Electric power industrial control network simulation experiment environment key node identification method

Abstract

The invention provides a key node identification method in an electric power industrial control network simulation experiment environment, and provides a key node identification method based on a graph theory and community detection aiming at the characteristics of huge scale, complex structure, variable topology and the like of an electric power industrial control network in the electric power industrial control network simulation experiment environment. The method comprises the following steps: modeling an electric power industrial control network in a simulation experiment environment into a graph structure, performing community division on the network by adopting a Louvain algorithm, and disassembling the complex network into a plurality of sub-networks with close internal connection according to modularity; then, an influence maximization algorithm (greedy algorithm) is applied in each community, and a core node which plays a key role in community connection and information propagation is identified. According to the method, the key nodes in the large-scale electric power simulation network can be quickly and accurately identified, technical support is provided for safety protection and operation stability of an electric power industrial control system, and the method has good practical value and application prospect.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method for identifying key nodes in a power industrial control network simulation experimental environment. Background Technology

[0002] As power systems continue to advance towards intelligence and information technology, the cybersecurity and operational stability of industrial control systems (ICS), a crucial component of the nation's critical infrastructure, are of paramount importance. Power ICS networks are typically large-scale and complex, with tightly interconnected and highly interdependent nodes. The failure of any critical node can trigger a chain reaction, causing system malfunctions or even widespread power outages. Therefore, accurately identifying and effectively protecting these critical nodes is of great significance for ensuring the safe and stable operation of the entire power system.

[0003] In the security research of power industrial control systems, simulation environments are crucial for attack verification, fault simulation, and protection strategy evaluation. However, unlike real networks, the network topology in experimental environments is large-scale and highly variable. The network structure needs to be dynamically adjusted according to testing objectives, exercise plans, or verification strategies. Faced with this highly flexible structural characteristic, there is an urgent need for an efficient and automated method for identifying critical nodes to quickly adapt to topology changes and improve the relevance and effectiveness of security verification.

[0004] Existing key node identification methods are mostly based on static graph theory metrics, such as degree centrality, betweenness centrality, and eigenvector centrality. However, these methods often ignore the functional partitioning structure within the network and are difficult to fully reflect the true influence of nodes in information dissemination and community connection. They also suffer from problems such as insufficient identification accuracy and poor adaptability. Summary of the Invention

[0005] The present invention aims to at least partially solve one of the technical problems in the related art.

[0006] Therefore, the first objective of this invention is to propose a method for identifying key nodes in a power industrial control network simulation experimental environment.

[0007] The second objective of this invention is to propose a key node identification device for a power industrial control network simulation experimental environment.

[0008] The third objective of this invention is to provide a computer device.

[0009] A fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0010] To achieve the above objectives, a first aspect of the present invention proposes a method for identifying key nodes in a power industrial control network simulation experimental environment, comprising: S1. Obtain network identification information, entity / virtual device information, user behavior data, and communication relationship data from the power industrial control network simulation experiment environment, and perform standardization processing, outlier removal, log aggregation, and desensitization processing on the data. S2, Construct a graph model containing nodes and edges based on the processed data, wherein the nodes contain network attributes and behavioral attributes, and the edges are set with direction attributes and weight attributes according to the directionality of communication behavior and connection strength; S3. The Louvain algorithm is used to divide the graph model into communities. By iteratively optimizing the modularity index, the network is decomposed into several tightly connected community subgraphs. The membership scores of boundary nodes are adjusted and small communities are merged for optimization. S4. For each community subgraph, apply a greedy algorithm to calculate the marginal influence gain of the nodes, and select the node with the largest influence gain as the key node.

[0011] In one embodiment of the present invention, S2 includes: S21, the node mapping attributes include IP address, MAC address, port, and network segment in the network attributes, as well as communication frequency, number of visits, and alarm history in the behavior attributes; S22 generates a globally unique identifier for each node using a hash algorithm and stores it in a graph database or graph storage structure for indexing and retrieval.

[0012] In one embodiment of the present invention, S3 includes: S31, Boundary node redistribution via formula Calculate the degree of a node’s affiliation with a community, and take the community with the highest degree of affiliation as its final affiliation; S32, Small community mergers are achieved by setting a minimum community size threshold. Calculate the module degree increment between small communities and neighboring large communities. If the modularity increases after merging, then the merge operation will be performed.

