Power grid network attack countering method and system based on flexible gray level self-adaption

Abstract

The invention discloses a power grid network attack countering method and system based on flexible gray level self-adaption, and the method comprises the steps: obtaining the multi-level gray point information of a power grid, carrying out the abnormal flow analysis, carrying out the shadow asset recognition processing based on an analysis result, and obtaining the shadow asset recognition data, obtaining known attack data of the power grid, carrying out attack mode analysis, constructing an attack link graph of a known attack mode to obtain an attack link analysis model, recognizing an abnormal access behavior corresponding to shadow asset recognition data through the attack link analysis model, carrying out target asset threat analysis to obtain asset threat analysis data, and sending the asset threat analysis data to the power grid. And attacker positioning is carried out according to the asset threat data, a corresponding attack countering strategy is called in combination with the known attack means similarity to carry out attack source blocking processing on the positioned attacker, and power grid network attack countering data is obtained. The power grid attack is accurately traced and attack countering is carried out from the source, so that data support of attack countering is provided for operation safety of the power grid.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power grid security protection, and in particular to a power grid network attack countermeasure method and system based on flexible gray self-adaptation. BACKGROUND

[0002] At present, with the development of smart grids, the degree of correlation between power grid devices is also increasingly close. When the power grid is subjected to network attacks, if it cannot be discovered and handled in a timely manner, it is easy to cause power grid information leakage, and even serious power grid paralysis, affecting daily production and life.

[0003] Existing attack means also become increasingly complex and concealed with the development of information technology. The traditional defense through firewalls cannot adapt to the speed of change of attack means, and the security defense mechanism of the power grid is facing severe challenges. The traditional power grid security defense method mainly identifies the identity based on the signature of the access device, and identifies the attack means and threat response based on the static and fixed rule library. For complex, advanced persistent threats and other new attack means, especially potential attack means, there are false positives, false negatives, and response lags, so that the attack means cannot be counteracted in a timely manner, affecting the safe operation of the power grid. SUMMARY

[0004] In view of the problem that the existing power grid attack means is difficult to counteract in a timely manner and affects the safe operation of the power grid, the present application provides a power grid network attack countermeasure method and system based on flexible gray self-adaptation, which can improve the detection comprehensiveness and timeliness of power grid attack means, accurately trace the power grid attack and counterattack from the source, and provide data support for power grid operation safety.

[0005] In a first aspect, the above application aims to achieve the following technical solutions: A power grid network attack countermeasure method based on flexible gray self-adaptation, the method implants gray points at each level of the power grid technology stack to identify network attack behavior, and the method comprises: Obtaining multi-level gray point information of the power grid, analyzing abnormal traffic of the multi-level gray point information, and identifying shadow assets based on the analysis result to obtain shadow asset identification data; Obtaining known attack data of the power grid, analyzing attack patterns of the known attack data, constructing an attack link graph of the known attack patterns, and obtaining an attack link analysis model; Identifying abnormal access behavior corresponding to the shadow asset identification data through the attack link analysis model, and performing target asset threat analysis to obtain asset threat analysis data; Attackers are located based on the asset threat data, and corresponding attack countermeasures are invoked based on the similarity of known attack methods to block the source of the attack on the located attackers, thereby obtaining power grid network attack countermeasure data.

[0006] In a preferred embodiment, this application can be further configured as follows: the attacker location is determined based on the asset threat data, and the corresponding attack countermeasure strategy is invoked in conjunction with the similarity of known attack methods to block the attack source of the located attacker, thereby obtaining power grid network attack countermeasure data, specifically including: The attack chain analysis model is used to analyze the attack chain of the asset threat data and perform attack source reverse processing. Based on the reverse processing results, the attacker source is located, and the attack source location data is obtained. Calculate the attack chain similarity between the attack chain of the asset threat data and the known attack chain, and determine the attack method of the current attack chain based on the calculation result; Based on the attack method determination result, the attack countermeasure strategy corresponding to the same known attack method is invoked to perform attack source blocking processing on the attack source location data, thereby obtaining power grid network attack countermeasure data.

