An analysis method and system of power information network security log

Abstract

The application discloses a kind of electric power information network security log analysis method and system, belong to electric power information network security technical field, the method is: obtaining expansion log set and network asset structured data, and obtaining electric power security event template library, external business interaction bipartite graph, internal business interaction bipartite graph and standard event description sentence, to obtain behavior event set based on the above data;Based on behavior event set, obtain event correlation strength set;Based on the above data, obtain initial attack chain path;Based on initial attack chain path, obtain reasoning result consistency degree, if greater than or equal to preset reasoning degree threshold, then the initial attack chain path is structured analysis, obtains electric power information network security log analysis result.Therefore, by implementing the application can avoid electric power information network multi-source security log due to data heterogeneity and lead to low log correlation analysis precision and attack event research and judge efficiency, realize the efficient and accurate correlation analysis of multi-source security log.

Description

Technical Field

[0001] This invention relates to the field of power information network security technology, and in particular to a method and system for analyzing power information network security logs. Background Technology

[0002] Currently, power grid information systems, based on the layout of business systems and critical assets, and combined with information such as security device functions and threat posture, deploy firewalls, IDS, WAFs, and other security devices to form specific network topologies as needed, providing network security protection for different business systems and assets. For the same network security incident, such as scanning network assets of a critical business system, each device along the path independently captures the security event and generates relevant logs according to its policy configuration. This results in different devices leaving a large number of log records on different paths when facing the same logical security event. In recent years, large language models, represented by GPT, Deepseek, LLaMA, and Gemini, have made breakthroughs in the field of natural language processing due to their powerful contextual understanding, few-shot learning, and logical reasoning capabilities. These large models, through large-scale text pre-training, have mastered the semantic representation and logical connections of general language, providing a new technical path for log semantic understanding. Currently, their applications in log analysis mainly focus on log translation, classification, and correlation analysis. Log translation involves using a large model to convert machine logs into natural language descriptions. For example, an IDS log can be translated as "On May 20, 2024, at 14:30, a host with IP 192.168.1.100 initiated access from port 443 to port 8080 of 10.0.0.5, suspected of exploiting an Apache path traversal vulnerability." Log classification leverages the generalization capabilities of the large model, training it through prompting to classify attack and normal behaviors based on logs. Log association typically uses the natural language description of the logs as input, and the large model's contextual understanding capabilities identify log relationships.

[0003] Under the current technological background, although large-scale models provide new directions for log analysis, existing rule-based or deep learning methods still have significant shortcomings in handling the problem of log correlation analysis for power information network security. Firstly, there is the problem of data heterogeneity. Different vendors define log fields differently. If data is integrated solely by concatenating fields, a huge sparse matrix will be formed. For example, logs from device A may contain null values ​​in fields specific to device B, making it difficult for machine learning or deep learning models used for analysis to converge. Secondly, there is the problem of event fragmentation. A logical security event may trigger security rules on multiple devices on the network link, resulting in fragmented and redundant security log records. Traditional log aggregation and analysis systems mostly achieve log aggregation through correlation rules, making it difficult to map these scattered logs to the same security event. Finally, there is the problem of label sparsity. Logs are often obscure code or presented in proprietary formats, lacking clear "attack" or "normal" labels. Without large-scale labeled data, it is impossible to train supervised learning models to understand log semantics, and it is also difficult to set large-scale automatic rules for attack analysis based on expert experience. Finally, there is a knowledge gap problem. Business systems, external security posture, security device information and other factors are constantly changing and updating. Existing methods cannot capture such semantic changes, which further leads to the inadequacy of log correlation analysis performance. Summary of the Invention

[0004] The present invention aims to provide a method and system for analyzing network security logs of power information networks, so as to solve the above-mentioned technical problems, avoid the low accuracy of log correlation analysis and poor efficiency of attack event judgment caused by data heterogeneity of multi-source security logs of power information networks, and realize efficient and accurate correlation analysis of multi-source security logs.

[0005] To address the aforementioned technical problems, this invention provides a method for analyzing power information network security logs, comprising: Obtain expanded log sets and structured data on network assets; Based on the expanded log set and network asset structured data, a power safety event template library, an external business interaction bipartite diagram, an internal business interaction bipartite diagram, and standard event description statements are obtained. Based on the power safety event template library and standard event description statements, a behavioral event set is obtained. Pair any two behavioral events in the behavioral event set to obtain several behavioral event pairs. Then, based on the behavioral event pairs, the external business interaction bipartite graph, the internal business interaction bipartite graph, and the power safety event template library, obtain the semantic cosine similarity, topological distance, and expert knowledge transfer probability of the behavioral event pairs in sequence. Calculate the association strength of several events based on the semantic cosine similarity, topological distance, and expert knowledge transfer probability to form an event association strength set. Based on the behavioral event set, the event correlation strength set, the preset second confidence threshold, the preset behavioral events, the preset power business logic constraints, and the preset correlation strength threshold, the initial attack chain path is obtained. Based on the initial attack chain path and the preset inference model, the consistency of the inference results is obtained. If the consistency of the inference results is greater than or equal to the preset inference degree threshold, the initial attack chain path is structured and parsed to obtain the power information network security log analysis results.

[0006] In the above scheme, by constructing a power security event template library, an external business interaction bipartite diagram, and an internal business interaction bipartite diagram, and transforming heterogeneous logs in the expanded log set into standardized event description statements in a unified format, and then obtaining a set of behavioral events through semantic matching, the scheme avoids low accuracy in log correlation analysis caused by inconsistent log formats, achieving standardized semantic representation of multi-source logs. Next, by integrating three dimensions—semantic cosine similarity, topological distance, and expert knowledge transfer probability—the scheme calculates event correlation strength and generates an event correlation strength set, avoiding correlation bias caused by single-dimensional analysis and achieving accurate correlation quantification of multi-source log events. Then, by pre-setting a second confidence threshold, pre-setting behavioral events, pre-setting power business logic constraints, and pre-setting correlation strength threshold, the scheme filters invalid paths in the attack chain path to obtain an initial attack chain path, avoiding low analysis efficiency caused by invalid event interference and missing business logic, and achieving efficient screening of attack chain paths. Finally, the consistency of the inference results of the initial attack chain path is verified by a pre-set inference model. If the consistency of the inference results is greater than or equal to the pre-set inference degree threshold, the initial attack chain path is structured and parsed to avoid errors in attack event judgment due to unreliable single inference results. Ultimately, efficient and accurate correlation analysis of multi-source security logs of the power information network is achieved.

[0007] Furthermore, the acquisition of the expanded log set and network asset structured data includes: Obtain the raw log set and structured data of network assets; Perform data cleaning on the original log set to obtain a standard log set; Pair any two standard logs in the standard log set to obtain several standard log pairs, and calculate the log similarity of the standard log pairs in turn; if the log similarity is greater than or equal to the preset log aggregation threshold, aggregate the standard logs in the standard log pair to obtain several aggregated logs; if the log similarity is less than the preset log aggregation threshold, determine the standard logs in the standard log pair as non-redundant logs. A collection of aggregated logs and non-redundant logs is formed by combining several aggregated logs and several non-redundant logs, and the information of the aggregated log collection is expanded to obtain the expanded log collection.

[0008] In the above scheme, by acquiring the original log set and structured data of network assets, basic data and asset knowledge support are provided for the subsequent standardization, aggregation, and analysis of power information network security logs, filling the gap in business attribute information for log analysis. Next, by cleaning the original log set, noise, format differences, and invalid data are eliminated, resulting in a standard log set and resolving the data heterogeneity problem of multi-source original logs. Then, by pairing any two standard logs in the standard log set, several standard log pairs are obtained, and the log similarity of each pair is calculated sequentially, providing a quantitative basis for the subsequent identification and aggregation of redundant logs. Subsequently, by aggregating standard log pairs with a similarity greater than or equal to a preset log aggregation threshold, aggregated logs are obtained. Standard logs with a similarity less than the preset threshold are identified as non-redundant logs. This accurately identifies and aggregates frequently repeated redundant logs while retaining valid non-redundant logs, solving the problem of fragmented and redundant log events and significantly reducing the amount of data for subsequent analysis. Finally, by integrating several aggregated logs and several non-redundant logs into an aggregated log set, and then augmenting the aggregated log set to obtain an augmented log set, we can enhance the information of the logs, reduce the dependence of subsequent analysis on pure log statistical features, and provide structured support for the correlation analysis of large models.

