Electric power information security protection method and system based on big data

Abstract

The invention provides an electric power information security protection method and system based on big data, and relates to the technical field of electric power information security. According to the method, the static knowledge graph is constructed and the time sequence diagram neural network is combined to capture the node time dimension risk change trend, so that the accurate identification and effective prediction of the potential risk of the electric power information system are realized; a dynamic risk baseline is constructed, and an early warning threshold value is adjusted in real time according to node risk changes, so that risk assessment closely fits the actual operation condition of the system, and the accuracy and reliability are improved; a multi-granularity time window mechanism is adopted to carry out weighted fusion on risk scores in different time periods, short-term and long-term risk factors are comprehensively considered, comprehensive risk value calculation is more scientific, and then the current risk level is accurately judged; finally, differential data protection encryption is implemented based on the risk level, security resources are reasonably allocated, resource waste is avoided while data security is guaranteed, and the efficiency of power information data protection and the resource utilization rate are comprehensively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power information security, and in particular to a power information security protection method and system based on big data. BACKGROUND

[0002] Traditional power information security protection methods often focus on the detection and prevention of known security threats, lacking the ability to actively identify and predict potential risks. Existing risk assessment methods are mostly based on static indicators and thresholds, making it difficult to accurately reflect the risk changes of power information systems during dynamic operation. For example, in the power system, there are complex logical associations between device operating states, power grid topology, and power transaction data. However, traditional methods often fail to deeply mine these associated information, thus failing to timely discover potential security risks.

[0003] The operating conditions of the power system will change over time, environment, and other factors, so the risk assessment also needs to have the ability to dynamically adjust. However, the existing risk assessment system usually uses fixed risk warning thresholds and cannot be adjusted in real time according to the actual operation of the system. This results in the original risk assessment results being inaccurate when the system operating state changes, and the current risk level cannot be timely reflected, thereby affecting the formulation and implementation of protection strategies.

[0004] Currently, the risk level determination of power information systems mainly relies on risk indicator values at a single time point, lacking comprehensive consideration of risk factors in different time periods. This determination method is easily affected by short-term fluctuations, resulting in inaccurate risk level determination results.

[0005] Therefore, it is necessary to provide a power information security protection method and system based on big data to solve the above technical problems. SUMMARY

[0006] To solve the above technical problems, the present application provides a power information security protection method and system based on big data to solve the problems of insufficient risk identification and prediction ability, inaccurate risk level determination, and inaccurate risk level determination in existing power information protection technology.

[0007] The power information security protection method based on big data provided by the present application includes the following steps: S1, obtaining power information big data to analyze the logical associations between various types of power information, and constructing a static knowledge graph according to the results of the logical associations; S2, updating the static knowledge graph and identifying the nodes therein, using a time series graph neural network method to capture the risk change trend of the nodes in the time dimension, and obtaining the risk change trend of the nodes; S3, collect historical power information big data and actual operation status of the current power grid, and construct a dynamic risk baseline for reflecting the risk level, wherein the dynamic risk baseline includes a plurality of risk warning thresholds; S4, according to the obtained node risk change trend, real-time adjust each risk warning threshold in the dynamic risk baseline, and obtain the current dynamic risk baseline; S5, adopt a multi-granularity time window mechanism, weight and fuse the risk scores in different time periods to obtain a comprehensive risk value, and compare the comprehensive risk value with the current dynamic risk baseline to determine the current risk level; S6, based on the determined current risk level, according to the pre-established mapping relationship between risk level and protection strategy, the data protection encryption corresponding to the current risk level is carried out.

[0008] Preferably, the specific steps of step S1 include: S101, collect power information big data from the data source of the power system, and pre-process and entity recognition, wherein the power information big data includes operation parameters, power grid topology structure, power transaction data information; the identified entity includes power generation equipment, transformer substation, power transmission line or user; S102, use the association rule mining method to analyze the frequent patterns and association rules between different types of power information to obtain a logical association result; S103, use the identified entity as a node and the logical association result as an edge to construct a static knowledge graph.