[0007] In a preferred embodiment, this application can be further configured as follows: after locating the attacker based on the asset threat data, and combining the similarity of known attack methods to call the corresponding attack countermeasure strategy to block the attack source of the located attacker, and obtaining the power grid network attack countermeasure data, it further includes: Obtain the subsequent access status of the abnormal access behavior, and evaluate the attack countermeasure effect of the power grid network attack countermeasure data based on the subsequent access status; If the expected countermeasure effect is not achieved, the abnormal access behavior corresponding to the shadow asset identification data is dissected, and the potential target asset threat of each dissected abnormal access behavior node is identified to obtain potential asset threat data. Based on the potential asset threat data, the visitor is located for each node exhibiting abnormal access behavior that poses a threat, and corresponding countermeasures are matched to perform multi-dimensional synchronous blocking.

[0008] In a preferred embodiment, this application can be further configured as follows: the step of identifying abnormal access behavior corresponding to the shadow asset identification data through the attack chain analysis model and performing target asset threat analysis to obtain asset threat analysis data specifically includes: The attack chain analysis model is used to analyze whether the access behavior of the shadow asset identification data conforms to the access permissions of the visitor, and unauthorized access behavior is identified as abnormal access behavior. Based on the exposed attack surface of shadow assets, the unauthorized access threats and corresponding attack vulnerability risks of the abnormal access behavior are analyzed to obtain asset threat analysis data.

[0009] In a preferred embodiment, this application can be further configured as follows: Based on the asset importance of the shadow asset, the analysis of the unauthorized access threat and corresponding attack vulnerability risk of the abnormal access behavior to obtain asset threat analysis data specifically includes: The threat to the target asset is quantified by the product of the asset's attack surface exposure, the risk of unauthorized disclosure, and the risk of attack vulnerabilities.

[0010] In a preferred embodiment, this application can be further configured as follows: acquiring known attack data on the power grid, performing attack pattern analysis on the known attack data, constructing an attack link graph of the known attack patterns, and obtaining an attack link analysis model, specifically including: Acquire known attack data on the power grid, classify the known attack data according to attack type using deep learning, analyze the attack patterns of each attack type, and obtain the attack attribute parameters of the known attack data; Attack chain analysis is performed on the known attack data to construct an attack chain graph of known attack patterns, and the corresponding attack attribute parameters are associated to obtain an attack chain analysis model.

[0011] In a preferred embodiment, this application may be further configured as follows: the step of acquiring known attack data of the power grid, performing attack pattern analysis on the known attack data, constructing an attack link graph of the known attack patterns, and obtaining an attack link analysis model further includes: The attack chain analysis model includes three analysis models: internal-to-external attack, internal-to-internal attack, and external-to-internal attack.

[0012] Secondly, the above-mentioned inventive objective of this application is achieved through the following technical solutions: A power grid network attack countermeasure system based on flexible gray-scale adaptation, the system being applied to the aforementioned power grid network attack countermeasure method based on flexible gray-scale adaptation, the system comprising: The asset identification module is used to acquire multi-level gray point information of the power grid, perform abnormal flow analysis on the multi-level gray point information, and perform shadow asset identification processing based on the analysis results to obtain shadow asset identification data. The model building module is used to acquire known attack data of the power grid, analyze the attack patterns of the known attack data, construct an attack link graph of the known attack patterns, and obtain an attack link analysis model. The threat analysis module is used to identify abnormal access behaviors corresponding to the shadow asset identification data through the attack chain analysis model, and to perform target asset threat analysis to obtain asset threat analysis data. The attack countermeasure module is used to locate attackers based on the asset threat data, and combine the similarity of known attack methods to call the corresponding attack countermeasure strategy to block the source of the attack on the located attackers, thereby obtaining power grid network attack countermeasure data.

[0013] Thirdly, the above-mentioned objectives of this application are achieved through the following technical solutions: A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the above-described method for countering power grid attacks based on flexible grayscale adaptation.

