Digital power grid network security index collaborative empowerment enhancement evaluation method, system, equipment and medium
By constructing a dynamic graph network structure and a collaborative weighting model, combined with graph neural network algorithms, the problems of rigid indicator weights and neglect of topological correlation in the cybersecurity situation assessment of digital power grids are solved. This enables accurate and adaptive assessment of the cybersecurity situation of digital power grids, improving the accuracy and depth of the assessment.
Patent Information
- Application Number
- CN202511786603.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-01
- Publication Date
- 2026-03-03
AI Technical Summary
Existing methods for assessing the cybersecurity situation of digital power grids suffer from imprecise indicator weighting and a lack of dynamic adjustment capabilities. They also neglect network topology correlation, leading to biased assessment results and an inability to adapt to dynamically changing business scenarios.
By collecting raw data from the digital power grid, a dynamic graph network structure is constructed. Combining the entropy weight method and subjective expert weight strategy, a collaborative weighting model is adopted to generate dynamic collaborative weights. The graph neural network algorithm is used for model training to establish an enhanced assessment model and realize dynamic assessment of network security status.
It improves the accuracy and scientific rigor of cybersecurity situation assessment, enabling the identification of complex attacks and hidden risks, and dynamically adjusts indicator weights to adapt to the actual business needs of the digital power grid.
Smart Images
Figure CN121599474A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of digital power grid security technology, specifically to a method, system, device, and medium for collaborative weighting and enhancement assessment of digital power grid network security indicators. Background Technology
[0002] With the advancement of the construction of "new power systems" and "digital grids," the power system is undergoing a profound digital transformation. The integration of information technology and operational technology is deepening, with technologies such as the Internet of Things and big data covering all aspects of the power grid. This not only improves efficiency and intelligence but also breaks down the physical isolation of traditional power systems, exposing grid assets to greater cyber threats. As the core of the nation's critical information infrastructure, the security of the digital grid is crucial to the national economy and people's livelihoods. Currently, targeted attacks on industrial control systems (such as advanced persistent threats and ransomware) have become a major hidden danger. Once critical equipment is controlled, it could lead to catastrophic consequences such as power outages and system paralysis. Traditional passive protection methods such as firewalls are no longer sufficient to cope with complex attacks, and the industry needs to shift to proactive defense. Cybersecurity situation assessment is a core support, which helps to understand the security status of the power grid, identify risks, predict threats, and provide support for decision-making by collecting multi-source security data and conducting scientific analysis.
[0003] Current methods for assessing the cybersecurity posture of digital power grids are significantly lacking in accuracy and dynamism, which can be examined from two perspectives: First, the weighting of indicators is not precise enough and lacks dynamic adjustment capabilities. Traditional methods of assigning weights to safety indicators mostly rely on the subjective experience of experts, which not only easily leads to rigid weighting and incomplete consideration, but also fails to establish a mechanism that can dynamically adjust the importance of indicators based on real-time data fluctuations.
[0004] Second, the assessment models neglect the topological interconnectivity of the network. These models often treat individual network assets in isolation, ignoring their actual connections within the digital power grid topology. This prevents the models from capturing the non-linear propagation patterns of security risks within the network, ultimately leading to biased assessment results.
[0005] To this end, the present invention provides a method for enhancing the assessment of collaborative weighting of network security indicators in digital power grids. Summary of the Invention
[0006] In view of the above-mentioned problems, the present invention is proposed.
[0007] Therefore, the present invention aims to overcome the shortcomings of the prior art and solve at least one technical problem mentioned in the background art.
[0008] To address the aforementioned technical problems, this invention provides the following technical solution: a method for collaboratively weighting and enhancing the evaluation of digital power grid network security indicators, comprising, The process involves collecting three sets of raw data from the digital power grid. The first set of raw data is used to construct a dynamic graph network structure. The second set of raw data is cleaned and normalized to generate standardized indicator data. Objective dynamic weights are calculated based on the standardized indicator data and fused with the third set of raw data. A collaborative weighting model is used to generate dynamic collaborative weights. These dynamic collaborative weights and standardized indicator data are then used as node and edge features, associated, and loaded onto the dynamic graph network structure to form a model training dataset. A nonlinear algorithm is trained using this dataset to establish an enhanced assessment model. Continuously input dynamic security indicator data is fed into the trained enhanced assessment model to generate enhanced cybersecurity posture assessment results.
[0009] As a preferred embodiment of the collaborative weighting and enhancement evaluation method for digital power grid network security indicators described in this invention, the collection of the first original data, the second original data, and the third original data of the digital power grid includes the collection of the first original data as original asset topology data. The second set of raw data collected is the raw dynamic indicator data; The third source data was collected using a subjective expert weighting strategy.
[0010] As a preferred embodiment of the collaborative weighting and enhancement evaluation method for digital power grid network security indicators described in this invention, the generation of standardized indicator data includes parsing and deduplicating the asset list in the first original data, and uniformly mapping the asset identifier to a unique asset node. Verify the connectivity and network configuration between assets, identify communication links, and construct a dynamic graph network structure based on asset nodes and communication links; Data cleaning is performed on the second set of raw data. The cleaned data is then normalized using a data standardization algorithm to generate standardized indicator data.
[0011] As a preferred embodiment of the digital power grid network security indicator collaborative weighting enhancement evaluation method described in this invention, the generation of dynamic collaborative weights includes processing standardized indicator data using the entropy weight method, quantifying the information content of the indicators, and calculating objective dynamic weights. A linear combination model is adopted to weight and fuse objective dynamic weights with third-party original data; A collaborative fusion coefficient is set to adjust the relative importance of the objective dynamic weight and the third original data, and dynamically adjusted according to the preset business scenario of the digital power grid to generate the dynamic collaborative weight.
