Power grid communication network security situation awareness method

Abstract

The invention relates to the technical field of situation awareness, and discloses a power grid communication network security situation awareness method, which comprises the following steps of: performing time sequence normalization processing on multi-source heterogeneous security logs and traffic data of a power grid network to obtain a multi-source security data set; performing power protocol association analysis on the multi-source security data set to obtain a security event sequence; constructing a power grid attack knowledge graph; performing association matching on the security event sequence and the power grid attack knowledge graph, and performing adaptive sensitivity weight evaluation on the operation state information of the power grid network to obtain a threat judgment result and confidence; carrying out situation analysis and quantification on the asset importance and the real-time load level of the power grid network to obtain a comprehensive security situation index; mapping the comprehensive security situation index to a preset early warning strategy response library to obtain an early warning signal and a protection strategy; according to the invention, the efficiency of power grid communication network security situation awareness can be improved.

Description

Technical Field

[0001] This invention relates to the field of situational awareness technology, and in particular to a method for situational awareness of power grid communication network security. Background Technology

[0002] During the operation of power grid communication networks, massive amounts of multi-source and heterogeneous security logs and traffic data are generated. Existing security situation awareness methods lack efficient time-series normalization processing schemes, making it impossible to transform data of different formats and sources into a unified standard for analysis. This results in lengthy data integration processes and makes it difficult to uncover potential correlations between data points. Furthermore, existing methods, when parsing power grid-specific communication protocols, do not fully consider the unique network topology and business logic of the power grid. Their extraction of protocol features from data packets is not accurate enough, failing to effectively distinguish between compliant operations and abnormal behavior. This leads to omissions or misjudgments in security event extraction, severely impacting the reliability of the foundational data for situation awareness.

[0003] Existing technologies have significant shortcomings in the construction of attack knowledge graphs and threat assessment. On the one hand, the analysis of entity relationships between historical attack cases, network topology, and asset lists is insufficient, failing to establish a complete chain of relationships between attack behaviors, vulnerabilities, network devices, and business assets. This results in insufficient relevance and completeness of the knowledge graph, and low accuracy in matching security events with attack knowledge. On the other hand, the threat assessment process lacks an adaptive sensitivity weight adjustment mechanism, failing to dynamically optimize assessment dimensions based on the real-time operating status of the power grid, business load levels, and the status of key nodes. This leads to insufficient confidence in threat judgment results and a lack of scientific rigor in the quantification of comprehensive security posture indicators. These two issues together result in untimely issuance of early warning signals and weakly targeted protection strategies by existing methods, making it difficult to meet the high-precision and real-time security posture awareness requirements of power grid communication networks. Summary of the Invention

[0004] This invention provides a method for power grid communication network security situation awareness to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides a method for power grid communication network security situation awareness, comprising:

[0006] S1. Perform time-series normalization processing on the multi-source heterogeneous security logs and traffic data of the power grid network to obtain the multi-source security dataset of the power grid network.

[0007] S2. Based on the network topology and power business logic of the power grid network, perform power protocol association parsing on the multi-source security dataset to obtain the security event sequence of the power grid network;

[0008] S3. Based on a general network security framework, perform entity association analysis on the historical attack case logs, network topology, and asset list of the power grid network to construct a power grid attack knowledge graph of the power grid network.

[0009] S4. The security event sequence is associated and matched with the power grid attack knowledge graph, and based on the association and matching results, an adaptive sensitivity weight evaluation is performed on the operation status information of the power grid network to obtain the threat determination result and confidence level of the operation status information.

[0010] S5. Based on the threat determination results and confidence levels, perform situational analysis and quantification on the asset importance and real-time load level of the power grid network to obtain the comprehensive security situation index of the power grid network.

[0011] S6. Map the comprehensive security situation indicators to a preset early warning strategy response library to obtain the early warning signals and protection strategies of the power grid network.

[0012] In a preferred embodiment, the step of performing time-series normalization processing on the multi-source heterogeneous security logs and traffic data of the power grid network to obtain the multi-source security dataset of the power grid network includes:

[0013] Extract traffic data from multi-source heterogeneous security logs and traffic mirroring ports of security probes in the power grid network;

[0014] The multi-source heterogeneous security logs and the traffic data are parsed using field protocols to obtain standard security log entries and standard traffic data records for the power grid network.

[0015] Based on a preset timeline, the standard security log entries and standard traffic data records are time-series aligned to obtain the security event data stream and network traffic data stream of the power grid network;

[0016] The security event data stream is encoded with event type features, and the network traffic data stream is statistically analyzed at the session level to obtain the event feature vector sequence and traffic feature vector sequence of the power grid network.

[0017] The event feature vector sequence and the flow feature vector sequence are fused and concatenated according to the time axis to obtain the multi-source security dataset of the power grid network.

[0018] In a preferred embodiment, the step of performing power protocol association parsing on the multi-source security dataset based on the network topology and power service logic of the power grid network to obtain a security event sequence of the power grid network includes:

[0019] Read the network topology of device connections in the power grid network and the power business logic of power grid business scheduling rules;

[0020] Based on the power business logic, logical consistency identification is performed on the data packets of the dedicated communication protocol for power communication networks in the multi-source security data set, and the data packets are deeply analyzed to obtain the protocol characteristics of the data packets;

[0021] Based on the network topology, the protocol features are mapped to source and destination devices in the power grid network. Combined with the power business logic and the power grid business scheduling rules, the compliance of the interaction between the source and destination devices represented by the protocol features is judged to obtain the initial associated events of the power grid network.

[0022] By performing a coupled analysis of the causality and temporality of the initial correlation events, the atomic safety events of the initial correlation events are obtained;

[0023] The security event sequence of the power grid network is obtained by sorting and numbering the events according to their timestamps.

[0024] In a preferred embodiment, the step of performing logical consistency identification on data packets of the dedicated communication protocol for power communication networks in the multi-source security data set based on the power service logic, and performing deep parsing on the data packets to obtain the protocol characteristics of the data packets, includes:

[0025] Based on the preset frame structure of the dedicated communication protocol for the power communication network, the data packets are formatted and verified to obtain compliant data packets of the multi-source security dataset.

[0026] The compliant data packets are validated for function codes, and valid data packets that fall within the permitted range of the power business logic are selected.

[0027] According to the message definition of the dedicated communication protocol for power communication networks, the message header fields of the valid data packets are extracted and parsed to obtain the message header feature information of the valid data packets;

[0028] Based on the data field structure corresponding to the function code, the payload data of the valid data packet is parsed to obtain the payload characteristic information of the valid data packet;

[0029] The header feature information and the payload feature information together constitute the protocol feature of the data packet.

[0030] In a preferred embodiment, the step of performing entity association analysis on historical attack case logs, network topology, and asset inventory of the power grid network based on a general network security framework to construct a power grid attack knowledge graph of the power grid network includes:

[0031] Structured data extraction is performed on the historical attack case logs, network topology, and asset list of the power grid network to obtain attack case data, node connection relationship data, and asset attribute data of the power grid network.

[0032] Based on the entity types defined in the general network security framework, attack behavior entities and vulnerability entities are extracted from the attack case data, network device entities from the node connection relationship data, and business asset entities from the asset attribute data.

[0033] Based on the association records in the historical attack case logs, the connection relationships in the network topology, and the ownership relationships in the asset list, establish a set of association relationships between the attack behavior entity, the vulnerability entity, the network device entity, and the business asset entity;

[0034] Consistency verification and redundancy merging are performed on the set of relationships, and the attack behavior entities, vulnerability entities, network device entities, and business asset entities are combined to construct a power grid attack knowledge graph for the power grid network.

[0035] In a preferred embodiment, establishing a set of association relationships between the attack entity, the vulnerability entity, the network device entity, and the business asset entity based on the association records in the historical attack case log, the connection relationships in the network topology, and the ownership relationships in the asset list includes:

[0036] Based on the associated records in the historical attack case logs, establish the causal relationship between the attacking entity and the vulnerable entity, as well as the impact path relationship between the attacking entity and the network device entity.

[0037] Based on the connection relationships in the network topology, establish physical and logical connection relationships between the network device entities;

[0038] Based on the ownership relationships in the asset list, establish the ownership and bearing association relationship between the network device entity and the business asset entity;

[0039] The causal relationships, the influence path relationships, the physical logical connection relationships, and the attribution bearer relationships are logically integrated and conflict-resolved to obtain a set of relationships between the attack behavior entity, the vulnerability entity, the network device entity, and the business asset entity.

[0040] In a preferred embodiment, the step of associating and matching the security event sequence with the power grid attack knowledge graph, and based on the association and matching results, performing an adaptive sensitivity weight evaluation on the operational status information of the power grid network to obtain the threat determination result and confidence level of the operational status information, includes:

[0041] Iterate through and extract the event types and related asset information of the security events in the security event sequence;

[0042] Based on the event type and the asset information involved, entity association retrieval is performed in the power grid attack knowledge graph to obtain the graph substructure of the security event;

[0043] Based on the integrity and threat level of the graph substructure, and combined with the real-time operating status information of the power grid network, the sensitivity weight coefficients of different evaluation dimensions in the real-time operating status information are dynamically adjusted.

[0044] Based on the adjusted sensitivity weight coefficients, the threat level of the operational status information is weighted and fused to obtain the threat determination result of the operational status information.

[0045] Based on the power grid attack knowledge graph, the confidence level of the threat determination result is calculated to obtain the confidence level of the threat determination result. The formula for calculating the confidence level is as follows:

[0046] ;

[0047] In the formula, The confidence level is... To match the dynamic weighting coefficients of coverage, This refers to the number of times that event attributes in the security event sequence are successfully matched with entity nodes in the graph substructure. The total number of event attributes that were attempted to be matched in the security event sequence. It is a natural constant. The dynamic weighting coefficients for the average matching degree. This is the arithmetic mean of the similarities between all successfully matched event attributes and graph nodes. For the dynamic weighting coefficient of the timeliness and completeness composite term, This refers to the information integrity index in the real-time operating status information. The preset time decay coefficient, This is the time difference between the current time and the average occurrence time of related historical attack cases in the aforementioned graph substructure.