[0014] Fourthly, the above-mentioned objectives of this application are achieved through the following technical solutions: A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described method for countering power grid attacks based on flexible grayscale adaptation.

[0015] In summary, this application includes at least one of the following beneficial technical effects: 1. This application uses flexible grayscale adaptive technology to implant gray points at various levels of the power grid security protection technology stack for automatic identification of shadow assets. Based on known attack data, an attack link analysis model is constructed to identify abnormal access behaviors corresponding to the identified shadow assets and perform target asset threat analysis. This enables the precise invocation of corresponding attack countermeasures to block attacks at the source. By analyzing asset threats in a structured manner, the attacker's intent can be quickly located, and then the countermeasures can be precisely invoked to block the attack at the source. This improves the comprehensiveness and timeliness of power grid attack detection, accurately traces the source of power grid attacks, and counters the attacks at the source, providing data support for attack countermeasures for power grid operation safety. 2. This application uses known attack data of the power grid as training samples, analyzes attack types and attack patterns through deep learning, and then analyzes attack links to construct an attack link map. The attack link map reveals the attacker's attack methods, attack organization, attack patterns, and trends, enabling intuitive and rapid attack analysis and tracing. Through multiple analyses of internal and external, external and internal, and internal and external aspects, it comprehensively and accurately analyzes the potential attack methods of the power grid, providing data support for attack countermeasures for the safe operation of the power grid. 3. This application also enables timely identification of abnormal traffic through gray point implantation, which can extract knowledge information that conforms to specific attack models, making it easier to discover the attacker's attack patterns and trends, reducing the workload of attack analysis, and improving the response efficiency of attack countermeasure strategies. Attached Figure Description

[0016] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0017] Figure 1 This is a flowchart illustrating the implementation of the power grid network attack countermeasure method based on flexible grayscale adaptation in this embodiment.

[0018] Figure 2 This is a flowchart illustrating the implementation of step S20 of the power grid network attack countermeasure method in this embodiment.

[0019] Figure 3 This is a flowchart illustrating the implementation of step S30 of the power grid network attack countermeasure method in this embodiment.

[0020] Figure 4 This is a flowchart illustrating the implementation of step S40 of the power grid network attack countermeasure method in this embodiment.

[0021] Figure 5 This is a flowchart illustrating the implementation of the multi-dimensional synchronous blocking method for countering power grid network attacks in this embodiment.

[0022] Figure 6 This is a structural block diagram of the power grid network attack countermeasure system based on flexible grayscale adaptation in this embodiment.

[0023] Figure 7 This is a schematic diagram of the internal structure of a computer device used to implement countermeasures against power grid network attacks. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0026] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0027] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0028] In one embodiment, such as Figure 1 As shown, this application discloses a power grid network attack countermeasure method based on flexible grayscale adaptation. In this embodiment, network attack behavior is identified by implanting gray points at various levels of the power grid technology stack, including server-side applications, server-side operating systems, and traffic gateways. The power grid network attack countermeasure method of this embodiment specifically includes the following steps: S10: Obtain multi-level gray point information of the power grid, perform abnormal flow analysis on the multi-level gray point information, and perform shadow asset identification processing based on the analysis results to obtain shadow asset identification data.

[0029] Specifically, multi-level gray point information of the power grid is obtained through pre-embedded gray points. Abnormal flow monitoring is performed on the multi-level gray point information to distinguish between normal operation flow and abnormal flow. Based on the analysis results, the target access server, i.e. the target asset, is identified, and shadow assets, i.e. potential access servers, are automatically identified. At the same time, the basic information of the server is learned and obtained to obtain shadow asset identification data.

[0030] S20: Obtain known attack data on the power grid, analyze the attack patterns of the known attack data, construct an attack link graph of the known attack patterns, and obtain an attack link analysis model.

[0031] Specifically, such as Figure 2 As shown, step S20 includes: S201: Obtain known attack data on the power grid, classify the known attack data according to attack type using deep learning, analyze the attack patterns of each attack type, and obtain the attack attribute parameters of the known attack data.