[0009] Preferably, the specific steps of step S2 include: S201, collect new data by setting a fixed time window, identify newly added nodes and deleted nodes, and apply the modifications to the original static knowledge graph to update the static knowledge graph; S202, from the updated static knowledge graph, identify each node, and for each identified node, collect its time series data sequence at different time points.

[0010] S203, use a time series graph neural network method to analyze the time series data sequence of each node, predict or represent the abnormal probability of each node in the future time window, and form a node risk change trend.

[0011] Preferably, the specific steps of step S3 include: S301, collect historical power information big data in a preset time period, including equipment operation data, power grid operation parameters, and fault records; S302, establish a plurality of hierarchical multi-dimensional risk indicators covering the device layer, network layer, application layer and data layer; S303, cluster analysis or probability distribution fitting is performed on the historical power information big data, a risk state interval of normal, early warning and high risk is statistically recognized, and a statistical recognition result is obtained; S304, a plurality of hierarchical risk early warning thresholds are set according to the statistical recognition result, and the risk early warning thresholds are bound to the corresponding hierarchical multi-dimensional risk indicators to form a dynamic risk baseline.

[0012] Preferably, the specific steps of step S4 include: S401, according to the node risk change trend, a corresponding risk early warning threshold adjustment strategy is formulated, including: the node whose risk change trend shows an upward trend, the corresponding risk early warning threshold is lowered; the node whose risk change trend shows a downward trend, the corresponding risk early warning threshold is raised, wherein the risk early warning threshold includes a normal threshold upper limit, a warning threshold interval and a high-risk threshold lower limit; S402, according to the formulated risk early warning threshold adjustment strategy, each risk early warning threshold in the dynamic risk baseline is adjusted in real time to obtain a current dynamic risk baseline.

[0013] Preferably, the specific steps of step S5 include: S501, a multi-granularity time window mechanism is used to divide time into time windows of different granularity time periods, including hour-level, day-level and week-level time periods, and corresponding weights are set for each time period time window; S502, a specific value of predicting or representing the abnormal probability of each node in the future time window is taken as the risk score of the node in the corresponding time window to obtain the local risk score of each time period time window; S503, the local risk scores of each time period time window are weighted and summed according to the corresponding weights to calculate the comprehensive risk value of each node, and the comprehensive risk value is compared with the current dynamic risk baseline to obtain a comparison result; S504, the current risk level is determined according to the comparison result, specifically including: if the comprehensive risk value in the comparison result is ≤ the normal threshold upper limit, the low risk level is determined; if the normal threshold upper limit < the comprehensive risk value ≤ the high-risk threshold lower limit, the medium risk level is determined; if the comprehensive risk value > the high-risk threshold lower limit, the high risk level is determined.

[0014] Preferably, the specific steps of step S6 include: S601, a mapping relationship between the risk level and the protection strategy is established, including: the low risk level is encrypted by using a symmetric encryption algorithm; the medium risk level generates a new key each time by using a temporary key based on time or session; the high risk level uses independent encryption partition and prohibits cross-zone access; S602, based on the current risk level, according to the mapping relationship between the risk level and the protection strategy, the corresponding data protection encryption strategy is called to implement differential encryption data protection.

[0015] The power information security protection system based on big data comprises: The correlation analysis module is used for acquiring power information big data to analyze logical correlations between various power information, and constructing a static knowledge graph according to a result of the logical correlations. The data analysis module is used for updating the static knowledge graph and identifying nodes in the static knowledge graph, capturing a risk change trend of the nodes in a time dimension by using a time series graph neural network method, and obtaining the risk change trend of the nodes. The threshold definition module is used for collecting historical power information big data and actual operation conditions of a current power grid, and constructing a dynamic risk baseline for reflecting a risk level, wherein the dynamic risk baseline comprises a plurality of risk warning thresholds. The dynamic adjustment module is used for adjusting each risk warning threshold in the dynamic risk baseline in real time according to the obtained risk change trend of the nodes, and obtaining a current dynamic risk baseline. The risk judgment module is used for adopting a multi-granularity time window mechanism to weight and fuse risk scores in different time periods to obtain a comprehensive risk value, and comparing the comprehensive risk value with the current dynamic risk baseline to determine a current risk level. The data protection module is used for performing data protection encryption corresponding to the current risk level according to a pre-established mapping relationship between the risk level and the protection strategy based on the determined current risk level.

