A double-mechanism-based power asset blind area dynamic monitoring method and system

Abstract

The application discloses a kind of based on double mechanism electric power asset blind area dynamic monitoring method, using the collaborative strategy of " passive identification + active prediction " to realize the all-round coverage of electric power asset blind area from real-time perception to early warning.It realizes the real-time perception of electric power asset state and the accurate identification of existing blind area by continuously integrating the state and correlation of electric power asset through the construction of dynamic space-time atlas, solves the defect of real-time deficiency of static account comparison method.For the problem that potential blind area is difficult to warn, the application introduces a prediction model based on space-time neural network, intelligently infers the monitoring blind area that may be formed in the future by learning the behavior evolution law of electric power asset in space-time dimension, realizes the forward-looking early warning of unknown risk.

Description

Technical Field

[0001] This invention belongs to the field of power asset blind spot monitoring technology in power systems, and more specifically, relates to a dynamic monitoring method and system for power asset blind spots based on a dual mechanism. Background Technology

[0002] Power system power asset monitoring blind spots refer to areas or equipment that cannot be effectively covered or monitored in power system monitoring and management. These areas are usually unable to be monitored in real time, have data collected, or have necessary operations performed due to technical, resource, or other limitations. Monitoring blind spots may lead to the neglect of potential problems in the power system, thereby increasing the risk of system operation.

[0003] Currently, commonly used power blind spot monitoring technologies mainly include the following two categories: 1. Passive Identification Method Based on Static Ledger Comparison: This method relies on maintaining a pre-registered static ledger of power assets (such as IP address, MAC address, communication port, and other identification information). By comparing real-time power asset information obtained from network scanning or communication traffic with this static ledger, unregistered, abnormal, or potentially illegal devices can be identified. Its implementation typically combines periodic full-network or segmented scanning. When a discrepancy is detected between the identification information of an online power asset and the ledger record, an alarm is triggered to compensate for the low efficiency of manual investigation. 2. Active Probe Method Based on Periodic Scanning: This method actively sends probe packets (such as ICMP requests, TCP SYN packets, etc.) to target IP address ranges in the network and discovers online power assets based on the device's response. By periodically executing such scanning tasks, a current network power asset inventory can be constructed. By analyzing the differences between this inventory and historical or baseline inventories, changes in the online and offline status of power assets can be detected, thereby identifying monitoring blind spots caused by dynamic changes in power assets.

[0004] However, both of the above-mentioned methods for monitoring blind spots in power assets have some significant drawbacks: First, the existing passive identification methods based on static ledger comparisons are severely lacking in real-time performance. Their monitoring effectiveness depends on the frequency of scanning cycles, creating a "time blind spot" between two scans. This makes it impossible to capture real-time dynamic changes in power assets (such as temporary connection or disconnection of equipment), resulting in a lag in the monitoring system. Second, the existing active detection methods based on periodic scanning lack predictive capabilities. Their core mechanisms are all post-event remedial detection, only able to identify and alert after an abnormal or missing event of power assets occurs. They cannot model and analyze potential or imminent blind spot risks in power assets or provide early warnings, leaving security protection in a passive state. Summary of the Invention

[0005] To address the aforementioned deficiencies or improvement needs of existing technologies, this invention provides a dynamic monitoring method for power asset blind spots based on a dual mechanism. Its purpose is to resolve the technical problems of existing passive identification methods based on static ledger comparison, which suffer from insufficient real-time performance and cannot capture real-time dynamic changes in power assets, resulting in a lagging monitoring system; and existing active detection methods based on periodic scanning, which lack predictive capabilities and can only identify and alert after power asset anomalies or missing events occur, thus failing to model, analyze, and provide early warnings for potential and impending power asset blind spot risks, leaving security protection in a passive state.

[0006] To achieve the above objectives, according to one aspect of the present invention, a method for dynamic monitoring of power asset blind spots based on a dual mechanism is provided, comprising the following steps: (1) Obtain multi-source heterogeneous data from the security monitoring platform, and preprocess the multi-source heterogeneous data to obtain a normalized feature matrix; (2) Construct a spatiotemporal knowledge graph based on the normalized feature matrix obtained in step (1), and perform serialization slicing on the dynamic spatiotemporal graph according to the preset time window to obtain the dynamic graph structure sequence; (3) Input the dynamic graph structure sequence at time t obtained in step (2) into the multi-scale spatiotemporal feature encoder constructed based on graph attention network to obtain a unified spatiotemporal feature matrix; (4) Input the unified spatiotemporal feature matrix obtained in step (3) into the decoder to obtain the real-time alarm list and the potential blind spot warning list; (5) Input the real-time alarm list and potential blind spot warning list obtained in step (4) into the pre-trained dynamic monitoring model of power asset blind spots to obtain the dynamic monitoring results of power asset blind spots.