[0013] In one embodiment of the present invention, S4 further includes: S41, Influence Function Through formula Calculation, where For the set of seed nodes, For nodes The neighborhood group, A collection of community nodes; S42, Marginal Influence Gain Through formula Calculate, select Largest node As a key node.

[0014] To achieve the above objectives, a second aspect of the present invention provides a key node identification device for a power industrial control network simulation experimental environment, comprising: The data acquisition and preprocessing module acquires network identification information, entity / virtual device information, user behavior data, and communication relationship data in the power industrial control network simulation experimental environment, and performs standardization processing, outlier removal, log aggregation, and desensitization processing on the data. The graph model construction module constructs a graph model containing nodes and edges based on the processed data. The nodes contain network attributes and behavioral attributes, and the edges are set with directional attributes and weight attributes according to the directionality of communication behavior and connection strength. The community partitioning and optimization module uses the Louvain algorithm to partition the graph model into communities. By iteratively optimizing the modularity index, the network is decomposed into several tightly connected community subgraphs. The membership scores of boundary nodes are adjusted and small communities are merged for optimization. The key node identification module applies a greedy algorithm to calculate the marginal influence gain of each node for each community subgraph, and selects the node with the largest influence gain as the key node.

[0015] This invention discloses a method and apparatus for identifying key nodes in a power control network simulation environment based on the Louvain algorithm. This method not only adapts to dynamic changes in network topology but also efficiently identifies nodes that have a critical impact on system security. This technology provides important theoretical support and technical assurance for the security protection, attack path assessment, and resource optimization of power control systems.

[0016] To achieve the above objectives, a third aspect of this application provides a computer device, including a processor and a memory; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, for implementing the key node identification method for power industrial control network simulation experimental environment based on Louvain algorithm as described in the first aspect embodiment.

[0017] To achieve the above objectives, the fourth aspect of this application proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method for identifying key nodes in a power industrial control network simulation experimental environment based on the Louvain algorithm as described in the first aspect embodiment.

[0018] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0019] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart of a method for identifying key nodes in a power industrial control network simulation experimental environment according to an embodiment of the present invention; Figure 2 This is an architecture diagram of a method for identifying key nodes in a power industrial control network simulation experimental environment according to an embodiment of the present invention; Figure 3 This is a flowchart illustrating a method for identifying key nodes in a power industrial control network simulation experimental environment according to an embodiment of the present invention. Figure 4 This is a structural diagram of a key node identification device for a power industrial control network simulation experimental environment according to an embodiment of the present invention; Figure 5 It is a computer device according to an embodiment of the present invention. Detailed Implementation

[0020] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0021] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0022] The following description, with reference to the accompanying drawings, illustrates a method and apparatus for identifying key nodes in a power industrial control network simulation experimental environment, according to an embodiment of the present invention.

[0023] Example 1 Figure 1 This is a flowchart of a method for identifying key nodes in a power industrial control network simulation experimental environment according to an embodiment of the present invention, such as... Figure 1 As shown, it includes: S1. Obtain network identification information, entity / virtual device information, user behavior data, and communication relationship data from the power industrial control network simulation experiment environment, and perform standardization processing, outlier removal, log aggregation, and desensitization processing on the data. S2, Construct a graph model containing nodes and edges based on the processed data, wherein the nodes contain network attributes and behavioral attributes, and the edges are set with direction attributes and weight attributes according to the directionality of communication behavior and connection strength; S3. The Louvain algorithm is used to divide the graph model into communities. By iteratively optimizing the modularity index, the network is decomposed into several tightly connected community subgraphs. The membership scores of boundary nodes are adjusted and small communities are merged for optimization. S4. For each community subgraph, apply a greedy algorithm to calculate the marginal influence gain of the nodes, and select the node with the largest influence gain as the key node.

[0024] This invention discloses a method for identifying key nodes in a power industrial control network simulation environment. This method not only adapts to dynamic changes in network topology but also efficiently identifies nodes that have a critical impact on system security. This technology provides important theoretical support and technical assurance for the security protection, attack path assessment, and resource optimization of power industrial control systems.