[0016] Compared with related technologies, the power information security protection method and system based on big data provided by the application have the following beneficial effects: The application realizes accurate identification and effective prediction of potential risks of a power information system by constructing a static knowledge graph and combining a time series graph neural network to capture a risk change trend of nodes in a time dimension; the application improves accuracy and reliability by constructing a dynamic risk baseline and adjusting warning thresholds in real time according to node risk changes, so that risk assessment closely matches actual operation conditions of a system; the application makes comprehensive risk value calculation more scientific by adopting a multi-granularity time window mechanism to weight and fuse risk scores in different time periods, and comprehensively considering short-term and long-term risk factors, and then accurately determines a current risk level; finally, the application implements differential data protection encryption based on the risk level, reasonably allocates security resources, avoids resource waste while ensuring data security, and comprehensively improves efficiency and resource utilization of power information data protection. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 The flowchart of the power information security protection method based on big data of the application; Figure 2 This is a system block diagram of the power information security protection system based on big data according to the present invention. Detailed Implementation

[0018] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0019] Example 1 like Figure 1 As shown, the power information security protection method based on big data includes the following steps: S1. Obtain big data on power information, analyze the logical relationships between various types of power information, and construct a static knowledge graph based on the results of the logical relationships; S2. Update the static knowledge graph and identify the nodes within it. Use the temporal graph neural network method to capture the risk change trend of the nodes in the time dimension and obtain the node risk change trend. S3. Collect historical power information big data and the current actual operation status of the power grid to construct a dynamic risk baseline that reflects the risk level. The dynamic risk baseline includes multiple risk warning thresholds. S4. Based on the obtained node risk change trend, adjust each risk warning threshold in the dynamic risk baseline in real time to obtain the current dynamic risk baseline; S5. A multi-granularity time window mechanism is adopted to weight and fuse the risk scores in different time periods to obtain a comprehensive risk value, and then compare the comprehensive risk value with the current dynamic risk baseline to determine the current risk level. S6. Based on the determined current risk level, perform data protection encryption corresponding to the current risk level according to the pre-established mapping relationship between risk level and protection strategy.

[0020] In the specific implementation process, step S1 includes the following steps: S101. Collect big data on power information from data sources in the power system, and preprocess and identify entities in the data. The big data on power information includes operating parameters, power grid topology, and power transaction data. The identified entities include power generation equipment, substations, transmission lines, or users.

[0021] Specifically, power information big data is collected from multiple data sources of the power system, including but not limited to monitoring systems of power plants (to obtain operating parameters of power generation equipment such as power generation capacity, voltage, current, etc.), databases of power grid dispatching centers (to obtain power grid topology information such as connection relationships between substations, directions of transmission lines, etc.), or power trading platforms (to obtain power trading data information such as traded power, trading price, trading time, etc.), and the collected original power information big data is cleaned, converted, integrated, etc. Specifically, it includes: removing noise, duplicate data and error data in the data; uniformly converting data in different formats into a format suitable for subsequent analysis; integrating data from different data sources to ensure data consistency and integrity. Key entities are identified from the preprocessed data. According to the characteristics of the power system, the identified entities mainly include power generation equipment (such as thermal power generating units, hydroelectric generating units, wind power generating units, etc.), substations (including substations of different voltage levels), transmission lines (such as high-voltage transmission lines, extra-high-voltage transmission lines, etc.), and users (including industrial users, commercial users and residential users, etc.).

[0022] In S102, a correlation rule mining method is used to analyze frequent patterns and correlation rules between different types of power information to obtain logical correlation results.