[0032] Specifically, the process involves acquiring known attack data on the power grid, classifying the known attack data according to attack type using deep learning, training the attack patterns of each attack type using multiple samples, and obtaining the attack attribute parameters for each attack type.

[0033] S202: Perform attack chain analysis on known attack data, construct an attack chain graph of known attack patterns, and associate it with corresponding attack attribute parameters to obtain an attack chain analysis model.

[0034] Specifically, attack chain analysis is performed on known attack data, and an attack chain graph of known attack patterns is constructed by combining the deployment of power grid servers. The attack attribute parameters corresponding to each attack pattern are then associated to form an attack chain analysis model.

[0035] Specifically, the attack chain analysis model in this embodiment includes three analysis models: internal-to-external attack, internal-to-internal attack, and external-to-internal attack.

[0036] S30: Identify abnormal access behaviors corresponding to shadow asset identification data through the attack chain analysis model, and perform target asset threat analysis to obtain asset threat analysis data.

[0037] Specifically, such as Figure 3 As shown, step S30 includes: S301: Analyze whether the access behavior of shadow asset identification data conforms to the access permissions of the visitor through the attack chain analysis model, and identify unauthorized access behavior as abnormal access behavior.

[0038] Specifically, the attack chain analysis model is used to analyze the access behavior of shadow assets in the shadow asset identification data, and further analyzes whether the access behavior complies with the access permissions of the visitor. Unauthorized access behavior is given special attention and marked as abnormal access behavior.

[0039] S302: Based on the exposed attack surface of shadow assets, analyze the unauthorized access threats and corresponding attack vulnerability risks of abnormal access behaviors to obtain asset threat analysis data.

[0040] Specifically, the attack surface of shadow assets is analyzed based on the historical attack frequency of the assets, and the unauthorized access threats and corresponding vulnerability risks of abnormal access behaviors are analyzed. For example, unauthorized access behaviors that manipulate important data of shadow assets or change the critical configuration of shadow assets are considered unauthorized threats. The greater the adverse impact on shadow assets, the higher the unauthorized threat. Correspondingly, the locations that can be manipulated by unauthorized means are considered to have vulnerability risks. The difficulty of unauthorized operations is used to determine whether the attack vulnerability risk is high-risk, thereby obtaining asset threat analysis data.

[0041] Specifically, the threat to a target asset is quantified by the product of the asset's attack surface exposure, the risk of unauthorized disclosure, and the risk of attack vulnerabilities.

[0042] S40: Based on asset threat data, attackers are located, and the corresponding attack countermeasures are invoked in conjunction with the similarity of known attack methods to block the source of the attack on the located attackers, thereby obtaining power grid network attack countermeasure data.

[0043] Specifically, such as Figure 4 As shown, step S40 includes: S401: Analyze the attack chain of asset threat data through the attack chain analysis model and perform attack source reverse processing. Based on the reverse processing results, locate the attacker source and obtain attack source location data.

[0044] Specifically, the attack chain analysis model is used to analyze the attack chain of asset threat data, and the attack source is traced back according to the attack chain until the attacker's initial login location is located to obtain the attack source location data.

[0045] S402: Calculate the attack chain similarity between the attack chain of asset threat data and the known attack chain, and determine the attack method of the current attack chain based on the calculation results.

[0046] Specifically, the attack intent probability of the attack chain of asset threat data is calculated by using the AIA algorithm, and the attack behavior is associated with the attack intent corresponding to the maximum attack intent probability to form a similarity metric. This similarity metric is then compared with the attack chain similarity metric between known attack chains. Based on the comparison results, the known attack chain with the highest similarity is selected to determine the attack method of the current attack chain.

[0047] S403: Based on the attack method determination result, the attack countermeasure strategy corresponding to the same known attack method is invoked to block the attack source location data, thereby obtaining the power grid network attack countermeasure data.