[0009] Furthermore, based on the expanded log set and network asset structured data, a power safety event template library, an external business interaction bipartite diagram, an internal business interaction bipartite diagram, and standard event description statements are obtained. A behavioral event set is then obtained based on the power safety event template library and standard event description statements, including: Map and concatenate the expanded log set to obtain input prompt data for the large model; The input prompt data of the large model is translated based on the preset translation model to obtain standard event description statements; The standard event description statement is verified based on a preset verification model. If the standard event description statement meets the preset description format, a power safety event template library is constructed based on the standard event description statement. Based on the structured data of network assets, construct a two-part diagram of external business interactions and a two-part diagram of internal business interactions; Based on the power safety event template library, semantic similarity matching is performed on standard event description statements to obtain the confidence level of the standard event description statements and the mapping events of the standard event description statements. If the confidence level is lower than a preset first confidence threshold or the mapping events meet the preset number of mapping results, the mapping events are verified and adjusted to obtain a standard mapping event set. Based on a preset time window, the standard mapping event set is identified, and the behavioral event set is extracted.

[0010] In the above scheme, by mapping and concatenating the expanded log set, the semantics of the log information can be enhanced, and input prompt data for the large model can be obtained. This provides a structured and scenario-based input foundation for the large model translation, solving the problem of missing semantic information in the logs. Next, a preset translation model is used to translate the input prompt data of the large model, obtaining standard event description statements. This transforms heterogeneous machine logs into natural language descriptions in a unified format, solving the problem of heterogeneous multi-source log data and achieving a unified semantic representation of logs. Then, a preset verification model is used to perform format standardization verification on the standard event description statements, ensuring that the output standard event description statements conform to the preset description format. This provides a standardized text foundation for subsequent semantic similarity matching and behavior mapping, avoiding analytical biases caused by inconsistent formats. Subsequently, a power safety event template library is constructed using the standard event description statements, forming a threat behavior representation system adapted to the power sector. This provides a dedicated template benchmark for the behavior mapping of log events, solving the problem of general templates being unsuitable for power business. Next, by constructing bipartite graphs of external and internal business interactions using structured network asset data, the legitimate interaction patterns and topological relationships between external access and internal business of the power network can be explicitly depicted. Then, semantic similarity matching of standard event description statements is performed using a power security event template library to obtain confidence levels and mapped events. Mapping results with low confidence or meeting a preset number of mapping results are verified and adjusted to obtain a standard mapped event set, achieving accurate mapping from log events to power security behavior templates. Finally, by identifying and extracting the time dimension of the standard mapped event set through a preset time window, a behavioral event set is obtained. This enables the filtering and aggregation of security events within the same time dimension, providing a time-ordered and behavior-unified event set for subsequent attack chain correlation analysis, solving the problem of event fragmentation.

[0011] Furthermore, it also includes: The standard event description statement is validated based on a preset validation model. If the standard event description statement does not meet the preset description format, the expanded log set is translated again until the standard event description statement meets the preset description format.

[0012] In the above scheme, a pre-set verification model is used to perform format standardization verification on standard event description statements. This identifies statements that do not conform to the pre-set description format, preventing inconsistent event descriptions from causing analytical biases in subsequent semantic matching and behavior mapping. Next, standard event description statements that do not meet the pre-set description format are re-translated using a large model based on an expanded log set and verified again until the output standard event description statements meet the pre-set description format. This ensures the uniformity and standardization of the output event description statements in terms of structure, dimensions, and expression, providing a standardized text input foundation for subsequent processing and avoiding the problem of low accuracy in association analysis caused by format issues from the source.

[0013] Furthermore, the standard event description statement is validated based on a preset validation model. If the standard event description statement meets the preset description format, a power safety event template library is constructed based on the standard event description statement, including: Build an initial power safety event template library; The standard event description statement is validated based on the preset validation model. If the standard event description statement meets the preset description format, the standard event description statement is aligned based on the initial power safety event template library, and the standard event description statement is used to supplement the initial power safety event template library to obtain the power safety event template library.

[0014] In the above scheme, the standard event description statements are validated using a pre-set validation model, providing standardized and high-quality materials for subsequent template library additions and preventing non-standard formatting from causing information chaos in the template library. Next, the validated standard event description statements are aligned with the initial power security event template library, accurately matching the actual power security events in the standard event description statements with the threat behaviors in the initial power security event template library. Simultaneously, the aligned standard event description statements are added to the initial power security event template library, forming a power security event template library adapted to the power information network, providing a precise and comprehensive template benchmark for subsequent event behavior mapping.

[0015] Further, the process involves pairing any two behavioral events in the behavioral event set to obtain several behavioral event pairs. Based on the behavioral event pairs, the external business interaction bipartite graph, the internal business interaction bipartite graph, and the power safety event template library, the semantic cosine similarity, topological distance, and expert knowledge transfer probability of the behavioral event pairs are obtained sequentially. The association strength of several events is then calculated based on semantic cosine similarity, topological distance, and expert knowledge transfer probability to form an event association strength set, including: Pair any two behavioral events in the behavioral event set to obtain several behavioral event pairs, and calculate the semantic cosine similarity of the behavioral event pairs in turn; Based on the behavioral event pairs, the bipartite graph of external business interactions, and the bipartite graph of internal business interactions, the topological distance of the behavioral event pairs is obtained sequentially. Based on the behavioral event pairs and the power safety event template library, the expert knowledge transfer probability of the behavioral event pairs is obtained sequentially. The association strength of several events is calculated based on semantic cosine similarity, topological distance, and expert knowledge transfer probability to form an event association strength set.

[0016] In the above scheme, by pairing any two behavioral events in the behavioral event set and calculating the semantic cosine similarity of each pair, the semantic representation association between any two behavioral events can be quantified. This provides a semantic dimension for determining the strength of event association, enabling accurate measurement of the semantic association of events and avoiding association bias caused by single-dimensional analysis. Next, by combining the power network business topology relationships—namely, the external business interaction bipartite graph and the internal business interaction bipartite graph—the path association degree of the asset nodes corresponding to the events is quantified, thereby obtaining the topological distance of each behavioral event pair. This provides a topological dimension constraint for calculating the strength of event association, ensuring that event association analysis aligns with the network interaction logic of actual power business. Finally, by obtaining the expert knowledge transfer probability of each behavioral event pair, the logical association between behavioral events can be quantified, providing a business knowledge dimension basis for calculating the strength of event association. Finally, by integrating three dimensions—semantic cosine similarity, topological distance, and expert knowledge transfer probability—the event association strength of corresponding behavioral event pairs is calculated and an event association strength set is formed. This achieves multi-dimensional comprehensive quantification of the degree of association between behavioral events, providing accurate and comprehensive association weight support for subsequent attack chain path screening and improving the accuracy of power information network security log association analysis.

[0017] Furthermore, the step of obtaining the initial attack chain path based on the behavioral event set, the event correlation strength set, the preset second confidence threshold, the preset behavioral events, the preset power business logic constraints, and the preset correlation strength threshold includes: Based on the set of behavioral events and the set of event correlation strengths, an initial attack chain directed acyclic graph is constructed; Based on a preset second confidence threshold and preset behavioral events, the directed acyclic graph of the initial attack chain is traversed to obtain the starting point of the attack chain. Based on the attack chain starting point, preset power business logic constraints, preset association strength threshold, and the initial attack chain directed acyclic graph, the initial attack chain path is obtained.

[0018] In the above scheme, an initial directed acyclic graph (DAG) of attack chains is constructed using a set of behavioral events and a set of event correlation strengths. This allows for visualization and structured modeling of behavioral events as nodes and the correlation strengths between events as directed edge weights. Discrete behavioral events are transformed into a network of event relationships with correlation weights, providing a visual and traversable analytical framework for subsequent attack chain path selection and mining, making the relationships between events more intuitive. Next, the initial DAG of attack chains is traversed and filtered using a preset second confidence threshold and preset behavioral events. This accurately locates the starting points of attack chains that meet the confidence threshold and belong to the preset behavioral events, determining precise starting and tracing points for attack chain paths and avoiding path mining biases and redundant calculations caused by starting from invalid nodes. Then, by using the attack chain starting point, preset power business logic constraints, and preset association strength threshold, the directed acyclic graph of the initial attack chain is traversed and filtered. Starting from the starting point, the path is extended along the directed edge, which can eliminate paths that do not conform to the physical logic of power business and weak association paths with association strength below the threshold. Finally, the initial attack chain path that conforms to the actual power business scenario is obtained, which solves the problem of low judgment efficiency caused by the lack of business constraints in path filtering in traditional analysis.