[0048] In a preferred embodiment, the step of dynamically adjusting the sensitivity weight coefficients of different evaluation dimensions in the real-time operating status information based on the integrity and threat level of the graph substructure and in conjunction with the real-time operating status information of the power grid network includes:

[0049] The entity coverage and relation completeness in the graph substructure are evaluated in a coordinated manner to obtain the integrity evaluation value of the graph substructure.

[0050] Based on the historical harm levels of the attacking entities in the graph substructure, the threat level evaluation value of the graph substructure is determined;

[0051] The core elements of the real-time operating status information of the power grid network are parsed to obtain the current business load level and the status of key network nodes.

[0052] The integrity evaluation value, the threat level evaluation value, the current service load level, and the status of key network nodes are evaluated with multi-dimensional weights to obtain the weight adjustment amount of the real-time operating status information.

[0053] Based on the weight adjustment amount, the preset basic sensitivity weight coefficients in the power grid network are adjusted and updated to obtain the sensitivity weight coefficients of the power grid network.

[0054] In a preferred embodiment, the step of performing situational analysis and quantification on the asset importance and real-time load level of the power grid network based on the threat determination results and confidence levels to obtain a comprehensive security situation index for the power grid network includes:

[0055] Obtain the threat determination results and their corresponding confidence levels, the importance level data of assets in the power grid network, and the real-time load level data of key nodes in the power grid network;

[0056] The threat assessment results, the importance level data, and the real-time load level data are standardized to obtain standardized threat values, standardized asset importance values, and standardized load level values.

[0057] Based on the confidence level, the threat determination result is weighted and corrected to obtain the corrected threat information of the threat determination result;

[0058] The modified threat information is quantitatively fused and analyzed with the asset importance value and the load level value to obtain the multi-dimensional situation quantification value of the power grid network;

[0059] A risk assessment is performed on the multidimensional situation quantification values ​​to obtain the comprehensive security situation index of the power grid network.

[0060] In a preferred embodiment, mapping the comprehensive security situation indicators to a preset early warning strategy response library to obtain early warning signals and protection strategies for the power grid network includes:

[0061] The deviation between the comprehensive security situation index and the preset security situation level threshold is compared to obtain the security situation classification result of the comprehensive security situation index.

[0062] Based on the security situation classification results, a search and matching is performed in the preset early warning strategy response library to obtain the preliminary early warning signal and preliminary protection strategy of the security situation classification results.

[0063] Logical conflict verification and priority ranking are performed on the preliminary warning signals and preliminary protection strategies to obtain the candidate warning signal set and candidate protection strategy set of the security situation classification result;

[0064] Based on the current operating mode and strategy execution history of the power grid network, the candidate early warning signal set and candidate protection strategy set are simultaneously screened to obtain the early warning signals and protection strategies of the power grid network.

[0065] Compared with the prior art, the present invention has the following beneficial effects:

[0066] 1. This invention achieves efficient integration of multi-source heterogeneous security logs and traffic data through time-series normalization processing. Through field protocol parsing, time-series alignment, feature encoding, and fusion splicing, a unified and complete multi-source security dataset is formed, significantly improving the standardization and utilization efficiency of data processing. Based on the power grid network topology and power business logic, power protocol correlation analysis is performed to accurately extract the protocol features of data packets and complete compliance judgments. Combined with causal and temporal coupling analysis, an ordered sequence of security events is generated, ensuring the accuracy and consistency of security event perception and providing high-quality data support for subsequent situational analysis.

[0067] 2. The power grid attack knowledge graph constructed in this invention achieves comprehensive correlation between attack behaviors, vulnerabilities, network devices, and business assets, providing a rich and reliable knowledge foundation for security event matching. By dynamically adjusting threat assessment dimensions through adaptive sensitivity weight evaluation, and enhancing the credibility of threat judgment results through scientific confidence calculation, it further integrates asset importance and real-time load levels to complete multi-dimensional situational quantification, forming a comprehensive security situational indicator that accurately reflects the power grid's security status. The early warning signals and protection strategies generated based on this indicator, after logical conflict verification and targeted screening, possess strong adaptability and specificity, effectively improving the accuracy, real-time performance, and effectiveness of power grid communication network security situational awareness and protection response. Attached Figure Description

[0068] Figure 1 This is a flowchart illustrating a method for assessing the network security situation of a power grid communication network according to an embodiment of the present invention.

[0069] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0070] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0071] This application provides a method for power grid communication network security situation awareness. The executing entity of this method includes, but is not limited to, at least one of the following electronic devices that can be configured to execute the method provided in this application: a server, a terminal, etc. In other words, the method for power grid communication network security situation awareness can be executed by software or hardware installed on a terminal device or a server device. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster. The server can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0072] Reference Figure 1 The diagram shown is a flowchart illustrating a power grid communication network security situation awareness method according to an embodiment of the present invention. In this embodiment, the power grid communication network security situation awareness method includes:

[0073] S1. Perform time-series normalization processing on the multi-source heterogeneous security logs and traffic data of the power grid network to obtain the multi-source security dataset of the power grid network.

[0074] In this embodiment of the invention, the step of performing time-series normalization processing on the multi-source heterogeneous security logs and traffic data of the power grid network to obtain the multi-source security dataset of the power grid network includes:

[0075] Extract traffic data from multi-source heterogeneous security logs and traffic mirroring ports of security probes in the power grid network;

[0076] The multi-source heterogeneous security logs and the traffic data are parsed using field protocols to obtain standard security log entries and standard traffic data records for the power grid network.

[0077] Based on a preset timeline, the standard security log entries and standard traffic data records are time-series aligned to obtain the security event data stream and network traffic data stream of the power grid network;

[0078] The security event data stream is encoded with event type features, and the network traffic data stream is statistically analyzed at the session level to obtain the event feature vector sequence and traffic feature vector sequence of the power grid network.

[0079] The event feature vector sequence and the flow feature vector sequence are fused and concatenated according to the time axis to obtain the multi-source security dataset of the power grid network.

[0080] The power grid network is equipped with various security monitoring probes, such as intrusion detection probes, vulnerability scanning probes, and firewall probes. Each type of security probe is configured with a dedicated data acquisition channel. The acquisition channel reads the native multi-source heterogeneous security logs from the local log storage module of each security probe at a fixed acquisition frequency of once per second. At the same time, data packet capture channels are configured on the traffic mirroring ports of the core switches and routers of the power grid network. The packet capture channels use network data packets as the smallest acquisition unit to capture all network traffic data transmitted in the traffic mirroring ports in real time. During the acquisition process, a unique device source identifier is added to each extracted multi-source heterogeneous security log and traffic data to ensure the uniqueness of data traceability. Finally, the extraction of multi-source heterogeneous security logs and traffic data from traffic mirroring ports of the security probes in the power grid network is completed.

[0081] For the extracted multi-source heterogeneous security logs, according to the preset log field parsing specifications, field extraction, field format unification, and invalid field removal operations are performed on the logs generated by different security probes. The field extraction covers core fields such as device identifier, event occurrence time, event type, source address, and destination address. Field format unification converts different format time fields into a unified YYYY-MM-DDHH:MM:SS format and converts address fields into decimal IP address format. Invalid field removal removes all garbled fields and null value fields that have no actual business meaning. For the extracted traffic data, according to the parsing rules of the TCP / IP five-layer network protocol, the protocol fields of the link layer, network layer, transport layer, and application layer are parsed from the network data packets layer by layer. The core fields parsed include the source MAC address, destination MAC address, source IP address, destination IP address, transport layer protocol type, port number, data packet length, and data transmission time. After parsing, each parsed log data is encapsulated according to a unified field structure to form a standard security log entry, and each parsed traffic data packet is encapsulated according to a unified protocol field structure to form a standard traffic data record.

[0082] The preset timeline is a continuous time series with 1-second intervals. The time range of the timeline covers the maximum and minimum values ​​of event occurrence time and data transmission time in all standard security log entries and standard traffic data records. For each standard security log entry, its encapsulated event occurrence time field is extracted and matched to the corresponding 1-second time interval in the preset timeline. All standard security log entries within the same time interval are arranged in chronological order of event occurrence, forming an ordered log data sequence indexed by the timeline. For each standard traffic data record, its encapsulated data transmission time field is extracted and matched to the corresponding 1-second time interval in the preset timeline. All standard traffic data records within the same time interval are arranged in chronological order of data transmission, forming an ordered traffic data sequence indexed by the timeline. The ordered log data sequence indexed by the timeline is defined as the security event data stream of the power grid network, and the ordered traffic data sequence indexed by the timeline is defined as the network traffic data stream of the power grid network, thus completing the time sequence alignment of standard security log entries and standard traffic data records.

[0083] For security event data streams, the first step is to identify all possible security event types in the power grid network and create a fixed event type coding table. Each unique security event type is assigned a unique numerical code. For all standard security log entries within each 1-second time interval indexed by the time axis in the security event data stream, the event type field of each entry is extracted and matched against the numerical code in the coding table. All numerical codes within the same time interval are padded with a fixed length of 128 bits. If there are no security log entries in the interval, they are padded with 0. If the number of codes in the interval exceeds 128 bits, the first 128 bits are truncated according to the chronological order of the events, forming a one-dimensional event feature vector corresponding to each time interval on the time axis. All event feature vectors corresponding to all time intervals are arranged sequentially according to the time axis to form the event feature vector sequence of the power grid network. For network traffic data streams… First, all standard traffic data records in the network traffic data stream are divided into sessions based on the five-tuple characteristics of source IP address, destination IP address, transport layer protocol type, source port number, and destination port number. Each unique five-tuple characteristic corresponds to an independent network session. For each network session after division, combined with the 1-second time interval of the time axis, the total number of data packets, the total length of data packets, and the data transmission rate of the corresponding session within each time interval are counted. If there is no corresponding traffic data for a session within a certain time interval, the values ​​of the three characteristics are all recorded as 0. The values ​​of the three core traffic characteristics of all network sessions within each time interval are arranged sequentially according to the preset session sorting rules to form a one-dimensional traffic feature vector corresponding to each time interval of the time axis. The traffic feature vectors corresponding to all time intervals are arranged sequentially according to the time axis to form the traffic feature vector sequence of the power grid network.