[0012] The beneficial effects of the preferred technical solution in the embodiments of the present invention are as follows: by integrating objective dynamic weights and subjective expert weights, and dynamically adjusting the collaborative fusion coefficient, the balance and adaptability of weight allocation are achieved, thereby improving the accuracy and scenario relevance of the evaluation.
[0013] As a preferred embodiment of the collaborative weighting enhancement evaluation method for digital power grid network security indicators described in this invention, the construction of the model training dataset includes extracting corresponding standardized indicator data for each asset node in the dynamic graph network structure to form a node indicator vector. By performing element-wise multiplication between the node indicator vector and the corresponding dynamic collaborative weight vector, the node weighted feature vector of the current node is generated. For each communication link in the dynamic graph network structure, the corresponding standardized index data is extracted and multiplied with the dynamic collaborative weight to generate the edge weighted feature vector of the current link. The node weighted feature vector and edge weighted feature vector are used as attribute features of nodes and links at a specific time, respectively, and loaded onto the dynamic graph network structure. A graph loaded with node and edge features is defined as a time snapshot, where the model training dataset consists of time snapshots combined in time series.
[0014] As a preferred embodiment of the collaborative weighting enhancement evaluation method for digital power grid network security indicators described in this invention, the establishment of the enhancement evaluation model includes: using a graph neural network algorithm as a nonlinear algorithm, and introducing risk labels representing historical real risk states into the model training dataset for supervised training. Graph neural network algorithms update node representations through a multi-layer information propagation mechanism. Each node aggregates features from its neighbors and itself in the graph structure, and then undergoes a non-linear transformation of a trainable weight matrix to generate a new layer of feature representation. The trainable weight matrix is iteratively trained by minimizing the loss function between the predicted risk output by the model and the true risk label.
[0015] The preferred technical solution in this embodiment of the invention has the following advantages: it uses graph neural networks for supervised training, minimizes prediction errors by aggregating topological features and nonlinear transformations, and enhances the model's ability and reliability to identify network security risks.
[0016] As a preferred embodiment of the collaborative weighting enhancement evaluation method for digital power grid network security indicators described in this invention, the generation of network security situation enhancement evaluation results includes generating node weighted feature vectors and edge weighted feature vectors corresponding to the current moment by processing continuously input dynamic security indicator data through data processing, collaborative weighting, and training set construction. The node-weighted feature vector and edge-weighted feature vector corresponding to the current time step are used as the initial layer input of the trained augmentation evaluation model; Load the trainable weights that are fixed in the model and perform forward propagation computation. Through the topological aggregation and nonlinear transformation mechanism of the graph neural network algorithm, update the feature representation of the asset node layer by layer. By utilizing the feature representation of the last layer output of the enhanced assessment model, the corresponding predicted risk values of asset nodes in the dynamic graph network structure are calculated, and the predicted risk values are aggregated to form the enhanced cybersecurity posture assessment results.
[0017] The beneficial effects of the preferred technical solution in the embodiments of the present invention are as follows: by using a trained model to process real-time dynamic data, the risk value of the asset node is calculated and output through forward propagation, forming a comprehensive and dynamic network security situation assessment, and supporting real-time decision-making.
[0018] Another objective of this invention is to provide a collaborative weighting and enhancement evaluation system for digital power grid network security indicators.
[0019] To address the aforementioned technical problems, this invention provides the following technical solution: a collaborative weighting and enhancement evaluation system for digital power grid network security indicators, comprising: a data acquisition module for acquiring original asset topology data, original dynamic indicator data, and subjective expert weighting strategies of the digital power grid; The data processing module is used to process raw asset topology data, construct dynamic graph network structure, and clean and normalize raw dynamic indicator data to generate standardized indicator data. The collaborative weighting module is used to calculate objective dynamic weights based on standardized indicator data and integrate them with subjective expert weighting strategies to generate dynamic collaborative weights through the collaborative weighting model. The training set construction module is used to associate and load dynamic collaborative weights and standardized index data as node and edge features onto the dynamic graph network structure to build a model training dataset. The model training module is used to train nonlinear algorithms using the model training dataset and build an enhanced evaluation model. The enhanced assessment module is used to feed continuously input dynamic security indicator data into the trained enhanced assessment model to generate enhanced cybersecurity posture assessment results.
[0020] The present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, characterized in that the processor executes the computer program to implement the steps of the digital power grid network security indicator collaborative weighting enhancement evaluation method.
[0021] The present invention provides a computer-readable storage medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements the steps of the digital power grid network security indicator collaborative weighting enhancement evaluation method.
[0022] The beneficial effects of the present invention are as follows: The digital power grid network security index collaborative weighting enhancement evaluation system of the present invention achieves dynamic adaptive adjustment of the evaluation index weights by synergistically integrating the objective dynamic weights calculated by the entropy weight method with the expert subjective weight strategy. This overcomes the one-sidedness and lag caused by a single weighting method and significantly improves the accuracy and scientificity of the network security situation assessment results.
[0023] The digital power grid network security indicator collaborative weighting enhancement assessment system described in this invention uses graph neural network algorithms to deeply mine the nonlinear correlation between the digital power grid asset topology and dynamic security indicators. It can identify complex attacks and hidden risks that are difficult to detect by traditional assessment methods and depend on network topology propagation, thereby enhancing the assessment model's in-depth analysis and situation prediction capabilities.
[0024] The digital power grid network security indicator collaborative weighting enhancement evaluation system described in this invention loads dynamic collaborative weights as feature multipliers into the time snapshot of the graph, enabling model training and evaluation to automatically focus on high-importance indicators and key asset nodes, thereby achieving enhanced evaluation of the security situation and making the evaluation results more in line with the actual business security needs of the digital power grid. Attached Figure Description
[0025] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0026] Figure 1 The overall flowchart of the digital power grid network security index collaborative weighting enhancement evaluation method provided in one embodiment of the present invention is shown.