[0007] Preferably, step (1) includes the following sub-steps: (1-1) Collect heterogeneous data from multiple sources from the network security monitoring platform and the power asset management system; Specifically, this step involves: first, collecting network traffic data from the network security monitoring platform and obtaining the fingerprint characteristics of power assets from the network traffic data using power asset fingerprinting technology; then, obtaining the online status of power assets from the power asset management system through periodic or triggered Nmap scans; subsequently, obtaining multiple core attributes of power assets from the power asset management system, including IP address, MAC address, hostname, department, and importance level; and finally, reading security log data from the network security monitoring platform, including firewall logs and intrusion detection system / intrusion prevention system logs. All the obtained network traffic data, fingerprint characteristics of all power assets, online status of all power assets, core attributes of all power assets, and security log data constitute multi-source heterogeneous data. (1-2) The multi-source heterogeneous data obtained in (1-1) are preprocessed to obtain the normalized feature matrix.

[0008] Preferably, step (1-2) specifically includes the following sub-steps: (1-2-1) Time alignment processing is performed on the network traffic data and security log data in the multi-source heterogeneous data obtained in (1-1), that is, the network traffic data and security log data from different collection sources are sliced ​​and aggregated according to a unified time window to obtain multiple time-series aligned data; (1-2-2) Entity parsing processing is performed on the multi-source heterogeneous data obtained in (1-1) and the time-series aligned data obtained in (1-2-1) to obtain a unified power asset entity view; Specifically, this step involves: first, performing association matching on the fingerprint features of power assets and the core attributes of power assets in all time-series aligned data to obtain a preliminary mapping relationship of power assets; then, performing conflict detection and resolution on the obtained preliminary mapping relationship of power assets to obtain a power asset association table; and finally, merging the obtained power asset association table with the power asset's flow data, log data, and core attributes to obtain an enhanced attribute set of power assets as a unified power asset entity view. (1-2-3) Standardize the unified power asset entity view generated in step (1-2-2) to obtain a normalized feature matrix; Specifically, this step involves: First, formatting and encoding the original power asset data in the unified power asset entity view. This involves standardizing the data format of core attributes and performing one-hot encoding or label encoding on discrete attributes to obtain standardized power asset attribute vectors, including equipment type, operating system, open ports, and protocol behavior. Next, expanding and integrating the standardized power asset attribute vectors involves one-hot encoding or word embedding quantization of equipment type and operating system, multi-value binarization of open ports, extraction of statistical features from protocol behavior, and Z-score standardization of all numerical features to obtain processed standardized fingerprint feature vectors. Finally, merging and aligning the processed power asset attribute vectors with the standardized fingerprint feature vectors according to power assets to form a normalized feature matrix.

[0009] Preferably, step (2) includes the following sub-steps: (2-1) Obtain the spectral snapshot at time t based on the normalized feature matrix obtained in step (1). , where t∈[1,T], and T is the total number of time segments; (2-2) Snapshot of the spectrum at time t obtained in step (2-1) Perform node and edge feature construction processing to obtain the dynamic graph structure sequence at time t; Specifically, this step involves first mapping each active power asset in the normalized feature matrix obtained in step (1) at time t to a power asset node in a graph structure. Then, construct the edge set at time t based on all the power asset nodes obtained at time t. Specifically, based on network traffic data from the security monitoring platform, if at time t any two power asset nodes... and If a communication relationship exists between them, then an edge is established between them. All the edges obtained constitute the edge set at time t. The dynamic interaction relationships between power assets are transformed into connections in a graph structure, representing communication links in the network, where i and j are both ∈ [1, the total number of power asset nodes N]. Subsequently, based on the edge set at time t... Construct the dynamic adjacency matrix at time t The dynamic adjacency matrix The element in row x, column y and the element in row y, column x are respectively the edge set. Connect an edge in the middle Two power asset nodes and , where x∈[1, dynamic adjacency matrix [row number], y∈[1, dynamic adjacency matrix] [Number of columns] Finally, extract the feature vector of the i-th power asset from the normalized feature matrix. and assign it to the dynamic adjacency matrix. Corresponding element in That is, the i-th power asset node at time t, all power asset nodes at time t that have been assigned feature vectors, and the edges between these power asset nodes at time t together constitute the dynamic graph structure sequence at time t.