[0048] Specifically, based on the attack method determination results, attack countermeasures associated with the same known attack methods are invoked to block the attack source location data, including prohibiting unauthorized access, isolating attackers, and creating honeypot systems to mislead attackers, thereby obtaining power grid attack countermeasure data.

[0049] In this embodiment, as Figure 5 As shown, after step S40, the following is also included: S404: Obtain the subsequent access status of abnormal access behavior, and evaluate the attack countermeasure effect of power grid network attack countermeasure data based on the subsequent access status.

[0050] Specifically, the system obtains the subsequent access status of abnormal access behavior, and evaluates the attack countermeasures effect of the power grid network attack countermeasures data based on the attacker's subsequent access to the target asset and shadow asset. If no attacker's asset access behavior is detected, the attack countermeasures are deemed effective. If attacker's asset access behavior is still detected, the attack countermeasures are deemed ineffective or have low effectiveness, and further blocking is required.

[0051] S405: If the expected countermeasure effect is not achieved, disassemble the abnormal access behavior corresponding to the shadow asset identification data, identify the potential target asset threat of each disassembled abnormal access behavior node, and obtain potential asset threat data.

[0052] Specifically, if the expected countermeasure effect is not achieved, the abnormal access behavior corresponding to the shadow asset identification data is disassembled, and the potential target asset threat of each abnormal access behavior node after disassembly is identified. That is, it is determined whether there is a potential attack link between each abnormal access behavior node after disassembly. If so, there is a potential target asset threat. Based on the degree of impact of the potential attack link on the target asset, it is determined whether the asset threat level is high-risk, and potential asset threat data is obtained.

[0053] S406: Based on potential asset threat data, locate the visitors for nodes with abnormal access behavior that pose a threat and match the corresponding countermeasures to carry out multi-dimensional synchronous blocking.

[0054] Specifically, based on potential asset threat data, the visitor is located for each node exhibiting abnormal access behavior that poses a threat, and corresponding countermeasures are matched. Multi-dimensional synchronous blocking is performed on each access behavior node in the potential attack chain.

[0055] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0056] In one embodiment, a power grid network attack countermeasure system based on flexible grayscale adaptation is provided, which corresponds one-to-one with the power grid network attack countermeasure method based on flexible grayscale adaptation described in the above embodiments. For example... Figure 6 As shown, this flexible grayscale adaptive power grid network attack countermeasure system includes an asset identification module, a model building module, a threat analysis module, and an attack countermeasure module. Detailed descriptions of each functional module are as follows: The asset identification module is used to acquire multi-level gray point information of the power grid, perform abnormal flow analysis on the multi-level gray point information, and perform shadow asset identification processing based on the analysis results to obtain shadow asset identification data.

[0057] The model building module is used to acquire known attack data of the power grid, analyze the attack patterns of the known attack data, construct an attack link graph of the known attack patterns, and obtain an attack link analysis model.

[0058] The threat analysis module is used to identify abnormal access behaviors corresponding to shadow asset identification data through the attack chain analysis model, and to perform target asset threat analysis to obtain asset threat analysis data.

[0059] The attack countermeasure module is used to locate attackers based on asset threat data, and combine the similarity of known attack methods to call the corresponding attack countermeasure strategy to block the source of the attack on the located attackers, thereby obtaining power grid network attack countermeasure data.

[0060] Preferably, the attack countermeasure module specifically includes: The source location submodule is used to analyze the attack chain of asset threat data through the attack chain analysis model and perform attack source reverse processing. Based on the reverse processing results, the attacker source is located, and the attack source location data is obtained.

[0061] The attack method determination submodule is used to calculate the attack chain similarity between the attack chain of asset threat data and known attack chains, and to determine the attack method of the current attack chain based on the calculation results.

[0062] The source blocking submodule is used to block the attack source location data by calling the attack countermeasure strategy corresponding to the same known attack method based on the attack method determination result, and obtain the power grid network attack countermeasure data.

[0063] Preferably, after the attack countermeasure module, it also includes: The countermeasure effectiveness evaluation submodule is used to obtain the subsequent access status of abnormal access behavior and evaluate the attack countermeasure effectiveness of power grid network attack countermeasure data based on the subsequent access status.

