Multi-security protection method and system for electric power application shopping mall

Abstract

The invention relates to a multi-security protection method for an electric power application shopping mall, and the method comprises the following steps: S1, collecting and recognizing the fingerprint information of equipment, then carrying out the credibility evaluation of the equipment, and outputting an authenticated and credible user session voucher; s2, dynamically judging a function and a data range which are allowed to be accessed in combination with a shopping mall permission model, and verifying whether the permission conforms to the current application or not in real time; s3, when a user accesses the application, deploying a runtime application self-protection component according to each running application, monitoring the running state of the application in real time, and obtaining monitoring content; s4, establishing an application normal behavior baseline based on a machine learning algorithm, and identifying an abnormal behavior by comparing a real-time behavior with a baseline model according to the monitoring content; and S5, when the security risk is detected, the system automatically executes corresponding response measures according to the risk level. The reliability of the electric power application shopping mall is effectively improved.

Description

Technical Field

[0001] This invention relates to the field of network protection, and in particular to a multi-layered security protection method and system for power application e-commerce. Background Technology

[0002] With the rapid development of new power systems and digital grids, the demand for application software within power companies and related ecosystems is growing daily. Power application marketplaces have emerged to meet this need, providing enterprises and third-party developers with a unified platform for application distribution, uploading, operation, and sharing. Through this open marketplace architecture, various business systems and operations personnel can conveniently and efficiently acquire, deploy, and manage various functional applications, enabling intelligent upgrades across multiple scenarios, including power production, dispatching, and management.

[0003] However, the power industry has extremely high security requirements. Its business systems are typically deeply integrated with power infrastructure and critical equipment. Once subjected to security incidents such as cyberattacks, malicious application implantation, unauthorized user operations, or data breaches, it can easily lead to production accidents, service interruptions, information leaks, and even threaten public safety. Therefore, as a critical information flow and software distribution center, the power application marketplace faces exceptionally complex and severe security threats. Summary of the Invention

[0004] To address the aforementioned problems, the present invention aims to provide a multi-layered security protection method and system for power application marketplaces, effectively improving the reliability of power application marketplaces.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] A multi-layered security protection method for power application e-commerce platforms includes the following steps:

[0007] S1: When a user logs into the online store, the device fingerprint information is first collected and identified, then the device trustworthiness is assessed, and the output is an authenticated and trusted user session credential.

[0008] S2: Use user session credentials as input to request access to mall resources. Combined with the mall permission model, dynamically determine the scope of functions and data that can be accessed, and verify in real time whether the permissions are in line with the current application.

[0009] S3: When a user accesses an application, deploy Runtime Application Self-Protection (RASP) components for each running application to monitor the application's running status in real time and obtain monitoring content.

[0010] S4: Establish a baseline for normal application behavior based on machine learning algorithms, and identify abnormal behavior by comparing real-time behavior with the baseline model based on the monitored content;

[0011] S5: When a security risk is detected, the system automatically executes corresponding response measures based on the risk level. Low-risk behaviors are logged and alerts are sent; medium-risk behaviors restrict application functions or reduce service levels; high-risk behaviors immediately isolate the application, disconnect the network connection, and send an emergency alert to the security administrator.

[0012] Furthermore, when a user logs into the online store, the device's fingerprint information is collected and identified to assess the device's trustworthiness, and an authenticated and trusted user session credential is output, as follows:

[0013] When a user logs into the power application marketplace, the system first activates the device fingerprint collection module. Through client-side JavaScript, browser API, and network protocol analysis, it collects the unique feature information of the user's terminal device. The collected device fingerprint includes hardware features, operating system environment features, network environment features, and browser features. A hash algorithm is then used to fuse the multi-dimensional feature information to generate a unique device identifier.

[0014] Based on the collected device fingerprint information, the system activates the trust assessment engine and conducts a security assessment of the logged-in device through multi-dimensional risk analysis;

[0015] Based on the device trustworthiness assessment results, the system dynamically selects the appropriate authentication strategy: two-factor authentication for high-trustworthiness devices; three-factor authentication for medium-trustworthiness devices; and three-factor authentication plus manual review for low-trustworthiness devices.

[0016] After a user is authenticated, the system generates a secure session token containing the user's identity information, device fingerprint, authentication level, permission scope, and validity period. The token adopts the JWT standard format and uses the RSA algorithm for digital signature to ensure the integrity and immutability of the token. A timestamp, a random number, and an expiration period are also embedded in the token.

[0017] Furthermore, the user session credentials are used as input to request access to mall resources. Combined with the mall permission model, the allowed functions and data range are dynamically determined, and the permission is verified to be consistent with the current application. Specifically, when a user requests access to mall resources with the secure session credentials generated in step S1, the permission control module first performs integrity verification and parsing of the secure session credentials. The pre-configured public key is used to digitally sign the secure session credentials to ensure that they have not been tampered with or forged. After successful verification, key information is extracted from the secure session credentials, including the user's unique identifier, user role list, device trust score, authentication level, token issuance time, and expiration time. At the same time, the system checks whether the secure session credentials are within the validity period, whether they have been actively canceled or blacklisted, and whether the user has concurrent session restrictions. After parsing, the user's identity information is compared with the user's main database to obtain the user's detailed attribute information.

[0018] Based on the user's detailed attribute information, an access context is constructed, and a hybrid permission model is adopted to dynamically determine the scope of functions and data that are allowed to be accessed.

[0019] Furthermore, the hybrid permission model combines RBAC and ABAC, as detailed below:

[0020] RBAC defines the mapping from roles to permissions. Let R(u) be the set of user roles and P be the basic permissions. r The set is:

[0021] ;

[0022] ABAC defines the condition constraints and strategy set:

[0023] The strategy is a predicate set S = {s} i Each strategy is a Boolean expression.

