construction module generates a decision matrix containing four risk levels of observation, speed limit, reinforcement, and isolation based on an input vector X; and gives a control strategy logic including risk levels and corresponding control actions, threshold intervals, according to risk levels and strategy level matching scores.

[0008] The strategy generation and conflict detection module dynamically generates a control strategy set according to the matching results of the decision matrix; and performs conflict detection on the control strategy set and the compliance library, and dynamically adjusts the instructions in conflict with the compliance library.

[0009] The instruction packaging and sending module encapsulates the generated control policy set in a unified message format, labels the version number and effective time, and sends it in batches according to the device label to the region by using the message bus; the execution node needs to report the policy receipt in real time, so as to judge whether it needs to compensate the delivery or rollback.

[0010] The decision matrix construction module generates the decision matrix based on the input vector X=(TS, RM, DC, NL, SLA) by formula (1):

[0011]

[0012] Wherein, TS is the device historical behavior score, RM is the safety rule matching degree, DC is the device business importance level, NL is the current network utilization rate, and SLA is the network service level agreement compliance rate;

[0013] The matching degree score of the policy level L is:

[0014]

[0015] Wherein, w i is the weight of the i-th dimension, and I(·) is the indicator function;

[0016] The input vector X needs to be normalized, and the weight w i can be dynamically adjusted:

[0017]

[0018] Wherein, X norm is the normalized input vector, min_range is the lower limit of normalization, max_range is the upper limit of normalization, t is time, base_weight is the basic weight, and urgency_factor(t) is the urgency coefficient obtained from time;

[0019] Further, the policy generation and conflict detection module dynamically generates the policy set S based on the input vector X and the policy level priority matrix:

[0020]

[0021] Wherein is the policy combination operator, is the priority weighted operation, P(L) is the policy level priority matrix; X i is the i-th dimension of the input vector X, and w i is the weight of the i-th dimension;

[0022] The conflict detection of the policy set S and the compliance library is:

[0023] According to the actual operation, a conflict type matrix is constructed, the conflict type matrix including at least three dimensions of control action combination, compliance and business impact, the action combination being from the policy set S;

[0024] According to the following conflict detection formula and the conflict type matrix, a conflict score is obtained:

[0025] ConflictScore=α·RegViolation+β·BussinessImpact (5)

[0026] Wherein RegViolation is the compliance value, BussinessImpact is the business impact value, and α and β are fixed weights.

[0027] Based on the conflict score ConflictScore, dynamic adjustment is performed:

[0028] For a policy exceeding a set threshold, optimization is performed through a policy optimization function; the policy optimization function being:

[0029]

[0030] Wherein S ' is a policy pool, and λ is a weight coefficient.

[0031] In the optimized control policy, core business throughput CoreBizThroughput, allowed delay Latency and authorized authentication level AuthLevel must satisfy the following conditions:

[0032]

[0033] Wherein T min is the minimum allowed core business throughput, L SLA is the allowed delay of the core business flow, and MaxAuth is the maximum authentication level.

[0034] The instruction packaging and sending module encapsulates the generated control policy into a JSON message object in a unified JSON / XML message format when packaging the message, and the encapsulated content includes version information, time limit information, policy ID, load information and signature information.

[0035] Further, the instruction packaging and sending module performs gray release according to the encapsulated JSON message object, and the release is batch release of the policy:

[0036]

[0037] Wherein Batch i is a device set of a certain release batch, and DeviceTag i∩Geo j is the intersection of all device tags and key regions, Δt·2 i-1 is the device network delay.

[0038] Further, the engine further comprises an optimization feedback module for continuously optimizing the risk decision engine and the control strategy; which comprises the following sub-modules:

[0039] The feedback data collection layer submodule: a multi-source data collection network is established in the implementation stage of the risk decision engine, and through real-time monitoring of the matching degree of device historical behavior scores and safety rules, a feedback matrix containing device business importance level, current network utilization rate and service quality compliance is formed;

[0040] The effect comparison and analysis submodule: this submodule evaluates the execution effect of the strategy, and calculates the rule execution accuracy rate using a sliding window; the sliding window refers to not updating the entire matrix each time, but only selecting the contents in the window for updating, then moving the window by one step, and then updating the next round; the strategy failure scene is recorded by rollback operation.