[0084] Extract each event feature vector from the event feature vector sequence that corresponds one-to-one with each 1-second time interval of the preset time axis. Simultaneously, extract each flow feature vector from the flow feature vector sequence that corresponds one-to-one with each 1-second time interval of the preset time axis. For each 1-second time interval in the time axis, concatenate the event feature vector and the flow feature vector end-to-end, that is, directly connect the last feature value of the event feature vector with the first feature value of the flow feature vector to form a fused feature vector corresponding to that time interval. Arrange the fused feature vectors corresponding to all 1-second time intervals in the preset time axis in chronological order according to the time axis to form a fused feature vector sequence indexed by the time axis. Associate and encapsulate this fused feature vector sequence with the corresponding time axis index information and device source identification information. The encapsulated overall data structure is the multi-source security dataset of the power grid network.

[0085] S2. Based on the network topology and power business logic of the power grid network, perform power protocol association parsing on the multi-source security dataset to obtain the security event sequence of the power grid network;

[0086] In this embodiment of the invention, the step of performing power protocol association parsing on the multi-source security dataset based on the network topology and power business logic of the power grid network to obtain the security event sequence of the power grid network includes:

[0087] Read the network topology of device connections in the power grid network and the power business logic of power grid business scheduling rules;

[0088] Based on the power business logic, logical consistency identification is performed on the data packets of the dedicated communication protocol for power communication networks in the multi-source security data set, and the data packets are deeply analyzed to obtain the protocol characteristics of the data packets;

[0089] Based on the network topology, the protocol features are mapped to source and destination devices in the power grid network. Combined with the power business logic and the power grid business scheduling rules, the compliance of the interaction between the source and destination devices represented by the protocol features is judged to obtain the initial associated events of the power grid network.

[0090] By performing a coupled analysis of the causality and temporality of the initial correlation events, the atomic safety events of the initial correlation events are obtained;

[0091] The security event sequence of the power grid network is obtained by sorting and numbering the events according to their timestamps.

[0092] Based on the power service logic, the data packets of the dedicated communication protocol for the power communication network in the multi-source security data set are logically consistent, and the data packets are deeply parsed to obtain the protocol characteristics of the data packets, including:

[0093] Based on the preset frame structure of the dedicated communication protocol for the power communication network, the data packets are formatted and verified to obtain compliant data packets of the multi-source security dataset.

[0094] The compliant data packets are validated for function codes, and valid data packets that fall within the permitted range of the power business logic are selected.

[0095] According to the message definition of the dedicated communication protocol for power communication networks, the message header fields of the valid data packets are extracted and parsed to obtain the message header feature information of the valid data packets;

[0096] Based on the data field structure corresponding to the function code, the payload data of the valid data packet is parsed to obtain the payload characteristic information of the valid data packet;

[0097] The header feature information and the payload feature information together constitute the protocol feature of the data packet.

[0098] Structured data on device connection relationships is retrieved from the topology management system of the power grid network. This data includes the physical identifiers, device types, physical connection link information between devices, and link transmission attributes of all power communication devices. Simultaneously, standardized documents of power business logic are retrieved from the power grid business dispatch management platform, and power grid business dispatch rules are extracted from them. These rules cover the execution process of various power businesses, the scope of devices for business interaction, the transmission specifications of business data, and the permission requirements for business operations. All retrieved topology relationship data and business logic rules are stored in a unified structured format to ensure the convenience of data retrieval during subsequent parsing. This completes the reading of the network topology relationship of device connection relationships and the power business logic of power grid business dispatch rules in the power grid network.

[0099] All data packets carrying the identifier of the dedicated communication protocol for power communication networks are extracted from the multi-source security dataset. Based on the power business data transmission specifications defined in the power business logic, the composition, order, and value range of the protocol fields in the data packets are checked to ensure they fully match the transmission specifications. If a data packet lacks a preset core field, the order of fields does not conform to the transmission specifications, or the field values ​​exceed the legal range defined by the transmission specifications, it is deemed logically inconsistent and the data packet is removed. If all protocol-related attributes match the transmission specifications, it is deemed logically consistent and the data packet is retained. For the retained logically consistent data packets, the protocol structure is disassembled layer by layer according to the parsing standard of the dedicated communication protocol for power communication networks. Core content such as service type, operation instructions, data transmission direction, device interaction identifier, and service execution time is extracted from the data packets. All extracted core content is integrated and encapsulated to form the protocol features corresponding to the data packet, thus completing the logical consistency identification and deep parsing of data packets based on the dedicated communication protocol for power communication networks according to the power business logic.

[0100] The device interaction identifiers are extracted from the protocol features, and the source and destination device identifiers corresponding to the data packets are separated. By comparing these identifiers with all physical device identifiers and device connection relationships recorded in the power grid network topology, the protocol features are precisely associated with the corresponding source and destination devices. This achieves a mapping of protocol features to source and destination devices in the power grid network. Power grid business scheduling rules are retrieved from the power business logic. Combined with the mapped source and destination device types and permissions, the business type and operation instructions corresponding to the operation represented by the protocol features are verified to ensure they conform to the business interaction specifications between source and destination devices. Simultaneously, it is verified whether the operation is within the scope of the power grid business. Within the scope of legitimate business execution defined by the service scheduling rules, if the operation represented by the protocol features conforms to the business interaction specifications of the source and destination devices and is within the scope of legitimate business execution, the operation is deemed compliant and the corresponding protocol features and device mapping relationship is retained. If the operation does not conform to the business interaction specifications or exceeds the scope of legitimate business execution, the operation is deemed non-compliant and the non-compliance type is marked. The compliant protocol features, device mapping relationships, non-compliant protocol features, device mapping relationships, and non-compliance types are integrated, and a unique event identifier is assigned to each integrated set of content to form the initial associated event of the power grid network, thus completing the device mapping and operation compliance judgment of the protocol features.

[0101] Extract event identifiers, business execution times, operation instructions, device interaction information, and compliance judgment results from all initial related events. Arrange the initial related events in chronological order of business execution time, and analyze the operation instruction and device interaction relationships between different initial related events. Determine whether the execution of a preceding event provides a prerequisite for the occurrence of a subsequent event. If the execution of a preceding event is a necessary prerequisite for the occurrence of a subsequent event, a causal relationship is determined; otherwise, no causal relationship is determined. Simultaneously, verify whether the business execution times of related initial related events comply with the business operation timing requirements stipulated in the power business logic. If the intervals of business execution times conform to the timing requirements... If the timing matches, the timing is deemed reasonable. If the time interval does not match the timing requirements, the timing is deemed abnormal. Multiple initial related events with causal relationships and reasonable timing are merged and integrated, and duplicate information is removed. Individual initial related events without causal relationships and with independent timing are directly retained. Information standardization is performed on both the merged and integrated event groups and the directly retained individual events to extract core event elements, including the source and destination devices involved in the event, the corresponding business type, operation instructions, compliance status, event occurrence time, and causal relationship information. The sorted core event elements are encapsulated to form atomic safety events of the power grid network, completing the causal and timing coupling analysis of the initial related events.

[0102] The event timestamp is extracted from the core event elements of each atomic safety event. This timestamp maintains the same time format as the preset timeline of the multi-source safety dataset. All atomic safety events are globally ordered according to their event timestamps from earliest to latest. The ordered atomic safety events are then sequentially numbered, with each number serving as a unique sequence identifier. The core event elements of each atomic safety event are associated with and bound to their corresponding sequence identifiers, ensuring that each atomic safety event has a unique sequence identifier and is arranged in timestamp order. All atomic safety events with completed sequence identifier binding and ordered by timestamps are integrated to form an ordered set of events arranged in chronological order. This ordered set of events is the safety event sequence of the power grid network, thus completing the sorting and numbering of atomic safety events and the generation of the safety event sequence.

[0103] The pre-defined frame structure in the dedicated communication protocol for power communication networks is retrieved. This frame structure clearly defines the constituent modules of the data packets, the fixed arrangement order of each module, the byte length of each module, and the fixed character identifiers for the frame start and frame end symbols. The data packets of the dedicated communication protocol for power communication networks in the multi-source security dataset are decomposed byte by byte according to this pre-defined frame structure. The decomposed data packets are checked to see if they contain all the pre-defined constituent modules, if the arrangement order of each module is completely consistent with the pre-defined frame structure, if the actual byte length of each module is consistent with the pre-defined length, and if the beginning and end of the data packets are the pre-defined frame start and frame end symbols. At the same time, the integrity of the data packet check fields is verified according to the verification method specified in the protocol. Only data packets with complete constituent modules, correct arrangement order, matching byte length, compliant start and end characters, and passed check field verification are retained. These retained data packets are the compliant data packets of the multi-source security dataset.

[0104] The original values ​​of the function code fields are extracted from the specified modules of the compliant data packets. The predefined allowed range of function codes in the power business logic is retrieved. This range includes all function code values ​​corresponding to legitimate power businesses such as grid dispatching, data acquisition, equipment control, and status feedback. The extracted original values ​​of the function codes are compared one by one with all values ​​in the allowed range. Only compliant data packets whose function code values ​​completely match a certain value in the allowed range are retained. The data packets retained after this filtering are the valid data packets.

[0105] The message definition for the message header in the dedicated communication protocol for power communication networks is retrieved. This definition clarifies all fixed fields included in the message header, the order of these fields, the byte length of each field, and the data type. Following the specifications of this message definition, the message header area of ​​the valid data packet is disassembled and extracted field by field in order of field arrangement. The extracted field values ​​are then standardized, converting address fields to the unified device encoding format of the power communication network and time fields to a time format consistent with the time axis used for time normalization of the multi-source security dataset. All standardized message header fields and their corresponding values ​​are then structured, integrated, and encapsulated. The encapsulated structured information constitutes the message header feature information of the valid data packet.