[0024] Let the i-th access control policy be:

[0025] ;

[0026] This means that for the i-th ABAC strategy in context C, it is only valid if all its subconditions f ij The entire policy si(C) is valid only when all of the sub-conditions (evaluating different attributes or combinations) are true.

[0027] Among them, A u A r A e A o These represent user attributes, resource attributes, environment attributes, and operation attributes, respectively; C represents the current context.

[0028] The set of permissions that satisfy the policy:

[0029] ;

[0030] Among them, P ABAC (u,r,e,o) indicates that in all policy sets S, there exists a policy s such that... i If the condition is true in the current context C, then operation o is allowed, and operation o belongs to PABAC; the basic license is RBAC.

[0031] After applying ABAC constraints, the intersection P is taken. allow :

[0032] ;

[0033] Among them, P deny A set of explicit rejection policies;

[0034] Define real-time session risk R sess :

[0035] R sess =λ1R dev +λ2R beh +λ3R env +λ4R biz ;

[0036] Among them, R dev For equipment risk; R beh For behavioral risk; R env Environmental risks are assessed by integrating features such as non-enterprise networks, remote locations, and off-peak hours; R biz For business risk; λ1, λ2, λ3, and λ4 are weighting coefficients;

[0037] Set a baseline threshold τ for the operation based on sensitivity. op And dynamically adjust based on user level and policy:

[0038] ;

[0039] Where, Δ clearance For user-level adjustment items; Δ context For context-sensitive risk adjustment; τ dyn This is the final dynamic risk threshold;

[0040] Decision criteria:

[0041] ;

[0042] Rsess represents the risk score for the current session; RiskPass represents the risk pass determination.

[0043] If the verification fails, it will trigger Step-Up enhanced authentication or result in rejection.

[0044] ;

[0045] in, To strengthen the authentication buffer;

[0046] Finally, the final access range is obtained through attribute matching and data range pruning, and based on a unified access decision function.

[0047] Furthermore, through attribute matching and data range pruning, and based on a unified access decision function, the final access range is obtained, as follows:

[0048] Define an organization mapping, a user department set Gu, and a resource ownership Gr, then the department visibility rule DeptPass is:

[0049] ;

[0050] Among them, G r G is the set of nodes to which the resource belongs. u The node for the currently accessing user; Descendants(G u ) indicates that G u This represents the set of all subordinate departments under the root node's organizational tree; roler represents the user's role; Auditor represents the auditor; Admin represents the administrator. For indicator functions,

[0051] According to data label L r ∈{Public,Internal,Sensitive,Confidential}, where Public represents public data, Internal represents internal data, Sensitive represents sensitive data, and Confidential represents confidential data;

[0052] Obtain user license level L u :

[0053] LabelPass=(L u ≥L r );

[0054] LabelPass represents the determination result;

[0055] Predicates are filtered by line. Perform row-level filtering:

[0056] ;

[0057] Where owner is the owner user ID of the resource record; uid is the current accessing user ID; dept is the department to which the data belongs; and Reviewer is the reviewer.

[0058] The function ψ is visible through the column. col (f) Perform column-level desensitization:

[0059] ;

[0060] Where f is a specific data field; label(f) is the sensitivity level label of field f; Sensitive specifies the label level; LabelPass is the user's data label access permission; mask(f) is the desensitization processing for data field f;

[0061] Construct a unified access decision function:

[0062] ;

[0063] Where op is the current operation; PRBAC is the set of permitted operations after merging all user roles; S is the set of all available policies; and D is the set of all explicit deny policies.

[0064] d j (C) represents the decision result of the j-th deny strategy;

[0065] Return to access scope:

[0066] ;

[0067] in, For row-level data visibility conditions based on users, resources, and environment; ψ col (u,r) is the set of functions for de-identifying fields / columns; rate_limit(u,op) is the flow control / frequency limit for the user in the corresponding operation.

[0068] Furthermore, the monitoring content includes: API call monitoring, monitoring internal and external API calls made by the application to detect unauthorized access; database access monitoring, monitoring SQL query statements to prevent SQL injection and data leakage; file system access monitoring, monitoring file read and write operations to prevent unauthorized access to sensitive files; and network communication monitoring, monitoring network requests to prevent malicious external connections and data leakage.

[0069] Furthermore, a baseline model is constructed based on the LSTM-AE model, as follows:

[0070] Construct a time-series feature vector x based on monitoring content tThis includes resource consumption characteristics, API call pattern characteristics, data access pattern characteristics, and business logic characteristics;

[0071] And for the time series feature vector x t The input features z are obtained by standardization. t :

[0072] Building an LSTM-AE model to learn normal application behavior patterns:

[0073] Encoder:

[0074] ;

[0075] ;

[0076] in, Let t be the hidden state of the encoder; LSTM e For the encoder's LSTM unit; This represents the encoder's hidden state from the previous moment. This represents the final encoded state of the entire input sequence;

[0077] Decoder:

[0078] ;

[0079] in, Let t be the hidden state of the decoder; LSTM d For the LSTM unit of the decoder; This represents the decoder's hidden state at the previous moment; W is the feature vector reconstructed by the LSTM decoder at time t. d ,b d These are the decoding layer weights and bias parameters, respectively;

[0080] The reconstruction loss function is L recon :

[0081] ;

[0082] Where T is the length of the time window; The square of the Euclidean distance;

[0083] A probability density model for normal behavioral characteristics is established using a multivariate Gaussian distribution model:

[0084] ;

[0085] Where u is the sample mean; Σ is the covariance matrix; z is the real-time standardized feature vector; and d is the feature dimension. Let be the determinant of the covariance matrix; p(z) is the probability density of z occurring under the normal distribution.

