Knowledge graph-based dynamic evaluation method for network security of power system

Abstract

The invention discloses a power system network security dynamic assessment method based on a knowledge graph, and aims to solve the problems of multi-source heterogeneous data, dynamic risk evolution and strong assessment subjectivity in power system network security assessment. The core lies in that a power system network security knowledge graph fusing an evaluation target and a quantitative index entity is constructed, and structured organization and dynamic association of evaluation data are realized by defining multiple sequential relationships; the knowledge graph is automatically constructed and updated with high precision by using the enhanced feature entity recognition and segmented convolutional neural network relation extraction technology; a quantitative evaluation model based on a wooden barrel principle and an S-shaped curve is innovatively proposed, the highest level and number of vulnerabilities are comprehensively considered, and objective, dynamic and refined evaluation of network security risks is realized. According to the invention, the accuracy, the real-time performance and the automation level of network security evaluation of the power system are obviously improved.

Description

Technical Field

[0001] This invention relates to the field of power system information security and knowledge graph technology, and in particular to a dynamic assessment method for power system network security based on knowledge graphs. Background Technology

[0002] As power systems become increasingly intelligent and networked, the cybersecurity threats they face are becoming more severe and dynamic. Power system assets are numerous and complex, generating security data that is multi-source, heterogeneous, and massive. Traditional security assessment methods often rely on static checklists or expert experience, which have the following inherent limitations:

[0003] 1. Insufficient data integration capabilities: It is difficult to effectively link and utilize multi-dimensional information such as assets, vulnerabilities, and threat intelligence scattered across different systems to form a global security view.

[0004] 2. Poor dynamic adaptability: The network situation and asset status are constantly changing, and the static assessment results cannot reflect the current real risk level of the system in real time.

[0005] 3. The evaluation process is highly subjective: Qualitative or semi-quantitative evaluation methods are greatly influenced by the evaluator's experience and lack objective and unified quantitative standards, resulting in poor comparability of evaluation results.

[0006] 4. Low level of automation: The entire process, from data acquisition and processing to analysis and evaluation, relies heavily on manual labor, resulting in low efficiency and difficulty in meeting the evaluation needs of large-scale power systems.

[0007] 5. Insufficient correlation analysis of vulnerabilities: Existing quantitative assessment methods often only consider the highest score of a single vulnerability, or the model is too complex, failing to concisely and effectively characterize the combined impact of the highest risk vulnerability and the total number of vulnerabilities on system security.

[0008] Knowledge graph technology, with its powerful semantic association and reasoning capabilities, provides an effective way to integrate multi-source information and express complex relationships. However, applying knowledge graphs to power system cybersecurity assessment still faces challenges such as low accuracy in domain entity recognition, high noise in relationship extraction, and how to transform graph data into accurate and dynamic assessment results.

[0009] Therefore, there is an urgent need in this field for a technical solution that can automatically construct high-quality security knowledge graphs and perform objective, dynamic, and refined quantitative evaluation based on graph data. Summary of the Invention

[0010] In view of this, the purpose of this invention is to provide a knowledge graph-based dynamic assessment method for power system network security, which improves the accuracy, real-time performance and automation level of power system network security assessment.

[0011] To achieve the above objectives, the present invention adopts the following technical solution: a dynamic assessment method for power system network security based on knowledge graphs, comprising the following steps:

[0012] S1. Construct a knowledge graph for power system network security: Extract assessment target entities and assessment indicator entities from multi-source heterogeneous data, and construct the relationships between entities, including measurement objects, latest indicators, earliest indicators, previous indicators, and segmentation indicators, to form a structured knowledge network.

[0013] S2, dynamically update and calculate the power system network security knowledge graph: by performing operations such as adding, deleting, predicting, completing and aging of evaluation indicator entities, and by aggregating indicators based on the time dimension, generate a group evaluation matrix and evaluation consistency indicators to realize the temporal evolution and dynamic maintenance of evaluation data.

[0014] S3, entity recognition based on enhanced feature model: The named entity recognition model, which integrates local text features and bidirectional long short-term memory network semantic features, is used to extract entities from power system network security texts in order to accurately identify complex and varied entity types in the domain.