[0023] Specifically, the preprocessed power information big data is sorted according to different types to form a data set suitable for correlation rule mining. For example, the operating parameters of power generation equipment, power grid topology, and power trading data information are sorted into different data tables respectively. An existing correlation rule mining algorithm such as Apriori algorithm or FP-Growth algorithm is selected, and the related parameters of the correlation rule mining algorithm are set, such as minimum support and minimum confidence, where the minimum support represents the frequency threshold of an item set in the data set, and the minimum confidence represents the reliability threshold of the correlation rule. Then the correlation rule mining algorithm is run to mine the frequent patterns and correlation rules between different types of power information, and the logical correlation results are obtained.

[0024] In this embodiment, the operating parameters of thermal power generating units, power grid topology and power trading data information in a regional power system are sorted into a data set. Apriori algorithm is selected for correlation rule mining, with minimum support set to 0.1 and minimum confidence set to 0.7. After running the Apriori algorithm, an association rule is mined: when the power generation capacity of the thermal power generating unit is greater than 450 MW, the load rate of the transmission line connecting the two 220 kV substations is greater than 80% with a confidence of 0.8. This association rule indicates that there is a certain logical relationship between the power generation capacity of the power generation equipment and the load rate of the transmission line, i.e. when the power generation capacity is high, the load rate of the transmission line is also often high.

[0025] S103. Construct a static knowledge graph by using the identified entities as nodes and the logical association results as edges.

[0026] Specifically, the identified entities, such as power generation equipment, substations, transmission lines, and users, are used as nodes in the static knowledge graph. Each node has a unique identifier and related attribute information. For example, a power generation equipment node may include attributes such as equipment type, rated power, and operating status; a substation node may include attributes such as substation name, voltage level, and geographical location. Next, the logical association results are used as edges in the static knowledge graph. Edges represent relationships between nodes. For example, a power generation equipment node and a transmission line node may have a "power supply" relationship; a substation node and a user node may have a "power supply service" relationship, etc. Each edge can also have related attribute information, such as edge weight (representing the strength of the relationship) and relationship type. Finally, an existing graph construction tool (such as Neo4j or JanusGraph) is selected to construct the static knowledge graph.

[0027] In the specific implementation process, step S2 includes the following steps: S201. Collect new data by setting a fixed time window, identify newly added nodes and deleted nodes, and apply the modifications to the original static knowledge graph to update the static knowledge graph.

[0028] Specifically, at the arrival of each set time window, new big data on power information is collected from various data sources within the power system. This newly collected data is then compared with the node information in the existing static knowledge graph. For example, if the new data contains entities not present in the original knowledge graph, such as newly connected power generation equipment or newly built substations, these entities are identified as newly added nodes. If certain entities in the original knowledge graph no longer appear in the new data, such as decommissioned power generation equipment or dismantled transmission lines, these entities are identified as deleted nodes. Based on the identified newly added and deleted nodes, the existing static knowledge graph is modified. Newly added nodes are added to the knowledge graph, and edges are established between them and other relevant nodes. Deleted nodes are removed from the knowledge graph, and the relationships between their connected edges are adjusted accordingly.

[0029] S202. Identify each node from the updated static knowledge graph, and collect data from each identified node at different time points to form a time-series data sequence.

[0030] Specifically, the updated static knowledge graph is traversed to obtain the relevant attribute information for each node. For each identified node, data at different time points is collected from the corresponding data source based on its type and attributes. For power generation equipment nodes, the values ​​of its operating parameters such as power generation, voltage, and current at different time points are collected. For substation nodes, data such as load factor and voltage level are collected. For transmission line nodes, data such as transmission power and line loss are collected. The collected data of each node at different time points are arranged in chronological order to form a time-series data sequence, which reflects the changes of the nodes over time.

[0031] S203. Using the time-series graph neural network method, the time-series data sequence of each node is analyzed to predict or characterize the probability of anomalies of each node in the future time window, forming the trend of node risk changes.

[0032] Specifically, a temporal graph neural network model, such as a temporal graph convolutional network (TGCN) or a temporal graph attention network (TGAT), is selected and pre-trained by acquiring historical time-series data sequences to obtain a trained temporal graph neural network model. The trained temporal graph neural network model is then used to predict or represent the probability of anomalies in each node within a future time window, outputting the probability value of anomalies occurring in a node within a future time window. Then, the probability values ​​of anomalies of each node in different future time windows are arranged in chronological order to form the trend of node risk changes.