[0010] Preferably, step (3) includes the following sub-steps: (3-1) Obtain the power asset system ledger from the network security monitoring platform, and perform vector concatenation processing between the dynamic graph structure sequence obtained in step (2) and the power asset system ledger to obtain the fusion input feature matrix features at time t. ; Specifically, this step involves: first, exporting the power asset system ledger from the network security monitoring platform; then, extracting the static node features of all power assets from the power asset system ledger; and finally, assigning the dynamic node features corresponding to each power asset in the dynamic graph structure sequence obtained in step (2). The static node features of the power asset are concatenated with vectors, and all concatenation results are summarized to obtain the fused input feature matrix at time t. ; (3-2) The fusion feature matrix obtained in step (3-1) at time t With dynamic adjacency matrix The input is fed into the graph attention network of the multi-scale spatiotemporal feature encoder to obtain the attention weights between each power asset node and its neighboring power asset nodes in the graph attention network; where the i-th power asset node at time t... The j-th power asset node at time t in the graph attention network (attention weights between) equal: ; intermediate parameters equal: in It is a learnable linear transformation weight matrix. It is a learnable attention weight vector. This indicates a splicing operation. It is a power asset node In graph attention networks Features of the layer This represents the activation function. ∈[1, total number of layers in the graph attention network]; (3-3) The features of the fused input feature matrix at time t obtained in step (3-1) The i-th power asset node at time t obtained in step (3-2) The j-th power asset node at time t in the graph attention network Attention weights between Input the multi-scale temporal feature extraction model of the multi-scale spatiotemporal feature encoder to obtain a two-dimensional matrix composed of unified spatiotemporal feature vectors of all power asset nodes, and obtain the i-th power asset node at time t based on this two-dimensional matrix. Corresponding unified spatiotemporal feature vector ; Specifically, this step involves the following steps: First, the fusion feature matrix obtained in step (3-1) at time t is weighted and fused with the attention weights obtained in step (3-2) to generate a temporal input feature tensor containing spatial neighborhood information. Then, this temporal input feature tensor is fed in parallel into three independent branches of the multi-scale temporal feature extraction model to obtain multi-scale temporal features respectively. Subsequently, the multi-scale temporal features output from the three independent branches are concatenated and nonlinearly activated sequentially to generate an intermediate feature representation that fuses multi-scale information. Next, the intermediate feature representation is dimensionality-reduced and vectorized to obtain a two-dimensional matrix with the same number of rows as the total number of power asset nodes at time t. Finally, this two-dimensional matrix is ​​divided by rows to obtain the i-th power asset node at time t. Corresponding unified spatiotemporal feature vector ; (3-4) Stack the unified spatiotemporal feature vectors of all power asset nodes at time t obtained in step (3-3) to obtain a unified spatiotemporal feature matrix.

[0011] Preferably, the process of obtaining the real-time alarm list in step (4) specifically involves firstly, using an inner product function to calculate the similarity of the unified spatiotemporal feature matrix to obtain the similarity between any two power asset nodes. The probability of the link existing at time t The existence probabilities of all the obtained links constitute the reconstructed adjacency matrix. ,in This represents the activation function. Represents the i-th power asset node The unified spatiotemporal eigenvectors are then used to reconstruct the adjacency matrix. The dynamic adjacency matrix at time t A consistency comparison analysis is performed to obtain the difference between the expected presence and the actual number of connections for each power asset node. Then, power asset nodes with a difference greater than a preset threshold and an actual number of connections of zero are marked as abnormally offline blind zone power asset nodes. Finally, all marked blind zone power asset nodes are summarized into a real-time alarm list. The process of obtaining the potential blind spot warning list in step (4) is as follows: First, the unified spatiotemporal feature matrix is ​​input into the multilayer perceptron, and the nonlinear mapping function is learned. Calculate the i-th power asset node in Offline probability value after time step ,in This indicates the length of the prediction time window; subsequently, the calculated i-th power asset node is... Offline probability value after time step Compared with the preset dynamic risk threshold θ, it will satisfy All power asset nodes with a value greater than θ are marked as high-risk power asset nodes; finally, all marked high-risk power asset nodes are ranked according to their offline probability values ​​to generate a potential blind spot warning list.