[0064] The potential threat analysis submodule is used to dissect the abnormal access behaviors corresponding to the shadow asset identification data if the expected countermeasure effect is not achieved, identify the potential target asset threats of each dissected abnormal access behavior node, and obtain potential asset threat data.

[0065] The multi-dimensional synchronous blocking submodule is used to locate the visitors of nodes with abnormal access behavior that pose a threat, match the corresponding countermeasures, and perform multi-dimensional synchronous blocking based on potential asset threat data.

[0066] Preferably, the threat analysis module specifically includes: The abnormal behavior identification submodule is used to analyze whether the access behavior of the shadow asset identification data conforms to the access permissions of the visitor through the attack chain analysis model, and to identify unauthorized access behavior as abnormal access behavior.

[0067] The threat analysis submodule is used to analyze the unauthorized access threats and corresponding attack vulnerability risks of abnormal access behavior based on the exposed attack surface of shadow assets, and obtain asset threat analysis data.

[0068] Preferably, the threat analysis submodule specifically includes: the target asset threat is quantitatively represented by the product of the asset attack surface exposure value, the risk of unauthorized leakage, and the risk of attack vulnerabilities.

[0069] Preferably, the model building module specifically includes: The data learning submodule is used to acquire known attack data of the power grid, classify the known attack data according to attack type using deep learning, analyze the attack patterns of each attack type, and obtain the attack attribute parameters of the known attack data.

[0070] The model building submodule is used to perform attack chain analysis on known attack data, construct attack chain graphs of known attack patterns, and associate them with corresponding attack attribute parameters to obtain an attack chain analysis model.

[0071] Preferably, the model building module also includes: an attack chain analysis model including three analysis models: internal-to-external attack, internal-to-internal attack, and external-to-internal attack.

[0072] Specific limitations regarding the flexible gray-scale adaptive power grid attack countermeasure system can be found in the limitations of the flexible gray-scale adaptive power grid attack countermeasure method described above, and will not be repeated here. Each module in the aforementioned flexible gray-scale adaptive power grid attack countermeasure system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0073] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides the environment for the operation of the operating system and computer programs in the non-volatile storage media. The database stores data for countering power grid network attacks. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a flexible grayscale adaptive power grid network attack countermeasure method.

[0074] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program being executed by a processor to implement the steps of a power grid network attack countermeasure method based on flexible grayscale adaptation.

[0075] Those skilled in the art will recognize that the units of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application of the technical solution and the constraints involved. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.

[0076] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical functional division. In actual implementation, there may be other division methods, such as multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored.

[0077] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0078] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A method for power grid cyber attack countermeasure based on flexible gray scale self-adaptation, characterized in that, The method performs network attack behavior identification by implanting gray points at various layers of a power grid technology stack, and the method includes: obtaining multi-layer gray point information of the power grid, performing abnormal traffic analysis on the multi-layer gray point information, and performing shadow asset identification processing based on the analysis result to obtain shadow asset identification data; obtaining known attack data of the power grid, performing attack mode analysis on the known attack data, constructing an attack link graph of the known attack mode, and obtaining an attack link analysis model; identifying abnormal access behavior corresponding to the shadow asset identification data through the attack link analysis model, and performing target asset threat analysis to obtain asset threat analysis data; performing attacker positioning according to the asset threat data, calling corresponding attack countermeasures according to the similarity of known attack means to perform attack source blocking processing on the positioned attacker, and obtaining power grid network attack countermeasure data.

2. The method of claim 1, wherein, The attack source blocking processing on the positioned attacker according to the similarity of known attack means to call corresponding attack countermeasures, and obtaining power grid network attack countermeasure data, specifically includes: analyzing the attack chain of the asset threat data through the attack link analysis model and performing attack source reverse processing, positioning the attack source according to the reverse processing result, and obtaining attack source positioning data; calculating the attack link similarity between the attack chain of the asset threat data and the known attack link, and determining the attack means according to the calculation result; according to the attack means determination result, calling the attack countermeasures corresponding to the same known attack means to perform attack source blocking processing on the attack source positioning data, and obtaining power grid network attack countermeasure data.