[0041] Further, the optimization feedback module further comprises a dynamic optimization implementation submodule: the matching degree index of the control strategy is adjusted by gradient descent, and the adjustment amplitude is not more than ±5% of the current value each time, and after adjustment, it needs to be verified through a simulation environment; regularly summarize the historical behavior scores of each device, generate an optimization scheme for the device whose score is lower than the qualified score for a plurality of times in succession; and retrain the decision tree model based on the service quality compliance data, and retain the latest versions as rollback options.

[0042] Specifically, the feedback matrix at least includes acquisition timestamp, device ID, historical behavior score, safety rule matching degree, business importance level, current network utilization rate, service quality compliance, and data state marker.

[0043] The feedback matrix is regularly updated, and the complete running data of a period of time is stored through a time series database.

[0044] Compared with the prior art, the present application has the following beneficial technical effects:

[0045] A. Improve risk response efficiency and accuracy

[0046] The application realizes sub-second risk assessment and response by constructing a dynamic decision matrix, integrating trust score, rule matching degree, device criticality and other five core factors; compared with the analysis delay of several hours of the traditional SIEM platform, the application adopts real-time normalization calculation and dynamic weight adjustment, and the strategy matching accuracy is improved by more than 40%, and through four-level risk control strategy, different actions (such as bandwidth limiting, traffic cleaning, etc.) can be automatically triggered according to different threat levels, avoiding the problem of extensive traditional binary strategy.

[0047] B. Guarantee business continuity and compliance

[0048] The application proposes a strategy conflict detection mechanism, which quantitatively analyzes the strategy compliance and business impact through a conflict type matrix, dynamically optimizes the strategy pool, and ensures that the core business throughput, delay and other indicators meet the preset threshold. On the other hand, a gray release mechanism is proposed to implement the strategy in batches according to the device label and region, and a feedback matrix is used to realize second-level compensation or rollback, reducing the risk of business interruption caused by misoperation by 75%.

[0049] C. Enhance system adaptability

[0050] A closed-loop feedback optimization of the decision engine is proposed, the feedback matrix is updated every 15 seconds, the rule matching degree is dynamically adjusted through a sliding window, and an optimization scheme is generated for low-score devices every month. In addition, the model is continuously iterated, the decision tree model is retrained based on service quality data every quarter, and 3 historical versions are reserved for selection, so that the system maintains more than 85% of the strategy effectiveness when facing new attack methods such as zero-day vulnerabilities.

[0051] D. Reduce operation and maintenance complexity and cost

[0052] By implementing standardized instruction packaging, including using JSON / XML unified format (including SemVer version control, ISO8601 timestamp, SHA256 signature), reducing the adaptation cost between heterogeneous systems, and using automatic strategy generation, the strategy is automatically combined through dynamic synthesis operators, compared with manual rule configuration, the efficiency is improved by 90%, and the operation and maintenance manpower demand is reduced by 50%. BRIEF DESCRIPTION OF DRAWINGS

[0053] Figure 1 A schematic diagram of the risk decision engine of the application. DETAILED DESCRIPTION

[0054] The application provides a risk decision engine for a distributed power system, which integrates network security, business priority and network performance and the like multidimensional data by establishing a device evaluation matrix, combines traditional device management, network security monitoring and intelligent decision support, and solves the problems of single risk execution mode, inability to perform risk grading, difficulty in guaranteeing business continuity and slow risk response speed in the traditional distributed power system.

[0055] Referring to Figure 1 A risk decision engine for a distributed power system, comprising a decision matrix construction module, a strategy generation and conflict detection module, and an instruction packaging and sending module.

[0056] The decision matrix construction module generates a decision matrix comprising four risk levels of observation, speed limit, reinforcement and isolation based on an input vector X, and gives a control strategy logic comprising risk levels and corresponding control actions, threshold intervals according to risk levels and strategy level matching scores.

[0057] The strategy generation and conflict detection module dynamically generates a control strategy set according to the matching results of the decision matrix, and detects conflicts between the control strategy set and a compliance library, and dynamically adjusts instructions in conflict with the compliance library.

