Risk early warning method and device for power plant industrial control system, and electronic equipment

Abstract

The invention discloses a risk early warning method and device for a power plant industrial control system and electronic equipment. The method comprises the following steps: acquiring target behavior data corresponding to a target change event of a power plant industrial control system under a real-time operation condition, and performing anomaly evaluation on the target behavior data according to a working condition operation baseline database to obtain each alarm element value corresponding to the target change event; and performing fusion calculation on all the alarm element values based on the element value weight corresponding to each alarm element value to obtain a target threat value corresponding to the target change event, and finally performing real-time risk early warning on the target change event according to a comparison result of the target threat value and a threat threshold. Through the early warning processing steps, a large amount of labor resource cost is saved, the requirements of high-precision and high-real-time risk early warning are met, and the use satisfaction degree of users is improved.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a risk warning method for power plant industrial control systems. Background Technology

[0002] In power plant industrial control systems, changes such as configuration downloads, permission alterations, abnormal logins, unauthorized peripheral access, and abnormal control command sequences can all damage the system or modify configuration data, leading to system crashes and paralysis, and causing unavoidable economic losses. Therefore, a risk warning method for power plant industrial control systems is needed. However, existing warning methods typically involve on-site inspections of equipment logs and documents by assessment personnel, combined with interviews and site visits, to analyze and classify information obtained on-site. This approach is not only inefficient but also fails to provide accurate and timely risk warnings, easily resulting in substantial economic losses and failing to meet user requirements. Summary of the Invention

[0003] This application provides a risk warning method, device, and electronic equipment for a power plant industrial control system, the technical solution of which is as follows:

[0004] In a first aspect, embodiments of this application provide a risk warning method for a power plant industrial control system, the method comprising:

[0005] The system acquires target behavior data corresponding to target change events that occur in the power plant's industrial control system under real-time operating conditions, and performs anomaly assessment on the target behavior data based on the operating condition baseline database to obtain the alarm element values ​​corresponding to the target change events. The operating condition baseline database is constructed through historical behavior datasets, and the alarm element values ​​include confidence value, impact range value, and impact degree value.

[0006] Based on the element value weights corresponding to each alarm element value, all alarm element values ​​are fused and calculated to obtain the target threat value corresponding to the target change event;

[0007] Real-time risk warnings are issued for target change events based on the comparison results between the target threat value and the threat threshold.

[0008] Secondly, a risk warning device for a power plant industrial control system is provided, the device comprising:

[0009] The evaluation module is used to acquire target behavior data corresponding to target change events that occur in the power plant's industrial control system under real-time operating conditions, and to perform anomaly evaluation on the target behavior data based on the operating condition baseline database to obtain the alarm element values ​​corresponding to the target change events. The operating condition baseline database is constructed through historical behavior datasets, and the alarm element values ​​include confidence value, impact range value, and impact degree value.

[0010] The calculation module is used to perform a fusion calculation on all the alarm element values ​​based on the element value weights corresponding to each alarm element value, so as to obtain the target threat value corresponding to the target change event.

[0011] The early warning module is used to provide real-time risk warnings for target change events based on the comparison results between the target threat value and the threat threshold.

[0012] Thirdly, an electronic device is provided, including a device processor and a memory;

[0013] The device processor is connected to the memory;

[0014] The memory is used to store executable program code;

[0015] The device processor runs a program corresponding to the executable program code stored in the memory to perform the steps of the method provided as in the first aspect or any possible implementation thereof.

[0016] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, the computer-readable storage medium storing instructions that, when executed on a computer or device processor, cause the computer or device processor to perform the method provided as in the first aspect or any possible implementation thereof.

[0017] The beneficial effects of the technical solutions provided in some embodiments of this application include at least the following:

[0018] In one or more embodiments of this application, target behavior data corresponding to target change events occurring in the power plant's industrial control system under real-time operating conditions is acquired. Anomaly assessment of the target behavior data is performed based on the operating condition baseline database to obtain alarm element values ​​corresponding to the target change event. Then, based on the element value weights corresponding to each alarm element value, all alarm element values ​​are fused and calculated to obtain the target threat value corresponding to the target change event. Finally, real-time risk warnings are issued for the target change event based on the comparison results between the target threat value and the threat threshold. Through these warning processing steps, not only are significant manual resource costs saved, but the requirements for high-accuracy and high-real-time risk warnings are also met, improving user satisfaction. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 A flowchart illustrating a risk warning method for a power plant industrial control system provided in this application embodiment;

[0021] Figure 2 A schematic diagram of the structure of a risk warning device for a power plant industrial control system provided in this application embodiment;

[0022] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0023] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0024] The terms "first," "second," "third," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or apparatuses.

