Intelligent substation logic vulnerability protection method and system based on business rule objectification

Abstract

The invention relates to the field of computer security, in particular to an intelligent substation logic vulnerability protection method and system based on business rule objectization, and the method comprises the steps: obtaining an unstructured preset business rule of an intelligent substation, and carrying out the objective processing of the preset business rule, and obtaining a standardized rule set; constructing a security agent strategy library based on the standardized rule set; collecting real-time business data and equipment state data in the operation process of the intelligent substation to form context information during operation; and performing matching verification on the runtime context information and the security agent strategy library to obtain a vulnerability detection result, and executing a corresponding vulnerability protection response operation according to the vulnerability detection result. According to the method, deep defense of legal-structure and malicious-logic vulnerabilities which cannot be defended by traditional means is realized, automation accuracy, low performance overhead and dynamic adaptability during business rule updating are also realized, and safe operation of the intelligent substation is effectively guaranteed.

Description

Technical Field

[0001] This invention relates to the field of computer security, and in particular to a method and system for protecting against logical vulnerabilities in intelligent substations based on the objectification of business rules. Background Technology

[0002] As the core hub of the smart grid, smart substations, with their high degree of automation and extensive networking, not only improve operational efficiency but also make them a prime target for cyberattacks. Among various cybersecurity threats, logical vulnerabilities stand out due to their high degree of concealment and enormous destructive potential. The essence of logical vulnerabilities lies in the unexpected inconsistency between the system's business logic design and the program code implementation. Attackers do not need to exploit memory-corruption vulnerabilities such as software buffer overflows; instead, they can construct structurally legitimate instructions, messages, and data that conform to communication protocols (such as IEC 61850), and by carefully manipulating parameters or operational timing, induce the system to produce unexpected and dangerous consequences during the execution of legitimate processes. These consequences could include erroneous closing, protection device malfunction or failure to operate, potentially leading to catastrophic accidents such as grid paralysis.

[0003] To combat various cyber threats, the industry has deployed a variety of security measures, such as network perimeter protection (e.g., firewalls, intrusion detection systems (IDS)), traditional host security measures (e.g., host intrusion detection systems (HIDS)), and traditional runtime application self-protection (RASP) measures. However, when defending against legitimate but malicious logical vulnerability attacks, existing mainstream technologies all have significant limitations, specifically as follows: Network boundary protection methods primarily rely on network and transport layer strategies or detection of known attack characteristics, making it difficult to deeply analyze the complex industrial control protocols (such as IEC 61850 MMS, GOOSE, and SV) in smart substations, which contain complex business semantics. Therefore, firewalls and traditional IDS cannot effectively identify and block commands that are "structurally legitimate but logically malicious" (such as issuing a "close" command when a system failure should result in a trip).

[0004] Traditional host security measures rely on known attack signatures, file integrity verification (such as system file hashes), or control flow monitoring (such as stack call hashes). However, logical vulnerability attacks do not alter the underlying code, files, or normal program control flow during implementation; instead, they abuse existing functionalities, rendering signature-based and hash-based protection mechanisms completely ineffective.

[0005] Traditional RASP technology embeds protective code at runtime, performing checks based on preset security rules (such as "user-entered amounts cannot be negative"). However, in the context of smart substations, business rules are extremely complex, highly coupled, and dynamically changing. Furthermore, these rules often exist in informal and subjective forms such as natural language and technical specifications within design documents. This makes it difficult for traditional RASP to comprehensively and accurately translate all business security logic into machine-executable, unambiguous "known" security rules, resulting in significant coverage blind spots and an inability to effectively protect against attacks exploiting vulnerabilities in complex business logic.

[0006] In summary, existing security protection technologies based on protocol structure legality, code integrity, or simple static rules have inherent technical shortcomings when facing advanced threats in smart substations stemming from inconsistencies between business logic and program logic. There is an urgent need for a new protection method that can deeply understand the business context and accurately identify logical anomalies. Summary of the Invention

[0007] Therefore, this invention aims to solve the problem that existing technologies cannot effectively defend against business logic vulnerabilities in smart substations, namely, the difficulty in protecting against logic vulnerabilities caused by inconsistencies between business logic and implementation logic. Thus, it provides a method and system for protecting against logic vulnerabilities in smart substations based on objective business rules. The method for protecting against logic vulnerabilities in smart substations based on objective business rules includes the following steps: Obtain unstructured preset business rules of intelligent substations, objectively process the preset business rules to obtain a standardized rule set, and construct a security agent strategy library based on the standardized rule set; Real-time business data and equipment status data during the operation of the intelligent substation are collected to form runtime context information; the runtime context information is matched and verified with the security agent policy library to obtain vulnerability detection results; and the corresponding vulnerability protection response operation is executed based on the vulnerability detection results.