[0033] In the specific implementation process, step S3 includes the following steps: S301. Collect historical power information big data within a preset time period, including equipment operation data, power grid operation parameters, and fault records.

[0034] Specifically, in this embodiment, the preset time period is the past one or two years. Relevant data, including equipment operation data, power grid operation parameters, and fault records, are collected from multiple data sources in the power system. The collected historical power information big data is then uniformly stored and managed, and a dedicated data warehouse or database is established for storage. S302. Establish multi-dimensional risk indicators covering multiple levels, including the device layer, network layer, application layer, and data layer.

[0035] Specifically, in this embodiment, at the equipment layer, for power generation equipment, a power generation efficiency below 80% and equipment aging exceeding 10 years are set as high-risk indicators; for substation equipment, a load factor exceeding 90% is set as a high-risk indicator. At the network layer, a grid node degree unevenness exceeding 0.5 and a communication latency exceeding 100ms are set as high-risk indicators. At the application layer, a dispatch automation system response time exceeding 5 seconds and a power trading system transaction success rate below 95% are set as high-risk indicators. At the data layer, a data accuracy rate below 90% and a data leakage risk assessment of "high" are set as high-risk indicators. These indicators are combined to form a multi-dimensional risk indicator system for the region's power system.

[0036] S303. Perform cluster analysis or probability distribution fitting on historical power information big data, statistically identify the risk state intervals of normal, early warning, and high risk, and obtain statistical identification results.

[0037] Specifically, existing clustering algorithms such as K-means clustering and hierarchical clustering are selected to use various multidimensional risk indicators from historical power information big data as feature vectors, dividing data points into different clusters. Each cluster represents a risk state. By analyzing the center and distribution range of the clusters, the risk state intervals of normal, warning, and high-risk are determined. For example, indicators from the equipment layer, network layer, application layer, and data layer are combined for clustering, dividing data points into three clusters, corresponding to normal, warning, and high-risk states respectively, and then statistically identifying the risk state intervals of normal, warning, and high-risk.

[0038] S304. Based on the statistical identification results, set risk warning thresholds for multiple levels and bind the risk warning thresholds with the corresponding multi-dimensional risk indicators to form a dynamic risk baseline.

[0039] Specifically, based on the statistically identified risk status ranges of normal, warning, and high-risk, a corresponding risk warning threshold is set for each multi-dimensional risk indicator. These thresholds are then linked to the corresponding multi-dimensional risk indicators at each level to ensure that each indicator has a clearly defined risk warning range. In this embodiment, for the power generation efficiency indicator at the equipment layer, the upper limit of the normal threshold is set to 100%, the warning threshold range is 80%-100%, and the lower limit of the high-risk threshold is 80%. For the communication latency indicator at the network layer, the upper limit of the normal threshold is set to 100ms, the warning threshold range is 100ms-200ms, and the lower limit of the high-risk threshold is 200ms. All multi-dimensional risk indicators at all levels and their corresponding risk warning thresholds are combined to form a dynamic risk baseline.

[0040] In the specific implementation process, step S4 includes the following steps: S401. Based on the trend of node risk changes, formulate corresponding risk warning threshold adjustment strategies, including: for nodes whose risk changes show an upward trend, lower their corresponding risk warning threshold; for nodes whose risk changes show a downward trend, raise their corresponding risk warning threshold. The risk warning threshold includes the upper limit of the normal threshold, the warning threshold range, and the lower limit of the high-risk threshold.