[0058] The instruction packaging and sending module packages the generated control strategy set in a unified message format, labels the version number and effective time, and uses a message bus to batch-deliver the instructions to devices by tags and regions in a gray release manner; the execution nodes need to report a strategy receipt in real time, so as to determine whether compensation delivery or rollback is needed.

[0059] Referring to Figure 1 Further, the application further comprises an optimization feedback module for continuously optimizing the risk decision engine and control strategies, which comprises the following submodules:

[0060] A feedback data acquisition layer submodule: a multi-source data acquisition network is constructed, and a feedback matrix comprising device business importance levels, current network utilization and service quality compliance is formed through real-time monitoring of device historical behavior scores and security rule matching degrees.

[0061] An effect comparison and analysis submodule: this submodule evaluates the execution effect of the strategy, and calculates the rule execution accuracy rate by using a sliding window; the sliding window refers to that each time, only the contents in the window are updated, then the window is moved by one step, and the next round of update is performed; the strategy invalidation scene is recorded by rollback operation.

[0062] Dynamic optimization implementation submodule: Gradient descent adjustment is implemented on the control strategy matching degree index, and the adjustment amplitude is not more than ±5% of the current value each time. After adjustment, it needs to be verified through the simulation environment; the historical behavior scores of each device are regularly summarized, and optimization schemes are generated for devices with scores lower than the qualified score for a certain number of consecutive times; and the decision tree model is retrained based on the service quality compliance data, and the latest versions are retained as rollback options.

[0063] The following will be described in detail.

[0064] 1) Decision matrix construction

[0065] A. The definition of the decision dimension consists of 5 core factors, namely trust score (TS), rule matching degree (RM), device criticality (DC), network load (NL), and network service level agreement compliance rate (SLA). The above core factors can be obtained from the trust evaluation engine, network state module, and service quality compliance evaluation module of the pre-system; or, when used as a separate engine, they are set according to the current device situation or decision requirements, and then updated gradually according to the usage.

[0066] The above data has been correctly obtained from the pre-system in this engine by default, represented in the form of an input vector, and the value range and representative meaning of the core factors are shown in Table 1.

[0067] Table 1 Decision dimension factors

[0068]

[0069] Based on the above dimension factors, the following formula can be used to generate the decision matrix. Each strategy level L corresponds to a five-dimensional hypercube, and Observe, Throttle, Enforce, Isolate represent the four risk levels of [observe, throttle, enforce, isolate].

[0070]

[0071] Therefore, for the input vector X = (TS, RM, DC, NL, SLA), the matching score of the strategy level L can be represented by the following formula:

[0072]

[0073] where w i is the weight of the i-th dimension, I(·) is the indicator function (1 within the range, otherwise 0), and the final selection max(MatchScore) corresponds to the risk level. In addition, the input vector X in the above formula needs to be normalized, and the weight w i can be dynamically adjusted according to specific requirements, as shown in the following formula:

[0074]

[0075] where X norm is the normalized input vector, min_range is the lower limit of normalization, max_range is the upper limit of normalization, t is time, base_weight is the base weight, urgency_factor(t) is the urgency coefficient derived from time.

[0076] According to the input under different circumstances, and the calculated policy level matching score, the control policy logic is given as shown in Table 2:

[0077] Table 2 Control policy logic

[0078]

[0079] 2) Strategy generation and conflict detection

[0080] The decision engine dynamically generates a set of differentiated control strategies according to the matrix matching results, including bandwidth throttling, multi-factor authentication, traffic mirroring, and connection interruption, and performs compliance and conflict detection before delivery, eliminates or adjusts instructions that conflict with the compliance library, and prevents core business from being damaged.

[0081] Based on the constructed policy matrix, the strategy generation and conflict detection module includes dynamic strategy generation, conflict detection mechanism, and dynamic process adjustment mechanism.

[0082] A. Since the strategy trigger condition in Table 2 is relatively fixed, the adaptability is poor.

[0083] The optimized control policy generation mechanism dynamically synthesizes the strategy set S to be executed based on the input vector X and the policy level priority matrix, as shown in the following formula:

[0084]

[0085] where represents a strategy combination operator, represents a priority weighting operation, P(L) is a policy level priority matrix.

[0086] B. Since the dynamically generated strategies and instructions may conflict with the compliance library, a conflict detection mechanism and a dynamic process adjustment mechanism are given.