[0027] Figure 2 The system architecture diagram of the collaborative weighting enhancement evaluation method for digital power grid network security indicators provided in one embodiment of the present invention is shown.
[0028] Figure 3 The flowchart of data processing and dynamic graph construction for a collaborative weighting enhancement evaluation method for digital power grid network security indicators provided in an embodiment of the present invention.
[0029] Figure 4 A flowchart of the data processing module of the collaborative weighting enhancement evaluation method for digital power grid network security indicators provided in an embodiment of the present invention.
[0030] Figure 5 The flowchart shows the workflow of the collaborative weighting module of the digital power grid network security index collaborative weighting enhancement evaluation method provided in one embodiment of the present invention.
[0031] Figure 6 This is a flowchart of the training set construction module of the collaborative weighting enhancement evaluation method for digital power grid network security indicators provided in an embodiment of the present invention.
[0032] Figure 7 The flowchart shows the model training module of the collaborative weighting enhancement evaluation method for digital power grid network security indicators provided in one embodiment of the present invention.
[0033] Figure 8 The flowchart shows the enhanced evaluation module of the collaborative weighting and enhancement evaluation method for digital power grid network security indicators provided in one embodiment of the present invention. Detailed Implementation
[0034] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.
[0035] Example 1, referring to Figure 1 This is one embodiment of the present invention, which provides a method for collaboratively weighting and enhancing the evaluation of digital power grid network security indicators, including: S100: Collect the first, second, and third raw data of the digital power grid; construct a dynamic graph network structure using the first raw data; and clean and normalize the second raw data to generate standardized indicator data. S200: Calculate objective dynamic weights based on standardized indicator data and integrate them with the third original data. Generate dynamic collaborative weights through a collaborative weighting model. Use the dynamic collaborative weights and standardized indicator data as node and edge features, associate them and load them onto the dynamic graph network structure to build a model training dataset. S300. Train a nonlinear algorithm using the model training dataset to establish an enhanced assessment model. Feed the continuously input dynamic security indicator data into the trained enhanced assessment model to generate enhanced cybersecurity situation assessment results. It should be noted that existing digital grid network security assessment methods often rely on static and isolated indicator weights, which are difficult to reflect the security risks of the grid topology and the dynamic relationship between assets. At the same time, existing methods tend to favor subjective experience or objective data in determining weights, lacking effective coordination, which leads to deviations between assessment results and the actual situation, and cannot adapt to the dynamic business scenarios of digital grids.
[0036] Therefore, in response to the aforementioned problems, through steps S100-S300, this invention integrates asset topology and dynamic indicators by constructing a dynamic graph network structure, and innovatively adopts a collaborative weighting model to integrate subjective and objective weights. Finally, it uses a nonlinear algorithm, graph neural network, for training and evaluation, thereby achieving a more accurate, adaptive, and enhanced assessment of the network security situation of the digital power grid that can reflect the risk transmission between assets.
[0037] Example 2, refer to Figure 1 This is one embodiment of the present invention, which provides a method for collaboratively weighting and enhancing the evaluation of digital power grid network security indicators, including: In this embodiment of the invention, step S100 involves collecting first, second, and third raw data of a digital power grid, constructing a dynamic graph network structure using the first raw data, and cleaning and normalizing the second raw data to generate standardized index data. This includes the following steps S101-S102: S101. Collect the first raw data as raw asset topology data, collect the second raw data as raw dynamic indicator data, and collect the third raw data as subjective expert weight strategy. Collect raw asset topology data, which includes equipment information, deployment location and connection relationship of power master station system, wide area communication network equipment, substation automation equipment and secondary safety protection equipment; Collect raw dynamic indicator data, which includes vulnerability indicators, threat indicators, and protection indicators; The subjective expert weighting strategy is collected. The subjective expert weighting strategy is an initial subjective weight that represents the importance of expert experience and business, obtained through the analytic hierarchy process or the Delphi method.
[0038] Specifically, in a digital power grid environment, data acquisition is performed through safety devices and management systems deployed at various levels of nodes, such as control master stations, substations, and distribution stations. First, the original asset topology data is collected. This process collects information on all network security-related equipment within the power grid, including power station systems, wide area communication network equipment, substation automation equipment, and secondary security protection equipment such as firewalls and intrusion detection systems. The specific data collected includes the device's unique identifier, model, operating system, deployment location, network address, service affiliation, and connectivity. Technically, it mainly relies on network topology discovery protocols, asset management systems (CMDB), and network configuration management tools, using protocols such as SNMP and NetFlow to periodically scan and obtain the link status and port openness between devices. The output of this process is the raw asset topology data, which can be represented as an unweighted directed graph. ,in Represents all network asset nodes. Represents the physical or logical connection between assets.
[0039] Simultaneously, raw dynamic indicator data is collected. This process gathers dynamic indicator data reflecting changes in network security status over time. These indicators are multi-dimensional, including vulnerability indicators, threat indicators, and protection indicators. Vulnerability indicators, such as the number of high-risk vulnerabilities in the latest vulnerability scan report. Patch installation delay days ; Threat indicators such as the number of Intrusion Detection System (IDP) alerts Number of viral infection events Abnormal network traffic ; Protection metrics such as security policy compliance rate Backup and recovery time ; This data comes from multiple security sources, such as SIEM security information and event management systems, vulnerability scanning platforms, and host log systems, and is continuously aggregated in time-series format; the output of this process is multi-dimensional raw dynamic indicator data; for any asset node At any given moment The set of indicators is represented as .