[0106] Based on the verified function code value in the valid data packet, the data field structure uniquely corresponding to that function code in the dedicated communication protocol for power communication networks is retrieved. This data field structure clearly defines the field composition of the corresponding load data, the order of each field, the byte length of each field, the data type, and the legal value range. The load data area of ​​the valid data packet is disassembled field by field according to this data field structure. The original value of each field is extracted and verified to be within the legal value range defined by the corresponding data field structure. Only the load data extraction results where all field values ​​meet the legal range requirements are retained. The extraction results are then structured and organized, and additional information such as the overall byte length of the load data and the data transmission direction identifier are recorded. The organized field values ​​and additional information are integrated and encapsulated. The encapsulated structured information is the load characteristic information of the valid data packet.

[0107] Extract all structured content from the header feature information corresponding to the valid data packet, and simultaneously extract all structured content from the load feature information corresponding to the valid data packet. Assign a unique identifier to both types of feature information that is consistent with the corresponding data packet in the multi-source security dataset. Integrate the header feature information and load feature information into a whole according to the message structure order specified in the dedicated communication protocol for power communication networks. During the integration process, retain all valid content of both types of feature information without any deletion. Standardize and encapsulate the integrated overall structured information. The encapsulated set of structured information is the protocol feature of the data packet.

[0108] S3. Based on a general network security framework, perform entity association analysis on the historical attack case logs, network topology, and asset list of the power grid network to construct a power grid attack knowledge graph of the power grid network.

[0109] In this embodiment of the invention, the step of performing entity association analysis on the historical attack case logs, network topology, and asset list of the power grid network based on a general network security framework to construct a power grid attack knowledge graph of the power grid network includes:

[0110] Structured data extraction is performed on the historical attack case logs, network topology, and asset list of the power grid network to obtain attack case data, node connection relationship data, and asset attribute data of the power grid network.

[0111] Based on the entity types defined in the general network security framework, attack behavior entities and vulnerability entities are extracted from the attack case data, network device entities from the node connection relationship data, and business asset entities from the asset attribute data.

[0112] Based on the association records in the historical attack case logs, the connection relationships in the network topology, and the ownership relationships in the asset list, establish a set of association relationships between the attack behavior entity, the vulnerability entity, the network device entity, and the business asset entity;

[0113] Consistency verification and redundancy merging are performed on the set of relationships, and the attack behavior entities, vulnerability entities, network device entities, and business asset entities are combined to construct a power grid attack knowledge graph for the power grid network.

[0114] The step of establishing a set of association relationships between the attack entity, the vulnerability entity, the network device entity, and the business asset entity based on the association records in the historical attack case logs, the connection relationships in the network topology, and the ownership relationships in the asset list includes:

[0115] Based on the associated records in the historical attack case logs, establish the causal relationship between the attacking entity and the vulnerable entity, as well as the impact path relationship between the attacking entity and the network device entity.

[0116] Based on the connection relationships in the network topology, establish physical and logical connection relationships between the network device entities;

[0117] Based on the ownership relationships in the asset list, establish the ownership and bearing association relationship between the network device entity and the business asset entity;

[0118] The causal relationships, the influence path relationships, the physical logical connection relationships, and the attribution bearer relationships are logically integrated and conflict-resolved to obtain a set of relationships between the attack behavior entity, the vulnerability entity, the network device entity, and the business asset entity.

[0119] Historical attack case logs were retrieved from the power grid network's security log storage system, raw network topology data from the network topology management platform, and raw asset list data from the asset management system. For the historical attack case logs, core information was extracted according to fixed dimensions: attack time, attack origin, attack target, attack method, exploited vulnerability, attack impact, and response measures. Garbled fields, duplicate records, and meaningless null values ​​were removed from the logs, and the extracted core information was structured and encapsulated according to a unified field structure. For the raw network topology data, core information such as the unique identifier of all network devices, physical connection links between devices, logical communication relationships, and link transmission attributes were extracted. Invalid connection records were removed, forming structured node connection relationship data. For the raw asset list data, core information such as the name, type, deployment location, business module, associated network devices, asset operating status, and security protection level of all power business assets was extracted. Duplicate asset records were removed, forming structured asset attribute data. This process of extracting structured data from the three types of raw data yielded attack case data, node connection relationship data, and asset attribute data for the power grid network.

[0120] The system retrieves predefined entity types and core characteristic definition standards for each entity type from the general network security framework. Based on these standards, it extracts all core information representing attack behaviors from attack case data, treating each independent attack behavior as an attack behavior entity. Each attack behavior entity is assigned a unique entity identifier and bound to corresponding core characteristic information. Simultaneously, it extracts all core information representing vulnerabilities from the attack case data, treating each independent vulnerability as a vulnerability entity, assigning each vulnerability entity a unique entity identifier and binding corresponding core characteristic information. Based on the entity type definition standards of the general network security framework, it extracts all core information representing network devices from node connection relationship data, treating each independent network device as a network device entity, assigning each network device entity a unique entity identifier and binding corresponding core characteristic information. Finally, based on the entity type definition standards of the general network security framework, it extracts all core information representing business assets from asset attribute data, treating each independent business asset as a business asset entity, assigning each business asset entity a unique entity identifier and binding corresponding core characteristic information.

[0121] The process involves: 1) Reviewing the original correlation records in historical attack case logs to extract direct correlation information between attack behaviors and vulnerabilities, attack behaviors and target network devices, and attack behaviors and target business assets. Based on this information, establishing correlations between attack entities and vulnerability entities, attack entities and network device entities, and attack entities and business asset entities. 2) Reviewing the connection relationships in the network topology to extract correlation information between physical connections and logical communication between network device entities. Based on this information, establishing correlations between network device entities. 3) Reviewing the ownership relationships in the asset list to extract correlation information between business asset entities and their respective network device entities, and between business asset entities and other business asset entities under the same business module. Based on this information, establishing correlations between business asset entities and network device entities, and between business asset entities and other business asset entities. Each established entity correlation is clearly labeled with a correlation type. All labeled entity correlations are then integrated and organized to form a correlation set containing all entity correlation information.

[0122] By comparing the original content of attack case data, node connection relationship data, and asset attribute data of the power grid network, each group of entity relationships in the relationship set is checked one by one. The labeling type and associated entity objects of the relationships are verified to ensure they completely match the records in the original data. Invalid relationships that contradict the original data records or lack supporting data are eliminated, thus completing the consistency verification of the relationship set. The relationship set after consistency verification is then traversed and sorted. Multiple relationships with completely identical labeling types between two identical entities are merged into a single relationship, preserving all core elements of that relationship during the merging process. The information is not deleted, and the redundancy of the association set is merged. The merged association set is then integrated with the extracted attack behavior entities, vulnerability entities, network device entities, and business asset entities. According to the knowledge graph construction specifications, each type of entity is used as a node of the knowledge graph. Each node is assigned a unique entity identifier and core feature information. The relationships between entities in the association set are used as edges of the knowledge graph. Each edge is assigned a corresponding association type and association information. Through the orderly association of nodes and edges, a complete graph structure is formed. This graph structure is the power grid attack knowledge graph of the power grid network.

[0123] Extract all related records from historical attack case logs, match each extracted attack entity with a vulnerability entity, and bind each attack entity exploiting a vulnerability to the corresponding vulnerability entity based on the specific vulnerability exploitation record in the log. Label this type of association with a causal relationship type and record the association based on the specific vulnerability exploitation record in the historical attack case logs. Simultaneously, assign a unique association identifier to each pair of attack entities and vulnerability entities. This identifier is bound to the unique identifiers of both entities and the retrieval information of the log association record. Finally, extract information on all network devices involved in the attack from the association records in the historical attack case logs. Information includes the directly targeted network devices and intermediate network devices in the attack propagation process. Based on the actual attack propagation path in the logs, an impact path association is established between the attacking entity and each involved network device entity. The path node attributes of this type of association are marked and the association is recorded based on the attack propagation records in historical attack case logs. A unique association identifier is assigned to each group of impact path associations between attacking entities and network device entities. This identifier is bound to the unique identifiers of both entities and the retrieval information of the log association records, thus completing the establishment of the causal association between attacking entities and vulnerable entities, and the impact path association between attacking entities and network device entities.

[0124] The system retrieves network topology data from the power grid network and extracts connection information between all network device entities, including the medium type, connection port, and link connectivity of physical connection links, as well as routing and forwarding rules, port mapping relationships, and communication protocol types for logical communication relationships. For each pair of network device entities with actual physical connection or logical communication relationship, a corresponding physical-logical connection association is established. This association is labeled with a specific sub-type and the association is recorded based on the specific connection record in the network topology. A unique association identifier is assigned to each pair of network device entities' physical-logical connection associations. This identifier is bound to the unique identifiers of both entities and the retrieval information of the network topology connection record. All pairings of network device entities without actual physical connection and logical communication relationship are eliminated, ensuring that all established physical-logical connection associations are effectively supported by network topology data. This completes the establishment of physical-logical connection associations between network device entities.

[0125] The system retrieves asset inventory data from the power grid network and extracts the ownership information of all business asset entities and network equipment entities, including the actual deployment location of the business asset entity, the hardware resource carrier on which it operates, and the network equipment management domain to which it belongs. For each business asset entity and network equipment entity with a deployment or management ownership relationship, a precise match is performed to establish a corresponding ownership association. This association is labeled with a specific sub-type and recorded based on the specific ownership record in the asset inventory. A unique association identifier is assigned to each pair of network equipment entities and business asset entities, and this identifier is bound to the unique entity identifier of both parties and the retrieval information of the asset inventory record. All network equipment entities and business asset entities without deployment or management ownership relationships are excluded from pairing, ensuring that all established ownership associations are effectively supported by asset inventory data. This completes the establishment of ownership associations between network equipment entities and business asset entities.