[0087] In the conflict detection mechanism, a conflict type matrix is first designed according to the actual operation situation, and Table 3 shows a possible conflict type matrix instance combination situation, where the action combination is the dynamic strategy set S calculated by the above formula.

[0088] Table 3 Conflict type matrix example

[0089] Action combination Compliance Business impact Rate limiting + mirroring 0.1 0.2 Authentication + interruption 0.9 0.8 Rate limiting + authentication 0.3 0.4

[0090] According to the following conflict detection formula, the conflict score can be obtained according to the conflict type matrix:

[0091] ConflictScore = a RegViolation + b BussinessImpact (5)

[0092] Where RegViolation is the compliance value, BussinessImpact is the business impact value, and a and b are fixed weights.

[0093] After obtaining the conflict score ConflictScore, dynamic process adjustment can be performed based on this score. The dynamic process optimizes the strategy with a high score (exceeding the set threshold) to protect the core business. The strategy optimization function is as follows:

[0094]

[0095] Where S ' is the strategy pool, and l is the weight coefficient.

[0096] In addition, in the optimized strategy, the core business throughput CoreBizThroughput, the allowed delay Latency, and the authorized authentication level AuthLevel must satisfy the following conditions:

[0097]

[0098] Where T min is the minimum allowed core business throughput, L SLA is the allowed delay of the core business flow, and MaxAuth is the maximum authentication level.

[0099] 3) Instruction packaging and sending

[0100] The generated control strategy is packaged in a unified JSON / XML message format, with version number and effective time marked, and is delivered in batches by device label and region using the message bus. The execution node needs to report the strategy receipt in real time, so as to judge whether it needs to compensate for the delivery or rollback.

[0101] After the dynamic strategy is generated, the instruction needs to be packaged and sent. This part mainly includes three parts, namely message packaging, gray delivery mechanism, and receipt processing.

[0102] A. In the message packaging process, the generated control strategy is packaged into a JSON message object in a unified format, including version information, time limit information, strategy ID, load information, and signature information. The specific details of the message are shown in Table 4:

[0103] Table 4 message content example

[0104]

[0105]

[0106] B. After the message packaging is completed, the message is sent to the device nodes in the communication network in batches according to the device tag->region form. Since the gray release has the characteristics of device tag priority, regional progressive expansion, time backoff mechanism, etc., it can realize the step-by-step batch release of the message, thereby improving the system stability and ensuring smooth operation.

[0107] According to the packaged JSON message object, the batch strategy of the gray release mechanism is as shown in the following formula:

[0108]

[0109] where Batch i is the device set of a certain release batch, DeviceTag i ∩Geo j is the intersection of all device tags and key regions, and Δt·2 i-1 is the device network delay.

[0110] For a group of distributed power grid management devices, the number of nodes is large, and the distance is far. In order to efficiently send messages or execute strategies to all network devices, messages are often selectively released in batches. The node devices of each batch are a subset of the entire power grid, and the devices in this batch are called a gray release device set.

[0111] C. The execution node device receiving the strategy instruction sends a receipt to the decision engine after receiving the message. According to different receipt messages, it is judged whether compensation release or rollback instructions are needed. The receipt is composed in the form of a state feedback matrix as shown in Table 5.

[0112] Table 5 receipt example

[0113]

[0114]

[0115] 4) Feedback mechanism

[0116] In order to continuously optimize the risk decision engine and strategy rules, combined with the characteristics of the distributed system, the following closed-loop feedback mechanism is proposed.

[0117] Feedback data collection layer design: Establish a multi-source data collection network during the implementation phase of the risk decision engine. Through real-time monitoring of the matching degree of device historical behavior scores and safety rules, a feedback matrix containing device business importance level, current network utilization, and service quality compliance is formed. The feedback matrix is shown in Table 6. The matrix is updated every 15 seconds, and the complete operation data for the past 30 days is stored through a time series database.

[0118] Table 6 Feedback matrix form example

[0119]

[0120] Effect comparison and analysis module: This module evaluates the execution effect of the strategy from two dimensions. The sliding window calculation rule execution accuracy is adopted, which means that instead of updating the entire matrix each time, only the contents in the window are updated, and then the window is moved by one step for the next round of update. The calculation method of the window is: the number of correct actions / total trigger times x 100%; In the business dimension, the strategy failure scenarios are deduced through rollback operation records (FAIL mark at the end of the document, etc.).