[0040] In addition, a subjective expert weighting strategy was implemented, which collected assessments of the importance of indicators and assets by security experts and grid business personnel based on experience, compliance requirements and business importance. This strategy is reflected in the initial subjective weights assigned to each indicator by experts. And the baseline risk levels of each key business asset; Technically, qualitative assessments can be transformed into quantitative subjective expert weighting strategies using methods such as the Analytic Hierarchy Process (AHP), the Delphi method, or expert questionnaires. For example, during power supply security periods for major events, the subjective weight of the core business system availability indicator must be increased. times; The output of this process is the subjective weight vector of the indicator. ,in This is the total number of security indicators, and this vector serves as the initial subjective input for the subsequent collaborative weighting module.
[0041] By combining the asset management system, network protocol scanning, SIEM platform, and expert knowledge base, the static topology structure was simultaneously obtained. Dynamic behavioral indicators and subjective strategies that imply business context This three-in-one data acquisition method ensures that subsequent evaluations are based on a complete and three-dimensional data view, avoiding the one-sidedness caused by relying solely on topology or alarms.
[0042] S102. Process the original asset topology data, construct a dynamic graph network structure, and clean and normalize the original dynamic indicator data to generate standardized indicator data.
[0043] Further steps include: processing the original asset topology data, constructing a dynamic graph network structure, and cleaning and normalizing the original dynamic indicator data to generate standardized indicator data. Specifically, this involves the following steps: The asset list in the original asset topology data is parsed and deduplicated, and the asset identifier is uniformly mapped to a unique asset node. Verify the connectivity and network configuration between assets, identify communication links with security significance, and construct a dynamic graph network structure based on asset nodes and communication links; Perform data cleaning on the raw dynamic indicator data, including filling in missing values and smoothing outliers; The cleaned data is normalized using a data standardization algorithm to generate standardized indicator data.
[0044] Specifically, the collected raw data is transformed into structured and standardized data that can be used for modeling, involving two parallel processing streams: In an embodiment of the present invention, parsing and deduplicating the asset list in the first original data includes the following steps A1-A3: A1. The first processing stream targets the original asset topology data, i.e. It is collected from asset management systems, network scanning tools, and configuration files; A2, Yes The asset list is parsed and deduplicated, mapping different identifiers such as IP address, MAC address or device serial number to a unique asset node. For example, "IP10.10.1.5" and "RTU-A1-Z01" are resolved and confirmed to be the same power automation terminal node; A3. Processing The system verifies network configurations and firewall policies to determine the actual, secure communication links between nodes. This process transforms the original, potentially redundant or inconsistent, asset and connectivity lists into a clear, dynamic graph network structure representing the network security relationships of the digital power grid. ,in, It forms the foundational topology framework for subsequent loading of metric data and graph network analysis.
[0045] In an optional implementation, the parsing and deduplication in S102 can be based on rule matching. Matching rules for asset identifiers are predefined, including IP address ranges, MAC address formats, device naming conventions, etc., forming a rule base. For each identifier in the original asset list, the rule base is applied for parsing. Asset identifiers are compared through rule matching; if multiple identifiers point to the same device under the same rule, they are merged into a unique node, and all associated identifiers are recorded. Based on the parsed unique node, connection relationships are verified, and a dynamic graph network structure is directly constructed, where nodes represent unified assets and edges represent secure communication links. However, rule matching cannot cover all identifier variants, resulting in incomplete parsing.
[0046] In another optional implementation, the parsing and deduplication in S102 can also be based on the parsing and deduplication of a hash function. A hash function is applied to the standardized identifier to generate a unique hash value, which serves as a temporary identifier for the node. The hash values are compared, and if the hash values of two asset identifiers are the same, they are considered to be the same node, and their attributes and connections are merged. Based on the nodes with unique hash values, a dynamic graph network structure is constructed by combining the original connection data. However, due to insufficient standardization or hash collisions, different nodes may be incorrectly merged.
[0047] The second processing stream targets the raw dynamic indicator data, namely It is a raw measurement value that contains multiple types and dimensions; In an embodiment of the present invention, the processing first involves data cleaning, including the following steps B1-B2: B1. For missing values, such as the failure to acquire data from a certain server in a certain data collection period. The patch lag time in days is filled with the value from the previous moment; B2. For outliers, such as The number of alarms suddenly increases to a maximum value due to equipment failure, and a threshold based on statistical quantiles is used for smoothing. In an optional implementation, data cleaning in S102 can be based on historical pattern matching: missing value filling. For the indicator data of each asset node, if the data at a certain point in time is missing, it is filled by matching historical similar patterns. The historical data patterns of the node in the same business cycle or the same time period are analyzed, the most similar historical time period is identified, and the indicator values of the corresponding time point are extracted from the similar time period and used directly to fill the missing values. Outlier smoothing is performed by using a local outlier detection method for the indicator data of each asset node. The local density of each data point within the time window is calculated and compared with neighboring points. If a data point is identified as an outlier, it is replaced with the median of the normal data points within the time window.
[0048] In another optional implementation, data cleaning in S102 can also include missing value filling: for the indicator data of each asset node, if the data is missing at a certain point in time, it is filled according to predefined business rules. For critical equipment, the missing value is filled with the indicator value of the equipment in the most recent normal inspection; for non-critical equipment, the missing value is filled with the global default value.
[0049] Outlier smoothing: For the indicator data of each asset node, a detection method based on business rule thresholds is used for smoothing. A reasonable range for each indicator is set according to expert experience or compliance requirements. If a data point exceeds the threshold, it is adjusted according to the rules.