[0086] Combining isolated forests with an ensemble anomaly detection method:

[0087]

[0088] Where h(z) is the average path length of sample z in the isolated tree; c(n) is the normalization constant; H(i) is the harmonic number; E(h(z)) is the average path length of sample z in the isolated forest; and AnomalyScore is the anomaly probability score output by the isolated forest.

[0089] Furthermore, based on the monitoring content, abnormal behaviors are identified by comparing real-time behavior with the baseline model, as follows:

[0090] Newly input monitoring content z new Based on the baseline model, the autoencoder anomaly score, statistical anomaly score, and isolated forest anomaly score were obtained respectively:

[0091] ;

[0092] ;

[0093] ;

[0094] in, For autoencoder pairs z new The reconstruction result; max_recon_error is the maximum reconstruction error on historical normal data; S AE S represents the normalized autoencoder reconstruction error. Stat h(z) is the Mahalanobis distance; new ) for z new The average path length isolated in an isolated forest; c(n) is the normalization constant; S IF represents the outlier score output by the isolated forest; u is the historical mean.

[0095] The comprehensive anomaly score S is obtained through weighted fusion. final :

[0096] ;

[0097] Where w1, w2, and w3 are the weight coefficients of each sub-model;

[0098] Finally, anomalies are determined based on the comprehensive anomaly score:

[0099] ;

[0100]

[0101] in, Dynamic threshold; α is the indicator function; β is the standard deviation adjustment factor; II[peak business period] indicates whether the current time is a peak business period, 1 if yes, 0 otherwise; std(S) is the global baseline threshold. recent ) represents the recent outlier score S recent The standard deviation.

[0102] Furthermore, when a security risk is detected, corresponding response measures are automatically executed according to the risk level, as follows: Based on the comprehensive anomaly score, a first threshold and a second threshold are set to classify the risk level into low-risk, medium-risk, and high-risk behaviors. Low-risk behaviors are logged and warnings are sent; medium-risk behaviors restrict application functions or reduce service levels; high-risk behaviors immediately isolate the application, disconnect the network connection, and send an emergency alarm to the security administrator. The isolation measures include: suspending the application process, revoking application permissions, isolating application network access, and backing up application data.

[0103] A multi-layer security protection system for power application marketplaces includes a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the integrated real-time coordinated risk scheduling method for main distribution microgrids as described above.

[0104] The present invention has the following beneficial effects:

[0105] 1. This invention effectively prevents unauthorized access from fake devices and abnormal environments by collecting device fingerprints and assessing trustworthiness. Combined with a dynamic permission determination mechanism, it ensures that each user access undergoes accurate security assessment and minimum permission allocation, significantly reducing the risk of account misuse and unauthorized access, and adapting to the complex business environment of the power industry with multiple identities and multiple terminals.

[0106] 2. This invention deploys a runtime self-protection (RASP) component in each application instance, and combines machine learning algorithms to dynamically learn and generate baselines of normal operating behavior for various applications. By comparing real-time behavior with the baselines, it can intelligently identify various known and unknown risks, abnormal operations and attack behaviors, breaking through the limitations of traditional static rules and single-point protection, making security detection more sensitive and response more timely, and improving the overall risk control level.

[0107] 3. This invention implements responses based on anomaly scoring and grading, automatically matching refined measures such as log recording, real-time early warning, function limitation, and business isolation for low, medium, and high risks. This not only effectively curbs the spread of security incidents but also avoids the impact of false alarms or single extreme measures on normal business operations. It minimizes the impact of security threats and the response time while also taking into account the business continuity and user experience of the power application marketplace. Attached Figure Description

[0108] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0109] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0110] refer to Figure 1 In this embodiment, a multi-layered security protection method for an electric power application marketplace is provided, comprising the following steps:

[0111] S1: When a user logs into the store, the device fingerprint information (such as hardware information, operating system environment, IP, network characteristics, etc.) is first collected and identified. Then, the device trustworthiness is assessed. If the assessment is normal, the multi-factor authentication process is entered. Multi-factor authentication integrates password, biometrics, verification code, etc. to ensure that the logged-in user is real and trustworthy. The output is an authenticated and trustworthy user session credential.

[0112] S2: Use user session credentials as input to request access to mall resources. Combined with the mall permission model, dynamically determine the scope of functions and data that can be accessed, and verify in real time whether the permissions are in line with the current application.

[0113] S3: When a user accesses an application, deploy Runtime Application Self-Protection (RASP) components for each running application to monitor the application's running status in real time and obtain monitoring content.

[0114] S4: Based on machine learning algorithms, a baseline of normal application behavior is established. Based on monitoring content, abnormal behavior is identified by comparing real-time behavior with the baseline model. Abnormal behaviors include: abnormal access frequency (a large number of API calls in a short period), abnormal access scope (access to resources beyond authorized limits), abnormal access time (sensitive operations outside of normal working hours), and abnormal data transmission (large amounts of data downloading or uploading). The system uses a combination of rule engines and machine learning to improve the accuracy of anomaly detection.

[0115] S5: When a security risk is detected, the system automatically executes corresponding response measures based on the risk level. Low-risk behaviors are logged and alerts are sent; medium-risk behaviors restrict application functionality or reduce service levels; high-risk behaviors immediately isolate the application, disconnect it from the network, and send an emergency alert to the security administrator. Isolation measures include: suspending the application process, revoking application permissions, isolating the application from network access, and backing up application data for investigation and analysis.