[0012] Preferably, the specific structure of the dynamic monitoring model for blind spots in power assets is as follows: Layer 1 takes as input all N active power assets at time t, and dynamic behavior data and static ledger data of all power assets at time t collected from the network security monitoring platform, including traffic, connection count, and device type importance level. This layer first maps all N power assets to N power asset nodes in a graph structure; then, it constructs the edge set at time t based on the collected dynamic behavior data. Subsequently, based on the edge set Generate the corresponding dynamic adjacency matrix at time t. Finally, static feature data for each power asset node is extracted from the static ledger data to form the static node features of the power asset nodes. The static node features of all power assets constitute a static node feature matrix. The dynamic behavior data at time t is used to construct a feature vector, which is then assigned to the dynamic adjacency matrix. The corresponding power asset nodes are output as static node feature matrices. With dynamic adjacency matrix ; The second layer takes the dynamic adjacency matrix at time t as its input, which is the output of the first layer. and static node feature matrix This layer will use a dynamic adjacency matrix. and static node feature matrix Perform a concatenation operation to form the node feature matrix at time t. And output, its dimension is N× ,in This indicates the length of the dynamic characteristic data for each power asset node. This indicates the length of the static feature data for each power asset node; The third layer takes the fused feature matrix at time t as its input, which is the output of the second layer. The dynamic adjacency matrix at time t of the output of layer 1 This layer first uses a graph attention mechanism to calculate the attention weights between each power asset node and each of its neighboring power asset nodes in the dynamic adjacency matrix; then it uses the fused feature matrix at time t... The feature vector of each power asset node is extracted, and the fused features of all neighboring power asset nodes of that power asset node are weighted and aggregated according to the attention weight to form the spatial augmentation feature at time t. Its dimension is N× ,in The length of the feature vector for each power asset node; finally, the spatial augmentation features of T consecutive time steps are combined into a spatial augmentation feature sequence { } and output, where i∈[1,T]; The fourth layer takes the spatial augmentation feature sequence output from the third layer as its input. This layer inputs the spatial enhancement feature sequence in parallel into three one-dimensional convolutional neural networks with different receptive fields to obtain features of three time patterns: short-term fluctuations, medium-term cycles, and long-term trends. The three features are then concatenated and fused to form a unified spatiotemporal feature matrix. And output, its dimension is N× ,in The length of the spatiotemporal feature vector for each power asset node; The fifth layer takes the unified spatiotemporal feature matrix Z output from the fourth layer as input. This layer uses an inner product function to calculate the similarity of this unified spatiotemporal feature matrix to obtain the similarity between any two power asset nodes. exist Probability of link existence at time t. And construct a reconstructed adjacency matrix based on the existence probabilities of all the obtained links. And output, its dimension is N×N, where Indicates the activation function; The sixth layer takes the unified spatiotemporal feature matrix Z, output from the fourth layer, as its input. This layer then inputs the unified spatiotemporal feature matrix into the multilayer perceptron, where it learns a nonlinear mapping function. Calculate the i-th power asset node in Offline probability value after time step ,in This indicates the length of the prediction time window; subsequently, the calculated i-th power asset node is... Offline probability value after time step Compared with the preset dynamic risk threshold θ, it will satisfy All power asset nodes with a value greater than θ are marked as high-risk power asset nodes; finally, all marked high-risk power asset nodes are ranked according to their offline probability values ​​to generate a potential blind spot warning list.

[0013] Preferably, the dynamic monitoring model for blind spots in power assets is trained through the following steps: (A1) Obtain a multi-source heterogeneous dataset from the power monitoring system network environment, and divide the multi-source heterogeneous dataset into a training set and a test set in an 8:2 ratio; (A2) Perform data preprocessing on the training set obtained in step (A1) to obtain the preprocessed training set; (A3) According to the preset time window The preprocessed training set obtained in step (A2) is subjected to serialization and slicing to obtain a dynamic spatiotemporal map sequence. ,in Time-based graph structure , This represents the dynamic adjacency matrix at time t. This represents the dynamic characteristic moment vector of the power asset node at time t; (A4) The graph at time t in the dynamic spatiotemporal map sequence obtained in step (A3) Adjacency matrix in Sample sampling is conducted, randomly selecting 50% of the power asset node pairs with interconnected relationships as positive samples, and randomly selecting 50% of the power asset node pairs without interconnected relationships as negative samples. (A5) Extract the dynamic node feature vector of each power asset node from the dynamic spatiotemporal graph sequence obtained in step (A3) and combine it with the static node feature matrix extracted from the system ledger. Perform a concatenation operation to obtain the fused node feature matrix at time t. ; (A6) Based on the fusion feature matrix at time t obtained in step (A5) and the dynamic adjacency matrix at time t obtained in step (A3), and using the graph attention mechanism to calculate the attention weight between each power asset node and each neighboring power asset node in the dynamic adjacency matrix, extract the feature vector of each power asset from the fusion feature matrix at time t, and perform weighted aggregation of the fusion features of all neighboring power asset nodes of the power asset node according to the attention weight to form the spatial augmentation feature at time t. ; (A7) Input the spatially enhanced node feature matrix obtained in step (A6) into three one-dimensional convolutional neural networks with different receptive fields to obtain features of three time patterns: short-term fluctuations, medium-term cycles, and long-term trends. Then, concatenate and fuse the three features to form a unified spatiotemporal feature matrix. And output; (A8) The unified spatiotemporal feature matrix obtained in step (A7) Two decoders are input in parallel to obtain the joint loss: (A9) Based on the joint loss obtained in step (A8), and using the backpropagation algorithm and the adaptive moment estimation optimizer, iteratively update all parameters of the graph attention network, multi-scale temporal convolution and decoder in the dynamic monitoring model of power asset blind spots until the loss function converges, thereby obtaining the initially trained dynamic monitoring model of power asset blind spots. (A10) Use the test set obtained in step (A1) to test the model initially trained in step (A9) and evaluate its performance indicators on the two tasks of real-time identification of power asset blind spots and offline risk prediction. When the indicators reach the optimal and stable, the final trained dynamic monitoring model of power asset blind spots is obtained.