[0050] In an embodiment of the present invention, the normalization of the cleaned data includes the following steps C1-C2: C1. To eliminate dimensional differences between different indicators, for indicators with a defined range of values, maximum-minimum normalization is used. For example, for... Security policy compliance rate, its normalized value The calculation formula is: in, This is the original value of the indicator. and These are its theoretical minimum value of 0 and maximum value of 100, respectively. C2. For indicators without a clear upper bound and prone to extreme values, Z-Score standardization is used. Abnormal traffic, its standardized value The calculation formula is: in This is the raw flow value of the indicator. This is the historical average of this traffic indicator. It is its historical standard deviation; the output of this processing stream is standardized index data. It is a dataset where all metrics are mapped to a uniform scale, which can be directly used for objective weight calculation in the collaborative weighting module and for evaluating model training in the model training module.
[0051] In an optional implementation, normalization in S102 can be decimal scaling. For each security indicator, the maximum absolute value of all sample values is calculated, and a scaling factor is determined based on this maximum value (i.e., 10 to the power of k, where k is the smallest integer that makes all values fall within the range [-1,1] after being divided by the scaling factor). The original value of each indicator is divided by the scaling factor to obtain the normalized value, so that all data are uniformly scaled to the range of [-1,1] or [0,1]. This is suitable for scenarios where the range of indicator values is roughly known and the distribution is relatively uniform.
[0052] In another optional implementation, the normalization in S102 can also be robustly standardized. For each security indicator, the median and interquartile range are calculated, the original value of each indicator is subtracted from the median, and then divided by the IQR to obtain the normalized value, so that the data is scaled based on statistical robustness; this is suitable for scenarios where the indicator data may have outliers or be non-normally distributed.
[0053] Topology structuring and index standardization are achieved through two parallel processing streams, respectively. Topology structuring ( This transforms a chaotic asset list into a graph structure recognizable by graph algorithms, enabling them to analyze topological relationships; metric standardization ( By using a normalization formula, the differences in measurement units between different indicators are eliminated. For example, the "times" of alarms and the "percentage" of compliance rate are unified to the same scale. This approach prevents metrics with large numerical ranges (such as abnormal traffic) from excessively dominating metrics with small numerical ranges (such as the number of vulnerabilities) in the model, thereby ensuring the stability and fairness of model training.
[0054] In this embodiment of the invention, in step S200, objective dynamic weights are calculated based on standardized indicator data and fused with third-party original data. Dynamic collaborative weights are generated through a collaborative weighting model. The dynamic collaborative weights and standardized indicator data are used as node and edge features, associated with and loaded onto a dynamic graph network structure to construct a model training dataset. This includes the following steps S201-S202: S201. Calculate objective dynamic weights based on standardized indicator data, and integrate them with subjective expert weight strategies to generate dynamic collaborative weights through a collaborative weighting model.
[0055] Furthermore, objective dynamic weights are calculated based on standardized indicator data and integrated with subjective expert weighting strategies to generate dynamic collaborative weights through a collaborative weighting model. This process includes the following steps: The entropy weight method is used to process standardized indicator data. By calculating the proportion, information entropy and information entropy redundancy of each indicator, the information content of the indicator is quantified, thereby calculating the objective dynamic weight. A linear combination model is adopted to weight and fuse objective dynamic weights with subjective expert weighting strategies; A collaborative fusion coefficient is set to adjust the relative importance of objective dynamic weights and subjective expert weights, and this coefficient is dynamically adjusted according to the preset business scenarios of the digital power grid, ultimately generating dynamic collaborative weights.
[0056] Specifically, the objective weights of the standardized indicator data output by the data processing module are calculated and then integrated with the subjective expert weighting strategy obtained by the data acquisition module. First, the objective dynamic weights are calculated. The entropy weighting method is used to calculate the standardized index data matrix. Process it; The matrix Include Digital grid asset nodes and Each security indicator, element in the matrix Representing the The first asset The standardized values of each indicator, among which From 1 to , From 1 to , Standardization of a certain RTU node in the corresponding data processing module Number of alarms; Calculate the first The first indicator The proportion of individual asset value : Based on specific gravity Calculate the first Information entropy of each indicator : in the formula Adjustment coefficient , This represents the total number of assets participating in the assessment within the digital power grid. Calculate the... Information entropy redundancy of each indicator : Through redundancy Calculation yields the first Objective dynamic weights of each indicator : all The vector formed This refers to the objective dynamic weight, which varies with the standardized indicator data. It changes dynamically with updates; In an embodiment of the present invention, performing weighted fusion with collaborative weighting includes the following steps D1-D2: D1, This collaborative weighting model will calculate the... Subjective expert weighting strategy Combined; D2. Use a linear combination model to generate the final dynamic collaborative weights. : in the formula It is the experts for the first The subjective weighting of each indicator; These are calculated objective dynamic weights; It is the synergy fusion coefficient, which takes a value between 0 and 1, and is used to adjust the relative importance of subjective and objective weights; The value is dynamically adjusted according to the preset business scenarios of the digital power grid, for example, in daily operation scenarios. The value is set to 0.5, but will be increased in critical power supply scenarios. Up to 0.7 to focus on expert strategies.
[0057] In an optional implementation, the weighted fusion in S201 can be multiplicative normalized fusion. For each indicator, the subjective weight is multiplied by the objective weight to obtain the unnormalized fusion weight value. The unnormalized fusion weights of all indicators are normalized so that their sum is 1, generating dynamic collaborative weights. According to the preset business scenario of the digital power grid, the relative importance of the subjective and objective weights is indirectly adjusted by adjusting the scaling factor in the normalization process.
[0058] In another optional implementation, the weighted fusion in S201 can also be threshold-switched fusion. The threshold is set according to the preset business scenario of the digital power grid. For example, when the change of objective weight exceeds the threshold, objective dynamic weight is used first; otherwise, subjective expert weight is used as the main weight. Through switching logic, under different conditions, subjective weight or objective weight is selected as the main weight for linear combination to generate dynamic collaborative weight. The threshold is dynamically adjusted according to the business scenario to balance the influence of subjective and objective weights.