[0041] Specifically, adjustments can be made manually based on the risk change trend of each node, or automatically adjusted using preset values. In this embodiment, in a power system, there is a substation node A and a transmission line node B. The risk change trends of these nodes are analyzed, and they show an upward trend. For substation node A: the original upper limit of the normal threshold was set to 80, the warning threshold range was 80-90, and the lower limit of the high-risk threshold was 90. Based on the magnitude of the upward trend and similar historical situations, it was decided to lower the upper limit of the normal threshold to 70, adjust the warning threshold range to 70-85, and adjust the lower limit of the high-risk threshold to 85. For transmission line node B: after equipment maintenance and optimization, its risk change trend shows a downward trend. The original upper limit of the normal threshold for this transmission line node was 75, the warning threshold range was 75-85, and the lower limit of the high-risk threshold was 85. Considering the downward trend and the system's need for resource utilization optimization, the upper limit of the normal threshold was increased to 80, the warning threshold range was adjusted to 80-90, and the lower limit of the high-risk threshold was adjusted to 90. In this way, an early warning will only be triggered when the risk score of the transmission line node reaches 80.

[0042] S402. According to the established risk warning threshold adjustment strategy, adjust each risk warning threshold in the dynamic risk baseline in real time to obtain the current dynamic risk baseline.

[0043] In the specific implementation process, step S5 includes the following steps: S501. A multi-granularity time window mechanism is adopted to divide time into time windows of different granularities, including hourly, daily, and weekly time windows, and to set corresponding weights for each time window.

[0044] Specifically, after dividing time into time windows of different granularities, the weight of hourly time windows is pre-set to 0.2, daily time windows to 0.3, and weekly time windows to 0.5.

[0045] In this embodiment, a power monitoring system is used to assess the risk of equipment in a substation. A day is divided into 24-hour time windows, with each hour representing a window; a daily time window (one whole day); and a weekly time window (covering seven days of the week). Analysis shows that hourly data fluctuates significantly and has a relatively small impact on overall risk, so its weight is set to 0.2; daily data reflects the overall daily operation, so its weight is set to 0.3; and weekly data reflects the periodic operating patterns and long-term risk trends of the equipment, so its weight is set to 0.5.

[0046] S502. The specific numerical value that predicts or characterizes the probability of anomalies of each node in a future time window is used as the risk score of the node in the corresponding time window, thus obtaining the local risk score of each time window.

[0047] S503. The local risk scores of each time window are weighted and summed according to their corresponding weights to calculate the comprehensive risk value of each node. The comprehensive risk value is then compared with the current dynamic risk baseline to obtain the comparison result.

[0048] Specifically, the weighted summation formula is as follows: Overall Risk Value = Hourly Local Risk Score × Hourly Weight + Daily Local Risk Score × Daily Weight + Weekly Local Risk Score × Weekly Weight. For example, the hourly local risk score is 0.15 with a weight of 0.2; the daily local risk score is 0.1 with a weight of 0.3; and the weekly local risk score is 0.08 with a weight of 0.5. Therefore, the overall risk value = 0.15 × 0.2 + 0.1 × 0.3 + 0.08 × 0.5 = 0.03 + 0.03 + 0.04 = 0.1.

[0049] S504. Determine the current risk level based on the comparison results, specifically including: if the comprehensive risk value in the comparison results is less than or equal to the upper limit of the normal threshold, it is determined to be a low risk level; if the upper limit of the normal threshold is less than or equal to the lower limit of the high risk threshold, it is determined to be a medium risk level; if the comprehensive risk value is greater than or equal to the lower limit of the high risk threshold, it is determined to be a high risk level.

[0050] Specifically, the calculated comprehensive risk value of each node is compared with the current dynamic risk baseline. The current dynamic risk baseline includes risk warning threshold information such as the upper limit of the normal threshold, the warning threshold range, and the lower limit of the high-risk threshold. By comparing these, it can be determined which risk range the comprehensive risk value of that node falls into, and the comparison result can be obtained.

[0051] In the specific implementation process, step S6 includes the following steps: S601. Establish a mapping relationship between risk levels and protection strategies, including: low-risk levels use symmetric encryption algorithms for encryption; medium-risk levels use temporary keys based on time or session, generating a new key for each access; high-risk levels use independent encrypted partitions and prohibit cross-partition access. S602. Based on the current risk level, and according to the mapping relationship between the risk level and the protection strategy, invoke the corresponding data protection encryption strategy to implement differentiated encrypted data protection.