[0014] Preferably, the multi-source heterogeneous dataset in step (A1) includes power asset information from multiple dimensions such as network traffic, active scanning, system ledgers, and security logs, which is used to record the attributes of power asset nodes, the communication relationships between power assets, and their changes over time. Step (A2) specifically involves the following steps: First, the training set obtained in step (A1) is time-aligned to obtain a time-aligned training set. Then, entity parsing is performed on the time-aligned training set to obtain a unified power asset entity view. Subsequently, feature engineering is performed on the obtained unified power asset entity view to obtain initial node feature vectors. Finally, the obtained initial node feature vectors are normalized to obtain standardized node dynamic feature vectors, and a dynamic adjacency matrix sequence is constructed based on the obtained standardized node dynamic feature vectors as the preprocessed training set. Step (A8) specifically involves: First, processing the unified spatiotemporal feature matrix through inner product operations to obtain the connection probabilities between each pair of power asset nodes. All connection probabilities constitute the reconstructed adjacency matrix. Then, based on the positive and negative samples sampled in step (A4), the difference between the reconstructed adjacency matrix and the dynamic adjacency matrix obtained in step (A3) is calculated as the reconstruction loss; subsequently, the unified spatiotemporal feature matrix is ​​input into the multilayer perceptron, and the future of each power asset node is predicted through nonlinear mapping. Offline probability value at time Compare the offline probability value with the future The online status of power asset nodes is compared at any time to obtain the predicted loss; finally, the reconstruction loss obtained in this step is weighted and summed with the predicted loss according to preset weights to obtain the joint loss.

[0015] According to another aspect of the present invention, a dynamic monitoring system for blind spots in power assets based on a dual mechanism is provided, comprising the following modules: The first module is used to acquire multi-source heterogeneous data from the security monitoring platform, and preprocess the multi-source heterogeneous data to obtain a normalized feature matrix. The second module is used to construct a spatiotemporal knowledge graph based on the normalized feature matrix obtained from the first module, and to perform serialization slicing on the dynamic spatiotemporal graph according to a preset time window to obtain a dynamic graph structure sequence. The third module is used to input the dynamic graph structure sequence at time t obtained from the second module into a multi-scale spatiotemporal feature encoder constructed based on a graph attention network to obtain a unified spatiotemporal feature matrix. The fourth module is used to input the unified spatiotemporal feature matrix obtained from the third module into the decoder to obtain a real-time alarm list and a potential blind spot warning list. The fifth module is used to input the real-time alarm list and potential blind spot warning list obtained from the fourth module into the pre-trained dynamic monitoring model for power asset blind spots in order to obtain dynamic monitoring results for power asset blind spots.

[0016] In summary, compared with the prior art, the above-described technical solutions conceived by this invention can achieve the following beneficial effects: 1. Because the present invention adopts steps (2) and (3), it constructs a dynamic spatiotemporal map by continuously analyzing network traffic, and uses the real-time reconstruction and comparison of the spatiotemporal map neural network to detect blind spots of power assets in real time. Therefore, it can solve the problem that the existing passive identification method based on static ledger comparison is seriously lacking in real time. Its monitoring effect depends on the scanning cycle frequency. During the interval between two scans, a "time blind spot" will be formed, which cannot capture the real-time dynamic changes of power assets (such as temporary access or disconnection of equipment), resulting in the technical problem of lag in the monitoring system. 2. Because the present invention adopts step (4), it uses a spatiotemporal neural network to deeply learn the spatiotemporal evolution law of power asset behavior, accurately predicts the offline risk of power assets in the future time period, and actively identifies power assets in abnormal state. Therefore, it can solve the problem that the existing active detection method based on periodic scanning lacks predictive ability. Its core mechanism is all post-event remedial detection, which can only identify and alarm after the occurrence of abnormal or missing events of power assets. It cannot model and analyze potential and imminent blind spot risks of power assets and provide early warning, which makes the safety protection passive. 3. This invention constructs a dual parallel mechanism of "passive discovery + active early warning" to achieve comprehensive and intelligent monitoring of blind spots in power assets. It can perceive the status of power assets in real time and accurately and identify existing blind spots. Furthermore, it can predict future risks based on the spatiotemporal evolution of power asset behavior. Ultimately, it forms a complete monitoring closed loop that covers the present and the future and takes into account both real-time and forward-looking capabilities, significantly improving the security and protection effectiveness of the power monitoring system. Attached Figure Description

[0017] Figure 1 This is a flowchart of the dynamic monitoring method for power asset blind spots based on a dual mechanism, as described in this invention. Figure 2 This is a schematic diagram of the dynamic monitoring model for blind spots in power assets used in the method of this invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0019] It should be noted that in the description of the embodiments of the present invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. The terms "upper," "lower," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the present invention. Those skilled in the art can understand the specific meaning of the above terms in the present invention according to the specific circumstances.

[0020] Furthermore, the technical solutions of the various embodiments of the present invention can be combined with each other, but only if they are feasible for those skilled in the art. If the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0021] The technical terminology of this invention will be explained and described below: Power asset equipment: refers to infrastructure equipment with network communication functions, including but not limited to computer mainframes, network switching equipment, security gateways, etc.