[0019] Furthermore, based on the initial attack chain path and the preset inference model, the consistency degree of the inference results is obtained. If the consistency degree of the inference results is greater than or equal to the preset inference degree threshold, the initial attack chain path is structured and parsed to obtain the power information network security log analysis results, including: Based on the initial attack chain path, standard prompt words are constructed; Input the standard prompt words into a preset reasoning model to obtain a round of reasoning results; The standard prompt words are shuffled to obtain random prompt words; The random prompts are input into a preset reasoning model to obtain the second round of reasoning results. Based on the results of the first and second rounds of reasoning, cross-validation prompts are constructed, and these cross-validation prompts are input into a preset large-scale reasoning model to obtain the results of the third round of reasoning. Based on the results of the first, second, and third rounds of reasoning, the consistency of the reasoning results is calculated. If the consistency of the reasoning results is greater than or equal to a preset reasoning degree threshold, the initial attack chain path is structured and parsed to obtain the power information network security log analysis results.

[0020] In the above scheme, standard prompts are constructed using the initial attack chain path, providing input for the pre-defined inference model. This allows the model to accurately understand the correlational inference needs of power safety events, ensuring the relevance of the first round of inference. Next, by inputting the standard prompts into the model, the first round of inference results are obtained, which preliminarily verifies the logical rationality and causal relationship of the initial attack chain path, providing a foundation for subsequent multiple rounds of verification. Then, by shuffling and reconstructing the event order in the standard prompts to obtain random prompts, the logical consistency of the initial attack chain path can be verified from different sequence dimensions, avoiding inference bias caused by a single event sequence. Subsequently, by inputting the random prompts into the model, the second round of inference results are obtained, allowing for a secondary verification of the initial attack chain path from different event arrangement dimensions, further validating the rationality of the attack chain path and improving the comprehensiveness of the inference results. Next, cross-validation prompts are constructed using the results of the first and second rounds of inference. These prompts are then input into a pre-defined inference model to obtain third-round inference results. This allows the pre-defined inference model to perform cross-verification based on the judgment results of the first two rounds, achieving multi-dimensional and in-depth verification of the initial attack chain path and significantly improving the reliability of the inference results. Finally, the consistency degree of the inference results is calculated using the results of the first, second, and third rounds of inference. If the consistency degree is greater than or equal to a pre-defined inference degree threshold, it indicates that an accurate and reliable attack chain path has been selected. At this point, the initial attack chain path is structured and parsed to obtain the power information network security log analysis results. Ultimately, this achieves efficient and accurate correlation analysis of multi-source security logs, solving the problem of low accuracy in power information network security log correlation analysis.

[0021] This invention provides an analysis system for power information network security logs, including a basic data acquisition module, an event characterization mapping module, an event correlation strength calculation module, an initial attack chain path filtering module, and an attack chain inference and verification module, specifically: The basic data acquisition module is used to acquire expanded log sets and structured data of network assets; The event representation mapping module is used to obtain a power safety event template library, an external business interaction bipartite diagram, an internal business interaction bipartite diagram, and a behavioral event set based on an expanded log set and network asset structured data; The event association strength calculation module is used to pair any two behavioral events in the behavioral event set to obtain several behavioral event pairs. Based on the behavioral event pairs, the external business interaction bipartite graph, the internal business interaction bipartite graph, and the power safety event template library, the semantic cosine similarity, topological distance, and expert knowledge transfer probability of the behavioral event pairs are obtained sequentially. The association strength of several events is calculated based on the semantic cosine similarity, topological distance, and expert knowledge transfer probability to form an event association strength set. The initial attack chain path filtering module is used to obtain the initial attack chain path based on the behavioral event set and the event correlation strength set. The attack chain inference verification module is used to obtain the consistency of inference results based on the initial attack chain path and the preset inference model. If the consistency of inference results is greater than or equal to the preset inference degree threshold, the initial attack chain path is structured and parsed to obtain the power information network security log analysis results.

[0022] This invention provides an analysis system for power information network security logs. In practical applications, it only requires an event representation mapping module. By constructing a power security event template library, an external business interaction bipartite graph, and an internal business interaction bipartite graph, and transforming heterogeneous logs in the expanded log set into a unified format, and obtaining a set of behavioral events through semantic matching, it avoids low accuracy in log association analysis due to inconsistent log formats, achieving standardized semantic representation of multi-source logs. Next, an event association strength calculation module is used. By integrating three dimensions—semantic cosine similarity, topological distance, and expert knowledge transfer probability—it calculates event association strength and generates an event association strength set. This avoids association bias caused by single-dimensional analysis, achieving accurate quantification of multi-source log events. Then, an initial attack chain path filtering module is used. By presetting a second confidence threshold, presetting behavioral events, presetting power business logic constraints, and presetting association strength threshold, it filters invalid paths in the attack chain path to obtain the initial attack chain path. This avoids low analysis efficiency due to interference from invalid events and missing business logic, achieving efficient filtering of attack chain paths. Finally, the attack chain inference verification module is used to verify the consistency of the inference results of the initial attack chain path through a preset inference model. If the consistency of the inference results is greater than or equal to the preset inference degree threshold, the initial attack chain path is structured and parsed to avoid errors in attack event judgment due to unreliable single inference results. Ultimately, efficient and accurate correlation analysis of multi-source security logs of the power information network is achieved.

[0023] Furthermore, the basic data acquisition module is used to acquire expanded log sets and structured network asset data, including: Obtain the raw log set and structured data of network assets; Perform data cleaning on the original log set to obtain a standard log set; Pair any two standard logs in the standard log set to obtain several standard log pairs, and calculate the log similarity of the standard log pairs in turn; if the log similarity is greater than or equal to the preset log aggregation threshold, aggregate the standard logs in the standard log pair to obtain several aggregated logs; if the log similarity is less than the preset log aggregation threshold, determine the standard logs in the standard log pair as non-redundant logs. A collection of aggregated logs and non-redundant logs is formed by combining several aggregated logs and several non-redundant logs, and the information of the aggregated log collection is expanded to obtain the expanded log collection.

[0024] In the above scheme, by acquiring the original log set and structured data of network assets, basic data and asset knowledge support are provided for the subsequent standardization, aggregation, and analysis of power information network security logs, filling the gap in business attribute information for log analysis. Next, by cleaning the original log set, noise, format differences, and invalid data can be eliminated, resulting in a standard log set and resolving the data heterogeneity problem of multi-source original logs. Then, by pairing any two standard logs in the standard log set, several standard log pairs are obtained, and the log similarity of each pair is calculated sequentially, providing a quantitative basis for the subsequent identification and aggregation of redundant logs. Subsequently, by aggregating standard log pairs with a similarity greater than or equal to a preset log aggregation threshold, aggregated logs are obtained. Standard logs with a similarity less than the preset threshold are identified as non-redundant logs. This accurately identifies and aggregates frequently repeated redundant logs while retaining valid non-redundant logs, solving the problem of fragmented and redundant log events and significantly reducing the amount of data for subsequent analysis. Finally, by integrating several aggregated logs and several non-redundant logs into an aggregated log set, and then augmenting the aggregated log set to obtain an augmented log set, we can enhance the information of the logs, reduce the dependence of subsequent analysis on pure log statistical features, and provide structured support for the correlation analysis of large models. Attached Figure Description

[0025] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0026] Figure 1 A flowchart illustrating a method for analyzing power information network security logs according to an embodiment of the present invention; Figure 2 This is an architecture diagram of a power information network security log analysis system provided in an embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0028] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0029] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0030] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0031] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0032] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).

[0033] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.

[0034] See Figure 1 To avoid low accuracy in log correlation analysis and poor efficiency in attack event assessment due to data heterogeneity in multi-source security logs of power information networks, this embodiment provides a method for analyzing network security logs of power information networks. The flowchart of this method can be found in [link to flowchart]. Figure 1 ,include: Step S1: Obtain the expanded log set and structured data of network assets; Step S2: Based on the expanded log set and network asset structured data, obtain the power safety event template library, external business interaction bipartite diagram, internal business interaction bipartite diagram and standard event description statements, and obtain the behavioral event set based on the power safety event template library and standard event description statements; Step S3: Pair any two behavioral events in the behavioral event set to obtain several behavioral event pairs. Based on the behavioral event pairs, the external business interaction bipartite graph, the internal business interaction bipartite graph, and the power safety event template library, obtain the semantic cosine similarity, topological distance, and expert knowledge transfer probability of the behavioral event pairs in sequence. Calculate the association strength of several events based on the semantic cosine similarity, topological distance, and expert knowledge transfer probability to form an event association strength set. Step S4: Based on the behavioral event set, event association strength set, preset second confidence threshold, preset behavioral events, preset power business logic constraints, and preset association strength threshold, obtain the initial attack chain path; Step S5: Based on the initial attack chain path and the preset inference model, obtain the consistency degree of the inference results. If the consistency degree of the inference results is greater than or equal to the preset inference degree threshold, then perform structured parsing on the initial attack chain path to obtain the power information network security log analysis results.