3. The method of claim 2, wherein, After the attack source blocking processing on the positioned attacker according to the similarity of known attack means to call corresponding attack countermeasures, and obtaining power grid network attack countermeasure data, it further includes: obtaining the subsequent access state of the abnormal access behavior, and evaluating the attack countermeasure effect of the power grid network attack countermeasure data according to the subsequent access state; if the expected countermeasure effect is not achieved, the abnormal access behavior corresponding to the shadow asset identification data is disassembled, the potential target asset threat of each disassembled abnormal access behavior node is identified, and potential asset threat data is obtained; according to the potential asset threat data, the abnormal access behavior nodes with threats are positioned and matched with corresponding countermeasures for multi-dimensional synchronous blocking processing.

4. The method of claim 1, wherein, The method for performing network attack behavior identification by implanting gray points at various layers of a power grid technology stack, and the method includes: through the attack link analysis model, analyze whether the access behavior of the shadow asset identification data conforms to the access permission of the access, and identify the unauthorized access behavior as abnormal access behavior; according to the exposure attack surface of the shadow asset, analyze the unauthorized threat and the corresponding attack vulnerability risk of the abnormal access behavior, and obtain asset threat analysis data.

5. The method of claim 4, wherein, The asset importance according to the shadow asset is analyzed, the unauthorized threat and the corresponding attack vulnerability risk of the abnormal access behavior are analyzed, asset threat analysis data is obtained, and specifically includes: The target asset threat is quantitatively represented by the product of the attack surface exposure value of the asset, the unauthorized leakage risk and the attack vulnerability risk.

6. The flexible gray-scale adaptive based power grid cyber attack countermeasure method of claim 1, wherein, The known attack data of the power grid is obtained, the attack mode analysis is performed on the known attack data, the attack link graph of the known attack mode is constructed, and an attack link analysis model is obtained, specifically including: The known attack data of the power grid is obtained, the known attack data is classified and deep learning is performed according to the attack type, the attack mode of each attack type is analyzed, and the attack attribute parameters of the known attack data are obtained. The attack link analysis model is obtained by performing attack link analysis on the known attack data, constructing the attack link graph of the known attack mode, and associating the corresponding attack attribute parameters.

7. The method of claim 6, wherein, The known attack data of the power grid is obtained, the attack mode analysis is performed on the known attack data, the attack link graph of the known attack mode is constructed, and an attack link analysis model is obtained, further including: The attack link analysis model includes three analysis models of internal-to-external attack, internal-to-internal attack and external-to-internal attack.

8. A flexible gray-scale adaptive based power grid cyber attack countermeasure system, characterized in that, The system is applied to the power grid network attack countermeasure method based on flexible gray self-adaption in any one of claims 1-7, and the system includes: An asset identification module is configured to obtain multi-level gray point information of the power grid, perform abnormal traffic analysis on the multi-level gray point information, perform shadow asset identification processing based on the analysis result, and obtain shadow asset identification data. A model construction module is configured to obtain known attack data of the power grid, perform attack mode analysis on the known attack data, construct an attack link graph of the known attack mode, and obtain an attack link analysis model. A threat analysis module is configured to identify abnormal access behavior corresponding to the shadow asset identification data through the attack link analysis model, and perform target asset threat analysis to obtain asset threat analysis data. An attack countermeasure module is configured to locate an attacker according to the asset threat data, call a corresponding attack countermeasure strategy according to the similarity of known attack means, and perform attack source blocking processing on the located attacker to obtain power grid network attack countermeasure data.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the steps of the power grid network attack countermeasure method based on flexible gray self-adaption in any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 9. The computer program is executed by the processor to realize the steps of the power grid network attack countermeasure method based on flexible gray self-adaption in any one of claims 1-7.

Images