[0022] The basic idea of ​​this invention is to provide a dynamic monitoring method for blind spots in power assets based on a dual mechanism. It employs a collaborative strategy of "passive identification + active prediction" to achieve comprehensive coverage of power asset blind spots, from real-time perception to proactive early warning. By constructing a dynamic spatiotemporal map and continuously integrating the status and relationships of power assets, it achieves real-time perception of power asset status and accurate identification of existing blind spots, overcoming the shortcomings of static ledger comparison methods in terms of real-time performance. Addressing the difficulty in predicting potential blind spots, this invention introduces a prediction model based on spatiotemporal neural networks. By learning the behavioral evolution patterns of power assets in the spatiotemporal dimension, it intelligently infers potential future monitoring blind spots, achieving proactive early warning of unknown risks.

[0023] like Figure 1 As shown, this invention provides a dynamic monitoring method for power asset blind spots based on a dual mechanism, comprising the following steps: (1) Obtain multi-source heterogeneous data from the security monitoring platform, and preprocess the multi-source heterogeneous data to obtain a normalized feature matrix; This step (1) includes the following sub-steps: (1-1) Collect multi-source heterogeneous data from the network security monitoring platform and the power asset management system.

[0024] Specifically, this step involves: First, collecting network traffic data (including NetFlow / sFlow streaming data and network packet metadata provided by Zeek / Bro logs) from the network security monitoring platform, and then using power asset fingerprinting technology to obtain the fingerprint characteristics of power assets (including device type, operating system, open ports, and protocol behavior) from the network traffic data. Next, obtaining the online status of power assets from the power asset management system through periodic or triggered Nmap scans. Subsequently, obtaining multiple core attributes of power assets from the power asset management system, including IP address, MAC address, hostname, department, and importance level. Finally, reading security log data from the network security monitoring platform, including firewall logs and intrusion detection system / intrusion prevention system logs. All the obtained network traffic data, fingerprint characteristics of all power assets, online status of all power assets, core attributes of all power assets, and security log data constitute multi-source heterogeneous data.

[0025] (1-2) The multi-source heterogeneous data obtained in (1-1) are preprocessed to obtain a normalized feature matrix; This step specifically includes the following sub-steps: (1-2-1) Perform time alignment processing on the network traffic data and security log data in the multi-source heterogeneous data obtained in (1-1) (slice and aggregate the network traffic data and security log data from different collection sources according to a unified time window) to obtain multiple time-series aligned data; (1-2-2) Entity parsing processing is performed on the multi-source heterogeneous data obtained in (1-1) and the time-series aligned data obtained in (1-2-1) to obtain a unified power asset entity view; Specifically, this step involves: first, performing association matching on the fingerprint features (including device type, operating system, open ports, and protocol behavior, etc.) of power assets in all time-series aligned data with the core attributes (including IP address, MAC address, hostname, etc.) of power assets to obtain a preliminary mapping relationship for power assets; then, performing conflict detection and resolution processing on the obtained preliminary mapping relationship for power assets to obtain a power asset association table; and finally, merging the obtained power asset association table with the power asset's traffic data, log data, and core attributes to obtain an enhanced attribute set for power assets as a unified power asset entity view. (1-2-3) Standardize the unified power asset entity view generated in step (1-2-2) to obtain a normalized feature matrix; Specifically, this step involves the following steps: First, the original power asset data in the unified power asset entity view is formatted and encoded. This involves standardizing the data format of core attributes (such as the standard representation of time and IP address) and performing one-hot encoding or tag encoding on discrete attributes to obtain standardized power asset attribute vectors, including equipment type, operating system, open ports, and protocol behavior. Next, the standardized power asset attribute vectors are expanded and integrated. This involves one-hot encoding or word embedding quantization of equipment type and operating system, multi-value binarization of open ports, extraction of statistical features from protocol behavior, and Z-score standardization of all numerical features to obtain processed standardized fingerprint feature vectors. Finally, the processed power asset attribute vectors and standardized fingerprint feature vectors are merged and aligned according to power assets to form a normalized feature matrix.

[0026] (2) Construct a spatiotemporal knowledge graph based on the normalized feature matrix obtained in step (1), and perform serialization slicing on the dynamic spatiotemporal graph according to the preset time window to obtain the dynamic graph structure sequence; This step (2) includes the following sub-steps: (2-1) Obtain the spectral snapshot at time t based on the normalized feature matrix obtained in step (1). , where t∈[1,T], and T is the total number of time segments; (2-2) Snapshot of the spectrum at time t obtained in step (2-1) Perform node and edge feature construction processing to obtain the dynamic graph structure sequence at time t.