[0025] The following description provides examples and does not limit the scope, applicability, or examples set forth in the claims. Changes may be made to the function and arrangement of the described elements without departing from the scope of this application. Various processes or components may be appropriately omitted, substituted, or added to the examples. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Furthermore, features described with respect to some examples may be combined into other examples.

[0026] Please see Figure 1 , Figure 1 This paper presents an overall flowchart of a risk warning method for a power plant industrial control system according to an embodiment of this application.

[0027] like Figure 1 As shown, the risk warning method for the power plant's industrial control system may include at least the following steps:

[0028] Step 101: Obtain target behavior data corresponding to target change events that occur in the power plant's industrial control system under real-time operating conditions, and perform anomaly assessment on the target behavior data based on the operating condition baseline database to obtain the alarm element values ​​corresponding to the target change events.

[0029] The operating condition baseline database is constructed using historical behavior datasets, and the alarm element values ​​include confidence value, impact range value, and impact degree value.

[0030] In this embodiment, since changes such as configuration downloads, permission changes, abnormal logins, unauthorized peripheral access, and abnormal control command sequences in power plant control systems can damage the system or modify configuration data, leading to system crashes and paralysis, and causing unavoidable economic losses, it is necessary to analyze the real-time operational data collected by the power plant control system through a controller to achieve real-time and accurate risk warnings. Specifically, this application selects the controller as the execution subject of the risk warning method for the power plant control system. When a behavior that conforms to predefined event characteristics is detected in the power plant control system under real-time operating conditions, it is marked as a target change event, and the associated original logs, operation context, timestamps, operation subjects, and other information are extracted to form structured target behavior data. The scope of extracted behavior data may include, but is not limited to, user login / logout logs, process start / stop records, file operation records, peripheral access events, configuration download / upload records, logic modification logs, operating status parameters, CPU load, etc.

[0031] Next, to facilitate the subsequent determination of the target threat value corresponding to the target behavior data, a baseline database for operational conditions can be constructed using historical behavior datasets. Specifically, the baseline database includes baseline behavior data corresponding to each operational condition, i.e., benchmark non-abnormal data, constructed using a large number of historical behavior datasets corresponding to historical test records. Further, anomaly assessment is performed on the target behavior data based on the constructed baseline database, that is, the baseline behavior data corresponding to the real-time operational conditions is compared with the target behavior data to obtain the alarm element values ​​corresponding to the target change event. These alarm element values ​​may include, but are not limited to, confidence values, impact range values, and impact degree values.

[0032] The credibility value reflects the likelihood that the event was malicious or an abnormal operation, the scope of impact value represents the range of devices, systems or business that the event may affect, and the degree of impact value reflects the severity of the consequences that the event may cause.

[0033] In one possible implementation, the method further includes:

[0034] Obtain the historical behavior dataset and determine the historical baseline behavior data corresponding to each historical operating condition in the historical behavior dataset;

[0035] By mapping and pairing each of the historical operating conditions with each of the historical baseline behavior data, an operating condition baseline database is obtained.

[0036] In this embodiment, when constructing the operating condition baseline database, it is necessary to first obtain a historical behavior dataset from a large number of historical test records. Since the historical behavior dataset includes historical abnormal behavior data and historical non-abnormal data corresponding to each historical operating condition, i.e., historical baseline behavior data, it is necessary to further filter out the historical baseline behavior data corresponding to each historical operating condition in the historical behavior dataset. Further, each historical operating condition is mapped and paired with each historical baseline behavior data, and the operating condition baseline database is constructed based on the paired mapping relationship. In the operating condition baseline database, each operating condition can have multiple historical baseline behavior data corresponding to it, i.e., each operating condition corresponds to a qualified data range.

[0037] In one possible implementation, the step of performing anomaly assessment on the target behavior data based on the operating condition baseline database to obtain the alarm element values ​​corresponding to the target change event includes:

[0038] Query the baseline behavior data corresponding to the real-time operating conditions according to the operating condition baseline database.