[0116] In this embodiment, when a user logs into the online store, the device fingerprint information is collected and identified to assess device trustworthiness, and an authenticated and trusted user session credential is output, as follows:

[0117] When a user logs into the power application marketplace, the system first activates the device fingerprint collection module. Through client-side JavaScript, browser API interfaces, and network protocol analysis, it collects unique feature information of the user's terminal device. The collected device fingerprint includes hardware features (CPU model, number of cores, memory capacity, screen resolution, graphics card model, audio device information, etc.), operating system environment features (operating system version, patch version, system language, time zone settings, font list, installed software list, etc.), network environment features (IP address, MAC address, network operator, geographical location, network latency features, etc.), and browser features (user agent string, supported MIME types, plugin list, WebGL renderer information, Canvas fingerprint, etc.). A hash algorithm is then used to fuse the multi-dimensional feature information to generate a unique device identifier, ensuring the uniqueness and unforgeability of the device fingerprint.

[0118] Based on the collected device fingerprint information, the system activates the trust assessment engine and conducts a security assessment of the logged-in device through multi-dimensional risk analysis;

[0119] The multi-dimensional risk analysis includes equipment historical reputation assessment, equipment environmental security assessment, network environment risk assessment, and behavioral consistency assessment, as detailed below:

[0120] Device historical reputation assessment quantifies a device's security and trustworthiness by analyzing its behavior over a past time window. The system first counts the number of malicious actions the device has participated in over the past 30 days, including malware infections, participation in DDoS attacks, and unauthorized data access. Each malicious action deducts 25 points, and if the device is blacklisted, 60 points are deducted. Simultaneously, the system assesses the legitimacy of the device's behavior, calculating a stability score based on the device's historical active days. Devices with longer active periods receive higher trust levels, and a logarithmic function is used for smoothing to avoid excessive score concentration. Furthermore, the system calculates the device's login success rate, the ratio of successful logins to total login attempts. Normal devices typically have a success rate above 90%, while attacked or misconfigured devices have lower success rates. Finally, the three sub-dimensions are combined with a weighted ratio of 5:2.5:2.5 to obtain the device's historical reputation score.

[0121] The equipment environment security assessment focuses on the current security status and potential threats of the equipment. The system detects known malware, Trojans, viruses, and other threats on the device through a malware scanning interface. Each detected malware deducts 30 points, and a suspicious process deducts an additional 20 points. The security patch status assessment uses an exponential decay function; the longer the time since the last security patch update, the lower the device's security. 180 days is used as the half-life parameter; beyond this time, the device's score will significantly decrease. The antivirus software status assessment is divided into four levels: running and with up-to-date virus definitions (100 points), running but with outdated virus definitions (70 points), software not running (30 points), and no antivirus software (0 points). These three dimensions are weighted at 4:4:2 to ensure that malware detection and patch status are dominant, with antivirus software serving as a secondary indicator. This design considers both the direct risks of current threats and assesses the long-term security maintenance level of the equipment.

[0122] Network environment risk assessment analyzes the security of the network environment in which the device resides from multiple perspectives. IP address reputation check is a core component; the system queries the threat intelligence database to determine whether an IP has participated in malicious activities. Malicious IPs are penalized 40 points, and using a proxy or VPN deducts 20 points. The geographical location risk coefficient is set based on the cybersecurity status of the country / region. Geographical location rationality is assessed by calculating the distance between the current login location and the user's frequently used locations; the greater the distance, the lower the credibility. An exponential decay function is used to smooth the scoring transition. In the network type security level assessment, enterprise private networks received the highest score (100 points), followed by home broadband (80 points), public WiFi has a high risk (60 points), mobile networks scored moderately (50 points), while Tor networks scored the lowest (20 points) due to their strong anonymity. The proxy / VPN usage assessment differentiates between different types: enterprise VPNs are relatively secure (80 points), commercial VPNs are moderately secure (50 points), and anonymous proxies have the highest risk (20 points). The four dimensions are weighted and integrated to comprehensively reflect the security status of the network environment.

[0123] Behavioral consistency assessment identifies abnormal login activity by comparing the similarity between current login behavior and the user's historical behavior patterns. Device similarity analysis calculates the cosine similarity between the current device's fingerprint feature vector and the feature vectors of the user's historically used devices; higher similarity indicates that the device is more consistent with the user's usage habits. To improve computational efficiency, the system pre-processes high-dimensional device fingerprints using Principal Component Analysis (PCA) or an autoencoder to extract the most discriminative features for comparison. Temporal consistency analysis compares the difference between the current login time and the user's typical login time, using 12 hours as a decay parameter; login behavior outside the normal time range is considered suspicious. Location consistency analysis calculates the distance between the current login location and the user's frequently used login locations, using 500 kilometers as a decay parameter; logins from different locations will lower the credibility score. The three dimensions are fused with a weighted ratio of 5:3:2, with device similarity playing a dominant role and time and location consistency serving as important supplements, forming a comprehensive profile of the user's behavioral patterns.

[0124] To further improve assessment accuracy, the system integrates multi-source threat intelligence to correct the initial trust score. Threat intelligence includes real-time updated lists of malicious IPs, domain blacklists, known attacker fingerprint databases, and security incident intelligence. The system first calculates a threat intelligence risk coefficient, ranging from 0 to 1, with higher values ​​indicating a higher threat level. A multiplicative correction method is used, multiplying the initial score by (1 - 0.7 × threat intelligence risk coefficient) to ensure that high-threat intelligence significantly reduces device trust. Simultaneously, the system runs a real-time anomaly detection model, calculating anomaly probabilities based on the multi-dimensional features of the current login behavior; logins with high anomaly probabilities are penalized with additional points. The final trust score is obtained through two corrections: first, a multiplicative correction based on threat intelligence, followed by a linear deduction based on the anomaly probability, ensuring the score reflects the latest security threat landscape in a timely manner.

[0125] Based on the device trustworthiness assessment results, the system dynamically selects the appropriate authentication strategy. For high-trustworthiness devices (score above 90), two-factor authentication (username and password + SMS verification code) is used; for medium-trustworthiness devices (score between 60 and 90), three-factor authentication (username and password + hardware token + biometric identification) is used; and for low-trustworthiness devices (score below 60), three-factor authentication plus manual review is used.