[0052] Specifically, in a power company's power monitoring system, risk levels are categorized into low, medium, and high by analyzing and evaluating power grid equipment operation data and network traffic data. For low-risk equipment status monitoring data, AES symmetric encryption is used for encrypted storage and transmission to ensure data confidentiality. For medium-risk power transaction data, when a user logs into the system to perform a transaction, the system generates a temporary key based on the current session. The user uses this key to encrypt and process the transaction data; the key is automatically destroyed after the transaction is completed. For high-risk power grid control command data, it is stored in a separate encrypted server partition. This partition uses a high-strength asymmetric encryption algorithm and has strict access control policies. Only specific control center systems can access this partition after multi-layered authentication; cross-partition access by any other system or user is prohibited.

[0053] Example 2 like Figure 2 As shown, the power information security protection system based on big data specifically includes: The correlation analysis module is used to acquire big data on power information, analyze the logical relationships between various types of power information, and construct a static knowledge graph based on the results of the logical relationships. The data analysis module is used to update the static knowledge graph and identify the nodes within it. It uses a time-series graph neural network method to capture the risk change trend of nodes over time and obtain the node risk change trend. The threshold definition module is used to collect historical power information big data and the current actual operation status of the power grid to construct a dynamic risk baseline that reflects the risk level. The dynamic risk baseline includes multiple risk warning thresholds. The dynamic adjustment module is used to adjust the risk warning thresholds in the dynamic risk baseline in real time based on the obtained node risk change trend, so as to obtain the current dynamic risk baseline. The risk assessment module uses a multi-granularity time window mechanism to weight and fuse risk scores from different time periods to obtain a comprehensive risk value, and compares the comprehensive risk value with the current dynamic risk baseline to determine the current risk level. The data protection module is used to perform data protection encryption corresponding to the current risk level based on the determined current risk level and according to the pre-established mapping relationship between risk level and protection strategy.

[0054] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0055] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, including read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-Erasable Programmable Read-Only Memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable medium capable of carrying or storing data.