[0039] Anomaly assessment is performed on the target behavior data based on the data intervals corresponding to each baseline behavior data to obtain the alarm element values ​​corresponding to the target change event.

[0040] In this embodiment, when determining the alarm element values ​​corresponding to the target change event, it is necessary to first query the baseline behavior data that should correspond to the real-time operating condition based on the operating condition baseline database. Next, the data range corresponding to each baseline behavior data is statistically analyzed, and the target behavior data is anomaly assessed based on this data range. That is, anomaly assessment is performed by determining the extent to which the target behavior data exceeds this data range, thus obtaining the alarm element values ​​corresponding to the target change event. As an example, if the influence range data range corresponding to each baseline behavior data under a certain real-time operating condition is (0,1), and the target influence range data in the target behavior data is 2.4, then its corresponding influence range value is (2.4-1) / 1=1.4.

[0041] Step 103: Based on the element value weights corresponding to each alarm element value, perform a fusion calculation on all the alarm element values ​​to obtain the target threat value corresponding to the target change event.

[0042] In this embodiment of the application, after obtaining the alarm element values ​​corresponding to the target change event, since the alarm element values ​​include confidence value, scope of influence value and degree of influence value, and different alarm element values ​​have different reference weights, in order to fuse and calculate the alarm element values ​​and convert them into target threat values ​​of the same dimension, it is necessary to first determine the element value weights corresponding to each alarm element value, and then fuse and calculate all alarm element values ​​according to the element value weights to obtain the target threat value corresponding to the target change event.

[0043] In one possible implementation, the step of fusing and calculating all the alarm element values ​​based on the element value weights corresponding to each of the alarm element values ​​to obtain the target threat value corresponding to the target change event includes:

[0044] The element value weight corresponding to each alarm element value is determined based on the vector value corresponding to each alarm element value;

[0045] The target threat value corresponding to the target change event is obtained by calculating the weight of each element value and the alarm element value based on the weight fusion method.

[0046] In this embodiment of the application, after obtaining the values ​​of each alarm element, it is necessary to first calculate the vector value corresponding to each alarm element value according to the square root method. The specific calculation formula is as follows:

[0047]

[0048] in, Let i be the vector label of the alarm element. The ratio of the importance of alarm element i to alarm element j is a preset value, m=3.

[0049] Next, the weight of each alarm element value is calculated based on the calculated vector values. The specific calculation formula is as follows:

[0050]

[0051] in, The prime value weights of alarm element i, Let i be the vector label of the alarm element. Let m be the vector label of alarm element j, where m=3.

[0052] Furthermore, after obtaining the weights of each element value, the weights of each element value and the values ​​of each alarm element can be calculated using the weight fusion method to obtain the target threat value corresponding to the target change event. Specifically, the existing weight fusion formula can be used, or a threat value calculation formula can be specially defined.

[0053] In one possible implementation, the calculation of the weights of each element value and each alarm element value based on the weight fusion method to obtain the target threat value corresponding to the target change event includes:

[0054] For any of the alarm element values, determine the minimum value of the historical alarm element corresponding to the alarm element value based on the historical behavior dataset;

[0055] The ratio between each alarm element value and the minimum value of each corresponding historical alarm element is calculated.

[0056] The target threat value corresponding to the target change event is determined based on the weights of each element value and the ratio results.

[0057] In this embodiment, when calculating the target threat value corresponding to a target change event based on the weights of each element value and each alarm element value, for any alarm element value, the minimum value of the historical alarm element corresponding to that alarm element value can first be obtained from the historical behavior dataset. Next, the ratio between each alarm element value and its corresponding minimum historical alarm element value is calculated. Finally, the target threat value corresponding to the target change event is determined based on the weights of each element value and the ratio results. Specifically, the target threat value... The calculation formula is as follows:

[0058]

[0059] in, This is the credibility weight value. As the influence range weight value, To determine the weight of the degree of influence, This is the ratio of the confidence value corresponding to the target change event to the historical minimum confidence value. This is the ratio of the impact range of a target change event to the minimum historical impact range. The ratio of the impact value corresponding to the target change event to the historical minimum impact value.

[0060] Step 105: Provide real-time risk warnings for the target change event based on the comparison results between the target threat value and the threat threshold.