[0126] After a user is authenticated, the system generates a secure session token containing the user's identity information, device fingerprint, authentication level, permission scope, and validity period. The token adopts the JWT standard format and uses the RSA algorithm for digital signature to ensure the integrity and immutability of the token. It also embeds security elements such as timestamps and random numbers to prevent replay attacks and sets a validity period.

[0127] In this embodiment, user session credentials are used as input to request access to e-commerce resources. Combined with the e-commerce permission model, the system dynamically determines the permitted functions and data scope, and verifies whether the permissions conform to the current application. Specifically: When a user requests access to e-commerce resources using the secure session credentials generated in step S1, the permission control module first verifies and parses the secure session credentials for integrity. It then uses a pre-configured public key to digitally sign the secure session credentials, ensuring they have not been tampered with or forged. After successful verification, key information is extracted from the secure session credentials, including the user's unique identifier, user role list, device trust score, authentication level, token issuance time, and expiration time. Simultaneously, the system checks whether the secure session credentials are valid, whether they have been actively cancelled or blacklisted, and whether the user has concurrent session restrictions. After parsing, the user's identity information is compared with the user's main database to obtain detailed user attribute information, including department, job level, business permission scope, and data access level, providing a comprehensive user profile foundation for subsequent permission determination.

[0128] Based on the user's detailed attribute information, an access context is constructed, and a hybrid permission model is adopted to dynamically determine the scope of functions and data that are allowed to be accessed.

[0129] In this embodiment, the hybrid access control model combines RBAC (role-based access control) and ABAC (attribute-based access control).

[0130] The RBAC layer defines a basic role-based access control (RBAC) matrix, including roles such as regular users, application developers, auditors, and administrators, each with different access permissions. The ABAC layer dynamically grants permissions based on user attributes, resource attributes, environment attributes, and operation attributes. User attributes include department, job level, and security level; resource attributes include application category, sensitivity level, and owner information; environment attributes include access time, geographical location, and network environment; and operation attributes include read, write, delete, and share operations. The policy engine uses a rule-based architecture, supporting complex policy expressions, such as "Only users with a security level of Confidential or higher can access core power applications from the corporate network during working hours." The system also supports policy inheritance and overriding mechanisms, allowing lower-level policies to inherit the basic permissions of higher-level policies, while also allowing for the expansion or restriction of permissions based on specific conditions, as follows:

[0131] RBAC defines the mapping from roles to permissions. Let R(u) be the set of user roles and P be the basic permissions. r The set is:

[0132] ;

[0133] ABAC defines the condition constraints and strategy set:

[0134] The strategy is a predicate set S = {s} i Each strategy is a Boolean expression.

[0135] Let the i-th access control policy be:

[0136] ;

[0137] Among them, A u A r A e A o These represent user attributes, resource attributes, environment attributes, and operation attributes, respectively; C represents the current context. This represents the conditional function for the j-th attribute under the i-th strategy; the above formula indicates that for the i-th ABAC strategy under context C, the condition is determined only if all its sub-conditions f ij The entire policy si(C) is valid only when all of the sub-conditions (evaluating different attributes or combinations) are true.

[0138] The set of permissions that satisfy the policy:

[0139] ;

[0140] Among them, P ABAC (u,r,e,o) indicates that in all policy sets S, there exists a policy s such that... i If the condition is true in the current context C, then operation o is allowed, and operation o belongs to PABAC; the basic license is RBAC.

[0141] After applying ABAC constraints, the intersection P is taken. allow :

[0142] ;

[0143] Among them, P deny A set of explicit rejection policies;

[0144] Define real-time session risk R sess :

[0145] R sess =λ1R dev +λ2R beh +λ3R env +λ4R biz ;

[0146] Among them, R dev For equipment risk; R beh For behavioral risk, the sliding window anomaly score (request frequency, anomaly sequence) is normalized to [0,1]; R env Environmental risks are assessed by integrating features such as non-enterprise networks, remote locations, and off-peak hours; R biz To represent business risks, sensitive operation weights (such as export, approval, and uploading) are mapped to [0,1]; λ1, λ2, λ3, and λ4 are weight coefficients;

[0147] Set a baseline threshold τ for the operation based on sensitivity. op And dynamically adjust based on user level and policy:

[0148] ;

[0149] Where, Δ clearance For user-level adjustment items; Δ context For context-sensitive risk adjustment; τ dyn This is the final dynamic risk threshold;

[0150] Decision criteria (risk pass conditions):

[0151] ;

[0152] Rsess represents the risk score for the current session; RiskPass represents the risk pass determination.

[0153] If the verification fails, it will trigger Step-Up enhanced authentication or result in rejection.

[0154] ;

[0155] in, To strengthen the authentication buffer;

[0156] Finally, the final access range is obtained through attribute matching and data range pruning, and based on a unified access decision function.

[0157] In this embodiment, the final access range is obtained through attribute matching and data range pruning, and based on a unified access decision function, as follows:

[0158] Define an organization mapping, a user department set Gu, and a resource ownership Gr. Then, the department visibility rule (including superiors and subordinates) is DeptPass:

[0159] ;

[0160] Among them, G r A set of nodes to which a resource (such as an application or data) belongs, such as "Production Technology Department"; G u The node for the currently accessing user; Descendants(G u ) indicates that G u This represents the set of all subordinate departments under the root node's organizational tree; roler represents the user's role; Auditor represents the auditor; Admin represents the administrator. For indicator functions,

[0161] According to data label L r ∈{Public,Internal,Sensitive,Confidential}, where Public represents public data, Internal represents internal data, Sensitive represents sensitive data, and Confidential represents confidential data;

[0162] Obtain user license level L u :

[0163] LabelPass=(L u ≥L r );

[0164] LabelPass represents the determination result;

[0165] Predicates are filtered by line. Perform row-level filtering:

[0166] ;

[0167] Where owner is the owner user ID of the resource record; uid is the current accessing user ID; dept is the department to which the data belongs; and Reviewer is the reviewer.