[0008] In one embodiment of the present invention, a method for objectifying the preset business rules to obtain a standardized rule set includes: The preset business rules are semantically parsed to extract all target elements, including the operating subject, controlled device, execution action, preconditions, device association relationship and instruction type. Each target element is labeled with a unique identifier and its semantic origin in the source rules is recorded to establish a traceable mapping between elements and source rules; Based on the preset logical expression format, the labeled target elements are structurally transformed: first, the mapping between each target element and the expression syntax unit is completed, and then it is bound to the standard logical node address of the device to generate machine-readable structured initial rules. The structured initial rules are subjected to logical redundancy removal and conflict detection. After passing the consistency check, a standardized rule set without conflicts or redundancy is finally output.

[0009] In one embodiment of the present invention, the security proxy policy library includes rule association constraints and anomaly determination conditions.

[0010] In one embodiment of the present invention, the method for constructing a security proxy policy library based on the standardized rule set is as follows: Historical vulnerability data and its corresponding rule matching information are obtained from the safety audit logs, historical fault records, and public vulnerability databases of smart substations; the data is then cleaned, denoised, and key features are extracted to form a structured vulnerability knowledge graph. A semantic similarity-based mapping algorithm is used to associate and map the standardized rule set with a structured vulnerability knowledge graph. Through a rule reasoning engine, the constraints of business rules and the triggering patterns of historical vulnerabilities are integrated to generate an initial detection rule set with clearly defined triggering conditions and vulnerability patterns. A multi-dimensional assessment model based on vulnerability severity, business impact scope, and frequency of occurrence is established to prioritize the initial detection rule set. The rules are then categorized according to vulnerability type and associated business module and persistently stored in the rule database, ultimately forming an indexable and queried security proxy policy library.

[0011] In one embodiment of the present invention, a method for matching and verifying the runtime context information with the security proxy policy library to obtain vulnerability detection results includes: The runtime context information is subjected to feature extraction and format standardization to generate standardized data suitable for processing by the rule engine; A parallel computing architecture is adopted to schedule multiple detection rules in the security proxy policy library to perform synchronous matching and logical judgment on the normalized data; The system aggregates the judgment results from each parallel computing unit, and based on a predefined vulnerability classification system and risk assessment model, labels the specific vulnerability types and their risk levels, ultimately generating structured vulnerability detection results.

[0012] In one embodiment of the present invention, the method of performing corresponding vulnerability protection operations based on the vulnerability detection results includes at least one of: operation instruction interception, abnormal alarm output, device status locking, and business process suspension.

[0013] Based on the same inventive concept, this invention also provides a smart substation logic vulnerability protection system based on business rule objectification, including: a security protocol generation module and a runtime protection module; The security protocol generation module is configured to: acquire unstructured preset business rules of the smart substation; perform objectification processing on the preset business rules to obtain a standardized rule set; and construct a security proxy strategy library based on the standardized rule set. The runtime protection module is configured to: collect real-time business data and equipment status data during the operation of the smart substation to form runtime context information; match and verify the runtime context information with the security agent policy library to obtain vulnerability detection results; and execute corresponding vulnerability protection response operations based on the vulnerability detection results.

[0014] In one embodiment of the present invention, the runtime protection module is deployed in the target application of the substation.

[0015] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the intelligent substation logic vulnerability protection method based on business rule objectification.

[0016] The present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the intelligent substation logic vulnerability protection method based on business rule objectification.

[0017] Compared with the prior art, the above-described technical solution of the present invention has the following advantages: Firstly, it achieves deep defense by shifting the focus of security protection from code features to the business logic level and transforming subjective business rules into objective security specifications. This effectively defends against logical vulnerability attacks that are structurally legitimate but logically malicious, which cannot be detected by traditional firewalls, HIDS, and traditional RASP, thus significantly improving the security of smart substations. Secondly, it combines automation and accuracy. By leveraging the powerful natural language understanding and reasoning capabilities of LLM, it automatically transforms massive amounts of unstructured subjective business procedures into precise and executable security policies, avoiding the oversights and high costs of manually defining rules. Third, to ensure low performance overhead, an "offline specification generation - online runtime protection" architecture is adopted, which places the resource-intensive LLM inference in the offline stage, and only executes the pre-compiled optimization rules through a lightweight Hooking agent in the online stage, so as to meet the stringent real-time requirements of embedded devices in smart substations. Fourth, it has dynamic adaptability. When business rules are updated, there is no need to modify the application code. Only the LLM needs to be retrained and the new security policy library needs to be compiled to quickly achieve protection iteration and flexibly adapt to business changes. Attached Figure Description