[0061] In this embodiment, after calculating the target threat value corresponding to the target change event, it is necessary to determine, according to a unified standard, whether an immediate warning is required under the target threat value condition, thereby meeting the requirements of high-precision and high-real-time warning. Specifically, a threat threshold can be preset, and the calculated target threat values ​​corresponding to each target change event are continuously compared with the threat threshold in real time to obtain the comparison results. When the comparison result indicates that the calculated target threat value exceeds the threat threshold, a real-time risk warning is issued for the target change event, and the target change event record is uploaded to the database. If the comparison result indicates that the calculated target threat value does not exceed the threat threshold, then the target change event does not require a real-time risk warning; only the target change event record needs to be uploaded to the database.

[0062] In one possible implementation, the step of providing real-time risk warning for the target change event based on the comparison result of the target threat value and the threat threshold includes:

[0063] The target threat value is compared with a threat threshold to obtain a comparison result. The threat threshold includes a first threat threshold and a second threat threshold, wherein the second threat threshold is greater than the first threat threshold.

[0064] In response to the comparison result indicating that the target threat value is greater than the second threat threshold, a first-level risk warning is issued for the target change event;

[0065] In response to the comparison result indicating that the target threat value is greater than the first threat threshold and not greater than the second threat threshold, a level-two risk warning is issued for the target change event;

[0066] In response to the comparison result indicating that the target threat value is not greater than the first threat threshold, the target change event is recorded.

[0067] In this embodiment, since the target threat values ​​vary in magnitude, multiple threat thresholds can be set to precisely determine the risk level of the target change event. These thresholds include a first threat threshold and a second threat threshold, with the second threat threshold being greater than the first threat threshold. As an example, the first threat threshold is set to 1, and the second threat threshold is set to 2. Next, the target threat value is compared with the threat thresholds to obtain the comparison result. When the comparison result indicates that the target threat value is greater than the second threat threshold, a first-level risk warning is issued for the target change event, i.e., an audible and visual alarm is triggered, and a red alarm message is pushed onto the monitoring screen. When the comparison result indicates that the target threat value is greater than the first threat threshold but not greater than the second threat threshold, a second-level risk warning is issued for the target change event, i.e., an audible and visual alarm is triggered, and a yellow alarm message is pushed onto the monitoring screen. When the comparison result indicates that the target threat value is not greater than the first threat threshold, the target change event is simply recorded and uploaded to the database.

[0068] In one possible implementation, the method further includes:

[0069] In response to the detection of the presence of the first-level or second-level risk warning, the target audio-visual flicker frequency is determined based on the risk warning level;

[0070] A visual and auditory warning is issued based on the target visual and auditory flashing frequency.

[0071] In this embodiment of the application, since the target threat value has different numerical values, the corresponding risk warning levels are different. If a unified sound and light warning standard is used for risk warning, it is impossible to quickly determine the risk level of the target change event based on the sound and light flashing frequency. Therefore, when a level one risk warning or a level two risk warning is detected, it is necessary to first determine the target sound and light flashing frequency based on the risk warning level, and then issue a sound and light warning based on the target sound and light flashing frequency.

[0072] As an example, when the risk warning level is Level 1, the audible and visual alarm flashes at a high frequency of 5Hz and emits a continuous buzzing sound. When the risk warning level is Level 2, the audible and visual alarm flashes at a low frequency of 1Hz and emits intermittent ringing sounds.

[0073] The foregoing has described specific embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0074] Please refer to the following. Figure 2 , Figure 2 A schematic diagram of a risk warning device for a power plant industrial control system provided in an embodiment of this application is shown. It should be noted that... Figure 2 The risk warning device of the power plant industrial control system shown is used to perform the functions described in this application. Figure 1 The methods shown in the embodiments are illustrated for ease of explanation, showing only the parts relevant to the embodiments of this application. For specific technical details not disclosed, please refer to this application. Figure 1 The example shown.

[0075] like Figure 2 As shown, the risk warning device of the power plant's industrial control system may include at least:

[0076] The evaluation module 201 is used to acquire target behavior data corresponding to target change events that occur in the power plant industrial control system under real-time operating conditions, and to perform anomaly evaluation on the target behavior data based on the operating condition baseline database to obtain the alarm element values ​​corresponding to the target change event. The operating condition baseline database is constructed through historical behavior datasets, and the alarm element values ​​include confidence value, impact range value, and impact degree value.