[0035] In this embodiment, by constructing a power security event template library, an external business interaction bipartite graph, and an internal business interaction bipartite graph, and transforming heterogeneous logs in the expanded log set into standardized event description statements in a unified format, and then obtaining a behavioral event set through semantic matching, the low accuracy of log correlation analysis caused by inconsistent log formats can be avoided, achieving standardized semantic representation of multi-source logs. Next, by fusing three dimensions—semantic cosine similarity, topological distance, and expert knowledge transfer probability—event correlation strength is calculated and an event correlation strength set is generated, avoiding correlation bias caused by single-dimensional analysis and achieving accurate correlation quantification of multi-source log events. Then, by presetting a second confidence threshold, presetting behavioral events, presetting power business logic constraints, and presetting correlation strength threshold, invalid paths in the attack chain are filtered to obtain an initial attack chain path, avoiding low analysis efficiency caused by invalid event interference and missing business logic, achieving efficient screening of attack chain paths. Finally, the consistency of the inference results of the initial attack chain path is verified by a pre-set inference model. If the consistency of the inference results is greater than or equal to the pre-set inference degree threshold, the initial attack chain path is structured and parsed to avoid errors in attack event judgment due to unreliable single inference results. Ultimately, efficient and accurate correlation analysis of multi-source security logs of the power information network is achieved.

[0036] Furthermore, the acquisition of the expanded log set and network asset structured data includes: Obtain the raw log set and structured data of network assets; Perform data cleaning on the original log set to obtain a standard log set; Pair any two standard logs in the standard log set to obtain several standard log pairs, and calculate the log similarity of the standard log pairs in turn; if the log similarity is greater than or equal to the preset log aggregation threshold, aggregate the standard logs in the standard log pair to obtain several aggregated logs; if the log similarity is less than the preset log aggregation threshold, determine the standard logs in the standard log pair as non-redundant logs. A collection of aggregated logs and non-redundant logs is formed by combining several aggregated logs and several non-redundant logs, and the information of the aggregated log collection is expanded to obtain the expanded log collection.

[0037] In this embodiment, by acquiring the original log set and structured network asset data, basic data and asset knowledge support are provided for the subsequent standardization, aggregation, and analysis of power information network security logs, filling the gap in business attribute information for log analysis. Next, by cleaning the original log set, noise, format differences, and invalid data can be eliminated. Simultaneously, the original logs can be compressed and enhanced to obtain a standard log set, solving the data heterogeneity problem of multi-source original logs. The data cleaning can include operations such as time standardization or character set unification. Then, since ports from the same IP can generate multiple standard logs per second, high-frequency duplicate logs may occur. A density-based aggregation algorithm can be used to obtain several standard log pairs by pairing any two standard logs in the standard log set, and the log similarity of each standard log pair is calculated sequentially. Specifically, let any two standard logs be... , ,in For timestamps, The source IP for the standard log. Let P be the destination IP address of the standard log, P be the port, and D be the event description. Then, the log similarity of a standard log pair can be calculated using the following formula: in These are the weight coefficients for the similarity across each dimension. , For IP similarity, different similarity functions can be defined based on expert experience; for example, 1 for the same network segment and 0 for different network segments. Port similarity can be determined by comparing the ports of two log entries. The quantitative similarity index obtained after matching; i and j represent any two standard logs; The similarity of event descriptions can be calculated using the term frequency-inverse document frequency (TF-IDF) algorithm. For time similarity; , A preset time threshold provides a quantitative basis for the subsequent identification and aggregation of redundant logs. Subsequently, standard log pairs with a similarity greater than or equal to the preset aggregation threshold are aggregated; that is, two standard logs in a standard log pair are aggregated into one aggregate log. The aggregate log is represented as "[repeated N times] + standard event description statement of the standard log". Meanwhile, standard logs with a similarity less than the preset aggregation threshold are identified as non-redundant logs. This accurately identifies and aggregates frequently repeated redundant logs while retaining valid non-redundant logs, solving the problem of fragmented and redundant log events and significantly reducing the amount of data for subsequent analysis. Finally, several aggregated logs and several non-redundant logs are integrated into an aggregated log set, and the aggregated log set is augmented to obtain an augmented log set. Specifically, by systematically modeling and mapping the business attributes of network assets, including security device attributes, IP-host-service mapping relationships, etc., the structured knowledge implicit in the asset management system and network topology is explicitly introduced into the log analysis process. This facilitates semantic enhancement of key log fields such as source / destination IP, port, protocol, and device identifier in subsequent steps. For example, if the security rules that trigger alarm logs can be obtained, these rules can be introduced as supplementary information to enhance the logs, supplement the prior knowledge required for large models to conduct correlation analysis and causal reasoning, and provide structured context support for subsequent cross-log and cross-time series reasoning of large models.

[0038] Furthermore, based on the expanded log set and network asset structured data, a power safety event template library, an external business interaction bipartite diagram, an internal business interaction bipartite diagram, and standard event description statements are obtained. A behavioral event set is then obtained based on the power safety event template library and standard event description statements, including: Map and concatenate the expanded log set to obtain input prompt data for the large model; The input prompt data of the large model is translated based on the preset translation model to obtain standard event description statements; The standard event description statement is verified based on a preset verification model. If the standard event description statement meets the preset description format, a power safety event template library is constructed based on the standard event description statement. Based on the structured data of network assets, construct a two-part diagram of external business interactions and a two-part diagram of internal business interactions; Based on the power safety event template library, semantic similarity matching is performed on standard event description statements to obtain the confidence level of the standard event description statements and the mapping events of the standard event description statements. If the confidence level is lower than a preset first confidence threshold or the mapping events meet the preset number of mapping results, the mapping events are verified and adjusted to obtain a standard mapping event set. Based on a preset time window, the standard mapping event set is identified, and the behavioral event set is extracted.

[0039] In this embodiment, by mapping IP / device names to asset names in the expanded log set, other related logs that are close in time can be aggregated into the input prompt as context. Furthermore, if security rules triggering alarm logs are introduced during the expansion process, these related logs can be concatenated with the expanded logs to obtain the large model input prompt data. This supplements missing security rules and contextual semantics, semantically enhancing the log information and providing a structured and scenario-based input foundation for large model translation, thus solving the problem of missing log semantic information. Next, the large model input prompt data is translated using a preset translation model. Specifically, security keywords are preliminarily identified and analyzed, and machine logs are translated into fixed-format natural language event descriptions. Key event information, such as time, source / destination asset, action type, protocol / port, and summary, is extracted to obtain standard event description statements. This transforms heterogeneous machine logs into unified-format natural language descriptions, solving the problem of heterogeneous multi-source log data and addressing the sparsity problem of the original sample space. It avoids methods relying on high-quality samples, such as field alignment, achieving a unified semantic representation of logs and providing input data for the subsequent construction of a power safety event template library. Then, the standard event description statements are formatted and validated using a pre-defined validation model. This ensures that the output standard event description statements conform to the pre-defined format, providing a standardized text foundation for subsequent semantic similarity matching and behavior mapping, and avoiding analytical biases caused by inconsistent formats. Subsequently, a power security event template library is constructed using the standard event description statements. This forms a threat behavior representation system adapted to the power industry, providing a dedicated template benchmark for behavior mapping of log events and solving the problem of general templates being unsuitable for power business.