[0121] Dynamic optimization implementation mechanism: First, implement gradient descent adjustment on the strategy rule matching degree index, with an adjustment amplitude of no more than ±5% of the current value. After adjustment, it needs to be verified through a simulated environment. Second, summarize the historical behavior scores of each device every month, and generate a special optimization scheme for devices with scores below 60 for three consecutive times. Finally, retrain the decision tree model based on service quality compliance data every quarter, and keep the last three versions as rollback options to ensure that the system maintains more than 85% of the strategy effectiveness when facing new attack methods such as zero-day vulnerabilities.

[0122] Compared with the analysis delay of several hours of traditional SIEM platforms, the present application uses real-time normalization calculation and dynamic weight adjustment, with a strategy matching accuracy improvement of more than 40%. Through four-level risk control strategies, differentiated actions can be automatically triggered for different threat levels, avoiding the problem of extensive traditional binary strategies. The gray release mechanism implements the strategy in batches according to device tags and regions, and realizes second-level compensation or rollback through feedback matrix, reducing the risk of business interruption caused by misoperation by 75%. Compared with manual rule configuration, the efficiency is improved by 90%, and the operation and maintenance manpower demand of the present application is reduced by 50%.

[0123] The above embodiments are preferred examples of implementing the present application, and the present application is not limited to the above embodiments. Any non-essential addition, replacement made by a person skilled in the art according to the technical features of the technical solution of the present application belongs to the protection scope of the present application.

Claims

1. A risk decision engine for distributed power systems, characterized in that, It includes a decision matrix construction module, a strategy generation and conflict detection module, and an instruction encapsulation and transmission module; The decision matrix construction module generates a decision matrix containing four risk levels: observation, speed limit, reinforcement, and isolation, based on the input vector X; and provides control strategy logic based on the matching score of risk level and strategy level, including risk level and corresponding control action and threshold range. The strategy generation and conflict detection module dynamically generates a set of control strategies based on the decision matrix matching results; and performs conflict detection between the set of control strategies and the compliance library, dynamically adjusting instructions that conflict with the compliance library. The instruction encapsulation and sending module encapsulates the generated control policy set in a unified message format, marks the version number and effective time, and uses the message bus to distribute it in batches to the region according to the device tag; the execution node needs to report the policy receipt in real time, based on which it is determined whether compensation distribution or rollback is required.

2. A risk decision engine for distributed power systems as described in claim 1, characterized in that, The decision matrix construction module generates the decision matrix based on the input vector X = (TS,RM,DC,NL,SLA) using equation (1): Among them, TS is the device's historical behavior score, RM is the degree of security rule matching, DC is the device's service importance level, NL is the current network utilization rate, and SLA is the network service level agreement compliance rate. The matching score for strategy level L is: Where w i is the weight of the i-th dimension, and I(·) is the indicator function; The input vector X needs to be normalized, and the weights w i Dynamically adjustable: Among them, X norm The input vector is normalized, min_range is the lower bound of normalization, max_range is the upper bound of normalization, t is time, base_weight is the base weight, and urgency_factor(t) is the urgency coefficient obtained from time.

3. A risk decision engine for distributed power systems as described in claim 1 or 2, characterized in that, Based on the matching scores of different risk levels and strategy levels, the control strategy logic is as follows: If the risk level is Observation, the trigger condition is TS>70∧RM<60∧DC<30∧NL<30, and the control action is to log and notify. If the risk level is rate limiting, the trigger condition is TS∈[50,70]∧RM∈[60,75]∧NL>30, and the control action is bandwidth limiting and QoS adjustment. If the risk level is enhanced, the trigger condition is TS∈[30,50]∧RM∈[75,90]∧DC>60, and the control action is authentication enhancement and traffic scrubbing. If the risk level is isolation, the trigger condition is TS<30∧RM>90∧NL>80, and the control action is to disconnect and perform honeypot operation.