[0025] Example 2 The following describes in detail, with reference to the accompanying drawings, a method for identifying key nodes in a power industrial control network simulation experimental environment based on the Louvain algorithm, according to an embodiment of the present invention. Figure 2 and Figure 3 As shown.

[0026] S10. Data Collection and Preprocessing: S101. Data Collection: This step involves continuously monitoring various communication, access, and control behaviors during the operation of the power control network simulation experimental environment to collect data on key network entities and their relationships. Specifically, this includes the following types of information: Network identification data: such as IP address, MAC address, port number, protocol type, device unique identifier (UUID), and the correspondence between domain name and its resolved IP.

[0027] Network entity data: such as basic information and topology location of key equipment like SCADA hosts, PLC controllers, RTU terminals, industrial switches, firewalls, sensors, and HMIs (human-machine interfaces).

[0028] Network virtual data: such as virtual host computers, virtual operator stations, virtual engineer stations, virtual switch devices, virtual firewall devices, etc.

[0029] User behavior data includes login behavior (login / logout time, login IP, session duration) and operation logs (operation type, target resource, operation result) for accounts such as operations and maintenance personnel and monitoring personnel.

[0030] Communication relationship data: Obtain communication flow records between nodes from switch port mirroring or traffic analysis devices, including packet direction, traffic size, duration, frequency, etc. To ensure the integrity and timeliness of data collection, it is preferable to deploy distributed data collection agents on each subsystem node, while using network traffic collection tools (Wireshark) and system log collection frameworks (ELK Stack) to uniformly aggregate information.

[0031] S102. Data Cleaning: The raw collected data has problems such as non-standard format, missing fields, timestamp errors, and duplicate records, and needs to be standardized.

[0032] This step includes the following cleaning operations: Field standardization: Unify the format and timestamp unit of various logs, adopt the ISO 8601 standard to process time records, and unify the IP / MAC address format.

[0033] Outlier detection and removal: Use rule-based methods to identify illegal or corrupt data records (such as null values, logical conflicts, illegal port numbers, etc.) and remove or mark them.

[0034] Log slicing and aggregation: Sliding window aggregation is performed on traffic logs (interaction frequency is counted at the minute level) to construct time series data, providing a basis for subsequent graph edge weight calculation.

[0035] Data anonymization: Sensitive fields (such as account names and command parameters) are hash-anonymized to protect the security of experimental data.

[0036] S20. Construction of Standard Diagram: After data collection and preprocessing, the processed network identifiers, virtual / physical devices, and interaction relationships need to be structured into basic units of a graph model—nodes and edges. These nodes and edges then form a standard graph structure (i.e., a community), providing a foundation for subsequent community partitioning and key node identification. This step includes the following three sub-steps: S201. Graph Node Construction: This step aims to create graph nodes for each valid object in the power control network based on the collected network identification information and entity / virtual device information. This step completes the mapping relationship between network identification information, device information and nodes, which facilitates subsequent community division using community detection algorithms.

[0037] S2011. Node Mapping Attributes: Each node contains a set of structured attribute fields, providing support for subsequent weighted analysis of the relationships between nodes. These include network attributes (IP address, MAC address, port, network segment, etc.) and behavioral attributes (communication frequency, number of visits, alarm history, etc.).

[0038] S2012. Each node is assigned a globally unique identifier (hash ID) and stored in a graph database or graph storage structure for indexing and retrieval.

[0039] S202. Graph Edge Construction: Edges are used to represent the data flow and correlation between two nodes, i.e., the interaction or dependency relationship between device nodes. Edge construction and attribute setting are important means for graph models to express network structure and dynamics, specifically including: S2021. Directional Attribute: Edges with clear causal relationships, such as "user a logs into device Y", "data flows from device A to device B", and "device A initiates a connection request to device X", are defined as directed edges; ordinary communication behaviors are considered undirected edges.

[0040] S2022. Weight Attributes: To improve the expressiveness of the graph structure, edges are assigned weights to quantify connection strength or risk impact. The weights are determined according to the following indicators: communication frequency (number of interactions per unit time); communication duration or traffic volume; behavior anomaly score (e.g., whether it is the first communication or whether there is a communication mutation); time weight (interactions in recent time periods are given higher weights).