[0059] The final output is the complete dynamic collaborative weight vector. This vector is passed to the training set building module to build the model training set.
[0060] It integrates the objectivity of data-driven approaches with the subjectivity of expert-driven approaches: on the one hand, it utilizes the entropy weight method ( The indicators were objectively measured. The amount of information at the current moment—indicators with more volatile data (such as...) A sudden increase in alarms receives higher objective weighting; on the other hand, it introduces expert strategies (…). To ensure the assessment aligns with the business importance of the power grid; Through the synergy fusion coefficient A linear combination of the two results in the final dynamic collaborative weight. It can sensitively reflect real-time data changes without deviating from the established security strategy, significantly improving the rationality of weight allocation.
[0061] S202. For each asset node in the dynamic graph network structure, extract its relevant standardized indicator data to form a node indicator vector. The node weighted feature vector is generated by performing element-wise multiplication between the node indicator vector and its corresponding dynamic collaborative weight vector. For each communication link in the dynamic graph network structure, extract its relevant standardized index data, and generate the edge-weighted feature vector of the link by multiplying it with the dynamic collaborative weight. The node weighted feature vector and edge weighted feature vector are used as attribute features of nodes and links at a specific time, respectively, and loaded onto the dynamic graph network structure. A graph loaded with node and edge features is defined as a time snapshot, where the model training dataset consists of time snapshots combined in time series.
[0062] Specifically, the various data streams generated during data processing and collaborative weighting are merged to construct a structured dataset for training the model training module: The dynamic graph network structure built in the data processing module. This structure defines the asset nodes in the digital power grid. and communication links The topological relationships are determined, and standardized indicator data output by the data processing module is obtained simultaneously. Dynamic collaborative weights output by the collaborative weighting module ; Construction and loading of feature vectors: for standardized index data Each type of indicator From dynamic collaborative weights Extract its corresponding weight value For the graph Each asset node in ,from Extract all standardized indicator data related to this node to form a node indicator vector. This vector Dimension, includes At this time node of Number of alarms Indicators such as the number of high-risk vulnerabilities are vectorized. Its corresponding weight vector Perform element-wise multiplication to generate the weighted feature vector of that node. : The calculated Load as image Middle node exist Similarly, for graphs, the attributes of time are also considered. Each communication link in ,from Extract all standardized metric data related to this link. ,For example Abnormal traffic indicators; By comparing it with the corresponding weights Multiply to generate a weighted feature vector for the link. and load it as an edge exist The attributes and characteristics of time; Will contain all node features Sum of edge features The picture As a snapshot in time, a series of graph snapshots are collected by repeating this process on historical data. The snapshot sequence in this figure is the final output model training dataset.
[0063] Graph-oriented feature engineering was performed, but the indicator data was not included. Instead of treating it as an isolated table, dynamic collaborative weights are used. and Multiply to generate a weighted feature vector. And load the vector into the dynamic graph network structure. corresponding node superior; This process deeply binds abstract indicator data with concrete power grid topology, forming a sequence of graph snapshots. This enables the model training module (S5) to learn not only the changes in metrics of individual assets, but also how risk is transmitted. edge In assets It spreads between them.
[0064] In an embodiment of the present invention, step S300 involves training a nonlinear algorithm using a model training dataset to establish an enhanced evaluation model. Continuously input dynamic security indicator data is then fed into the trained enhanced evaluation model to generate enhanced cybersecurity posture evaluation results. This includes the following steps S301-S302: S301. A graph neural network algorithm is used as a nonlinear algorithm, and risk labels representing historical real risk states are introduced into the model training dataset for supervised training. Graph neural network algorithms update node representations through a multi-layer information propagation mechanism, where each node aggregates the features of its neighboring nodes and itself in the graph structure, and generates a new layer of feature representations through a non-linear transformation of a trainable weight matrix. The trainable weight matrix is iteratively trained by minimizing the loss function between the predicted risk output by the model and the true risk label.
[0065] Specifically, a non-linear algorithm is trained using the model training dataset output by the training set building module, thereby constructing an enhanced evaluation model: Obtain the training dataset for the constructed model, which is represented as a series of graph snapshots. Each image snapshot All contain loaded node-weighted feature vectors. Weighted eigenvectors of edges Dynamic graph network structure; To perform supervised training, risk labels need to be introduced into this dataset. This label represents digital grid assets. exist The historical true risk status at any given time can be obtained from a historical security event database or expert review. A graph neural network algorithm is used as the nonlinear algorithm for this module. This algorithm is selected to process graph structure data and capture the nonlinear propagation characteristics of risk in the digital power grid topology. The training process uses a Graph Convolutional Network (GCN) as an example. During training iterations, the model input is... Snapshot of a moment It contains a node feature matrix and graph structure Derived adjacency matrix , Each line It includes the weighted average of the asset node. The number of vulnerabilities and Indicators such as alarm count are used in graph neural networks to update node representations through multi-layer information propagation. Layer Node Feature Matrix Calculated using the following propagation rules: in the formula It is the first The node feature matrix of the layer, and Equal to the input feature matrix ; It is an adjacency matrix with self-loops added. It is an identity matrix, ensuring that the node's aggregated information includes its own characteristics; yes The angle matrix, It is the first The trainable weight matrix of the layer, It is a non-linear activation function; This formula expresses the concept of each asset node in a digital power grid. New features It is achieved by aggregating its components in a dynamic graph network structure. Features of all neighboring nodes and its own previous layer Then through trainable weights Obtained by performing a nonlinear transformation; The model minimizes the predictive risk of its output. Compared with the true risk label The model is trained using a loss function between different loss functions, such as cross-entropy loss. The final output of the training process is an enhanced evaluation model. This model is a converged graph neural network, which internally embeds all trainable weights. The model has learned the complex nonlinear relationships between standardized indicator data, dynamic collaborative weights, and dynamic graph network structure, which can be used to enhance the evaluation of new data in the evaluation module.