[0015] S4, Relation Extraction Based on Segmented Convolutional Neural Network: Training corpus is constructed using remote supervision and semantic similarity denoising methods, and a segmented convolutional neural network model is used to extract structured relationships between entities in order to construct high-quality knowledge graph triples;

[0016] S5, based on the S-curve function for quantitative security assessment: Based on the barrel principle, it comprehensively considers the highest severity level of vulnerabilities and the number of vulnerabilities of the same level. By introducing an S-curve function with an upper limit for the level, it calculates the overall vulnerability risk value of the power system, thereby realizing a quantitative and dynamic assessment of the network security situation.

[0017] In a preferred embodiment, the evaluation target entity in step S1 includes the core assets and components of the power system, which have a hierarchical structure and include the next-level evaluation target entities; the evaluation index entity is used to quantitatively describe the security attribute parameters of the evaluation target entity within a specific time range.

[0018] In a preferred embodiment, in step S1, the measurement object relationship is used to associate the evaluation index entity with the corresponding evaluation target entity; the latest index and earliest index relationship is used to associate the evaluation target entity with the evaluation index entities of its latest and earliest time periods, and has a measurement period attribute; the previous index relationship is used to link the evaluation index entities of the same evaluation target entity in different time periods in chronological order; and the segmentation index relationship is used to represent the logical membership relationship between evaluation index entities.

[0019] In a preferred embodiment, the dynamic update and calculation in step S2 includes: importing new evaluation indicator entities into the knowledge graph, deleting specified evaluation indicator entities, predicting and completing future evaluation indicator entities based on time series, deleting aging data, and performing aggregate calculations on evaluation indicator entities in the time dimension.

[0020] In a preferred embodiment, the enhanced feature model described in step S3 concatenates the local text feature vector extracted based on feature templates with the contextual semantic feature vector learned by the BiLSTM network, and inputs them together into a conditional random field layer to complete sentence-level sequence labeling. The scoring function of its label sequence... for:

[0021]

[0022] in, This represents the total score for the current label. y represents the transition score between labels; n specifically refers to the total number of words (or characters) contained in a sentence. It is the upper bound of the summation process. i represents the position index of the current word in the sequence. It is a loop variable (or subscript) used in the summation formula, traversing from 1 to n, indicating that calculations are performed and accumulated for each position in the sequence. Therefore, the meaning of this scoring function is: for a sentence of length n, calculate the label score at each position i (from the 1st word to the nth word), as well as the transition score between adjacent labels, and add all these scores together to obtain the total score of the entire label sequence y.

[0023] In a preferred embodiment, the relation extraction in step S4 specifically involves: first, constructing a small domain knowledge base, and then aligning the knowledge base with the text using a remote supervision method to generate an initial corpus; subsequently, denoising the corpus by calculating the Jaccard semantic similarity between relational phrases in the knowledge base and entity pairs in the sentence; finally, inputting the denoised corpus into a segmented convolutional neural network model for training and relation classification.

[0024] In a preferred embodiment, the quantitative security assessment based on the S-curve function described in step S5 is calculated using a formula that determines the overall vulnerability risk value based on the highest-level vulnerability type present in the system:

[0025] When advanced vulnerabilities exist, the risk value for: ,in The highest vulnerability score, The number of advanced vulnerabilities;

[0026] When there are intermediate-level vulnerabilities but no high-level vulnerabilities, the risk value is... for: ,in The highest vulnerability score, The number of intermediate-level vulnerabilities;

[0027] When only low-level vulnerabilities exist, the risk value is... for: ,in The highest vulnerability score, This represents the number of low-level vulnerabilities.

[0028] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement a knowledge graph-based dynamic assessment method for power system network security as described above.

[0029] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the knowledge graph-based dynamic assessment method for power system network security as described above.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] 1. It realizes the structuring and dynamization of assessment data: By constructing a knowledge graph with rich temporal relationships, isolated and static security data is transformed into an interconnected and traceable dynamic knowledge network, laying the data foundation for real-time assessment.