[0126] The established causal relationships, influence path relationships, physical and logical connection relationships, and attribution carrier relationships are uniformly sorted according to a fixed structured format of entity unique identifier pairs, relationship types, subtypes, identifiers, and basis for association, forming a standardized set of relationships to be processed. Conflict judgment criteria are established: relationships with the same entity unique identifier but different relationship types without supporting original data are considered type conflicts; relationships with the same basis that contradict the original data in historical attack case logs, network topology, and asset lists are considered basis conflicts. The set of relationships to be processed is then checked against these criteria one by one. Relationships with type conflicts are combined with the original data... The data verification process verifies the true types of relationships and retains only one valid type. For relationships with conflicts, those without valid original data support are directly removed, while valid relationships with original data support are retained. After resolving conflicts in all relationships, all valid relationships are globally logically integrated, retaining all structured information of each group of relationships without any deletion. A globally unique relationship set identifier is assigned to all integrated valid relationships. All valid relationships with global identifiers are structurally encapsulated as a whole. The encapsulated structured set is the relationship set between attack entities, vulnerability entities, network device entities, and business asset entities.

[0127] S4. The security event sequence is associated and matched with the power grid attack knowledge graph, and based on the association and matching results, an adaptive sensitivity weight evaluation is performed on the operation status information of the power grid network to obtain the threat determination result and confidence level of the operation status information.

[0128] In this embodiment of the invention, the step of associating and matching the security event sequence with the power grid attack knowledge graph, and based on the association and matching results, performing adaptive sensitivity weight evaluation on the operating status information of the power grid network to obtain the threat determination result and confidence level of the operating status information, includes:

[0129] Iterate through and extract the event types and related asset information of the security events in the security event sequence;

[0130] Based on the event type and the asset information involved, entity association retrieval is performed in the power grid attack knowledge graph to obtain the graph substructure of the security event;

[0131] Based on the integrity and threat level of the graph substructure, and combined with the real-time operating status information of the power grid network, the sensitivity weight coefficients of different evaluation dimensions in the real-time operating status information are dynamically adjusted.

[0132] Based on the adjusted sensitivity weight coefficients, the threat level of the operational status information is weighted and fused to obtain the threat determination result of the operational status information.

[0133] Based on the power grid attack knowledge graph, the confidence level of the threat determination result is calculated to obtain the confidence level of the threat determination result. The formula for calculating the confidence level is as follows:

[0134] ;

[0135] In the formula, The confidence level is... To match the dynamic weighting coefficients of coverage, This refers to the number of times that event attributes in the security event sequence are successfully matched with entity nodes in the graph substructure. The total number of event attributes that were attempted to be matched in the security event sequence. It is a natural constant. The dynamic weighting coefficients for the average matching degree. This is the arithmetic mean of the similarities between all successfully matched event attributes and graph nodes. For the dynamic weighting coefficient of the timeliness and completeness composite term, This refers to the information integrity index in the real-time operating status information. The preset time decay coefficient, This is the time difference between the current time and the average occurrence time of related historical attack cases in the aforementioned graph substructure.

[0136] The step of dynamically adjusting the sensitivity weight coefficients of different evaluation dimensions in the real-time operating status information based on the integrity and threat level of the graph substructure and in conjunction with the real-time operating status information of the power grid network includes:

[0137] The entity coverage and relation completeness in the graph substructure are evaluated in a coordinated manner to obtain the integrity evaluation value of the graph substructure.

[0138] Based on the historical harm levels of the attacking entities in the graph substructure, the threat level evaluation value of the graph substructure is determined;

[0139] The core elements of the real-time operating status information of the power grid network are parsed to obtain the current business load level and the status of key network nodes.

[0140] The integrity evaluation value, the threat level evaluation value, the current service load level, and the status of key network nodes are evaluated with multi-dimensional weights to obtain the weight adjustment amount of the real-time operating status information.

[0141] Based on the weight adjustment amount, the preset basic sensitivity weight coefficients in the power grid network are adjusted and updated to obtain the sensitivity weight coefficients of the power grid network.

[0142] A full traversal of the security event sequence of the power grid network is performed. The core attribute information of each security event is extracted sequentially according to the arrangement of atomic security events in the sequence. Among them, the event type information is extracted to include fixed dimensions such as the business operation type, compliance status, and abnormal behavior category corresponding to the security event. The asset information is extracted to include fixed dimensions such as the unique identifier of the network device entity associated with the security event, the unique identifier of the business asset entity, and the business module to which the asset belongs. The event type and related asset information of each security event are structured and encapsulated, and a unique sequence identifier consistent with the corresponding security event is assigned to the encapsulated information to ensure that each security event has a corresponding structured event type and related asset information bound to it.

[0143] The event type information of each encapsulated security event is precisely matched with the core features of the attack behavior entities in the power grid attack knowledge graph. The asset information involved is precisely matched with the unique identifiers of network device entities and business asset entities in the power grid attack knowledge graph. The successfully matched attack behavior entities, network device entities, and business asset entities are used as core retrieval nodes. All entity nodes and related edges that are directly related to the core retrieval nodes are retrieved in the power grid attack knowledge graph. The retrieval scope covers all related entities and related edges corresponding to causal relationships, influence path relationships, physical logical connection relationships, and attribution bearer relationships. The retrieved core retrieval nodes, related entity nodes, and various related edges are structurally integrated to form an independent structure that only contains graph content related to the current security event. This independent structure is the graph substructure of the security event.

[0144] A pre-defined criterion for determining the completeness of the knowledge graph substructure is established. This criterion is based on the ratio of the actual search coverage of all associated entities and edges in the power grid attack knowledge graph by the core retrieval node for security event matching to the total number of associated entities. A ratio of 100% indicates complete completeness; a ratio between 70% and 99% indicates basic completeness; and a ratio below 70% indicates incompleteness. Simultaneously, a pre-defined threat level is extracted for all attack entities in the knowledge graph substructure. This level is categorized into three fixed levels—low, medium, and high—based on the severity of historical attack cases in the power grid attack knowledge graph. Furthermore, real-time operational status information of the power grid network is retrieved. The information includes preset assessment dimensions such as device operating status, service transmission status, network connectivity status, and protocol interaction status. Based on the completeness and threat level of the graph substructure, the sensitivity weight coefficients of different assessment dimensions are dynamically adjusted. When the completeness is fully realized and the threat level is high, the weight coefficients of device operating status and service transmission status are adjusted upward. When the completeness is incomplete and the threat level is low, the weight coefficients of various assessment dimensions are kept at the initial baseline value. When the completeness is basically realized and the threat level is medium, the weight coefficients of the corresponding assessment dimensions are adjusted according to the importance of the related assets. Finally, the adjusted sensitivity weight coefficients of each assessment dimension are obtained.

[0145] Independent threat level assessments are conducted on each preset evaluation dimension of the real-time operation status information of the power grid network. Each dimension is assessed based on preset threat judgment standards. Equipment operation status is based on the normal range of equipment operation parameters; exceeding the range indicates a corresponding threat level. Service transmission status is based on the packet loss rate and latency benchmark values ​​of service data transmission; exceeding the benchmark indicates a corresponding threat level. Network connectivity status is based on the link on / off status and communication rate benchmark values; anomalies indicate a corresponding threat level. Protocol interaction status is based on the compliance of the protocol frame structure and the validity of the function code; violations indicate a corresponding threat level. The threat levels obtained from the independent assessments of each evaluation dimension are combined with the adjusted sensitivity weight coefficients. The independent threat levels are then integrated according to the proportion of each dimension's weight coefficient. During the integration process, the threat level assessment results of dimensions with higher weight coefficients are prioritized. Finally, an overall threat level judgment conclusion for the power grid network operation status information is formed. This conclusion is the threat judgment result for the operation status information. The threat judgment results are divided into four fixed conclusions according to the degree of harm: no threat, low threat, medium threat, and high threat.

[0146] The confidence level of threat assessment results is calculated based on historical attack case data and entity relationship data in the power grid attack knowledge graph. The number of historical attack cases that completely match the event type and asset information involved in the current security event in the graph substructure is counted, as well as the number of valid relationships in the graph substructure. When the number of completely matched historical attack cases is no less than 3 and the percentage of valid relationships is 100%, the confidence level of the threat assessment result is high. When the number of completely matched historical attack cases is 1 to 2 and the percentage of valid relationships is between 70% and 99%, the confidence level of the threat assessment result is medium. When there are no completely matched historical attack cases and the percentage of valid relationships is less than 70%, the confidence level of the threat assessment result is low. At the same time, the quantitative representation results corresponding to the three confidence levels of high, medium and low are matched, and the quantitative representation results are the confidence levels of the threat assessment results.

[0147] Confidence level is a credibility index obtained by comprehensively considering the matching of security events with the knowledge graph, the completeness of real-time operational information, and the time value of historical cases. The sources of each parameter in the formula and the meaning of the formula are as follows.

[0148] The dynamic weighting coefficient of matching coverage is derived from the integrity evaluation value of the graph substructure and the statistical results of historical associated matching data. Combining the core requirements of confidence calculation, the sum of this coefficient, the dynamic weighting coefficient of the average matching degree, and the dynamic weighting coefficient of the timeliness integrity composite item is fixed at 1. Its specific value is adjusted according to the integrity evaluation value of the graph substructure. When the integrity evaluation value is 100, the coefficient is 0.4; when the integrity evaluation value is 80, it is 0.35; when the integrity evaluation value is 70, it is 0.3; and when the integrity evaluation value is 60, it is 0.25. This ensures that it can dynamically adapt to the integrity of the graph substructure and accurately reflect the influence weight of matching coverage on confidence.

[0149] The number of successful matches between event attributes in the security event sequence and entity nodes in the graph substructure comes from the entity association retrieval process between the security event sequence and the power grid attack knowledge graph. After the association retrieval is completed, each event attribute that attempts to match in the security event sequence is checked one by one to determine whether it can form a valid match with a certain entity node in the graph substructure. The criterion for a valid match is that the event attribute and the core features of the entity node are completely consistent. The number of all event attributes that meet this criterion is the number of successful matches.