[0066] By leveraging the topological aggregation mechanism of graph neural networks, as shown in the GCN formula, the model no longer views each asset in isolation. Instead, in each layer ( They all force it to aggregate its adjacency matrix. The defined characteristics of neighboring nodes ( ); By stacking multiple layers, the model can perceive the breadth and depth of risk propagation across the topology. For example, it can learn "a self-indicator". Normal assets, if linked to three high-risk... The real risks of neighbors The model will also improve; By minimizing the loss function, the trainable weights of the model... These complex topological dependencies were solidified, ultimately leading to the establishment of an enhanced evaluation model.
[0067] S302. The continuously input dynamic security indicator data is processed through the preprocessing and feature engineering pipeline of the data processing module, collaborative weighting module and training set construction module to generate node weighted feature vectors and edge weighted feature vectors corresponding to the current time. The node-weighted feature vector and edge-weighted feature vector corresponding to the current time step are used as the initial layer input of the trained augmentation evaluation model; Load the trainable weights that are fixed in the model and perform forward propagation computation. Through the topological aggregation and nonlinear transformation mechanism of the graph neural network algorithm, update the feature representation of the asset node layer by layer. By utilizing the feature representation of the last layer output of the enhanced assessment model, the corresponding predicted risk values of asset nodes in the dynamic graph network structure are calculated, and the predicted risk values are aggregated to form the enhanced cybersecurity posture assessment results.
[0068] Specifically, the system receives continuously input dynamic security indicator data, which is the latest observation of the original dynamic indicator data: The dynamic security index data is fed into a complete preprocessing and feature engineering pipeline defined in the data processing module, collaborative weighting module, and training set construction module. This pipeline performs standardization, objective weight calculation and collaborative weighting fusion, and feature vector construction. The output of this process is integrated with the dynamic graph network structure. nodes The corresponding new weighted feature matrix ; The matrix Each row contains the latest, collaboratively weighted data for that node. Alarm indicators and Data such as vulnerability metrics; The feature matrix As initial layer input The augmented evaluation model, which has already been trained in the model training module, is fed into the model, and the model is loaded with fixed trainable weights. And perform forward propagation computation: in the formula It is the first The node feature matrix of the layer It is the first time that the model is solidified during training. Layer weight matrix, It is an adjacency matrix containing self-loops. yes The angle matrix, both are derived from dynamic graph network structures. Export; It is a non-linear activation function; This calculation is from Start iterating layer by layer until the last layer. The model's final output layer is based on the features of the last layer. Calculations are made for each asset node in the digital power grid Predicted risk value ; Generate predicted risk values from all asset nodes. The set The set The results of the enhanced cybersecurity posture assessment dynamically reflect the latest risk status of all nodes across the network.
[0069] By leveraging the inference capabilities of the trained model, continuously input dynamic security indicator data is preprocessed into a new feature matrix. After that, the model no longer needs to be retrained; instead, the weights fixed in S5 are directly loaded. Perform forward propagation; This process essentially involves learning complex propagation patterns from historical data (which are then solidified in...). (In China) Applying it to new data in real time; Therefore, the output evaluation results It is no longer a simple weighted sum of indicators, but a predictive risk that takes into account the impact on the entire network topology, thus achieving enhanced assessment and dynamically reflecting the latest network security situation.
[0070] Example 3, referring to Figures 2-8 This is an embodiment of the present invention, and the above is an illustrative scheme of the collaborative weighting enhancement evaluation method for digital power grid network security indicators. It should be noted that the technical solution of the collaborative weighting enhancement evaluation system for digital power grid network security indicators and the technical solution of the aforementioned collaborative weighting enhancement evaluation method for digital power grid network security indicators belong to the same concept. Details not described in detail in the technical solution of the collaborative weighting enhancement evaluation system for digital power grid network security indicators in this embodiment can be found in the description of the technical solution of the aforementioned collaborative weighting enhancement evaluation method for digital power grid network security indicators.
[0071] This embodiment provides a collaborative weighting enhancement evaluation system for digital power grid network security indicators, including: a data acquisition module, used to collect the original asset topology data, original dynamic indicator data, and subjective expert weighting strategy of the digital power grid; The data processing module is used to process raw asset topology data, construct dynamic graph network structure, and clean and normalize raw dynamic indicator data to generate standardized indicator data. The collaborative weighting module is used to calculate objective dynamic weights based on standardized indicator data and integrate them with subjective expert weighting strategies to generate dynamic collaborative weights through the collaborative weighting model. The training set construction module is used to associate and load dynamic collaborative weights and standardized index data as node and edge features onto the dynamic graph network structure to build a model training dataset. The model training module is used to train nonlinear algorithms using the model training dataset and build an enhanced evaluation model. The enhanced assessment module is used to feed continuously input dynamic security indicator data into the trained enhanced assessment model to generate enhanced cybersecurity posture assessment results.
[0072] This embodiment also provides an electronic device applicable to the collaborative weighting and enhancement evaluation method for digital power grid network security indicators, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the collaborative weighting and enhancement evaluation method for digital power grid network security indicators as proposed in the above embodiment.
[0073] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements the collaborative weighting enhancement evaluation method for digital power grid network security indicators as proposed in the above embodiments.
[0074] The storage medium proposed in this embodiment and the method for collaboratively empowering and enhancing the evaluation of digital power grid network security indicators proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.