[0032] 2. Improved the automation and accuracy of knowledge graph construction: By strengthening the feature entity recognition model and combining it with semantic denoising relationship extraction methods, the problems of complex entities and high relationship annotation costs in the field of power safety were effectively solved, ensuring the quality of the knowledge graph.

[0033] 3. An innovative, objective, and precise quantitative assessment model was developed: The proposed assessment method based on the S-curve not only follows the "barrel principle" to identify the weakest link in the system, but also cleverly incorporates the cumulative effect of the number of vulnerabilities of the same level through a function. This achieves a leap in assessment results from "qualitative" to "quantitative" and from "one-sided" to "comprehensive." The model is simple and conforms to the actual laws governing risk changes.

[0034] 4. Enhanced practicality and adaptability of the assessment system: The entire method is highly automated and can adapt to the dynamic changes in the power system network situation, providing continuous and objective decision support for safety management personnel and significantly improving the proactive defense capability of the power system. Attached Figure Description

[0035] Figure 1 This is a flowchart illustrating the construction process of the knowledge graph in an embodiment of the present invention.

[0036] Figure 2 This is a schematic diagram of the network security assessment indicator knowledge graph constructed in an embodiment of the present invention.

[0037] Figure 3 This is a schematic diagram of the basic graph of the S-shaped function used in the embodiments of the present invention and its application in vulnerability risk assessment. Detailed Implementation

[0038] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0039] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0040] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations according to this application; as used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise; furthermore, it should be understood that when the terms “comprising” and / or “including” are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0041] This invention provides a dynamic assessment method for power system network security based on knowledge graphs, referencing... Figure 1-3 Its core idea is to construct and maintain a dynamically evolving power system security knowledge graph through automated means, and based on this graph, to achieve objective, accurate and dynamic assessment of cybersecurity risks using innovative quantitative models.

[0042] Step S1: Construct a knowledge graph for power system cybersecurity

[0043] This step forms the basis for building the evaluation system. For example... Figure 2 As shown, two types of core entities are defined: "Evaluation Target Entities" (such as "Substation A" and "Dispatch Server B") and "Evaluation Indicator Entities" (such as "Number of Vulnerabilities within a Certain Time Period" and "CVSS Score of a Vulnerability"). Evaluation target entities can have a hierarchical structure. The relationship types between entities are defined and constructed as follows:

[0044] (1) Measurement object: Associating the evaluation indicator entity with the evaluation target entity it describes.

[0045] (2) Latest indicator / earliest indicator: The evaluation target entity is associated with the evaluation indicator entity of its latest or earliest time period, and the relationship attribute includes the measurement period.

[0046] (3) Previous indicator: Establish a linked list relationship between evaluation indicator entities of the same evaluation target entity at different time periods to form a time series.

[0047] (4) Segmentation indicators: These represent the logical hierarchical relationship between assessment indicator entities, such as decomposing the overall risk indicator into multiple sub-indicators.

[0048] These relationships together constitute a knowledge network that can reflect both static attributes and temporal evolution.

[0049] Step S2: Dynamic updating and computation of the knowledge graph

[0050] To ensure that the knowledge graph reflects real-time situations, it needs to be dynamically maintained. This process involves a series of computational operations, and its data foundation comes from... Figure 1 The build process shown:

[0051] (1) Data acquisition and preprocessing: Security data is collected from multiple channels using technologies such as web crawlers, and preprocessed by word segmentation, annotation and other methods.

[0052] (2) Entity recognition and relation extraction: The structured entities and relations are extracted through the specialized models in subsequent steps S3 and S4.

[0053] (3) Graph storage and updating: The obtained entities and relations are stored in a graph database (such as Neo4j) to form a graph database. Figure 2 The system displays a visualized knowledge graph and performs dynamic computational operations such as adding, deleting, predicting, completing, aging, and aggregating entities.

[0054] Through these operations, the knowledge graph becomes a living, dynamically evolving system.

[0055] Step S3: Entity recognition based on enhanced feature model

[0056] To automate the construction of knowledge graphs, entities need to be extracted from unstructured text (such as security bulletins and vulnerability reports). This invention employs a reinforced feature model, and its workflow is as follows:

[0057] (1) Preprocess the input text and vectorize the words.