[0040] Next, bipartite graphs of external and internal business interactions are constructed using structured network asset data. In the external business interaction bipartite graph, the left-hand nodes represent external visitors, such as public IP addresses or IP address clusters; the right-hand nodes represent business systems providing services externally, such as power dispatch interfaces, operation and maintenance management platforms, and data service interfaces. Edges between nodes represent normal business access interactions or abnormal attack interactions, with edge attributes being time-dimensional aggregated logs. These attributes characterize the long-term protocol characteristics, access frequency, and time characteristics of the current topology, used to depict external access patterns and abnormal interaction behaviors. The bipartite graphs describe the interaction relationships between different business systems and their dependent supporting resources within the internal network environment. Internal business interaction bipartite graphs... Figure 1The side nodes represent internal business systems or functional modules, such as scheduling systems and metering systems. The other side nodes in the internal business interaction bipartite graph represent the underlying resources or communication entities they depend on, such as database services and internal IP address ranges. The association edges between nodes represent behaviors such as internal business calls, data synchronization, or control command transmission. This modeling approach can explicitly depict the call paths, dependencies, and normal interaction patterns between internal businesses, providing structured priors for identifying abnormal lateral movement, unauthorized access, or abnormal business calls. Then, semantic similarity matching is performed on standard event description statements using a power safety event template library to obtain confidence levels and mapped events. Mapping results with low confidence or meeting a preset number of mapping results are verified and adjusted to obtain a standard mapped event set, achieving accurate mapping from log events to power safety behavior templates. The semantic similarity matching method can be achieved by pre-constructing a large model to infer prompt words, using a preset semantic similarity evaluation model to perform semantic similarity assessment, and outputting confidence levels; or by calculating the confidence level using a semantic similarity matching algorithm. If the confidence level is lower than the preset first confidence threshold or the number of mapped events meets the preset number of mapping results, it indicates that the mapped events may be inaccurate. Manual intervention or the use of pre-set auxiliary rules based on experience can be used to verify and adjust the mapped events, thereby improving the accuracy of the results. Finally, by identifying and extracting the time dimension of the standard mapped event set through a preset time window, a behavioral event set is obtained. This allows for the filtering and aggregation of security events within the same time dimension, providing a time-ordered and behaviorally consistent set of events for subsequent attack chain correlation analysis, thus solving the problem of event fragmentation.

[0041] Furthermore, it also includes: The standard event description statement is validated based on a preset validation model. If the standard event description statement does not meet the preset description format, the expanded log set is translated again until the standard event description statement meets the preset description format.

[0042] In this embodiment, a pre-defined verification model is used to perform format standardization verification on standard event description statements. This identifies statements that do not conform to the pre-defined description format, preventing inconsistent event descriptions from causing analytical biases in subsequent semantic matching and behavior mapping. Next, standard event description statements that do not meet the pre-defined description format are re-translated using a large model based on an expanded log set and verified again until the output standard event description statements meet the pre-defined description format. This ensures the uniformity and standardization of the output event description statements in terms of structure, dimensions, and expression, providing a standardized text input foundation for subsequent processing and avoiding the problem of low accuracy in association analysis caused by format issues from the source.

[0043] Furthermore, the standard event description statement is validated based on a preset validation model. If the standard event description statement meets the preset description format, a power safety event template library is constructed based on the standard event description statement, including: Build an initial power safety event template library; The standard event description statement is validated based on the preset validation model. If the standard event description statement meets the preset description format, the standard event description statement is aligned based on the initial power safety event template library, and the standard event description statement is used to supplement the initial power safety event template library to obtain the power safety event template library.

[0044] In this embodiment, by establishing an initial power security event template library, existing templates can be supplemented with power system-specific behaviors, such as abnormal changes in remote control commands, to refine and supplement the template library, making it more characteristic of the power grid field. Optional security event templates include Mitre Attack, etc., and the template library can be updated based on security policy updates and new attack events to ensure its timeliness. Then, standard event description statements are validated using a preset validation model, providing standard and high-quality materials for subsequent template library supplementation, avoiding information chaos caused by non-standard formatting. Next, the validated standard event description statements are aligned with the initial power security event template library, accurately matching the actual power security events in the standard event description statements with the threat behaviors in the initial power security event template library. Simultaneously, the aligned standard event description statements are added to the initial power security event template library, forming a power security event template library adapted to the power information network, providing an accurate and comprehensive template benchmark for subsequent event behavior mapping. In this embodiment, the power safety event template library built based on standard event description statements can be executed using either a scheduled task or a fixed-length window. A scheduled task refers to setting a fixed time period and performing the operation in each period, while a fixed-length window refers to setting a fixed log window length and triggering execution after the accumulated events reach the fixed window length.

[0045] Further, the process involves pairing any two behavioral events in the behavioral event set to obtain several behavioral event pairs. Based on the behavioral event pairs, the external business interaction bipartite graph, the internal business interaction bipartite graph, and the power safety event template library, the semantic cosine similarity, topological distance, and expert knowledge transfer probability of the behavioral event pairs are obtained sequentially. The association strength of several events is then calculated based on semantic cosine similarity, topological distance, and expert knowledge transfer probability to form an event association strength set, including: Pair any two behavioral events in the behavioral event set to obtain several behavioral event pairs, and calculate the semantic cosine similarity of the behavioral event pairs in turn; Based on the behavioral event pairs, the bipartite graph of external business interactions, and the bipartite graph of internal business interactions, the topological distance of the behavioral event pairs is obtained sequentially. Based on the behavioral event pairs and the power safety event template library, the expert knowledge transfer probability of the behavioral event pairs is obtained sequentially. The association strength of several events is calculated based on semantic cosine similarity, topological distance, and expert knowledge transfer probability to form an event association strength set.

[0046] In this embodiment, the behavioral event set Each behavioral event All contain triple information: ,in For behavioral events Normalized timestamp, For behavioral events Behavioral template identifiers (such as Mitre ATT&CK ID). For behavioral events Standard event description statements. Through behavioral event sets... For any two behavioral events, pair them up and calculate the semantic cosine similarity of each pair of behavioral events in turn. Specifically: and Represents any two behavioral events, through Calculating the semantic cosine similarity of behavioral event pairs quantifies the degree of semantic representation association between any two behavioral events, providing a semantic dimension for determining the strength of event association, and achieving accurate measurement of event semantic association, avoiding association bias caused by single-dimensional analysis. Next, by combining the power network business topology relationships, namely the external business interaction bipartite graph and the internal business interaction bipartite graph, the path association degree of the asset nodes corresponding to the events is quantified, thereby sequentially obtaining the topological distance of each behavioral event pair. Specifically, the topological distance of the behavioral event pair is calculated using a topological distance function. For the event and events Topological distance, For the event The corresponding asset node location, For the event The location of the asset node, if and If the topological distance is less than a preset topological distance threshold, a higher value is used; otherwise, a lower value is used. The higher value is [value], and the lower value is [value]. This provides a topological constraint for calculating event correlation strength, allowing event correlation analysis to align with the network interaction logic of actual power business. Then, the expert knowledge transfer probability of each behavioral event pair is obtained sequentially. This method can quantify the logical correlation between behavioral events, providing a business knowledge dimension as a basis for calculating the event correlation strength. Finally, by integrating three dimensions—semantic cosine similarity, topological distance, and expert knowledge transfer probability—the event correlation strength of corresponding behavioral event pairs is calculated. And form a set of event correlation strengths, specifically: ,in, For the event and events The strength of the event correlation As the preset activation function, , , These are weighting coefficients. This enables a multi-dimensional comprehensive quantification of the correlation between behavioral events, providing accurate and comprehensive correlation weight support for subsequent attack chain path screening, and improving the accuracy of correlation analysis of power information network security logs.

[0047] Furthermore, the step of obtaining the initial attack chain path based on the behavioral event set, the event correlation strength set, the preset second confidence threshold, the preset behavioral events, the preset power business logic constraints, and the preset correlation strength threshold includes: Based on the behavioral event set and the event correlation strength set, an initial attack chain directed acyclic graph is constructed; The initial attack chain directed acyclic graph is traversed based on a preset second confidence threshold and preset behavioral events to obtain the starting point of the attack chain; Based on the attack chain starting point, preset power business logic constraints, preset association strength threshold, and the initial attack chain directed acyclic graph, the initial attack chain path is obtained.

[0048] In this embodiment, to improve the efficiency of attack chain construction, a search algorithm constrained by power safety knowledge (GK) can be used. An initial directed acyclic graph (DAG) of attack chains is constructed using a set of behavioral events and a set of event correlation strengths. This allows for visualization and structured modeling of behavioral events as nodes and the correlation strengths between events as directed edge weights, transforming discrete behavioral events into a network of event relationships with correlation weights. This provides a visual and traversable analytical framework for subsequent attack chain path selection and mining, making the relationships between events more intuitive. Next, the initial DAG of attack chains is traversed and filtered using a preset second confidence threshold and preset behavioral events. This accurately locates the starting points of attack chains that meet the confidence threshold and belong to the preset behavioral events. This method determines a precise starting point for tracing the attack chain path, avoiding path mining deviations and redundant calculations caused by starting from invalid nodes. The preset behavioral events are events belonging to the "reconnaissance" or "initial entry" phase. Then, the directed acyclic graph of the initial attack chain is traversed and filtered by the attack chain starting point, preset power business logic constraints, and preset association strength thresholds. Paths are expanded along directed edges starting from the starting point, eliminating paths that do not conform to the physical logic of power business and weakly associated paths with association strength below the threshold. Ultimately, an initial attack chain path conforming to the actual power business scenario is obtained, solving the problem of low analysis efficiency caused by the lack of business constraints in path filtering in traditional analysis. If the obtained initial attack chain path contains two consecutive points with strong event association strength... Below the preset correlation strength threshold If so, then stop that branch. The preset power business logic constraints are as follows: for example, access to assets related to "dispatch services" may trigger the "remote control command change" event.