[0075] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.
[0076] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.
Claims
1. A collaborative weighting and enhancement evaluation method for digital power grid network security indicators, characterized by: include, Collect the first, second, and third raw data of the digital power grid, use the first raw data to construct a dynamic graph network structure, and clean and normalize the second raw data to generate standardized indicator data. Objective dynamic weights are calculated based on standardized indicator data and fused with third-party original data. Dynamic collaborative weights are generated through a collaborative weighting model. The dynamic collaborative weights and standardized indicator data are used as node and edge features, associated and loaded onto a dynamic graph network structure to construct a model training dataset. A nonlinear algorithm is trained using a model training dataset to establish an enhanced assessment model. Continuously input dynamic security indicator data is fed into the trained enhanced assessment model to generate enhanced cybersecurity posture assessment results.
2. The digital power grid network security indicator collaborative weighting enhancement evaluation method as described in claim 1, characterized in that: The first, second, and third raw data of the digital power grid to be collected include raw asset topology data. The second set of raw data collected is the raw dynamic indicator data; The third source data was collected using a subjective expert weighting strategy.
3. The method for collaborative weighting and enhancing the evaluation of digital power grid network security indicators as described in claim 2, characterized in that: The process of generating standardized indicator data includes parsing and deduplicating the asset list in the first raw data, and uniformly mapping the asset identifier to a unique asset node. Verify the connectivity and network configuration between assets, identify communication links, and construct a dynamic graph network structure based on asset nodes and communication links; Data cleaning is performed on the second set of raw data. The cleaned data is then normalized using a data standardization algorithm to generate standardized indicator data.
4. The digital power grid network security indicator collaborative weighting enhancement evaluation method as described in claim 3, characterized in that: The generation of dynamic collaborative weights includes processing standardized indicator data using the entropy weight method, quantifying the information content of the indicators, and calculating objective dynamic weights. A linear combination model is adopted to weight and fuse objective dynamic weights with third-party original data; A collaborative fusion coefficient is set to adjust the relative importance of the objective dynamic weight and the third original data, and dynamically adjusted according to the preset business scenario of the digital power grid to generate the dynamic collaborative weight.
5. The digital power grid network security indicator collaborative weighting enhancement evaluation method as described in claim 4, characterized in that: The construction of the model training dataset includes extracting the corresponding standardized indicator data for each asset node in the dynamic graph network structure to form a node indicator vector. By performing element-wise multiplication between the node indicator vector and the corresponding dynamic collaborative weight vector, the node weighted feature vector of the current node is generated. For each communication link in the dynamic graph network structure, the corresponding standardized index data is extracted and multiplied with the dynamic collaborative weight to generate the edge weighted feature vector of the current link. The node weighted feature vector and edge weighted feature vector are used as attribute features of nodes and links at a specific time, respectively, and loaded onto the dynamic graph network structure. The graph with loaded node and edge features is defined as a time snapshot, where the model training dataset consists of time snapshots combined in a time series.
6. The collaborative weighting and enhancement evaluation method for digital power grid network security indicators as described in claim 5, characterized in that: The establishment of the enhanced assessment model includes using a graph neural network algorithm as a nonlinear algorithm and introducing risk labels representing historical real risk states into the model training dataset for supervised training. Graph neural network algorithms update node representations through a multi-layer information propagation mechanism. Each node aggregates features from its neighbors and itself in the graph structure, and then undergoes a non-linear transformation of a trainable weight matrix to generate a new layer of feature representation. The trainable weight matrix is iteratively trained by minimizing the loss function between the predicted risk output by the model and the true risk label.
7. The collaborative weighting and enhancement evaluation method for digital power grid network security indicators as described in claim 6, characterized in that: The generation of enhanced network security posture assessment results includes generating node weighted feature vectors and edge weighted feature vectors corresponding to the current moment by processing continuously input dynamic security indicator data through data processing, collaborative weighting, and training set construction. The node-weighted feature vector and edge-weighted feature vector corresponding to the current time step are used as the initial layer input of the trained augmentation evaluation model; Load the trainable weights that are fixed in the model and perform forward propagation computation. Through the topological aggregation and nonlinear transformation mechanism of the graph neural network algorithm, update the feature representation of the asset node layer by layer. By utilizing the feature representation of the last layer output of the enhanced assessment model, the corresponding predicted risk values of asset nodes in the dynamic graph network structure are calculated, and the predicted risk values are aggregated to form the enhanced cybersecurity posture assessment results.
8. A digital power grid network security indicator collaborative weighting enhancement evaluation system, employing the digital power grid network security indicator collaborative weighting enhancement evaluation method as described in any one of claims 1 to 7, characterized in that, include: The data acquisition module is used to collect raw asset topology data, raw dynamic indicator data, and subjective expert weighting strategies of the digital power grid. The data processing module is used to process raw asset topology data, construct dynamic graph network structure, and clean and normalize raw dynamic indicator data to generate standardized indicator data. The collaborative weighting module is used to calculate objective dynamic weights based on standardized indicator data and integrate them with subjective expert weighting strategies to generate dynamic collaborative weights through the collaborative weighting model. The training set construction module is used to associate and load dynamic collaborative weights and standardized index data as node and edge features onto the dynamic graph network structure to build a model training dataset. The model training module is used to train nonlinear algorithms using the model training dataset and build an enhanced evaluation model. The enhanced assessment module is used to feed continuously input dynamic security indicator data into the trained enhanced assessment model to generate enhanced cybersecurity posture assessment results.
9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the collaborative weighting enhancement evaluation method for digital power grid network security indicators as described in any one of claims 1 to 7.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the collaborative weighting enhancement evaluation method for digital power grid network security indicators as described in any one of claims 1 to 7.