[0168] The function ψ is visible through the column. col (f) Perform column-level desensitization:

[0169] ;

[0170] Where f is a specific data field (e.g., phone number, salary, evaluation, etc.); label(f) is the sensitivity level label of field f (e.g., Public, Internal, Sensitive, Confidential); Sensitive specifies the label level; LabelPass is the user's data label access permission (e.g., whether the user's permission level is ≥ the label level of the current field); mask(f) is the desensitization processing of data field f, such as partial hiding or obfuscation;

[0171] Construct a unified access decision function:

[0172] ;

[0173] Where op represents the current operation (such as read / write / approval); PRBAC represents the set of permitted operations after merging all user roles; S represents the set of all available policies; and D represents the set of all explicit deny policies.

[0174] d j (C) represents the decision result of the j-th deny strategy;

[0175] Return to access scope:

[0176] ;

[0177] in, For row-level data visibility conditions based on users, resources, and environment (usually WHERE clauses or Filter predicates); ψ col (u,r) is a set of fields / columns that need to be de-identified (which fields need to be de-identified and which are allowed directly); rate_limit(u,op) is the flow control / frequency limit for users in the corresponding operation (such as the maximum number of times allowed every 5 minutes, the daily export quota, etc.).

[0178] In this embodiment, the monitoring content includes: API call monitoring, which monitors internal and external APIs called by the application to detect unauthorized access; database access monitoring, which monitors SQL query statements to prevent SQL injection and data leakage; file system access monitoring, which monitors file read and write operations to prevent unauthorized access to sensitive files; and network communication monitoring, which monitors network requests to prevent malicious external connections and data leakage.

[0179] In this embodiment, a baseline model is constructed based on the LSTM-AE model, as follows:

[0180] Construct a time-series feature vector x based on monitoring content t This includes resource consumption characteristics (CPU utilization, memory usage, disk I / O, network traffic), API call pattern characteristics (call frequency vector, call sequence entropy, call interval statistics), data access pattern characteristics (database query frequency, data read / write ratio, access table distribution entropy), and business logic characteristics (number of user sessions, business operation success rate, and abnormal response ratio).

[0181] And for the time series feature vector x t The input features z are obtained by standardization. t :

[0182] Building an LSTM-AE model to learn normal application behavior patterns:

[0183] Encoder:

[0184] ;

[0185] ;

[0186] in, Let t be the hidden state of the encoder; LSTM e For the encoder's LSTM unit; This represents the encoder's hidden state from the previous moment. This represents the final encoded state of the entire input sequence;

[0187] Decoder:

[0188] ;

[0189] in, Let t be the hidden state of the decoder; LSTM d For the LSTM unit of the decoder; This represents the decoder's hidden state at the previous moment; W is the feature vector reconstructed by the LSTM decoder at time t.d ,b d These are the decoding layer weights and bias parameters, respectively;

[0190] The reconstruction loss function is L recon :

[0191] ;

[0192] Where T is the length of the time window; The square of the Euclidean distance;

[0193] A probability density model for normal behavioral characteristics is established using a multivariate Gaussian distribution model:

[0194] ;

[0195] Where u is the sample mean; Σ is the covariance matrix; z is the real-time standardized feature vector; and d is the feature dimension. Let be the determinant of the covariance matrix; p(z) is the probability density of z occurring under the normal distribution.

[0196] Combining isolated forests with an ensemble anomaly detection method:

[0197]

[0198] Where h(z) is the average path length of sample z in the isolated tree; c(n) is the normalization constant; H(i) is the harmonic number; E(h(z)) is the average path length of sample z in the isolated forest; and AnomalyScore is the anomaly probability score output by the isolated forest.

[0199] In this embodiment, based on the monitored content, abnormal behavior is identified by comparing real-time behavior with a baseline model, as follows:

[0200] Newly input monitoring content z new Based on the baseline model, the autoencoder anomaly score, statistical anomaly score, and isolated forest anomaly score were obtained respectively:

[0201] ;

[0202] ;

[0203] ;

[0204] in, For autoencoder pairs z new The reconstruction result; max_recon_error is the maximum reconstruction error on historical normal data; S AE S represents the normalized autoencoder reconstruction error.Stat h(z) is the Mahalanobis distance; new ) for z new The average path length isolated in an isolated forest; c(n) is the normalization constant; S IF represents the outlier score output by the isolated forest; u is the historical mean.

[0205] The comprehensive anomaly score S is obtained through weighted fusion. final :

[0206] ;

[0207] Where w1, w2, and w3 are the weight coefficients of each sub-model;

[0208] Finally, anomalies are determined based on the comprehensive anomaly score:

[0209]

[0210]

[0211] in, Dynamic threshold; α is the indicator function; β is the standard deviation adjustment factor; II[peak business period] indicates whether the current time is a peak business period, 1 if yes, 0 otherwise; std(S) is the global baseline threshold. recent ) represents the recent outlier score S recent The standard deviation.

[0212] In this embodiment, when a security risk is detected, corresponding response measures are automatically executed according to the risk level, as follows: Based on the comprehensive anomaly score, a first threshold and a second threshold are set respectively to classify the risk level into low-risk behavior, medium-risk behavior, and high-risk behavior. Low-risk behavior is logged and an early warning is sent; medium-risk behavior restricts application functions or reduces service level; high-risk behavior immediately isolates the application, cuts off network connection, and sends an emergency alarm to the security administrator. The isolation measures include: suspending the application process, revoking application permissions, isolating application network access, and backing up application data.