[0150] The total number of event attributes that attempt to be matched in a security event sequence is derived from a full traversal of the security event sequence. This involves traversing all security events in the sequence, extracting the event attributes from each security event that are used for association and matching with the power grid attack knowledge graph, including all attributes that need to be matched, such as event type and asset information involved. These attributes are then counted one by one, and the total number obtained is the total number of event attributes that attempt to be matched.

[0151] The dynamic weighting coefficient of the average matching degree is determined synchronously with the dynamic weighting coefficient of the matching coverage rate. It is also based on the integrity evaluation value of the graph substructure and the statistical results of historical association matching data. Following the principle that the sum of the weights of the three is 1, the value is adjusted according to the integrity evaluation value. When the integrity evaluation value is 100, the coefficient is 0.3; when the integrity evaluation value is 80, the coefficient is 0.35; when the integrity evaluation value is 70, the coefficient is 0.35; and when the integrity evaluation value is 60, the coefficient is 0.3. This ensures that the weight of the average matching degree can be dynamically adjusted according to the integrity of the graph substructure, which fits the calculation requirements of confidence.

[0152] The arithmetic mean of the similarity between all successfully matched event attributes and graph nodes is derived from the similarity statistics and calculation of successful matching results. Each successfully matched event attribute is compared with the core features of the corresponding graph node. If the core features completely overlap, the similarity is recorded as 1. If the overlap reaches 80%, the similarity is recorded as 0.8. If the overlap reaches 60%, the similarity is recorded as 0.6. Cases with an overlap of less than 60% are not considered successful matches. The similarity values ​​corresponding to all successful matches are accumulated, and then the accumulated result is divided by the number of successful matches. The result is the arithmetic mean.

[0153] The dynamic weight coefficient of the timeliness and integrity composite item is determined synchronously with the first two dynamic weight coefficients. It is comprehensively adjusted based on the threat level evaluation value and integrity evaluation value of the map substructure, following the principle that the sum of the three weights is 1. When the threat level evaluation value is 90 and the integrity evaluation value is 100, the coefficient is 0.3; when the threat level evaluation value is 70 and the integrity evaluation value is 80, the coefficient is 0.3; when the threat level evaluation value is 50 or the integrity evaluation value is less than 70, the coefficient is 0.4, ensuring that the timeliness and integrity composite item can dynamically adapt the weight according to the threat level and map integrity.

[0154] The information integrity index in real-time operation status information is derived from the analysis of the core elements of the real-time operation status information of the power grid network. The analysis includes four core evaluation dimensions: equipment operation status, service transmission status, network connectivity status, and protocol interaction status. If the information in each dimension is complete and without missing parts and can be parsed normally, that dimension is recorded as 1. If the information is missing, cannot be parsed, or is parsed abnormally, that dimension is recorded as 0. The values ​​of the four dimensions are summed, and the sum is divided by 4. The result is the information integrity index, which is used to reflect the completeness of the real-time operation status information.

[0155] The preset time decay coefficient is a fixed value based on historical attack case data in the power grid attack knowledge graph. By statistically analyzing the matching confidence decay pattern corresponding to different time differences in historical attack cases, it was found that the larger the difference between the occurrence time of a historical attack case and the current time, the lower its reference value for the current threat judgment result. Based on this pattern, the time decay coefficient is set as a fixed value to quantify the impact of time difference on confidence decay and ensure that the confidence calculation can fit the reference value difference in the time dimension.

[0156] The time difference between the current time and the average occurrence time of related historical attack cases in the graph substructure is derived from the calculation of the occurrence time of the current time and the occurrence time of historical attack cases. First, all historical attack cases related to the current security event sequence are extracted from the graph substructure, and the occurrence time of each historical attack case is recorded one by one. The occurrence times of all recorded occurrence times are accumulated, and then the accumulated result is divided by the number of historical attack cases to obtain the average occurrence time of related historical attack cases. The current time is subtracted from the average occurrence time, and the resulting time difference is the time difference value. The unit of the time difference is uniformly set to hours to ensure the consistency of the calculation dimension.

[0157] The significance of this formula lies in its ability to scientifically and quantitatively calculate the credibility of threat assessment results by comprehensively considering the sufficiency and accuracy of matching security event sequences with the power grid attack knowledge graph, the completeness of real-time operational status information, and the time reference value of historical attack cases. This achieves an accurate assessment of confidence levels. The matching coverage component reflects the comprehensiveness of the matching between security events and graph substructures, the average matching degree reflects the accuracy of the matching, and the timeliness and completeness composite component reflects the effectiveness of real-time information and the time value of historical cases. These three components are organically combined through dynamic weighting coefficients to ensure that the calculated confidence level objectively and accurately reflects the reliability of the threat assessment results. This provides a reliable quantitative basis for assessing the network security status of the power grid. Furthermore, all calculation factors are derived from the security event sequences, power grid attack knowledge graph, and real-time operational status information obtained in previous processes, ensuring high consistency with the overall technical process and guaranteeing the coherence and reproducibility of the technical solution.

[0158] Retrieve the core retrieval node corresponding to the current substructure of the power grid attack knowledge graph. The core retrieval node consists of previously retrieved attack behavior entities, network device entities, and business asset entities. Count the total number of all associated entities for this core retrieval node in the complete power grid attack knowledge graph. Then, verify the actual number of such associated entities in each substructure. The entity coverage rate is the ratio of the actual number of associated entities in the substructure to the total number of corresponding associated entities in the complete graph. Simultaneously, count the total number of all relationships for the core retrieval node in the complete power grid attack knowledge graph and verify the actual number of such relationships in each substructure. The quantity and relational completeness are the proportions of the actual number of relationships contained in the graph substructure to the total number of corresponding relationships in the complete graph. A collaborative evaluation standard is set: when both entity coverage and relational completeness are 100%, the completeness evaluation value is 100; when both entity coverage and relational completeness are between 70% and 99%, the completeness evaluation value is 80; when either entity coverage or relational completeness is below 70% and the other is between 70% and 99%, the completeness evaluation value is 70; when both entity coverage and relational completeness are below 70%, the completeness evaluation value is 60. The completeness evaluation value of the graph substructure is obtained through this collaborative evaluation method.

[0159] Extract all attack behavior entities from the graph substructure, and retrieve the historical attack case severity level corresponding to each attack behavior entity in the power grid attack knowledge graph. This level is a fixed level based on the duration of power grid service interruption and the extent of asset damage caused by the attack behavior in the historical attack cases, and is divided into three levels: low, medium, and high. If there are multiple attack behavior entities in the graph substructure, take the highest level among the historical severity levels corresponding to all attack behavior entities as the overall historical severity level of the graph substructure. Set the correspondence rules between levels and evaluation values: high severity level corresponds to a threat level evaluation value of 90, medium severity level corresponds to a threat level evaluation value of 70, and low severity level corresponds to a threat level evaluation value of 50. Determine the threat level evaluation value of the graph substructure according to this correspondence rule.

[0160] The system retrieves real-time operational status information of the power grid network, including data transmission volume, operating parameters of key network nodes, and link connectivity status. This information is then analyzed by breaking down core elements. The current service load level is determined based on a preset service load benchmark value in the power grid service scheduling rules. The level is assigned according to the proportion of real-time data transmission volume to this benchmark value: a transmission volume ratio of 80% or higher indicates a high load; a ratio between 40% and 79% indicates a medium load; and a ratio below 40% indicates a low load. (The last sentence appears to be incomplete and possibly refers to a separate analysis of network key nodes.) The nodes are the network equipment entities corresponding to the power grid dispatch center, core switches, and main transformers. During the parsing process, the CPU utilization, memory usage, and link transmission rate of these key nodes are checked one by one. When both CPU utilization and memory usage are below 80% and the link transmission rate meets the preset benchmark, the network key node status is normal. When any parameter is between 80% and 90% and the link transmission rate is normal, the network key node status is sub-healthy. When any parameter is above 90% or the link transmission is interrupted, the network key node status is abnormal. The current business load level and network key node status of the power grid network are obtained through this parsing method.

[0161] The preset evaluation weights for integrity assessment, threat level assessment, current service load level, and network critical node status are 30%, 30%, 20%, and 20%, respectively. The current service load level is converted into corresponding values: 80 for high load, 60 for medium load, and 40 for low load. The network critical node status is converted into corresponding values: 90 for normal, 70 for sub-healthy, and 50 for abnormal. The values ​​of the four dimensions are multiplied by their respective weights, and all the products are summed. The sum is the weight adjustment amount for the real-time operating status information. The value of this adjustment amount is fixed between 50 and 100 and directly serves as the core basis for subsequent weight adjustments.

[0162] The system retrieves the preset basic sensitivity weight coefficients for the power grid network. These coefficients are set for four evaluation dimensions: equipment operation status, service transmission status, network connectivity status, and protocol interaction status, based on real-time operational status information. The initial baseline values ​​are 0.3, 0.25, 0.25, and 0.2, respectively, and the sum of the coefficients for the four dimensions is fixed at 1. If the weight adjustment is between 80 and 100, the basic sensitivity weight coefficients for all four evaluation dimensions are increased by 20%, while the sum of the coefficients remains at 1. If the weight adjustment is between 60 and 79, the basic sensitivity weight coefficients for the four evaluation dimensions remain unchanged. If the weight adjustment is between 50 and 59, the basic sensitivity weight coefficients for all four evaluation dimensions are decreased by 20%, while the sum of the coefficients remains at 1. The basic sensitivity weight coefficients are adjusted and updated according to this adjustment rule. The coefficients for the four evaluation dimensions obtained after the adjustment and update are the sensitivity weight coefficients for the power grid network.

[0163] S5. Based on the threat determination results and confidence levels, perform situational analysis and quantification on the asset importance and real-time load level of the power grid network to obtain the comprehensive security situation index of the power grid network.