[0041] S203. Graph Initialization: After defining the nodes and edges, the graph structure can be initialized, that is, the edge and node information is organized into a standard graph structure for subsequent graph computation operations. This process includes: S2031. Storage Structure Construction: Based on actual application requirements, a graph database (Neo4j) is selected for persistent storage.

[0042] S2032. Structural Verification and Connectivity Check: After initialization, perform an integrity check on the graph, including: whether there are isolated nodes (nodes without any edge connections); whether there are duplicate edges or logically conflicting edges; and connectivity assessment (whether there are multiple unconnected subgraphs).

[0043] S30 Club Detection and Classification: After initializing the network graph, a community detection algorithm is needed to structurally partition the nodes in the graph to uncover functional modules or potential risk clusters within the network. The core of this step is to divide the graph into several communities, each consisting of a group of nodes with tightly connected internal connections and sparse external connections. These communities can serve as subgraphs for subsequent key node identification. This step includes the following three aspects: S301. Community Detection: Community detection, as a core task in graph mining, is suitable for identifying groups of nodes with similar structures and functions or associated behavioral patterns. Considering the heterogeneity, edge weight characteristics, and large-scale data characteristics of power control networks, this embodiment prefers the Louvain algorithm as the main method for community partitioning.

[0044] The Louvain algorithm optimizes based on the modularity metric, which measures the density of node clusters within a subgraph; higher modularity indicates a more reasonable partition. Modularity optimization is a common problem in community detection, namely, finding a community partitioning method that maximizes modularity. Higher modularity results in clearer and more reasonable community partitioning; lower modularity results in more ambiguous partitioning. The definition of modularity is as follows: Given a network, suppose we have divided the nodes in the network into k communities, denoted as . For each club We define The number of sides within the club. For the club The modularity Q is the sum of the number of edges between a node and all other nodes in the network. Then the modularity Q is defined as:

[0045] in, It is the actual edge weight between nodes i and j; It is the total connection weight of node i, i.e. ; m is the sum of the weights of all edges in the graph, i.e. ci is the community number to which node i belongs; Let i be the degree of nodes i and j; This indicates that the value is 1 when nodes i and j belong to the same community, and 0 otherwise.

[0046] S302. Community Division: In specific implementation, based on the constructed graph model, the Louvain algorithm is executed to divide communities. The operation process can be broken down into the following steps: S3021. Initial Allocation: Each node is initialized as an independent community, and there are N communities in the network; S3022. Local Modularity Improvement: For each node i, consider moving it from its current community to the community of its neighboring nodes. Calculate the modularity increment. This refers to the change in the modulus of the entire network after node i moves from its current community to its target community. For a weighted graph, the change in modulus of the entire network after node i moves from its current community to its target community is significant. Move to Club The module degree increment can be expressed as:

[0047] In the formula For the club The sum of the original edge weights, For nodes With clubs The total weight of the connecting edges of the middle node. For the club The sum of the degrees of all nodes in the array. For nodes The total degree (weight) is calculated. Then, the community with the largest positive increment is selected for movement; if there is no positive increment, it is not moved. The above steps are repeated until all nodes moving no longer increase the modularity. At this stage, the communities are compressed into a "super node," that is, each community is regarded as a node, and a new network is constructed. The edge weight between communities is the sum of the edge weights of the original nodes between the communities.

[0048] S3023. A simplified network is now obtained; the graph has shrunk, but community relationships are preserved. Re-execute S3022, performing modularity optimization again on the new network. Repeat the above steps until module Q no longer improves or its change falls below a preset threshold, at which point the algorithm terminates. The final output is a set of independent but tightly connected nodes, forming several community subgraphs. Each community can be considered a potential "functional block" or "risk domain."

[0049] S303. Club Optimization: To improve the accuracy and applicability of the segmentation, the following optimizations were further implemented: S3031. Boundary Node Reassignment: For "multi-home" nodes appearing on the edges of multiple communities, calculate their affiliation score:

[0050] in Represents a node For the club The degree of belonging, the molecular level of its association with the community The total edge weights of all other nodes are used as the denominator, which is the total weights of all connected edges. The maximum value is taken. The community is where it ultimately belongs.