[0018] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0019] Figure 1 This is a flowchart illustrating a method for protecting against logical vulnerabilities in intelligent substations based on business rule objectification, provided in an embodiment of the present invention. Figure 2 This is a schematic diagram illustrating the specific process of a smart substation logic vulnerability protection method based on business rule objectification provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of an intelligent substation logic vulnerability protection system based on business rule objectification provided in an embodiment of the present invention; Explanation of reference numerals in the accompanying drawings: 100, Safety protocol generation module; 200, Runtime protection module. Detailed Implementation

[0020] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.

[0021] Example 1: This invention provides a method for protecting against logical vulnerabilities in smart substations based on the objectification of business rules. Through a two-stage architecture of offline specification generation and online runtime protection, the subjective business rules existing in unstructured forms such as natural language in smart substations are transformed into objective security policies that can be understood and executed by machines. During runtime, business operations and equipment status are verified in real time to accurately block logical vulnerability attacks, while meeting the stringent requirements of smart substations for real-time performance and low overhead.

[0022] This embodiment is applicable to smart substations of various voltage levels and can be deployed at key nodes such as the monitoring master station, bay-level IEDs (intelligent electronic devices), and process-level equipment. It is compatible with the IEC 61850 protocol (including sub-protocols such as MMS, GOOSE, and SV) and can be adapted to the existing business systems and equipment architecture of substations without large-scale modification of the original application code.

[0023] Specifically, refer to Figure 1 and Figure 2 As shown, the intelligent substation logic vulnerability protection method based on business rule objectification specifically includes the following steps: During the offline protocol generation stage, unstructured preset business rules of the smart substation are obtained, and the preset business rules are objectively processed to obtain a standardized rule set; based on the standardized rule set, a security agent strategy library is constructed. During the online runtime protection phase, real-time business data and equipment status data during the operation of the smart substation are collected to form runtime context information; the runtime context information is matched and verified with the security agent policy library to obtain vulnerability detection results; and the corresponding vulnerability protection response operation is executed based on the vulnerability detection results.

[0024] Furthermore, the specific steps for obtaining unstructured preset business rules of the smart substation and objectifying these preset business rules to obtain a standardized rule set are as follows: Unstructured preset business rules from intelligent substations are collected to form a business rule corpus. These preset business rules are sourced from documents including, but not limited to, substation operation procedures, equipment safety operation plans, interlocking logic technical specifications, and fault handling manuals. They are also supplemented with practical experience summaries from on-site maintenance personnel. Example rules include, "Under no circumstances shall an operator or automation system perform a closing operation on the corresponding main circuit breaker (switch) if the grounding switch (grounding knife) is not clearly open (opened)," and "Under fault conditions, no tripping command shall be issued to the disconnecting switch in the non-faulty area," thus forming a complete business rule corpus.

[0025] The collected rules are formatted and duplicate expressions are removed, such as the same interlocking requirements in different documents. Vague expressions are corrected, such as clarifying "equipment status is normal" as "equipment has no alarms and electrical parameters are within the rated range". Finally, a standardized corpus is formed, and each rule is labeled with the source document name, chapter number and version number for easy traceability.

[0026] A large-scale language model (LLM) specifically trained for smart substation business scenarios is used to objectify the rules in the corpus. The specific steps are as follows: Using LLM's Named Entity Recognition (NER) and relation extraction algorithms, target elements are extracted from each rule, including the operating subject (e.g., "operator", "automation system"), controlled equipment (e.g., "main circuit breaker CB-01", "grounding switch GS-01"), execution action (e.g., "closing", "opening"), preconditions (e.g., "grounding switch open", "no fault alarm"), equipment association (e.g., "CB-01 and GS-01 are paired equipment"), and instruction type (e.g., "control instruction", "query instruction"). For example, for the rule "Closing with grounding switch on is strictly prohibited", the extracted elements are: operating subject = operator / automation system, controlled equipment = main circuit breaker (B), execution action = closing (CLOSE), precondition = grounding switch (G) open (OPEN), equipment association = B and G are paired, and instruction type = control instruction.