[0164] In this embodiment of the invention, the step of performing situational analysis and quantification on the asset importance and real-time load level of the power grid network based on the threat determination result and confidence level to obtain a comprehensive security situation index of the power grid network includes:

[0165] Obtain the threat determination results and their corresponding confidence levels, the importance level data of assets in the power grid network, and the real-time load level data of key nodes in the power grid network;

[0166] The threat assessment results, the importance level data, and the real-time load level data are standardized to obtain standardized threat values, standardized asset importance values, and standardized load level values.

[0167] Based on the confidence level, the threat determination result is weighted and corrected to obtain the corrected threat information of the threat determination result;

[0168] The modified threat information is quantitatively fused and analyzed with the asset importance value and the load level value to obtain the multi-dimensional situation quantification value of the power grid network;

[0169] A risk assessment is performed on the multidimensional situation quantification values ​​to obtain the comprehensive security situation index of the power grid network.

[0170] The threat assessment results and their corresponding confidence levels obtained from the previous weighted fusion analysis are retrieved to ensure a one-to-one correspondence and a unique assessment identifier. Importance level data for all assets is retrieved from the power grid network asset management system. This data is categorized into three fixed levels: high, medium, and low, based on the type of power grid business undertaken by the asset, the scope of business impact after an interruption, and the difficulty of recovery. Each level is bound to a unique identifier for the corresponding asset. Real-time load level data for key nodes is retrieved from the power grid network real-time monitoring system. Key nodes are limited to network equipment entities corresponding to the power grid dispatch center, core switches, and main transformers. Real-time load level data includes three core components: node CPU utilization, memory usage, and business data transmission load. All retrieved data is organized in a unified structured format to ensure that the data can be directly used for subsequent processing, completing the acquisition of various required data.

[0171] Threat assessment results are standardized, categorized into four levels: no threat, low threat, medium threat, and high threat. Fixed standardization rules are established: no threat corresponds to a standardized threat value of 10, low threat to 30, medium threat to 60, and high threat to 90. Each threat assessment result is converted into a corresponding numerical value according to these rules, yielding a standardized threat value. Asset importance level data is also standardized, with a corresponding rule between level and value: high importance level corresponds to a standardized asset importance value of 90, medium importance level to 70, and low importance level to a standardized asset importance value of 70. The value is 50. Following this rule, the numerical conversion of all asset importance levels is completed to obtain standardized asset importance values. Real-time load level data is standardized by using the preset load benchmark values ​​for key nodes in the power grid network as a basis. The proportions of CPU utilization, memory usage, and business data transmission load to their respective benchmark values ​​are calculated. The maximum value among these three proportions is taken as the comprehensive real-time load level proportion for that node. A proportion not less than 80% corresponds to a standardized load level value of 90; a proportion between 40% and 79% corresponds to a standardized load level value of 70; and a proportion less than 40% corresponds to a standardized load level value of 50. The conversion of load levels for all key nodes is completed in this manner to obtain standardized load level values.

[0172] A pre-defined rule is established for the correspondence between confidence levels and correction coefficients: a high confidence level corresponds to a correction coefficient of 1.0; a medium confidence level corresponds to a correction coefficient of 0.8; and a low confidence level corresponds to a correction coefficient of 0.6. For each threat assessment result, the standardized threat value is multiplied by the correction coefficient corresponding to its confidence level. The correction coefficient is set based on the principle that the higher the confidence level, the more reliable the threat assessment result, and the smaller the correction magnitude; conversely, the lower the confidence level, the lower the reliability of the threat assessment result, and the larger the correction magnitude. Through this weighted correction method, the corrected value corresponding to each threat assessment result is obtained, and this value is the corrected threat information for the threat assessment result.

[0173] The corrected threat information, standardized asset importance values, and standardized load level values ​​are quantitatively fused according to a fixed logic. During fusion, the corrected threat information is first associated with the corresponding standardized asset importance value to ensure that they correspond to the same asset or critical node. Then, the standardized load level value corresponding to that asset or critical node is added. Fusion rules are set to integrate the three values ​​at a ratio of 40%, 30%, and 30%. The integration process involves multiplying each value by its corresponding ratio and then summing the results. The sum obtained is the multidimensional situation quantification value corresponding to that asset or critical node. The multidimensional situation quantification values ​​of all assets and critical nodes are integrated to form a set of multidimensional situation quantification values ​​for the power grid network, thus completing the quantitative fusion analysis.

[0174] The risk assessment range and corresponding rules for multi-dimensional situation quantification values ​​are preset. When the multi-dimensional situation quantification value is not lower than 80, it is judged as high risk, corresponding to a comprehensive security situation index of 90; when the multi-dimensional situation quantification value is between 60 and 79, it is judged as medium risk, corresponding to a comprehensive security situation index of 70; when the multi-dimensional situation quantification value is between 40 and 59, it is judged as low risk, corresponding to a comprehensive security situation index of 50; when the multi-dimensional situation quantification value is lower than 40, it is judged as no significant risk, corresponding to a comprehensive security situation index of 30. A global assessment is performed on the set of multi-dimensional situation quantification values ​​of the power grid network. The risk level and comprehensive security situation index corresponding to the highest value among all multi-dimensional situation quantification values ​​are taken as the final assessment result of the entire power grid network. This result is the comprehensive security situation index of the power grid network.

[0175] S6. Map the comprehensive security situation indicators to a preset early warning strategy response library to obtain the early warning signals and protection strategies of the power grid network.

[0176] In this embodiment of the invention, mapping the comprehensive security situation index to a preset early warning strategy response library to obtain the early warning signal and protection strategy of the power grid network includes:

[0177] The deviation between the comprehensive security situation index and the preset security situation level threshold is compared to obtain the security situation classification result of the comprehensive security situation index.

[0178] Based on the security situation classification results, a search and matching is performed in the preset early warning strategy response library to obtain the preliminary early warning signal and preliminary protection strategy of the security situation classification results.

[0179] Logical conflict verification and priority ranking are performed on the preliminary warning signals and preliminary protection strategies to obtain the candidate warning signal set and candidate protection strategy set of the security situation classification result;

[0180] Based on the current operating mode and strategy execution history of the power grid network, the candidate early warning signal set and candidate protection strategy set are simultaneously screened to obtain the early warning signals and protection strategies of the power grid network.

[0181] The system retrieves preset security status level thresholds. These thresholds are fixed thresholds defined based on the power grid network security operation specifications and the distribution range of comprehensive security status indicators from historical security events. Four threshold intervals are clearly defined for each security status level: a comprehensive security status indicator of 80 or higher corresponds to a high-risk threshold interval; 60 to 79 corresponds to a medium-risk threshold interval; 40 to 59 corresponds to a low-risk threshold interval; and below 40 corresponds to a threshold interval with no significant risk. The previously obtained comprehensive security status indicator of the power grid network is then compared with each of these four threshold intervals to determine which interval it falls into. If the comprehensive security status indicator is 90, it falls into the high-risk threshold interval, and the corresponding security status classification is high-risk; if it is 70, it falls into the medium-risk threshold interval, and the corresponding classification is medium-risk, and so on. This method of comparing deviations yields the security status classification result of the comprehensive security status indicator.

[0182] The pre-built early warning strategy response library is a structured database constructed in advance. The library is classified and stored according to different categories of security situation classification results. Each classification result category corresponds to a unique preliminary early warning signal and a set of preliminary protection strategies. Each classification category has a clear identifier that corresponds one-to-one with the security situation classification result. Based on the previously obtained security situation classification results, the core identifier of the classification result is extracted. The core identifier is then precisely matched with the identifiers of each category in the early warning strategy response library. After a successful match, all preliminary early warning signals and preliminary protection strategies stored under that category are retrieved. This ensures that the retrieved content is completely compatible with the security situation classification results, with no mismatches or omissions, thus obtaining the preliminary early warning signals and preliminary protection strategies corresponding to the security situation classification results.

[0183] Each of the retrieved preliminary warning signals and preliminary protection strategies is checked item by item, and logical conflict verification is carried out. Conflict judgment criteria are set. If there are items in the preliminary warning signals that contradict each other in terms of warning level or warning scope, or items in the preliminary protection strategies that cannot be executed simultaneously or will interfere with each other after execution, they are all judged as logical conflicts. During the verification, the logical correlation between each preliminary warning signal, each preliminary protection strategy, and the warning signal and protection strategy are compared one by one. All items that meet the conflict judgment criteria are eliminated, and preliminary warning signals and preliminary protection strategies without any logical conflicts are retained. Then, a priority ranking rule is set. Warning signals are ranked according to their urgency. Warning signals corresponding to high risk have higher priority than those corresponding to medium risk, low risk, and no obvious risk. Protection strategies are ranked according to their execution urgency. Strategies related to blocking risk sources have higher priority than isolation equipment strategies, and isolation equipment strategies have higher priority than monitoring and investigation strategies. Preliminary warning signals and preliminary protection strategies without conflicts are arranged in an orderly manner according to this rule. The results of the ranking are integrated to obtain the candidate warning signal set and candidate protection strategy set of the security situation classification results.

[0184] The current operating mode of the power grid network is retrieved. This mode is divided into three fixed modes: normal operation mode, peak load operation mode, and maintenance operation mode. Different operating modes correspond to different policy execution restrictions. The normal operation mode has no special restrictions. The peak load operation mode prohibits the execution of protection policies that will affect power transmission. The maintenance operation mode prohibits the execution of protection policies that will interrupt the maintenance equipment. At the same time, the historical policy execution data of the power grid network is retrieved. This data records the protection policies executed under various security situation classification results in the past, the execution effect, and abnormal feedback. If a protection policy has caused abnormalities in power grid operations in the past, it is determined to be an incompatible policy. During the screening process, based on the current operating mode, policies in the candidate protection policy set that do not meet the mode restrictions are first eliminated. At the same time, the candidate warning signals that are incompatible with the current mode are also eliminated. Then, combined with the policy execution historical data, candidate protection policies and warning signals with good historical execution effects and no abnormal feedback are retained, and incompatible items are eliminated. Finally, a unique warning signal that is suitable for the current power grid operating state and a set of protection policies that can be directly executed without execution conflicts are obtained. These are the warning signals and protection policies of the power grid network.