[0027] Specifically, this step involves first mapping each active power asset in the normalized feature matrix obtained in step (1) at time t to a power asset node in a graph structure. Then, construct the edge set at time t based on all the power asset nodes obtained at time t. (Specifically, based on network traffic data in the security monitoring platform, if at time t any two power asset nodes...) and If a communication relationship exists between them, then an edge is established between them. All the edges obtained constitute the edge set at time t. The dynamic interaction relationships between power assets are transformed into connections in a graph structure, representing communication links in the network, where i and j are both ∈ [1, the total number of power asset nodes N]). Subsequently, based on the edge set at time t... Construct the dynamic adjacency matrix at time t (This dynamic adjacency matrix) The element in row x, column y and the element in row y, column x are respectively the edge set. Connect an edge in the middle Two power asset nodes and , where x∈[1, dynamic adjacency matrix [row number], y∈[1, dynamic adjacency matrix] [Number of columns], and finally, extract the feature vector of the i-th power asset from the normalized feature matrix. and assign it to the dynamic adjacency matrix. Corresponding element in That is, the i-th power asset node at time t, all power asset nodes at time t that have been assigned feature vectors, and the edges between these power asset nodes at time t together constitute the dynamic graph structure sequence at time t.

[0028] The advantage of this step (2) is that it transforms the static power asset ledger and discrete scan data into a dynamic graph sequence with spatiotemporal correlation, providing a structured data model for capturing the continuous change patterns of power asset behavior.

[0029] (3) Input the dynamic graph structure sequence at time t obtained in step (2) into the multi-scale spatiotemporal feature encoder constructed based on graph attention network to obtain a unified spatiotemporal feature matrix (which can comprehensively characterize the evolution of power asset behavior in spatial topology and multiple time scales, and each row of the matrix corresponds to a unified spatiotemporal feature vector of a power asset). Step (3) includes the following sub-steps: (3-1) Obtain the power asset system ledger from the network security monitoring platform, and perform vector concatenation processing between the dynamic graph structure sequence obtained in step (2) and the power asset system ledger to obtain the fusion input feature matrix features at time t. ; Specifically, this step involves first exporting the power asset system ledger from the network security monitoring platform; then, extracting the static node features of all power assets from the power asset system ledger (including features that do not change over time, such as equipment type, importance level, manufacturer, and serial number); and finally, assigning the dynamic node features corresponding to each power asset in the dynamic graph structure sequence obtained in step (2). The static node features of the power asset are concatenated with vectors, and all concatenation results are summarized to obtain the fused input feature matrix at time t. .

[0030] (3-2) The fusion feature matrix obtained in step (3-1) at time t With dynamic adjacency matrix The input is fed into the graph attention network of the multi-scale spatiotemporal feature encoder to obtain the attention weights between each power asset node and its neighboring power asset nodes in the graph attention network. Specifically, the i-th power asset node at time t The j-th power asset node at time t in the graph attention network (i.e., power asset nodes) Attention weights between neighboring power asset nodes equal: ; intermediate parameters equal: in It is a learnable linear transformation weight matrix. It is a learnable attention weight vector. This indicates a splicing operation. It is a power asset node In graph attention networks Features of the layer This represents the activation function. ∈[1, total number of layers in the graph attention network].

[0031] (3-3) The features of the fused input feature matrix at time t obtained in step (3-1) The i-th power asset node at time t obtained in step (3-2) The j-th power asset node at time t in the graph attention network Attention weights between Input the multi-scale temporal feature extraction model of the multi-scale spatiotemporal feature encoder to obtain a two-dimensional matrix composed of unified spatiotemporal feature vectors of all power asset nodes, and obtain the i-th power asset node at time t based on this two-dimensional matrix. Corresponding unified spatiotemporal feature vector .

[0032] Specifically, this step involves first fusing the fusion feature matrix at time t obtained in step (3-1) with the attention weights obtained in step (3-2) to generate a temporal input feature tensor containing spatial neighborhood information; then, this temporal input feature tensor is fed in parallel into three independent branches of the multi-scale temporal feature extraction model (each branch is configured with a convolutional kernel of a different scale: the first branch is configured with a small-scale convolutional kernel to capture short-term behavioral patterns of power assets, such as port scanning and sudden increases and decreases in traffic; the second branch is configured with a medium-scale convolutional kernel to capture medium-term cyclical patterns of power assets, such as heartbeats and cyclic timed tasks). The third branch is configured with large-scale convolutional kernels to capture long-term trends in power assets, such as business growth and performance degradation, to obtain multi-scale time features. Subsequently, the multi-scale time features output from the three independent branches are concatenated and non-linearly activated to generate an intermediate feature representation that integrates multi-scale information (maintaining the same structure in the row dimension as the input power asset nodes). Then, the intermediate feature representation is dimensionality-reduced and vectorized to obtain a two-dimensional matrix with the same number of rows as the total number of power asset nodes at time t. Finally, this two-dimensional matrix is ​​divided by rows to obtain the i-th power asset node at time t. Corresponding unified spatiotemporal feature vector .