4. A risk decision engine for distributed power systems as described in claim 1, characterized in that, The policy generation and conflict detection module dynamically generates a control policy set S based on the input vector X and the policy level priority matrix. Where ⊕ is the strategy combination operator. For priority-weighted operations, P(L) is the strategy level priority matrix; X i Let w be the i-th dimension of the input vector X. i Let be the weight of the i-th dimension; The conflict detection between the control policy set S and the compliance library is as follows: Construct a conflict type matrix based on actual operational conditions. The conflict type matrix should include at least three dimensions: control action combination, compliance, and business impact. The action combination comes from the strategy set S. The conflict score is derived based on the following conflict detection formula and conflict type matrix: ConflictScore=α·RegViolation+β·BussinessImpact (5) Where RegViolation is the compliance value, BusinessImpact is the business impact value, and α and β are both fixed weights. Dynamic adjustments based on the ConflictScore: For policies exceeding a set threshold, optimization is performed using a policy optimization function; the policy optimization function is: Where S ' Here, λ represents the policy pool, and λ is the weight coefficient. In the optimized control strategy, the core business throughput (CoreBizThroughput), allowed latency (Latency), and authorization authentication level (AuthLevel) must meet the following conditions: Where T min To minimize the allowable core business throughput, L SLA Allowing for delays in core business flows, MaxAuth represents the maximum authentication level.

5. A risk decision engine for distributed power systems as described in claim 1, characterized in that, The instruction encapsulation and sending module encapsulates the generated control policy into a JSON message object in a unified JSON / XML message format during message encapsulation. The encapsulated content includes version information, timeliness information, policy ID, load information, and signature information.

6. A risk decision engine for distributed power systems as described in claim 1, characterized in that, The instruction encapsulation and sending module distributes instructions in batches based on the encapsulated JSON message object in a canary release manner. Batch i For a specific batch of devices, DeviceTag i ∩Geo j For the intersection of all device tags and key regions, Δt·2 i-1 This is due to network latency in the device.

7. A risk decision engine for distributed power systems as described in claim 1, characterized in that, It also includes an optimization feedback module to continuously optimize the risk decision engine and control strategies; That Includes the following sub-modules: Feedback data acquisition layer submodule: Construct a multi-source data acquisition network, and form a feedback matrix that includes the business importance level of the device, the current network utilization rate, and the service quality compliance through real-time monitoring of the matching degree between the device's historical behavior score and the security rule. Performance Comparison and Analysis Submodule: This submodule evaluates the execution effect of the strategy and uses a sliding window to calculate the rule execution accuracy. The sliding window refers to updating only the content in the window each time without updating the entire matrix, and then moving the window by one step to perform the next round of updates. The failure scenarios of the strategy are recorded through rollback operations.

8. A risk decision engine for distributed power systems as described in claim 7, characterized in that, It also includes a dynamic optimization implementation submodule: implementing gradient descent adjustments to the control strategy matching degree index, with each adjustment not exceeding ±5% of the current value, and verification through a simulation environment after adjustment; periodically summarizing the historical behavior scores of each device, generating optimization schemes for devices with scores below the qualified score for several consecutive times; and retraining the decision tree model based on service quality compliance data, retaining several recent versions as rollback options.

9. A risk decision engine for distributed power systems as described in claim 7, characterized in that, The feedback matrix includes at least the collection timestamp, device ID, historical behavior score, security rule matching degree, business importance level, current network utilization, service quality compliance, and data status marker. The feedback matrix is ​​updated regularly and the complete operational data for a period of time is stored in a time-series database.

10. A risk decision-making method for distributed power systems, characterized in that, Build a risk decision engine and execute operations including decision matrix construction, strategy generation and conflict detection, instruction encapsulation and transmission; The decision matrix construction generates a decision matrix containing four risk levels: observation, speed limit, reinforcement, and isolation, based on the input vector X; and provides control strategy logic based on the matching score of risk level and strategy level, including risk level and corresponding control action and threshold range. The strategy generation and conflict detection process dynamically generates a set of control strategies based on the decision matrix matching results; and performs conflict detection between the control strategy set and the compliance library, dynamically adjusting instructions that conflict with the compliance library. The instruction encapsulation and transmission process involves encapsulating the generated control policy set in a unified message format, labeling it with the version number and effective time, and then using the message bus to distribute it in batches to different regions according to device tags. The execution node needs to report the policy feedback in real time, based on which it is determined whether compensation needs to be issued or rollback is required.

Images