[0027] Assign a unique identifier (ID) to each target element, in the format of “element type-serial number”, such as “controlled equipment-001 (CB-01)” or “precondition-008 (ground knife disconnected)”. At the same time, record the semantic source of the element in the source rule (such as “Article 2 of Chapter 3 of the Operating Procedures”). Establish a two-way traceable mapping table between the element and the source rule and store it in a relational database.

[0028] Based on a pre-defined first-order logical expression format, the annotated target elements are transformed into machine-readable structured rules. First, elements are mapped to expression syntax units, such as mapping "execute action = close" to "Command.Type=='CLOSE'". Second, controlled equipment is bound to the standard logical node addresses of substation equipment (e.g., "CB-01" is bound to "LD01 / LLN0GOING Pos"), generating initial structured rules. For example, the rule "It is strictly forbidden to close the circuit breaker with the grounding switch on" is transformed into the initial structured rule, namely: FORALL (Breaker B, GroundSwitch G) WHERE IsPaired(B, G): Event(Command.Type == 'CLOSE', Target == B) => MUST_VERIFY (State(G) == 'OPEN').

[0029] A redundancy elimination algorithm based on logical equivalence is used to delete duplicate rules, such as two rules with completely identical logical expressions. Through a rule conflict detection engine, the preconditions and execution results of different rules are compared to identify conflicting rules. For example, if one rule requires "closing the circuit breaker when there is a fault" and another prohibits "closing the circuit breaker when there is a fault", safety experts will intervene to review and determine whether to retain or modify the rule. Finally, a standardized rule set without conflicts and redundancy is output.

[0030] Based on the standardized rule set and integrating historical vulnerability data, an indexable and queryable security proxy policy library is constructed. The specific execution steps are as follows: Data related to logical vulnerabilities in smart substations is screened from substation safety audit logs, historical fault records, and public industrial control vulnerability databases. Key information such as vulnerability triggering conditions, affected equipment, and business consequences is extracted. Through data cleaning (removing invalid logs), noise reduction (correcting log format errors), and feature extraction using the TF-IDF algorithm, a structured vulnerability knowledge graph is formed, which includes triggering modes of various typical logical vulnerabilities. A semantic mapping algorithm based on cosine similarity is used to calculate the semantic similarity between the standardized rule set and the vulnerability triggering patterns in the vulnerability knowledge graph, establishing the association between rules and vulnerabilities. Through the Prolog rule reasoning engine, the constraints of business rules and the triggering patterns of historical vulnerabilities are integrated to generate an initial detection rule set. For example, the standardized rule "closing the circuit breaker while the grounding switch is not disconnected" is integrated with the triggering pattern of "closing the circuit breaker with the grounding switch" (CVE-2023-XXXX) to generate a detection rule: when a closing command for a paired circuit breaker is detected, the real-time status of the corresponding grounding switch must be verified; if the grounding switch is closed, it is determined to be a logical vulnerability trigger.

[0031] A multi-dimensional assessment model was established, with assessment indicators including vulnerability severity, business impact scope, and occurrence frequency. The Analytic Hierarchy Process (AHP) was used to calculate the priority of each initial detection rule, which was divided into three levels: high (P1), medium (P2), and low (P3). Vulnerabilities were classified according to their type (such as operation sequence vulnerabilities, privilege abuse vulnerabilities, and parameter tampering vulnerabilities) and their associated business modules (such as main transformer operation, outgoing line interval operation, and fault handling). The classifications were stored in a PostgreSQL database to build a security agent policy library, which supports fast indexing and querying based on device ID, rule priority, and vulnerability type.

[0032] The core of the online runtime protection phase is to collect substation operation data in real time, match and verify it with the detection rule base, and execute precise protection responses. The specific implementation steps are as follows: The runtime protection module's built-in data source interface collects two types of data in real time: First, real-time business data, including issued control commands (such as closing / opening commands), parameter configuration data (such as protection settings), and communication messages (IEC61850 MMS / GOOSE messages); second, equipment status data, including the real-time position status of circuit breakers, disconnectors, and grounding switches (collected via remote signaling interface, sampling frequency 10Hz), electrical parameters (voltage, current, power, sampling frequency 50Hz), and equipment alarm information (such as overload alarms and communication interruption alarms). The data collection method employs a non-intrusive design, acquiring communication messages through a mirror port and reading equipment status through the IEC61850 standard interface, without affecting the original data transmission link.