[0049] Furthermore, based on the initial attack chain path and the preset inference model, the consistency degree of the inference results is obtained. If the consistency degree of the inference results is greater than or equal to the preset inference degree threshold, the initial attack chain path is structured and parsed to obtain the power information network security log analysis results, including: Based on the initial attack chain path, standard prompt words are constructed; Input the standard prompt words into a preset reasoning model to obtain a round of reasoning results; The standard prompt words are shuffled to obtain random prompt words; The random prompts are input into a preset reasoning model to obtain the second round of reasoning results. Based on the results of the first and second rounds of reasoning, cross-validation prompts are constructed, and these cross-validation prompts are input into a preset large-scale reasoning model to obtain the results of the third round of reasoning. Based on the results of the first, second, and third rounds of reasoning, the consistency of the reasoning results is calculated. If the consistency of the reasoning results is greater than or equal to a preset reasoning degree threshold, the initial attack chain path is structured and parsed to obtain the power information network security log analysis results.

[0050] In this embodiment, standard prompt words are constructed through the initial attack chain path, providing input for the pre-defined inference model. This allows the model to accurately understand the correlation inference requirements of power safety events, ensuring the targeted nature of the first round of inference. An example of the standard prompt words is: "As a power safety expert, I know the event..." (Web vulnerability attempt) occurred at time T1, targeting asset A; event (Lateral movement within the internal network) occurred at time T2, originating from asset A. Considering the network security risks of the power system, determine if there is a causal relationship between the two. Reasoning steps required: 1. Analyze whether the attack path is reachable; 2. Assess whether the behavioral characteristics match the attacker's attack path; 3. Determine the final judgment and confidence level. Next, by inputting standard prompts into a pre-defined inference model, a first-round inference result is obtained, which preliminarily verifies whether the logic of the initial attack chain path is reasonable and whether the causal relationship is correct, providing a basis for subsequent multi-round verification. Then, by shuffling and reconstructing the event order in the standard prompts to obtain random prompts, the logical consistency of the initial attack chain path can be verified from different order dimensions, avoiding inference bias caused by a single event order. Subsequently, by inputting random prompts into the pre-defined inference model to obtain a second-round inference result, the initial attack chain path can be verified a second time from different event arrangement dimensions, further verifying the rationality of the attack chain path and improving the comprehensiveness of the inference result. Next, cross-validation prompts are constructed using the first-round and second-round inference results, and input into the pre-defined inference model to obtain a third-round inference result. This allows the pre-defined inference model to perform cross-verification based on the judgment results of the first two rounds, achieving multi-dimensional and in-depth verification of the initial attack chain path and significantly improving the reliability of the inference result. Finally, the consistency degree of the inference result is calculated using the first-round, second-round, and third-round inference results, specifically: ,in, As the result of one round of reasoning, This is the result of the second round of reasoning. The results of three rounds of reasoning are considered. If the consistency of the reasoning results is greater than or equal to a preset reasoning level threshold... If the initial attack chain path is identified, a precise and reliable attack chain path is selected. At this point, the initial attack chain path is structured and parsed to obtain the power information network security log analysis results. These results include a structured representation of the attack chain: event sequence, stage labels, inference text associated with each event, overall attack confidence score, and a list of affected assets and business systems. This ultimately achieves efficient and accurate correlation analysis of multi-source security logs, addressing the issue of low accuracy in power information network security log correlation analysis. If the consistency of the inference results is less than a preset inference threshold... This triggers a re-evaluation or manual review.

[0051] This embodiment provides a power information network security log analysis system. Please refer to [link / reference]. Figure 2 It includes a basic data acquisition module, an event representation mapping module, an event correlation strength calculation module, an initial attack chain path filtering module, and an attack chain inference and verification module, specifically: The basic data acquisition module is used to acquire expanded log sets and structured data of network assets; The event representation mapping module is used to obtain a power safety event template library, an external business interaction bipartite diagram, an internal business interaction bipartite diagram, and a behavioral event set based on an expanded log set and network asset structured data; The event association strength calculation module is used to pair any two behavioral events in the behavioral event set to obtain several behavioral event pairs. Based on the behavioral event pairs, the external business interaction bipartite graph, the internal business interaction bipartite graph, and the power safety event template library, the semantic cosine similarity, topological distance, and expert knowledge transfer probability of the behavioral event pairs are obtained sequentially. The association strength of several events is calculated based on the semantic cosine similarity, topological distance, and expert knowledge transfer probability to form an event association strength set. The initial attack chain path filtering module is used to obtain the initial attack chain path based on the behavioral event set and the event correlation strength set. The attack chain inference verification module is used to obtain the consistency of inference results based on the initial attack chain path and the preset inference model. If the consistency of inference results is greater than or equal to the preset inference degree threshold, the initial attack chain path is structured and parsed to obtain the power information network security log analysis results.

[0052] This embodiment provides an analysis system for power information network security logs. In practical applications, it only requires an event representation mapping module. By constructing a power security event template library, an external business interaction bipartite graph, and an internal business interaction bipartite graph, and converting heterogeneous logs in the expanded log set into a unified format, and obtaining a set of behavioral events through semantic matching, it avoids low accuracy in log association analysis due to inconsistent log formats, achieving standardized semantic representation of multi-source logs. Next, an event association strength calculation module is used. By integrating three dimensions—semantic cosine similarity, topological distance, and expert knowledge transfer probability—it calculates event association strength and generates an event association strength set. This avoids association bias caused by single-dimensional analysis, achieving accurate quantification of multi-source log events. Then, an initial attack chain path filtering module is used. By presetting a second confidence threshold, presetting behavioral events, presetting power business logic constraints, and presetting association strength threshold, it filters invalid paths in the attack chain path to obtain the initial attack chain path. This avoids low analysis efficiency due to interference from invalid events and missing business logic, achieving efficient filtering of attack chain paths. Finally, the attack chain inference verification module is used to verify the consistency of the inference results of the initial attack chain path through a preset inference model. If the consistency of the inference results is greater than or equal to the preset inference degree threshold, the initial attack chain path is structured and parsed to avoid errors in attack event judgment due to unreliable single inference results. Ultimately, efficient and accurate correlation analysis of multi-source security logs of the power information network is achieved.

[0053] Furthermore, the basic data acquisition module is used to acquire expanded log sets and structured network asset data, including: Obtain the raw log set and structured data of network assets; Perform data cleaning on the original log set to obtain a standard log set; Pair any two standard logs in the standard log set to obtain several standard log pairs, and calculate the log similarity of the standard log pairs in turn; if the log similarity is greater than or equal to the preset log aggregation threshold, aggregate the standard logs in the standard log pair to obtain several aggregated logs; if the log similarity is less than the preset log aggregation threshold, determine the standard logs in the standard log pair as non-redundant logs. A collection of aggregated logs and non-redundant logs is formed by combining several aggregated logs and several non-redundant logs, and the information of the aggregated log collection is expanded to obtain the expanded log collection.

[0054] In this embodiment, by acquiring the original log set and structured network asset data, basic data and asset knowledge support are provided for the subsequent standardization, aggregation, and analysis of power information network security logs, filling the gap in business attribute information for log analysis. Next, by cleaning the original log set, noise, format differences, and invalid data are eliminated, resulting in a standard log set and resolving the data heterogeneity problem of multi-source original logs. Then, by pairing any two standard logs in the standard log set, several standard log pairs are obtained, and the log similarity of each pair is calculated sequentially, providing a quantitative basis for the subsequent identification and aggregation of redundant logs. Subsequently, by aggregating standard log pairs with a similarity greater than or equal to a preset log aggregation threshold, aggregated logs are obtained. Standard logs with a similarity less than the preset threshold are identified as non-redundant logs. This accurately identifies and aggregates frequently repeated redundant logs while retaining valid non-redundant logs, solving the problem of fragmented and redundant log events and significantly reducing the amount of data for subsequent analysis. Finally, by integrating several aggregated logs and several non-redundant logs into an aggregated log set, and then augmenting the aggregated log set to obtain an augmented log set, we can enhance the information of the logs, reduce the dependence of subsequent analysis on pure log statistical features, and provide structured support for the correlation analysis of large models.