[0056] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

Claims

1. A power information security protection method based on big data, characterized in that, The security protection method comprises the following steps: S1, obtaining power information big data to analyze the logical association between various power information, and constructing a static knowledge graph according to the result of logical association; S2, updating the static knowledge graph and identifying the nodes, using a time sequence graph neural network method to capture the risk change trend of the nodes in the time dimension, and obtaining the risk change trend of the nodes; S3, collecting historical power information big data and the actual operating condition of the current power grid, and constructing a dynamic risk baseline for reflecting the risk level, wherein the dynamic risk baseline comprises a plurality of risk warning thresholds; S4, according to the obtained risk change trend of the nodes, real-time adjusting the risk warning thresholds in the dynamic risk baseline, and obtaining the current dynamic risk baseline; S5, using a multi-granularity time window mechanism, weighting and fusing the risk scores in different time periods to obtain a comprehensive risk value, and comparing the comprehensive risk value with the current dynamic risk baseline to determine the current risk level; S6, based on the determined current risk level, according to the pre-established mapping relationship between the risk level and the protection strategy, performing data protection encryption corresponding to the current risk level. 2.The big data-based electric power information security protection method according to claim 1, characterized in that, The specific steps of step S1 include: S101, collecting power information big data from the data source of the power system, and preprocessing and entity recognition, wherein the power information big data includes operating parameters, power grid topology structure, power transaction data information; the identified entities include power generation equipment, transformer substations, transmission lines or users; S102, using an association rule mining method to analyze the frequent patterns and association rules between different types of power information to obtain a logical association result; S103, taking the identified entities as nodes and the logical association result as edges to construct a static knowledge graph. 3.The big data-based electric power information security protection method according to claim 1, characterized in that, The specific steps of step S2 include: S201, collecting new data by setting a fixed time window, identifying new nodes and deleted nodes, and applying the modifications to the original static knowledge graph to update the static knowledge graph; S202, identifying each node from the updated static knowledge graph, and collecting time sequence data of each node at different time points to form a time sequence data sequence; S203, using a time sequence graph neural network method to analyze the time sequence data sequence of each node, predict or represent the abnormal probability of each node in the future time window, and form a node risk change trend. 4.The big data-based electric power information security protection method according to claim 1, wherein, The specific steps of step S3 include: S301, collecting historical power information big data in a preset time period, including equipment operation data, power grid operating parameters, and fault records; S302, establishing a plurality of hierarchical multi-dimensional risk indicators covering the device layer, network layer, application layer and data layer; S303, performing clustering analysis or probability distribution fitting on the historical power information big data, statistically identifying normal, warning and high-risk risk state intervals, and obtaining a statistical identification result; S304, setting a plurality of hierarchical risk warning thresholds according to the statistical identification result, and binding the risk warning thresholds with the multi-dimensional risk indicators of the corresponding level to form a dynamic risk baseline. 5.The big data-based electric power information security protection method according to claim 4, characterized in that, The specific steps of step S4 include: S401、According to the node risk change trend, a corresponding risk warning threshold adjustment strategy is formulated, including: if the node risk change trend is upward, the corresponding risk warning threshold of the node is lowered; if the node risk change trend is downward, the corresponding risk warning threshold of the node is raised, wherein the risk warning threshold includes a normal threshold upper limit, a warning threshold interval and a high-risk threshold lower limit; S402、According to the formulated risk warning threshold adjustment strategy, each risk warning threshold in the dynamic risk baseline is adjusted in real time to obtain the current dynamic risk baseline. 6.The big data-based electric power information security protection method according to claim 5, wherein, The specific steps of step S5 include: S501、Using a multi-granularity time window mechanism, time is divided into time windows of different granularity time periods, including hour-level, day-level and week-level time periods, and corresponding weights are set for each time period time window; S502、The specific value of predicting or representing the abnormal probability of each node in the future time window is taken as the risk score of the node in the corresponding time window to obtain the local risk score of each time period time window; S503、The local risk scores of each time period time window are weighted and summed according to the corresponding weights to calculate the comprehensive risk value of each node, and the comprehensive risk value is compared with the current dynamic risk baseline to obtain a comparison result; S504、According to the comparison result, the current risk level is determined, specifically including: if the comprehensive risk value in the comparison result is ≤ the normal threshold upper limit, it is determined as a low risk level; if the normal threshold upper limit < the comprehensive risk value ≤ the high-risk threshold lower limit, it is determined as a medium risk level; if the comprehensive risk value > the high-risk threshold lower limit, it is determined as a high risk level. 7.The big data-based electric power information security protection method according to claim 6, wherein, The specific steps of step S6 include: S601、Establishing a mapping relationship between the risk level and the protection strategy, including: using a symmetric encryption algorithm for encryption for the low risk level; using a temporary key based on time or session to generate a new key for each access for the medium risk level; using independent encryption partitioning and prohibiting cross-zone access for the high risk level; S602、Based on the current risk level, the corresponding data protection encryption strategy is called according to the mapping relationship between the risk level and the protection strategy to implement differential encryption data protection.

8. A power information security protection system based on big data, applying the power information security protection method based on big data according to any one of claims 1-7, characterized in that, The security protection system includes: An association analysis module is configured to analyze logical associations between various types of power information from the power information big data and construct a static knowledge graph based on the results of the logical associations; A data analysis module is configured to update the static knowledge graph and identify nodes therein, capture risk change trends of the nodes in the time dimension using a time series graph neural network method, and obtain node risk change trends; A threshold definition module is configured to collect historical power information big data and actual operating conditions of the current power grid, and construct a dynamic risk baseline for reflecting risk levels, wherein the dynamic risk baseline includes multiple risk warning thresholds; A dynamic adjustment module is configured to adjust each risk warning threshold in the dynamic risk baseline in real time according to the obtained node risk change trends, and obtain a current dynamic risk baseline. The risk judgment module is configured to adopt a multi-granularity time window mechanism, to weight and fuse risk scores in different time periods to obtain a comprehensive risk value, and to compare the comprehensive risk value with a current dynamic risk baseline to determine a current risk level; The data protection module is configured to, based on the determined current risk level, perform data protection encryption corresponding to the current risk level according to a pre-established mapping relationship between risk levels and protection strategies.

Images