[0213] A multi-layer security protection system for power application marketplaces includes a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the integrated real-time coordinated risk scheduling method for main distribution microgrids as described above.

[0214] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0215] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0216] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0217] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0218] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A multi-layered security protection method for an electric power application marketplace, characterized in that, Includes the following steps: S1: When a user logs into the online store, the device fingerprint information is first collected and identified, then the device trustworthiness is assessed, and the output is an authenticated and trusted user session credential. S2: Use user session credentials as input to request access to mall resources. Combined with the mall permission model, dynamically determine the scope of functions and data that can be accessed, and verify in real time whether the permissions are in line with the current application. S3: When a user accesses an application, deploy runtime application self-protection components for each running application to monitor the application's running status in real time and obtain monitoring content. S4: Establish a baseline for normal application behavior based on machine learning algorithms, and identify abnormal behavior by comparing real-time behavior with the baseline model based on the monitored content; S5: When a security risk is detected, the system will automatically execute the corresponding response measures according to the risk level.

2. The multi-security protection method for an electric power application marketplace according to claim 1, characterized in that, When a user logs into the online store, the system collects and identifies the device's fingerprint information, assesses the device's trustworthiness, and outputs an authenticated and trusted user session credential, as detailed below: When a user logs into the power application marketplace, the system first activates the device fingerprint collection module. Through client-side JavaScript, browser API, and network protocol analysis, it collects the unique feature information of the user's terminal device. The collected device fingerprint includes hardware features, operating system environment features, network environment features, and browser features. A hash algorithm is then used to fuse the multi-dimensional feature information to generate a unique device identifier. Based on the collected device fingerprint information, the system activates the trust assessment engine and conducts a security assessment of the logged-in device through multi-dimensional risk analysis; Based on the device trustworthiness assessment results, the system dynamically selects the appropriate authentication strategy. For high-trustworthiness devices, two-factor authentication is adopted. For medium-trust devices, three-factor authentication is used; For low-reliability devices, a three-factor authentication plus manual review authentication method is used; After a user is authenticated, the system generates a secure session token containing the user's identity information, device fingerprint, authentication level, permission scope, and validity period. The token adopts the JWT standard format and uses the RSA algorithm for digital signature to ensure the integrity and immutability of the token. A timestamp, a random number, and an expiration period are also embedded in the token.

3. The multi-security protection method for an electric power application marketplace according to claim 1, characterized in that, The process involves using user session credentials as input to request access to e-commerce resources. Combined with the e-commerce permission model, the system dynamically determines the permitted functions and data ranges and verifies whether the permissions are compatible with the current application. Specifically, when a user requests access to e-commerce resources using the secure session credentials generated in step S1, the permission control module first verifies and parses the secure session credentials. It then uses a pre-configured public key to digitally sign the secure session credentials, ensuring they have not been tampered with or forged. After successful verification, key information is extracted from the secure session credentials, including the user's unique identifier, user role list, device trust score, authentication level, token issuance time, and expiration time. Simultaneously, the system checks whether the secure session credentials are valid, whether they have been actively cancelled or blacklisted, and whether the user has concurrent session restrictions. After parsing, the user's identity information is compared with the user's main database to obtain detailed user attribute information. Based on the user's detailed attribute information, an access context is constructed, and a hybrid permission model is adopted to dynamically determine the scope of functions and data that are allowed to be accessed.

4. The multi-security protection method for an electric power application marketplace according to claim 3, characterized in that, The hybrid permission model combines RBAC and ABAC, as detailed below: RBAC defines the mapping from roles to permissions. Let R(u) be the set of user roles and P be the basic permissions. r gather for: ； ABAC defines the condition constraints and strategy set: The strategy is a predicate set S = {s} i Each strategy is a Boolean expression. Let the i-th access control policy be... : ； Among them, A u A r A e A o These represent user attributes, resource attributes, environment attributes, and operation attributes, respectively; C represents the current context. This represents the conditional function for the j-th attribute under the i-th strategy; the above formula indicates that for the i-th ABAC strategy under context C, the condition is determined only if all its sub-conditions f ij The entire strategy si(C) is valid only when all values ​​are true. The set of permissions that satisfy the policy: ； Among them, P ABAC (u,r,e,o) indicates that in all policy sets S, there exists a policy s such that... i If the condition is true in the current context C, then operation o is allowed, and operation o belongs to PABAC; the basic license is RBAC. After applying ABAC constraints, the intersection P is taken. allow : ； Among them, P deny A set of explicit rejection policies; Define real-time session risk R sess : R sess =λ1R dev +λ2R beh +λ3R env +λ4R biz ; Among them, R dev For equipment risk; R beh For behavioral risk; R env Environmental risks are assessed by integrating features such as non-enterprise networks, remote locations, and off-peak hours; R biz For business risk; λ1, λ2, λ3, and λ4 are weighting coefficients; Set a baseline threshold τ for the operation based on sensitivity. op And dynamically adjust based on user level and policy: ； Where, Δ clearance For user-level adjustment items; Δ context For context-sensitive risk adjustment; τ dyn This is the final dynamic risk threshold; Decision criteria: ； Rsess represents the risk score for the current session; RiskPass represents the risk pass determination. If the verification fails, it will trigger Step-Up enhanced authentication or result in rejection. ； in, To strengthen the authentication buffer; Finally, the final access range is obtained through attribute matching and data range pruning, and based on a unified access decision function.