[0055] To more intuitively and fully illustrate how the power information network security log analysis method provided in this embodiment can avoid the low accuracy of log correlation analysis and poor efficiency of attack event judgment caused by data heterogeneity in multi-source security logs of power information networks, and achieve efficient and accurate correlation analysis of multi-source security logs, the following two embodiments are provided for specific explanation: 1. Correlation analysis of intranet lateral movement attacks in scheduling automation systems.

[0056] The dispatch automation system is used for power grid operation monitoring and dispatch command issuance. The system includes key business systems such as the dispatch management platform and the dispatch core database. Firewalls, Web Application Firewall (WAF) and intrusion detection systems are deployed at the system boundary.

[0057] During a specific attack period, the firewall recorded high-frequency access behavior of the same external IP to the scheduling portal web service port. The WAF logs detected multiple HTTP requests containing abnormal SQL statement characteristics. Within a 1-minute time window, a total of 500 raw log sets (security alarm logs) with highly similar source IPs, target IPs, and access patterns were captured. After data cleaning of the raw log sets, a standard log set was obtained. Any two standard logs in the standard log set were paired to obtain several standard log pairs. The log similarity of the standard log pairs was calculated sequentially. Based on the log similarity of the standard log pairs and a preset log aggregation threshold, the above standard logs were aggregated to generate an aggregated log: "[Repeated 500 times] External IP 1.2.3.4 Anomaly Scanning Scheduling Management Platform Web Interface".

[0058] Next, the aggregated logs and context information are input into a preset translation model for semantic fusion, outputting a standardized, structured event description statement in a unified format. The semantically fused events are as follows: event : 2024-06-12 14:00:08, 1.2.3.4, external Internet access node, 10.10.1.15, scheduling management platform, Web vulnerability exploitation attack, external IP attempted to exploit the scheduling management platform Web interface vulnerability through abnormal HTTP requests, the attack behavior is suspected to be SQL injection, and there is a risk of gaining system management privileges.

[0059] event 2024-06-12 14:05:21, 10.10.1.15, Scheduling Management Platform, 10.10.2.30, Scheduling Core Database System, Abnormal Internal Lateral Access: The Scheduling Management Platform attempted to access the Scheduling Core Database via SSH during non-normal business hours. The access behavior did not conform to the established business call rules.

[0060] Then, based on the power safety event template library (power business asset modeling results), and according to the external and internal business interaction bipartite diagrams between the dispatch management platform and the dispatch core database, analysis revealed that there are only specific business interface call relationships between the dispatch management platform and the dispatch core database, and there should be no direct SSH operation and maintenance access path. Simultaneously, combining the power safety event template library and standard event description statements, behavior mapping was performed on the events, and the events... Mapped to initial access (ATT&CK T1190), the event Mapped to lateral movement (ATT&CK T1021).

[0061] From the perspective of correlation, in the time dimension, events The initial access occurred on 2024-06-12 14:00:08, event Lateral movement occurred at 14:05:21 on 2024-06-12. Event Within the next 5 minutes, there was a clear temporal correlation between the two events; semantically, both events involved assets of the dispatch management platform, indicating a strong semantic connection. Considering the high-value business dependency between the dispatch management platform and the core database, and the common attack pattern of lateral movement through credential theft after exploiting a web vulnerability, the initial attack chain path was obtained based on the behavioral event set, event correlation strength set, preset second confidence threshold, preset behavioral events, preset power business logic constraints, and preset correlation strength threshold. Based on the initial attack chain path and the preset inference model, the consistency of the inference result was 0.82. Therefore, the attack behavior was determined to conform to the attack chain characteristics of web vulnerability exploitation, control of the dispatch management platform, and internal lateral movement access to the core database. This event was identified as an intranet lateral movement attack against the power dispatch system triggered by a web vulnerability exploit, with an attack chain confidence of 0.82.

[0062] 2. Correlation analysis of abnormal control command attacks in remote operation and maintenance systems.

[0063] The remote operation and maintenance system is used to remotely inspect and configure parameters of power equipment. The system is deployed in the intranet security zone and has strict business access relationships with the dispatching system and station control equipment. It is equipped with security devices such as firewalls, intrusion detection systems and host auditing systems.

[0064] Within a 2-minute time window, the firewall recorded abnormal access to the remote operation and maintenance system management port from an external IP address. The IDS detected abnormal remote operation and maintenance protocol interactions, and the host audit log recorded an abnormal control command initiated by the operation and maintenance system to the station control equipment. Within 30 seconds, the firewall recorded 240 highly similar raw log sets (alarm logs), with the source IP, destination IP, and port being identical. After cleaning the raw log sets, a standard log set was obtained. Any two standard logs in the standard log set were paired to obtain several standard log pairs, and the log similarity of the standard log pairs was calculated sequentially. Based on the log similarity of the standard log pairs and a preset log aggregation threshold, the above standard logs were aggregated to generate an aggregated log: "[Repeated 240 times] External IP 5.6.7.8 abnormally accessed the substation remote operation and maintenance system management interface."

[0065] Next, the aggregated logs and context information are input into a preset translation model for semantic fusion, outputting a standardized, structured event description statement in a unified format. The semantically fused events are as follows: event "2024-06-18 10:10:12, 5.6.7.8, External Internet Access Node, 172.16.10.20, Substation Remote Operation and Maintenance System, Unauthorized Interface Access Scan, External IP accessed the remote operation and maintenance system management interface at high frequency in a short period of time, and the access characteristics match the automated scan or unauthorized access attempt."

[0066] event "2024-06-18 10:11:05, 5.6.7.8, external Internet access node, 172.16.10.20, substation remote operation and maintenance system, abnormal remote operation and maintenance session establishment, the attacker established a remote control session through abnormal operation and maintenance protocol interaction, the behavior did not match the legitimate operation and maintenance work order or authorization process."

[0067] event "2024-06-18 10:12:18, 5.6.7.8, Remote Operation and Maintenance System, 172.16.20.35, Substation Station Control Equipment System, Unauthorized Control Command Execution, The attacker issued an abnormal parameter modification command to the station control equipment through the remote operation and maintenance system, which may affect the operating status of the equipment in the station."

[0068] Then, based on the analysis of the external and internal business interaction bipartite diagrams, the following business interaction relationships were found: the external business interaction bipartite diagram shows external access entities to the remote operation and maintenance system, and the internal business interaction bipartite diagram shows the remote operation and maintenance system to the station control equipment. Simultaneously, combining the power safety event template library and standard event description statements, behavior mapping was performed on the events. Mapped to initial access (ATT&CKT1190), event Mapped to remote service (ATT&CKT1021), event Mapped to control command execution (ATT&CKT0851, ATT&CKT1489).

[0069] From a correlation perspective, in the time dimension, 10:10 External IP scans and attempts to access the operations and maintenance system. 10:11 An abnormal operation and maintenance protocol session was established. At 10:12, an abnormal parameter modification command was issued to the station control equipment. These events occurred consecutively within 3 minutes, showing a close temporal correlation. Semantically, all three events revolve around the "remote operation and maintenance system" asset, indicating a strong semantic connection. The operation and maintenance system and the station control equipment have a direct control relationship in the internal business interaction diagram. Domain knowledge constraints stipulate that parameter modification control commands should not be triggered without an operation and maintenance work order. The progression from unauthorized interface access attempts to illegally establishing a remote operation and maintenance session, and then to issuing unauthorized control commands to the station control equipment, represents a typical high-risk attack behavior evolution path in the power remote operation and maintenance scenario, with an expert knowledge transfer probability of 0.91. Based on the behavioral event set, event correlation strength set, preset second confidence threshold, preset behavioral events, preset power business logic constraints, and preset correlation strength threshold, the initial attack chain path is obtained. Based on the initial attack chain path and the preset inference model, the consistency of the inference results is obtained, which is 0.94. It is determined that the attacker first attempted unauthorized access to the remote operation and maintenance system, then established an abnormal operation and maintenance session, and finally issued unauthorized control commands to the station control equipment. This behavioral chain conforms to the typical attack path for substation control systems, and the attack chain confidence is 0.94.

[0070] It is understood that the above system item embodiments correspond to the method item embodiments of the present invention, and can implement the power information network security log analysis method provided by any of the above method item embodiments of the present invention.