[0077] The calculation module 202 is used to perform a fusion calculation on all the alarm element values ​​based on the element value weights corresponding to each alarm element value to obtain the target threat value corresponding to the target change event;

[0078] The early warning module 203 is used to provide real-time risk warnings for target change events based on the comparison results between the target threat value and the threat threshold.

[0079] In one possible implementation, the evaluation module 201 is specifically used for:

[0080] Obtain the historical behavior dataset and determine the historical baseline behavior data corresponding to each historical operating condition in the historical behavior dataset;

[0081] By mapping and pairing each of the historical operating conditions with each of the historical baseline behavior data, an operating condition baseline database is obtained.

[0082] In one possible implementation, the evaluation module 201 is further configured to:

[0083] Query the baseline behavior data corresponding to the real-time operating conditions according to the operating condition baseline database.

[0084] Anomaly assessment is performed on the target behavior data based on the data intervals corresponding to each baseline behavior data to obtain the alarm element values ​​corresponding to the target change event.

[0085] In one possible implementation, the computing module 202 is specifically used for:

[0086] The element value weight corresponding to each alarm element value is determined based on the vector value corresponding to each alarm element value;

[0087] The target threat value corresponding to the target change event is obtained by calculating the weight of each element value and the alarm element value based on the weight fusion method.

[0088] In one possible implementation, the computing module 202 is further configured to:

[0089] For any of the alarm element values, determine the minimum value of the historical alarm element corresponding to the alarm element value based on the historical behavior dataset;

[0090] The ratio between each alarm element value and the minimum value of each corresponding historical alarm element is calculated.

[0091] The target threat value corresponding to the target change event is determined based on the weights of each element value and the ratio results.

[0092] In one possible implementation, the early warning module 203 is specifically used for:

[0093] The target threat value is compared with a threat threshold to obtain a comparison result. The threat threshold includes a first threat threshold and a second threat threshold, wherein the second threat threshold is greater than the first threat threshold.

[0094] In response to the comparison result indicating that the target threat value is greater than the second threat threshold, a first-level risk warning is issued for the target change event;

[0095] In response to the comparison result indicating that the target threat value is greater than the first threat threshold and not greater than the second threat threshold, a level-two risk warning is issued for the target change event;

[0096] In response to the comparison result indicating that the target threat value is not greater than the first threat threshold, the target change event is recorded.

[0097] In one possible implementation, the early warning module 203 is further used for:

[0098] In response to the detection of the presence of the first-level or second-level risk warning, the target audio-visual flicker frequency is determined based on the risk warning level;

[0099] A visual and auditory warning is issued based on the target visual and auditory flashing frequency.

[0100] Those skilled in the art will clearly understand that the technical solutions of the embodiments of this application can be implemented by means of software and / or hardware. In this application, "unit" and "module" refer to software and / or hardware that can independently complete or cooperate with other components to complete a specific function, wherein the hardware may be, for example, a field-programmable gate array (FPGA), an integrated circuit (IC), etc.

[0101] Each processing unit and / or module in the embodiments of this application can be implemented by an analog circuit that implements the functions described in the embodiments of this application, or by software that executes the functions described in the embodiments of this application.

[0102] Please refer to the following. Figure 3 , Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of this application is shown.

[0103] like Figure 3 As shown, the electronic device 300 may include at least one device processor 301, at least one network interface 304, a user interface 303, a memory 305, and at least one communication bus 302.

[0104] The communication bus 302 can be used to realize the connection and communication of the above components.

[0105] The user interface 303 may include buttons, and the optional user interface may also include a standard wired interface or a wireless interface.

[0106] The network interface 304 may include, but is not limited to, Bluetooth modules, NFC modules, Wi-Fi modules, etc.

[0107] The device processor 301 may include one or more processing cores. The device processor 301 connects to various parts within the electronic device 300 using various interfaces and lines. It executes various functions and processes data of the electronic device 300 by running or executing instructions, programs, code sets, or instruction sets stored in the memory 305, and by calling data stored in the memory 305. Optionally, the device processor 301 may be implemented using at least one hardware form of DSP, FPGA, or PLA. The device processor 301 may integrate one or more of the following: CPU, GPU, and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content required for display; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the device processor 301 and may be implemented as a separate chip.