5. The multi-security protection method for an electric power application marketplace according to claim 4, characterized in that, The process of obtaining the final access range through attribute matching and data range pruning, and based on a unified access decision function, is as follows: Define an organization mapping, user department set Gu, resource ownership Gr, then department visibility is defined as DeptPass: ； Among them, G r G is the set of nodes to which the resource belongs. u The node for the currently accessing user; Descendants(G u ) indicates that G u This represents the collection of all subordinate departments under the root node's organization tree; role represents the user's role; Auditor represents the auditor; Admin represents the administrator; For indicator functions, According to data label L r ∈{Public,Internal,Sensitive,Confidential}, where Public represents public data, Internal represents internal data, Sensitive represents sensitive data, and Confidential represents confidential data; Obtain user license level L u : LabelPass=(L u ≥L r ); LabelPass represents the determination result; Predicates are filtered by line. Perform row-level filtering: ； Where owner is the owner user ID of the resource record; uid is the current accessing user ID; dept is the department to which the data belongs; and Reviewer represents the reviewer. The function ψ is visible through the column. col (f) Perform column-level desensitization: ； Where f is a specific data field; label(f) is the sensitivity level label of field f; Sensitive specifies the label level; LabelPass is the user's data label access permission; mask(f) is the desensitization processing for data field f; Construct a unified access decision function: ； Where op represents the current operation; P RBAC S represents the set of permitted actions after merging all user roles; D represents the set of all available policies; and d represents the set of all explicit deny policies. j (C) represents the decision result of the j-th deny strategy; Return access scope: ； in, For row-level data visibility conditions based on users, resources, and environment; ψ col (u,r) is the set of functions for de-identifying fields / columns; rate_limit(u,op) is the flow control / frequency limit for the user in the corresponding operation.

6. The multi-security protection method for an electric power application marketplace according to claim 1, characterized in that, The monitoring content includes: API call monitoring, which monitors internal and external API calls made by the application to detect unauthorized access; database access monitoring, which monitors SQL query statements to prevent SQL injection and data leakage; file system access monitoring, which monitors file read and write operations to prevent unauthorized access to sensitive files; and network communication monitoring, which monitors network requests to prevent malicious external connections and data leakage.

7. The multi-security protection method for an electric power application marketplace according to claim 1, characterized in that, The baseline model built based on the LSTM-AE model is as follows: Construct a time-series feature vector x based on monitoring content t This includes resource consumption characteristics, API call pattern characteristics, data access pattern characteristics, and business logic characteristics; And for the time series feature vector x t The input features z are obtained by standardization. t : Building an LSTM-AE model to learn normal application behavior patterns: Encoder: ； ; in, Let t be the hidden state of the encoder; LSTM e For the encoder's LSTM unit; This represents the encoder's hidden state from the previous moment. This represents the final encoded state of the entire input sequence; Decoder: ； in, Let t be the hidden state of the decoder; LSTM d For the LSTM unit of the decoder; This represents the decoder's hidden state at the previous moment; W is the feature vector reconstructed by the LSTM decoder at time t. d ,b d These are the decoding layer weights and bias parameters, respectively; The reconstruction loss function is L recon : ； Where T is the length of the time window; The square of the Euclidean distance; A probability density model for normal behavioral characteristics is established using a multivariate Gaussian distribution model: ； Where u is the sample mean; Σ is the covariance matrix; z is the real-time standardized feature vector; and d is the feature dimension. Let be the determinant of the covariance matrix; p(z) is the probability density of z occurring under the normal distribution. Combining isolated forests with an ensemble anomaly detection method: ； Where h(z) is the average path length of sample z in the isolated tree; c(n) is the normalization constant; E(h(z)) is the average path length of sample z in the isolated forest; and AnomalyScore is the anomaly probability score output by the isolated forest.

8. The multi-security protection method for an electric power application marketplace according to claim 7, characterized in that, The process of identifying abnormal behavior by comparing real-time behavior with a baseline model based on monitored content is as follows: Newly input monitoring content z new Based on the baseline model, the autoencoder anomaly score, statistical anomaly score, and isolated forest anomaly score were obtained respectively: ； ； ； in, For autoencoder pairs z new The reconstruction result; max_recon_error is the maximum reconstruction error on historical normal data; S AE S represents the normalized autoencoder reconstruction error. Stat h(z) is the Mahalanobis distance; new ) for z new The average path length isolated in an isolated forest; c(n) is the normalization constant; S IF represents the outlier score output by the isolated forest; u is the historical mean. The comprehensive anomaly score S is obtained through weighted fusion. final : ； Where w1, w2, and w3 are the weight coefficients of each sub-model; Finally, anomalies are determined based on the comprehensive anomaly score (Anomaly Score). ； ； in, Dynamic threshold; α is the indicator function; β is the standard deviation adjustment factor; II[peak business period] indicates whether the current time is a peak business period, 1 if yes, 0 otherwise; std(S) is the global baseline threshold. recent ) represents the recent outlier score S recent The standard deviation.

9. The multi-security protection method for an electric power application marketplace according to claim 1, characterized in that, When a security risk is detected, corresponding response measures will be automatically executed based on the risk level, as follows: Based on the comprehensive anomaly score, a first threshold and a second threshold are set respectively to classify risk levels into low-risk behavior, medium-risk behavior and high-risk behavior. Low-risk behavior is logged and an early warning is sent. Medium-risk behaviors may result in restrictions on application functionality or a reduction in service level. High-risk behaviors should be immediately isolated from the application, the network connection should be cut off, and an emergency alert should be sent to the security administrator. The isolation measures include: suspending the application process, revoking the application permissions, isolating the application's network access, and backing up the application data.

10. A multi-security protection system for an electric power application marketplace, characterized in that, It includes a processor, a memory, and a computer program stored in the memory. When the processor executes the computer program, it specifically performs the steps in the integrated real-time coordination and risk scheduling method for a primary and secondary microgrid as described in any one of claims 1-9.

Images