[0058] (2) Input the word vector sequence into the BiLSTM layer to obtain the contextual semantic representation of each word. .

[0059] (3) At the same time, the local features of the current word are extracted using the predefined feature template and transformed into feature vectors.

[0060] (4) The output of BiLSTM (correspond ) and local feature vectors (after linear transformation) The scores are added together to obtain the final feature representation of each word. The enhanced feature model described in step S3 uses the scores obtained from the hidden layers of the BiLSTM model to determine the final label score s for each word. With feature template score Adding them together, we get: ,in , This is the weight matrix. This is the output of the hidden layer. The model maximizes the log-likelihood function. The system is trained and then decoded using the Viterbi algorithm to obtain the optimal entity sequence.

[0061] (5) Input the feature representation into the CRF layer, use the CRF transition matrix A to consider the dependency relationship between labels, and decode the globally optimal entity label sequence using the Viterbi algorithm.

[0062] This model significantly improves the recognition accuracy in the field of power safety, where entity types are complex and boundaries are ambiguous, by combining local deterministic features with global contextual semantics.

[0063] Step S4: Relation extraction based on segmented convolutional neural networks

[0064] After identifying the entities, it is necessary to extract the relationships between them. This invention employs the following process:

[0065] 1. Construct a seed knowledge base: Manually construct a small, high-quality knowledge base of electrical system security relationships.

[0066] 2. Remote supervision and corpus generation: Align the seed knowledge base with a large amount of text, automatically label sentences containing known entity pairs, and generate the initial training corpus.

[0067] 3. Semantic Denoising: To address the mislabeling problem in remote supervision, the Jaccard semantic similarity between relational phrases in the knowledge base and words on the dependency paths between entity pairs in sentences is calculated. Noisy samples with similarity below a threshold are removed to obtain the purified training corpus.

[0068] 4. PCNN Model for Relationship Classification: Words in a sentence and their relative positions to entities are converted into vectors and input into a segmented convolutional neural network. PCNN divides the convolution result into three segments based on the positions of two entities and performs max pooling on each segment to better capture relevant local features. Finally, a SoftMax output layer determines the relationship type between entity pairs.

[0069] This method effectively reduces the reliance on manual annotation for relation extraction and improves the robustness and accuracy of the model through denoising.

[0070] Step S5: Quantitative security assessment based on S-curve function

[0071] Based on vulnerability data in the knowledge graph, a final risk quantification assessment is conducted. The assessment method of this invention is based on two principles: the barrel principle (the system risk is no less than the highest risk vulnerability) and the cumulative effect of quantity (the more vulnerabilities of the same level, the higher the risk).

[0072] Figure 3 The graph of a basic sigmoid function is shown, its basic form being: This function has the characteristic of asymptotically approaching 1 from 0. This invention modifies this basic function and applies it to vulnerability risk assessment. Different assessment functions are selected based on the highest-level vulnerability present in the system:

[0073] Advanced vulnerabilities exist. : The risk value is from Starting point, depending on the number of advanced vulnerabilities It increases rather than grows linearly, approaching 10 infinitely.

[0074] Intermediate vulnerability exists And there are no advanced vulnerabilities: The risk value is from Starting point, depending on the number of intermediate vulnerabilities It increases and grows, infinitely approaching 7.

[0075] Only low-level vulnerabilities exist. : The risk value is from Starting with the number of low-level vulnerabilities It increases and grows, infinitely approaching 4.

[0076] The model is simple to calculate and has a clear physical meaning. It can highlight the decisive role of the most serious vulnerability and reasonably reflect the cumulative impact of the number of vulnerabilities, thus achieving an objective and refined assessment of the security risks of the power system.