[0033] The collected raw data undergoes format conversion and feature extraction. Unstructured message data is parsed into key-value pair format (e.g., "Command.Type: CLOSE, Target: CB-01"), and device status data is uniformly converted into standardized status codes (e.g., "OPEN=0, CLOSE=1, ALARM=2") to generate standardized data suitable for rule engine processing. At the same time, timestamps (accurate to milliseconds) and data source identifiers are added.

[0034] A multi-threaded parallel computing architecture is adopted, allocating computing resources according to rule priority (4 threads for P1 level rules, 2 threads for P2 level rules, and 1 thread for P3 level rules), and scheduling rules in the security agent policy library to synchronously match normalized data. During the matching process, a subset of rules related to the current operation is first filtered based on the device ID, and then verified in order of priority to ensure that high-priority rules are matched first, thereby improving detection efficiency.

[0035] The system aggregates the matching results from each parallel computing unit, labels the vulnerability type according to a predefined vulnerability classification system (such as "operation timing violation" or "precondition failure violation"), and determines the risk level (high, medium, or low) by combining a multi-dimensional risk assessment model (vulnerability severity × business impact scope). It then generates structured vulnerability detection results, including information such as vulnerability ID, trigger time, involved devices, violation rules, and risk level.

[0036] Based on the vulnerability detection results, the methods for performing corresponding vulnerability protection operations include at least one of the following: operation command interception, abnormal alarm output, device status locking, and business process suspension. Specifically, based on the risk level of the vulnerability detection results, the corresponding protection response operations are performed as follows: When a vulnerability is classified as high-risk (P1 level), immediately execute a combination of operations including intercepting operation commands, locking device status, and outputting abnormal alarms. For example, if a vulnerability involving closing the circuit breaker with a grounding switch (high-risk) is detected, immediately intercept the closing command and prevent it from being sent to the hardware device; simultaneously, lock the operation permissions of the corresponding circuit breaker (prohibit subsequent similar commands); issue an alarm through the audible and visual alarm device of the substation monitoring master station, and simultaneously push the alarm information to the maintenance personnel's mobile APP (using HTTPS protocol for encrypted transmission). The alarm content includes "Vulnerability type: Closing with grounding switch; Affected devices: CB-01, GS-01; Recommended operation: Check the grounding switch status and disconnect it before retrying."

[0037] When a vulnerability is classified as medium risk (P2 level), the "abnormal alarm output + business process suspension" operation is executed. For example, when a "misoperational tripping of the isolating switch in a non-faulty area" command (medium risk) is detected, the current business process is suspended, the command is not intercepted but an alarm is issued, and the operation and maintenance personnel confirm before continuing to execute, so as to avoid business impact caused by misoperation.

[0038] When the risk level is low-risk (P3 level), only the "abnormal alarm output" operation is performed to record the vulnerability log to the security audit system for subsequent traceability and analysis, without affecting the normal operation of the current business process.

[0039] Example 2: Based on the same inventive concept, such as Figure 3 As shown, the present invention also provides a smart substation logic vulnerability protection system based on business rule objectification, including: a security protocol generation module 100 and a runtime protection module 200; The security protocol generation module 100 is configured to: acquire unstructured preset business rules of the smart substation; perform objectification processing on the preset business rules to obtain a standardized rule set; and construct a security proxy strategy library based on the standardized rule set. The runtime protection module 200 is configured to: collect real-time business data and equipment status data during the operation of the intelligent substation to form runtime context information; match and verify the runtime context information with the security agent policy library to obtain vulnerability detection results; and execute corresponding vulnerability protection response operations based on the vulnerability detection results.

[0040] Furthermore, such as Figure 2As shown, the runtime protection module 200 is deployed in the target application of the substation. Through dynamic hooking technology, it intercepts key business functions in the application (such as the `execute_control_command()` control command execution function and the `check_interlock()` interlocking check function). Before the function execution, a security verification process is triggered. If the verification passes, the original business logic is allowed to execute; otherwise, a protection response operation is executed. The hooking agent supports hot deployment and unloading, and the list of functions to be hooked can be flexibly configured through a configuration file to adapt to different application models.

[0041] When the substation business rules (such as the revision of operating procedures) change, the safety protocol generation module 100 re-collects the rules, regenerates the standardized rule set through the LLM model, updates the security agent policy library, and pushes it to all runtime protection modules. After receiving the update instruction, the runtime protection module automatically loads the new rule library without restarting the application, thus achieving dynamic adaptation of the protection policy.

[0042] Example 3: The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the intelligent substation logic vulnerability protection method based on business rule objectification described in Embodiment 1.