[0071] It should be noted that the system embodiments described above are merely illustrative, and some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0072] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for analyzing network security logs of power information systems, characterized in that, include: Obtain expanded log sets and structured data on network assets; Based on the expanded log set and network asset structured data, a power safety event template library, an external business interaction bipartite diagram, an internal business interaction bipartite diagram, and standard event description statements are obtained. Based on the power safety event template library and standard event description statements, a behavioral event set is obtained. Pair any two behavioral events in the behavioral event set to obtain several behavioral event pairs. Then, based on the behavioral event pairs, the external business interaction bipartite graph, the internal business interaction bipartite graph, and the power safety event template library, obtain the semantic cosine similarity, topological distance, and expert knowledge transfer probability of the behavioral event pairs in sequence. Calculate the association strength of several events based on the semantic cosine similarity, topological distance, and expert knowledge transfer probability to form an event association strength set. Based on the behavioral event set, the event correlation strength set, the preset second confidence threshold, the preset behavioral events, the preset power business logic constraints, and the preset correlation strength threshold, the initial attack chain path is obtained. Based on the initial attack chain path and the preset inference model, the consistency of the inference results is obtained. If the consistency of the inference results is greater than or equal to the preset inference degree threshold, the initial attack chain path is structured and parsed to obtain the power information network security log analysis results.

2. The method for analyzing power information network security logs according to claim 1, characterized in that, The acquisition of the expanded log set and network asset structured data includes: Obtain the raw log set and structured data of network assets; Perform data cleaning on the original log set to obtain a standard log set; Pair any two standard logs in the standard log set to obtain several standard log pairs, and calculate the log similarity of the standard log pairs in turn; if the log similarity is greater than or equal to the preset log aggregation threshold, aggregate the standard logs in the standard log pair to obtain several aggregated logs; if the log similarity is less than the preset log aggregation threshold, determine the standard logs in the standard log pair as non-redundant logs. A collection of aggregated logs and non-redundant logs is formed by combining several aggregated logs and several non-redundant logs, and the information of the aggregated log collection is expanded to obtain the expanded log collection.

3. The method for analyzing power information network security logs according to claim 1, characterized in that, The process involves acquiring a power safety event template library, an external business interaction bipartite diagram, an internal business interaction bipartite diagram, and standard event description statements based on the expanded log set and network asset structured data. Furthermore, it involves acquiring a set of behavioral events based on the power safety event template library and standard event description statements, including: Map and concatenate the expanded log set to obtain input prompt data for the large model; The input prompt data of the large model is translated based on the preset translation model to obtain standard event description statements; The standard event description statement is verified based on a preset verification model. If the standard event description statement meets the preset description format, a power safety event template library is constructed based on the standard event description statement. Based on the structured data of network assets, construct a two-part diagram of external business interactions and a two-part diagram of internal business interactions; Based on the power safety event template library, semantic similarity matching is performed on standard event description statements to obtain the confidence level of the standard event description statements and the mapping events of the standard event description statements. If the confidence level is lower than a preset first confidence threshold or the mapping events meet the preset number of mapping results, the mapping events are verified and adjusted to obtain a standard mapping event set. Based on a preset time window, the standard mapping event set is identified, and the behavioral event set is extracted.

4. The method for analyzing power information network security logs according to claim 3, characterized in that, Also includes: The standard event description statement is validated based on a preset validation model. If the standard event description statement does not meet the preset description format, the expanded log set is translated again until the standard event description statement meets the preset description format.

5. The method for analyzing power information network security logs according to claim 3, characterized in that, The standard event description statement is validated based on a preset validation model. If the standard event description statement meets the preset description format, a power safety event template library is constructed based on the standard event description statement, including: Build an initial power safety event template library; The standard event description statement is validated based on the preset validation model. If the standard event description statement meets the preset description format, the standard event description statement is aligned based on the initial power safety event template library, and the standard event description statement is used to supplement the initial power safety event template library to obtain the power safety event template library.

6. The method for analyzing power information network security logs according to claim 1, characterized in that, The process involves pairing any two behavioral events in the behavioral event set to obtain several behavioral event pairs. Based on these behavioral event pairs, the external business interaction bipartite graph, the internal business interaction bipartite graph, and the power safety event template library, the semantic cosine similarity, topological distance, and expert knowledge transfer probability of the behavioral event pairs are sequentially obtained. The association strength of several events is then calculated based on these semantic cosine similarity, topological distance, and expert knowledge transfer probability to form an event association strength set, including: Pair any two behavioral events in the behavioral event set to obtain several behavioral event pairs, and calculate the semantic cosine similarity of the behavioral event pairs in turn; Based on the behavioral event pairs, the bipartite graph of external business interactions, and the bipartite graph of internal business interactions, the topological distance of the behavioral event pairs is obtained sequentially. Based on the behavioral event pairs and the power safety event template library, the expert knowledge transfer probability of the behavioral event pairs is obtained sequentially. The association strength of several events is calculated based on semantic cosine similarity, topological distance, and expert knowledge transfer probability to form an event association strength set.

7. The method for analyzing power information network security logs according to claim 1, characterized in that, The process of obtaining the initial attack chain path based on the behavioral event set, the event correlation strength set, the preset second confidence threshold, the preset behavioral events, the preset power business logic constraints, and the preset correlation strength threshold includes: Based on the set of behavioral events and the set of event correlation strengths, an initial attack chain directed acyclic graph is constructed; Based on a preset second confidence threshold and preset behavioral events, the directed acyclic graph of the initial attack chain is traversed to obtain the starting point of the attack chain. Based on the attack chain starting point, preset power business logic constraints, preset association strength threshold, and the initial attack chain directed acyclic graph, the initial attack chain path is obtained.

8. The method for analyzing power information network security logs according to claim 1, characterized in that, Based on the initial attack chain path and the preset inference model, the consistency of the inference results is obtained. If the consistency of the inference results is greater than or equal to the preset inference degree threshold, the initial attack chain path is structured and parsed to obtain the power information network security log analysis results, including: Based on the initial attack chain path, standard prompt words are constructed; Input the standard prompt words into a preset reasoning model to obtain a round of reasoning results; The standard prompt words are shuffled to obtain random prompt words; The random prompts are input into a preset reasoning model to obtain the second round of reasoning results. Based on the results of the first and second rounds of reasoning, cross-validation prompts are constructed, and these cross-validation prompts are input into a preset large-scale reasoning model to obtain the results of the third round of reasoning. Based on the results of the first, second, and third rounds of reasoning, the consistency of the reasoning results is calculated. If the consistency of the reasoning results is greater than or equal to a preset reasoning degree threshold, the initial attack chain path is structured and parsed to obtain the power information network security log analysis results.

9. A power information network security log analysis system, characterized in that, It includes a basic data acquisition module, an event representation mapping module, an event correlation strength calculation module, an initial attack chain path filtering module, and an attack chain inference and verification module, specifically: The basic data acquisition module is used to acquire expanded log sets and structured data of network assets; The event representation mapping module is used to obtain a power safety event template library, an external business interaction bipartite diagram, an internal business interaction bipartite diagram, and a behavioral event set based on an expanded log set and network asset structured data; The event association strength calculation module is used to pair any two behavioral events in the behavioral event set to obtain several behavioral event pairs. Based on the behavioral event pairs, the external business interaction bipartite graph, the internal business interaction bipartite graph, and the power safety event template library, the semantic cosine similarity, topological distance, and expert knowledge transfer probability of the behavioral event pairs are obtained sequentially. The association strength of several events is calculated based on the semantic cosine similarity, topological distance, and expert knowledge transfer probability to form an event association strength set. The initial attack chain path filtering module is used to obtain the initial attack chain path based on the behavioral event set and the event correlation strength set; The attack chain inference verification module is used to obtain the consistency of inference results based on the initial attack chain path and the preset inference model. If the consistency of inference results is greater than or equal to the preset inference degree threshold, the initial attack chain path is structured and parsed to obtain the power information network security log analysis results.

10. The power information network security log analysis system according to claim 9, characterized in that, The basic data acquisition module is used to acquire expanded log sets and structured network asset data, including: Obtain the raw log set and structured data of network assets; Perform data cleaning on the original log set to obtain a standard log set; Pair any two standard logs in the standard log set to obtain several standard log pairs, and calculate the log similarity of the standard log pairs in turn; if the log similarity is greater than or equal to the preset log aggregation threshold, aggregate the standard logs in the standard log pair to obtain several aggregated logs; if the log similarity is less than the preset log aggregation threshold, determine the standard logs in the standard log pair as non-redundant logs. A collection of aggregated logs and non-redundant logs is formed by combining several aggregated logs and several non-redundant logs, and the information of the aggregated log collection is expanded to obtain the expanded log collection.

Images