[0108] The memory 305 may include RAM or ROM. Optionally, the memory 305 may include a non-transitory computer-readable medium. The memory 305 may be used to store instructions, programs, code, code sets, or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 305 may also be at least one storage device located remotely from the aforementioned device processor 301. Figure 3 As shown, the memory 305, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and program instructions.

[0109] Specifically, the device processor 301 can be used to call the risk warning application of the power plant industrial control system stored in the memory 305, and specifically perform the following operations:

[0110] The system acquires target behavior data corresponding to target change events that occur in the power plant's industrial control system under real-time operating conditions, and performs anomaly assessment on the target behavior data based on the operating condition baseline database to obtain the alarm element values ​​corresponding to the target change events. The operating condition baseline database is constructed through historical behavior datasets, and the alarm element values ​​include confidence value, impact range value, and impact degree value.

[0111] Based on the element value weights corresponding to each alarm element value, all alarm element values ​​are fused and calculated to obtain the target threat value corresponding to the target change event;

[0112] Real-time risk warnings are issued for target change events based on the comparison results between the target threat value and the threat threshold.

[0113] As an optional embodiment of this application, the method further includes:

[0114] Obtain the historical behavior dataset and determine the historical baseline behavior data corresponding to each historical operating condition in the historical behavior dataset;

[0115] By mapping and pairing each of the historical operating conditions with each of the historical baseline behavior data, an operating condition baseline database is obtained.

[0116] As an optional embodiment of this application, the step of performing anomaly assessment on the target behavior data based on the operating condition baseline database to obtain the alarm element values ​​corresponding to the target change event includes:

[0117] Query the baseline behavior data corresponding to the real-time operating conditions according to the operating condition baseline database.

[0118] Anomaly assessment is performed on the target behavior data based on the data intervals corresponding to each baseline behavior data to obtain the alarm element values ​​corresponding to the target change event.

[0119] As an optional embodiment of this application, the step of fusing and calculating all the alarm element values ​​based on the element value weights corresponding to each of the alarm element values ​​to obtain the target threat value corresponding to the target change event includes:

[0120] The element value weight corresponding to each alarm element value is determined based on the vector value corresponding to each alarm element value;

[0121] The target threat value corresponding to the target change event is obtained by calculating the weight of each element value and the alarm element value based on the weight fusion method.

[0122] As an optional embodiment of this application, the step of calculating the weights of each element value and each alarm element value based on the weight fusion method to obtain the target threat value corresponding to the target change event includes:

[0123] For any of the alarm element values, determine the minimum value of the historical alarm element corresponding to the alarm element value based on the historical behavior dataset;

[0124] The ratio between each alarm element value and the minimum value of each corresponding historical alarm element is calculated.

[0125] The target threat value corresponding to the target change event is determined based on the weights of each element value and the ratio results.

[0126] As an optional embodiment of this application, the step of providing real-time risk warning for the target change event based on the comparison result of the target threat value and the threat threshold includes:

[0127] The target threat value is compared with a threat threshold to obtain a comparison result. The threat threshold includes a first threat threshold and a second threat threshold, wherein the second threat threshold is greater than the first threat threshold.

[0128] In response to the comparison result indicating that the target threat value is greater than the second threat threshold, a first-level risk warning is issued for the target change event;

[0129] In response to the comparison result indicating that the target threat value is greater than the first threat threshold and not greater than the second threat threshold, a level-two risk warning is issued for the target change event;

[0130] In response to the comparison result indicating that the target threat value is not greater than the first threat threshold, the target change event is recorded.

[0131] As an optional embodiment of this application, the method further includes:

[0132] In response to the detection of the presence of the first-level or second-level risk warning, the target audio-visual flicker frequency is determined based on the risk warning level;

[0133] A visual and auditory warning is issued based on the target visual and auditory flashing frequency.

[0134] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the above-described method. The computer-readable storage medium may include, but is not limited to, any type of disk, including floppy disks, optical disks, DVDs, CD-ROMs, microdrives, as well as magneto-optical disks, ROMs, RAMs, EPROMs, EEPROMs, DRAMs, VRAMs, flash memory devices, magnetic cards or optical cards, nanosystems (including molecular memory ICs), or any type of medium or device suitable for storing instructions and / or data.