[0043] Example 4: The present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed by a processor, implements the intelligent substation logic vulnerability protection method based on business rule objectification as described in Embodiment 1.

[0044] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0045] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0046] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0047] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0048] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A method for intelligent substation logic vulnerability protection based on business rule objectification, characterized in that, The method comprises the following steps: acquiring unstructured preset business rules of the smart substation, and performing objective processing on the preset business rules to obtain a standardized rule set; constructing a security agent strategy library based on the standardized rule set; collecting real-time business data and equipment state data in the operation process of the smart substation to form runtime context information; matching and checking the runtime context information with the security agent strategy library to obtain a vulnerability detection result, and performing a corresponding vulnerability protection response operation according to the vulnerability detection result.

2. The method of claim 1, wherein the method is based on business rules objectification for intelligent substation logic vulnerability protection. The method for performing objective processing on the preset business rules to obtain a standardized rule set comprises the following steps: performing semantic analysis on the preset business rules to extract all target elements, wherein the target elements include an operation subject, a controlled device, an execution action, a precondition, a device association relationship and an instruction type; labeling each target element with a unique identity and recording its semantic origin in the source rule to establish traceable mapping between the elements and the source rule; performing structural conversion on the labeled target elements based on a preset logical expression format: first, completing mapping between each target element and an expression syntax unit, and then binding it with a standard logical node address of a device to generate a machine-readable structured initial rule; performing logical redundancy elimination and conflict detection on the structured initial rule, and finally outputting a conflict-free and non-redundant standardized rule set after consistency checking.

3. The method of claim 1, wherein the method is based on business rules objectification for intelligent substation logic vulnerability protection. The security agent strategy library contains inter-rule association constraints and abnormal judgment conditions.

4. The method of claim 3, wherein the method is based on business rules objectification for intelligent substation logic vulnerability protection. The method for constructing a security agent strategy library based on the standardized rule set comprises the following steps: obtaining historical vulnerability data and corresponding rule matching information from security audit logs, historical fault records and public vulnerability libraries of the smart substation; performing cleaning, denoising and key feature extraction on the data to form a structured vulnerability knowledge graph; using a mapping algorithm based on semantic similarity to associate and map the standardized rule set with the structured vulnerability knowledge graph; through a rule reasoning engine, the constraint conditions of business rules and the trigger modes of historical vulnerabilities are fused to generate an initial detection rule set with clear trigger conditions and vulnerability modes; establishing a multi-dimensional evaluation model based on vulnerability severity, business impact range and occurrence frequency to prioritize the initial detection rule set; according to the vulnerability type and the business module to which it belongs, the rules are classified and persistently stored in a rule database to finally construct a security agent strategy library that can be indexed and queried.

5. The method of claim 1, wherein the method is based on business rules objectification for intelligent substation logic vulnerability protection. The method for matching and checking the runtime context information with the security agent strategy library to obtain a vulnerability detection result comprises the following steps: performing feature extraction and format standardization on the runtime context information to generate standardized data suitable for rule engine processing; using a parallel computing architecture to schedule multiple detection rules in the security agent strategy library to perform synchronous matching and logical judgment on the standardized data; aggregating the judgment results of each parallel computing unit, labeling the specific vulnerability type and risk level according to a pre-defined vulnerability classification system and risk evaluation model, and finally generating a structured vulnerability detection result.

6. The method of claim 1, wherein the method is based on business rules objectification for intelligent substation logic vulnerability protection. The method for performing corresponding vulnerability protection operations according to the vulnerability detection result includes at least one of operation instruction interception, abnormality alarm output, device state lockout and business process suspension.

7. An intelligent substation logic vulnerability protection system based on business rule objectification, characterized in that, The method comprises: a security protocol generation module and a runtime protection module; The security protocol generation module is configured to: acquire unstructured preset business rules of the smart substation, perform objective processing on the preset business rules to obtain a standardized rule set, and construct a security agent policy library based on the standardized rule set; The runtime protection module is configured to: collect real-time business data and device state data in the operation process of the smart substation to form runtime context information, match and verify the runtime context information with the security agent policy library to obtain a vulnerability detection result, and perform corresponding vulnerability protection response operations according to the vulnerability detection result.

8. The intelligent substation logic vulnerability protection system based on business rule objectification of claim 7, wherein: The runtime protection module is deployed in a target application program of the substation.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the smart substation logical vulnerability protection method based on business rule objectification according to any one of claims 1-6. 10.A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the smart substation logical vulnerability protection method based on business rule objectification according to any one of claims 1-6.

Images