[0051] S3032. Small Community Merging: Set a minimum community size threshold T. For communities smaller than T, calculate their modularity increment with neighboring large communities. If merging can improve the overall modularity, then perform the merge operation.

[0052] S40. Identification of Influential Nodes: After completing the community division, in order to further improve the ability to identify key nodes in the power industrial control network, this invention uses an influence maximization algorithm within each community to identify the most influential nodes during the attack propagation or abnormal spread process, so as to prioritize protection or monitoring.

[0053] S401. This invention preferably employs a greedy algorithm to solve the problem of maximizing influence within a community, supplemented by a heuristic optimization algorithm to improve computational efficiency. After the community is constructed, each sub-community can be represented as a graph. Each node represents a network entity. The goal is to select K nodes from the node set V such that information propagated from these nodes covers the maximum number of nodes, i.e., maximizing the propagation impact.

[0054] S402. Influence Function The ability to propagate within a community starting from a seed set S is represented by the following model:

[0055] This is the set of seed nodes, representing the selected propagation starting point within the community. For the set of neighbors of a node, Given a set of community nodes, the algorithm only considers propagation occurring within the community. For the edge The weight of the node represents the node's weight. To the neighbors Its influence.

[0056] Each greedy choice is based on the marginal impact gain:

[0057] Where S is the set of selected seeds. It is a candidate node. That is, nodes The additional influence gained from adding a seed set.

[0058] S403. After the greedy algorithm calculates the maximum influence for each sub-community, the node with the largest marginal influence gain is the most influential network node and is the key node that needs to be detected and protected.

[0059] Example 3 To achieve the above embodiments, such as Figure 4 As shown, this embodiment also provides a key node identification device 10 for a power industrial control network simulation experimental environment. The device 10 includes a data acquisition and preprocessing module 100, a graph model construction module 200, a community division and optimization module 300, and a key node identification module 400.

[0060] The data acquisition and preprocessing module 100 acquires network identification information, entity / virtual device information, user behavior data, and communication relationship data in the power industrial control network simulation experiment environment, and performs standardization processing, outlier removal, log aggregation, and desensitization processing on the data. The graph model construction module 200 constructs a graph model containing nodes and edges based on the processed data, wherein the nodes contain network attributes and behavioral attributes, and the edges are set with direction attributes and weight attributes according to the directionality of communication behavior and connection strength. The community partitioning and optimization module 300 uses the Louvain algorithm to partition the graph model into communities. By iteratively optimizing the modularity index, the network is decomposed into several tightly connected community subgraphs. The membership scores of boundary nodes are adjusted and small communities are merged for optimization. The key node identification module 400 applies a greedy algorithm to calculate the marginal influence gain of each node for each community subgraph, and selects the node with the largest influence gain as the key node.

[0061] Furthermore, the graph model building module 200 described above is also used for: Node mapping attributes include IP address, MAC address, port, and network segment in network attributes, as well as communication frequency, number of visits, and alarm history in behavior attributes; A globally unique identifier is generated for each node using a hash algorithm and stored in a graph database or graph storage structure for indexing and retrieval.

[0062] Furthermore, the aforementioned community division and optimization module 300 is also used for: Boundary node redistribution is achieved through the formula Calculate the degree of a node’s affiliation with a community, and take the community with the highest degree of affiliation as its final affiliation; Small community mergers are achieved by setting a minimum community size threshold. Calculate the module degree increment between small communities and neighboring large communities. If the modularity increases after merging, then the merge operation will be performed.

[0063] Furthermore, the aforementioned key node identification module 400 is also used for: Influence function Through formula Calculation, where For the set of seed nodes, For nodes The neighborhood group, A collection of community nodes; Marginal influence gain Through formula Calculate, select Largest node As a key node.

[0064] This invention discloses a key node identification device for a power industrial control network simulation experimental environment. This device not only adapts to dynamic changes in network topology but also efficiently identifies nodes that have a critical impact on system security. This technology provides important theoretical support and technical assurance for the security protection, attack path assessment, and resource optimization of power industrial control systems.

[0065] To implement the methods of the above embodiments, the present invention also provides a computer device, such as... Figure 5 As shown, the computer device 600 includes a memory 601 and a processor 602; wherein, the processor 602 reads executable program code stored in the memory 601 to run a program corresponding to the executable program code, so as to implement the various steps of the method described above.