[0185] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0186] This application embodiment can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0187] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for situational awareness of power grid communication network security, characterized in that, The method includes: S1. Perform time-series normalization processing on the multi-source heterogeneous security logs and traffic data of the power grid network to obtain the multi-source security dataset of the power grid network. S2. Based on the network topology and power business logic of the power grid network, perform power protocol association parsing on the multi-source security dataset to obtain the security event sequence of the power grid network; S3. Based on a general network security framework, perform entity association analysis on the historical attack case logs, network topology, and asset list of the power grid network to construct a power grid attack knowledge graph of the power grid network. S4. The security event sequence is associated and matched with the power grid attack knowledge graph, and based on the association and matching results, an adaptive sensitivity weight evaluation is performed on the operation status information of the power grid network to obtain the threat determination result and confidence level of the operation status information. S5. Based on the threat determination results and confidence levels, perform situational analysis and quantification on the asset importance and real-time load level of the power grid network to obtain the comprehensive security situation index of the power grid network. S6. Map the comprehensive security situation indicators to a preset early warning strategy response library to obtain the early warning signals and protection strategies of the power grid network.

2. The power grid communication network security situation awareness method as described in claim 1, characterized in that, The process of performing time-series normalization on the multi-source heterogeneous security logs and traffic data of the power grid network yields a multi-source security dataset for the power grid network, including: Extract traffic data from multi-source heterogeneous security logs and traffic mirroring ports of security probes in the power grid network; The multi-source heterogeneous security logs and the traffic data are parsed using field protocols to obtain standard security log entries and standard traffic data records for the power grid network. Based on a preset timeline, the standard security log entries and standard traffic data records are time-series aligned to obtain the security event data stream and network traffic data stream of the power grid network; The security event data stream is encoded with event type features, and the network traffic data stream is statistically analyzed at the session level to obtain the event feature vector sequence and traffic feature vector sequence of the power grid network. The event feature vector sequence and the flow feature vector sequence are fused and concatenated according to the time axis to obtain the multi-source security dataset of the power grid network.

3. The power grid communication network security situation awareness method as described in claim 1, characterized in that, Based on the network topology and power business logic of the power grid network, the multi-source security dataset is analyzed using power protocol association to obtain a security event sequence of the power grid network, including: Read the network topology of device connections in the power grid network and the power business logic of power grid business scheduling rules; Based on the power business logic, logical consistency identification is performed on the data packets of the dedicated communication protocol for power communication networks in the multi-source security data set, and the data packets are deeply analyzed to obtain the protocol characteristics of the data packets; Based on the network topology, the protocol features are mapped to source and destination devices in the power grid network. Combined with the power business logic and the power grid business scheduling rules, the compliance of the interaction between the source and destination devices represented by the protocol features is judged to obtain the initial associated events of the power grid network. By performing a coupled analysis of the causality and temporality of the initial correlation events, the atomic safety events of the initial correlation events are obtained; The security event sequence of the power grid network is obtained by sorting and numbering the events according to their timestamps.

4. The power grid communication network security situation awareness method as described in claim 3, characterized in that, Based on the power service logic, the data packets of the dedicated communication protocol for the power communication network in the multi-source security data set are logically consistent, and the data packets are deeply parsed to obtain the protocol characteristics of the data packets, including: Based on the preset frame structure of the dedicated communication protocol for the power communication network, the data packets are formatted and verified to obtain compliant data packets of the multi-source security dataset. The compliant data packets are validated for function codes, and valid data packets that fall within the permitted range of the power business logic are selected. According to the message definition of the dedicated communication protocol for power communication networks, the message header fields of the valid data packets are extracted and parsed to obtain the message header feature information of the valid data packets; Based on the data field structure corresponding to the function code, the payload data of the valid data packet is parsed to obtain the payload characteristic information of the valid data packet; The header feature information and the payload feature information together constitute the protocol feature of the data packet.

5. The power grid communication network security situation awareness method as described in claim 1, characterized in that, The method, based on a general network security framework, performs entity association analysis on historical attack case logs, network topology, and asset inventory of the power grid network to construct a power grid attack knowledge graph, including: Structured data extraction is performed on the historical attack case logs, network topology, and asset list of the power grid network to obtain attack case data, node connection relationship data, and asset attribute data of the power grid network. Based on the entity types defined in the general network security framework, attack behavior entities and vulnerability entities are extracted from the attack case data, network device entities from the node connection relationship data, and business asset entities from the asset attribute data. Based on the association records in the historical attack case logs, the connection relationships in the network topology, and the ownership relationships in the asset list, establish a set of association relationships between the attack behavior entity, the vulnerability entity, the network device entity, and the business asset entity; Consistency verification and redundancy merging are performed on the set of relationships, and the attack behavior entities, vulnerability entities, network device entities, and business asset entities are combined to construct a power grid attack knowledge graph for the power grid network.

6. The power grid communication network security situation awareness method as described in claim 5, characterized in that, The step of establishing a set of association relationships between the attack entity, the vulnerability entity, the network device entity, and the business asset entity based on the association records in the historical attack case logs, the connection relationships in the network topology, and the ownership relationships in the asset list includes: Based on the associated records in the historical attack case logs, establish the causal relationship between the attacking entity and the vulnerable entity, as well as the impact path relationship between the attacking entity and the network device entity. Based on the connection relationships in the network topology, establish physical and logical connection relationships between the network device entities; Based on the ownership relationships in the asset list, establish the ownership and bearing association relationship between the network device entity and the business asset entity; The causal relationships, the influence path relationships, the physical logical connection relationships, and the attribution bearer relationships are logically integrated and conflict-resolved to obtain a set of relationships between the attack behavior entity, the vulnerability entity, the network device entity, and the business asset entity.

7. The power grid communication network security situation awareness method as described in claim 1, characterized in that, The step of associating and matching the security event sequence with the power grid attack knowledge graph, and based on the association and matching results, performing adaptive sensitivity weight evaluation on the power grid network's operational status information to obtain the threat determination result and confidence level of the operational status information, includes: Iterate through and extract the event types and related asset information of the security events in the security event sequence; Based on the event type and the asset information involved, entity association retrieval is performed in the power grid attack knowledge graph to obtain the graph substructure of the security event; Based on the integrity and threat level of the graph substructure, and combined with the real-time operating status information of the power grid network, the sensitivity weight coefficients of different evaluation dimensions in the real-time operating status information are dynamically adjusted. Based on the adjusted sensitivity weight coefficients, the threat level of the operational status information is weighted and fused to obtain the threat determination result of the operational status information. Based on the power grid attack knowledge graph, the confidence level of the threat determination result is calculated to obtain the confidence level of the threat determination result. The formula for calculating the confidence level is as follows: ； In the formula, The confidence level is... To match the dynamic weighting coefficients of coverage, This refers to the number of times that event attributes in the security event sequence are successfully matched with entity nodes in the graph substructure. The total number of event attributes that were attempted to be matched in the security event sequence. It is a natural constant. The dynamic weighting coefficients for the average matching degree. This is the arithmetic mean of the similarities between all successfully matched event attributes and graph nodes. For the dynamic weighting coefficient of the timeliness and completeness composite term, This refers to the information integrity index in the real-time operating status information. The preset time decay coefficient, This is the time difference between the current time and the average occurrence time of related historical attack cases in the aforementioned graph substructure.

8. The power grid communication network security situation awareness method as described in claim 7, characterized in that, The step of dynamically adjusting the sensitivity weight coefficients of different evaluation dimensions in the real-time operating status information based on the integrity and threat level of the graph substructure and in conjunction with the real-time operating status information of the power grid network includes: The entity coverage and relation completeness in the graph substructure are evaluated in a coordinated manner to obtain the integrity evaluation value of the graph substructure. Based on the historical harm levels of the attacking entities in the graph substructure, the threat level evaluation value of the graph substructure is determined; The core elements of the real-time operating status information of the power grid network are parsed to obtain the current business load level and the status of key network nodes. The integrity evaluation value, the threat level evaluation value, the current service load level, and the status of key network nodes are evaluated with multi-dimensional weights to obtain the weight adjustment amount of the real-time operating status information. Based on the weight adjustment amount, the preset basic sensitivity weight coefficients in the power grid network are adjusted and updated to obtain the sensitivity weight coefficients of the power grid network.

9. A method for assessing the network security situation of power grid communication networks as described in claim 1, characterized in that, Based on the threat assessment results and confidence levels, the asset importance and real-time load level of the power grid network are quantitatively analyzed to obtain a comprehensive security situation index for the power grid network, including: Obtain the threat determination results and their corresponding confidence levels, the importance level data of assets in the power grid network, and the real-time load level data of key nodes in the power grid network; The threat assessment results, the importance level data, and the real-time load level data are standardized to obtain standardized threat values, standardized asset importance values, and standardized load level values. Based on the confidence level, the threat determination result is weighted and corrected to obtain the corrected threat information of the threat determination result; The modified threat information is quantitatively fused and analyzed with the asset importance value and the load level value to obtain the multi-dimensional situation quantification value of the power grid network; Risk assessment is performed on the multidimensional situation quantification values ​​to obtain the comprehensive security situation index of the power grid network.

10. A method for assessing the network security situation of power grid communication networks as described in claim 1, characterized in that, The step of mapping the comprehensive security situation indicators to a preset early warning strategy response library to obtain early warning signals and protection strategies for the power grid network includes: The deviation between the comprehensive security situation index and the preset security situation level threshold is compared to obtain the security situation classification result of the comprehensive security situation index. Based on the security situation classification results, a search and matching is performed in the preset early warning strategy response library to obtain the preliminary early warning signal and preliminary protection strategy of the security situation classification results. Logical conflict verification and priority ranking are performed on the preliminary warning signals and preliminary protection strategies to obtain the candidate warning signal set and candidate protection strategy set of the security situation classification result; Based on the current operating mode and strategy execution history of the power grid network, the candidate early warning signal set and candidate protection strategy set are simultaneously screened to obtain the early warning signals and protection strategies of the power grid network.

Images