[0135] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0136] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0137] In the several embodiments provided in this application, it should be understood that the disclosed apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some service interface; the indirect coupling or communication connection between devices or units may be electrical or other forms.

[0138] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0139] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0140] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0141] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0142] The foregoing has described specific embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A risk early warning method for a power plant industrial control system, characterized in that, The method includes: The system acquires target behavior data corresponding to target change events that occur in the power plant's industrial control system under real-time operating conditions, and performs anomaly assessment on the target behavior data based on the operating condition baseline database to obtain the alarm element values ​​corresponding to the target change events. The operating condition baseline database is constructed through historical behavior datasets, and the alarm element values ​​include confidence value, impact range value, and impact degree value. Based on the element value weights corresponding to each alarm element value, all alarm element values ​​are fused and calculated to obtain the target threat value corresponding to the target change event; Real-time risk warnings are issued for target change events based on the comparison results between the target threat value and the threat threshold.

2. The method according to claim 1, characterized in that, The method further includes: Obtain the historical behavior dataset and determine the historical baseline behavior data corresponding to each historical operating condition in the historical behavior dataset; By mapping and pairing each of the historical operating conditions with each of the historical baseline behavior data, an operating condition baseline database is obtained.

3. The method according to claim 1, characterized in that, The step of performing anomaly assessment on the target behavior data based on the operating condition baseline database to obtain the alarm element values ​​corresponding to the target change event includes: Query the baseline behavior data corresponding to the real-time operating conditions according to the operating condition baseline database. Anomaly assessment is performed on the target behavior data based on the data intervals corresponding to each baseline behavior data to obtain the alarm element values ​​corresponding to the target change event.

4. The method according to claim 1, characterized in that, The step of fusing and calculating all the alarm element values ​​based on the element value weights corresponding to each alarm element value to obtain the target threat value corresponding to the target change event includes: The element value weight corresponding to each alarm element value is determined based on the vector value corresponding to each alarm element value; The target threat value corresponding to the target change event is obtained by calculating the weight of each element value and the alarm element value based on the weight fusion method.

5. The method according to claim 4, characterized in that, The calculation of the weights of each element value and each alarm element value based on the weighted fusion method to obtain the target threat value corresponding to the target change event includes: For any of the alarm element values, determine the minimum value of the historical alarm element corresponding to the alarm element value based on the historical behavior dataset; The ratio between each alarm element value and the minimum value of each corresponding historical alarm element is calculated. The target threat value corresponding to the target change event is determined based on the weights of each element value and the ratio results.

6. The method according to claim 1, characterized in that, The real-time risk warning for the target change event based on the comparison result of the target threat value and the threat threshold includes: The target threat value is compared with a threat threshold to obtain a comparison result. The threat threshold includes a first threat threshold and a second threat threshold, wherein the second threat threshold is greater than the first threat threshold. In response to the comparison result indicating that the target threat value is greater than the second threat threshold, a first-level risk warning is issued for the target change event; In response to the comparison result indicating that the target threat value is greater than the first threat threshold and not greater than the second threat threshold, a level-two risk warning is issued for the target change event; In response to the comparison result indicating that the target threat value is not greater than the first threat threshold, the target change event is recorded.

7. The method according to claim 6, characterized in that, The method further includes: In response to the detection of the presence of the first-level or second-level risk warning, the target audio-visual flicker frequency is determined based on the risk warning level; A visual and auditory warning is issued based on the target visual and auditory flashing frequency.

8. A risk early warning device for a power plant industrial control system, characterized in that, The device includes: The evaluation module is used to acquire target behavior data corresponding to target change events that occur in the power plant's industrial control system under real-time operating conditions, and to perform anomaly evaluation on the target behavior data based on the operating condition baseline database to obtain the alarm element values ​​corresponding to the target change events. The operating condition baseline database is constructed through historical behavior datasets, and the alarm element values ​​include confidence value, impact range value, and impact degree value. The calculation module is used to perform a fusion calculation on all the alarm element values ​​based on the element value weights corresponding to each alarm element value, so as to obtain the target threat value corresponding to the target change event. The early warning module is used to provide real-time risk warnings for target change events based on the comparison results between the target threat value and the threat threshold.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer-readable storage medium stores instructions that, when executed on a computer or processor, cause the computer or processor to perform the steps of the method as described in any one of claims 1-7.

Images