[0066] To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method described in the foregoing embodiments.

[0067] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0068] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A method for identifying key nodes in a power industrial control network simulation experimental environment, characterized in that, include: S1. Obtain network identification information, entity / virtual device information, user behavior data, and communication relationship data from the power industrial control network simulation experiment environment, and perform standardization processing, outlier removal, log aggregation, and desensitization processing on the data. S2, Construct a graph model containing nodes and edges based on the processed data, wherein the nodes contain network attributes and behavioral attributes, and the edges are set with direction attributes and weight attributes according to the directionality of communication behavior and connection strength; S3. The Louvain algorithm is used to divide the graph model into communities. By iteratively optimizing the modularity index, the network is decomposed into several tightly connected community subgraphs. The membership scores of boundary nodes are adjusted and small communities are merged for optimization. S4. For each community subgraph, apply a greedy algorithm to calculate the marginal influence gain of the nodes, and select the node with the largest influence gain as the key node.

2. The method as described in claim 1, characterized in that, The S2 includes: S21, the node mapping attributes include IP address, MAC address, port, and network segment in the network attributes, as well as communication frequency, number of visits, and alarm history in the behavior attributes; S22 generates a globally unique identifier for each node using a hash algorithm and stores it in a graph database or graph storage structure for indexing and retrieval.

3. The method as described in claim 1, characterized in that, The S3 includes: S31, Boundary node redistribution via formula Calculate the degree of a node’s affiliation with a community, and take the community with the highest degree of affiliation as its final affiliation; S32, Small community mergers are achieved by setting a minimum community size threshold. Calculate the module degree increment between small communities and neighboring large communities. If the modularity increases after merging, then the merge operation will be performed.

4. The method as described in claim 1, characterized in that, The S4 further includes: S41, Influence Function Through formula Calculation, where For the set of seed nodes, For nodes The neighborhood group, A collection of community nodes; S42, Marginal Influence Gain Through formula Calculate, select Largest node As a key node.

5. A key node identification device for a power industrial control network simulation experimental environment, characterized in that, include: The data acquisition and preprocessing module acquires network identification information, entity / virtual device information, user behavior data, and communication relationship data in the power industrial control network simulation experimental environment, and performs standardization processing, outlier removal, log aggregation, and desensitization processing on the data. The graph model construction module constructs a graph model containing nodes and edges based on the processed data. The nodes contain network attributes and behavioral attributes, and the edges are set with directional attributes and weight attributes according to the directionality of communication behavior and connection strength. The community partitioning and optimization module uses the Louvain algorithm to partition the graph model into communities. By iteratively optimizing the modularity index, the network is decomposed into several tightly connected community subgraphs. The membership scores of boundary nodes are adjusted and small communities are merged for optimization. The key node identification module applies a greedy algorithm to calculate the marginal influence gain of each node for each community subgraph, and selects the node with the largest influence gain as the key node.

6. The apparatus as claimed in claim 5, characterized in that, The graph model building module is also used for: Node mapping attributes include IP address, MAC address, port, and network segment in network attributes, as well as communication frequency, number of visits, and alarm history in behavior attributes; A globally unique identifier is generated for each node using a hash algorithm and stored in a graph database or graph storage structure for indexing and retrieval.

7. The apparatus as claimed in claim 5, characterized in that, The community division and optimization module is also used for: Boundary node redistribution is achieved through the formula Calculate the degree of a node’s affiliation with a community, and take the community with the highest degree of affiliation as its final affiliation; Small community mergers are achieved by setting a minimum community size threshold. Calculate the module degree increment between small communities and neighboring large communities. If the modularity increases after merging, then the merge operation will be performed.

8. The apparatus as claimed in claim 5, characterized in that, The key node identification module is also used for: Influence function Through formula Calculation, where For the set of seed nodes, For nodes The neighborhood group, A collection of community nodes; Marginal influence gain Through formula Calculate, select Largest node As a key node.

9. A computer device, characterized in that, Including processor and memory; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the key node identification method for power industrial control network simulation experimental environment as described in any one of claims 1-4.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method for identifying key nodes in a power industrial control network simulation experimental environment as described in any one of claims 1-4.

Images