[0077] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A dynamic assessment method for power system network security based on knowledge graphs, characterized in that, Includes the following steps: S1. Construct a knowledge graph for power system network security: Extract assessment target entities and assessment indicator entities from multi-source heterogeneous data, and construct the relationships between entities, including measurement objects, latest indicators, earliest indicators, previous indicators, and segmentation indicators, to form a structured knowledge network. S2, dynamically update and calculate the power system network security knowledge graph: by performing operations such as adding, deleting, predicting, completing and aging of evaluation indicator entities, and by aggregating indicators based on the time dimension, generate a group evaluation matrix and evaluation consistency indicators to realize the temporal evolution and dynamic maintenance of evaluation data. S3, entity recognition based on enhanced feature model: The named entity recognition model, which integrates local text features and bidirectional long short-term memory network semantic features, is used to extract entities from power system network security texts in order to accurately identify complex and varied entity types in the domain. S4, Relation Extraction Based on Segmented Convolutional Neural Network: Training corpus is constructed using remote supervision and semantic similarity denoising methods, and a segmented convolutional neural network model is used to extract structured relationships between entities in order to construct high-quality knowledge graph triples; S5, based on the S-curve function for quantitative security assessment: Based on the barrel principle, it comprehensively considers the highest severity level of vulnerabilities and the number of vulnerabilities of the same level. By introducing an S-curve function with an upper limit for the level, it calculates the overall vulnerability risk value of the power system, thereby realizing a quantitative and dynamic assessment of the network security situation.

2. The method for dynamic evaluation of power system network security based on knowledge graphs according to claim 1, characterized in that, The target entities for evaluation mentioned in step S1 include the core assets and components of the power system, which have a hierarchical structure and include the next-level target entities for evaluation; the evaluation index entities are used to quantitatively describe the security attribute parameters of the target entities for evaluation within a specific time range.

3. The method for dynamic assessment of power system network security based on knowledge graphs according to claim 1, characterized in that, In step S1, the measurement object relationship is used to associate the evaluation indicator entity with the corresponding evaluation target entity; the latest indicator and earliest indicator relationship is used to associate the evaluation target entity with the evaluation indicator entities of its latest and earliest time periods, and has the measurement period attribute; the previous indicator relationship is used to link the evaluation indicator entities of the same evaluation target entity in different time periods in chronological order. The segmentation index relationship is used to represent the logical membership relationship between evaluation index entities.

4. The method for dynamic assessment of power system network security based on knowledge graphs according to claim 1, characterized in that, The dynamic update and calculation in step S2 includes: importing new evaluation indicator entities into the knowledge graph, deleting specified evaluation indicator entities, predicting and completing future evaluation indicator entities based on time series, deleting aging data, and performing aggregation calculations on evaluation indicator entities in the time dimension.

5. The method for dynamic assessment of power system network security based on knowledge graphs according to claim 1, characterized in that, The enhanced feature model described in step S3 concatenates the local text feature vectors extracted based on feature templates with the contextual semantic feature vectors learned by the BiLSTM network, and inputs them together into a conditional random field layer to complete sentence-level sequence labeling. The scoring function for its label sequence... for: in, This represents the total score for the current label. This represents the transition score between labels, where n specifically refers to the total number of words or characters contained in a sentence, and i represents the position index of the current word or character in the sequence.

6. The method for dynamic evaluation of power system network security based on knowledge graphs according to claim 1, characterized in that, The relation extraction described in step S4 specifically involves: first, constructing a small domain knowledge base, and then using a remote supervision method to align the knowledge base with the text to generate an initial corpus; Subsequently, the corpus is denoised by calculating the Jaccard semantic similarity between relational phrases in the knowledge base and entity pairs in the sentence; finally, the denoised corpus is input into a segmented convolutional neural network model for training and relation classification.

7. The method for dynamic assessment of power system network security based on knowledge graphs according to claim 1, characterized in that, The quantitative security assessment based on the S-curve function described in step S5 uses a formula to calculate the overall vulnerability risk value, which is determined according to the highest-level vulnerability type present in the system. When advanced vulnerabilities exist, the risk value for: ,in The highest vulnerability score, The number of advanced vulnerabilities; When there are intermediate-level vulnerabilities but no high-level vulnerabilities, the risk value is... for: ,in The highest vulnerability score, The number of intermediate-level vulnerabilities; When only low-level vulnerabilities exist, the risk value is... for: ,in The highest vulnerability score, This represents the number of low-level vulnerabilities.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements a knowledge graph-based dynamic assessment method for power system network security as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements a knowledge graph-based dynamic assessment method for power system network security as described in any one of claims 1 to 7.

Images