[0033] (3-4) Stack the unified spatiotemporal feature vectors of all power asset nodes at time t obtained in step (3-3) to obtain a unified spatiotemporal feature matrix; The advantage of this step (3) is that, through the collaborative design of spatial attention mechanism and multi-scale temporal convolution, the joint modeling of local interaction patterns and long-term and short-term behavioral trends of power assets is realized, which significantly improves the richness and discriminative power of feature expression.

[0034] (4) Input the unified spatiotemporal feature matrix obtained in step (3) into the decoder to obtain the real-time alarm list and the potential blind spot warning list; The process of obtaining the real-time alarm list in this step involves, firstly, using an inner product function to calculate the similarity of the unified spatiotemporal feature matrix to obtain the similarity between any two power asset nodes. The probability of the link existing at time t The existence probabilities of all the obtained links constitute the reconstructed adjacency matrix. ,in This represents the activation function. Represents the i-th power asset node The unified spatiotemporal eigenvectors are then used to reconstruct the adjacency matrix. The dynamic adjacency matrix at time t A consistency comparison analysis is performed to obtain the difference between the expected presence and the actual number of connections for each power asset node. Then, power asset nodes with a difference greater than a preset threshold (ranging from [0.3, 0.7], preferably 0.5) and an actual number of connections of zero are marked as abnormally offline blind zone power asset nodes. Finally, all marked blind zone power asset nodes are summarized into a real-time alarm list.

[0035] The process of obtaining the potential blind spot warning list in this step involves first inputting the unified spatiotemporal feature matrix into the multilayer perceptron, and then learning the nonlinear mapping function. Calculate the i-th power asset node in Offline probability value after time step ,in This indicates the length of the prediction time window; subsequently, the calculated i-th power asset node is... Offline probability value after time step The value is compared with a preset dynamic risk threshold θ (which ranges from [0.6, 0.95], preferably 0.85), and the result satisfies... All power asset nodes with a value greater than θ are marked as high-risk power asset nodes. Finally, all marked high-risk power asset nodes are ranked according to their offline probability values ​​to generate a potential blind spot warning list (which is used to provide a decision-making basis for the intervention priority of operation and maintenance personnel).

[0036] The advantage of this step (4) is that, through the dual-task parallel architecture of "real-time detection + early warning", it not only ensures the timely discovery of existing blind spots, but also realizes the forward-looking prediction of potential risks, forming a complete monitoring closed loop.

[0037] (5) Input the real-time alarm list and potential blind spot warning list obtained in step (4) into the pre-trained dynamic monitoring model of power asset blind spots to obtain the dynamic monitoring results of power asset blind spots.

[0038] like Figure 2 As shown, the specific structure of the dynamic monitoring model for blind spots in power assets of this invention is as follows: The first layer takes as input all active power assets (totaling N) at time t, and dynamic behavior data and static ledger data (including traffic, connection count, device type importance level, etc.) of all power assets at time t collected from the network security monitoring platform. This layer first maps all N power assets to N power asset nodes in a graph structure; then, it constructs the edge set at time t based on the collected dynamic behavior data. (Specifically, traverse all power asset node pairs) Where i and j are both ∈ [1, N], if a node is detected With nodes If there is communication traffic between them, then an edge is established between them. All established edges together constitute... Subsequently, based on the edge set Generate the corresponding dynamic adjacency matrix at time t. (Its dimension is N×N); Finally, static feature data of each power asset node is extracted from the static ledger data to form the static node features of the power asset node. The static node features of all power assets constitute a static node feature matrix. The dynamic behavior data at time t is used to construct a feature vector, which is then assigned to the dynamic adjacency matrix. The corresponding power asset nodes are output as static node feature matrices. With dynamic adjacency matrix ; The second layer takes the dynamic adjacency matrix at time t as its input, which is the output of the first layer. and static node feature matrix This layer will use a dynamic adjacency matrix. and static node feature matrix Perform a concatenation operation to form the node feature matrix at time t. And output, its dimension is N× ,in This indicates the length of the dynamic characteristic data for each power asset node. This indicates the length of the static feature data for each power asset node; The third layer takes the fused feature matrix at time t as its input, which is the output of the second layer. The dynamic adjacency matrix at time t of the output of layer 1 This layer first uses a graph attention mechanism to calculate the attention weights between each power asset node and each of its neighboring power asset nodes in the dynamic adjacency matrix; then it uses the fused feature matrix at time t... The feature vector of each power asset node is extracted, and the fused features of all neighboring power asset nodes of that power asset node are weighted and aggregated according to the attention weight to form the spatial augmentation feature at time t. Its dimension is N× ,in The length of the feature vector for each power asset node; finally, the spatial augmentation features of T consecutive time steps are combined into a spatial augmentation feature sequence { } and output, where i∈[1,T]; The fourth layer takes the spatial augmentation feature sequence output from the third layer as its input. This layer inputs the spatial enhancement feature sequence in parallel into three one-dimensional convolutional neural networks with different receptive fields to obtain features of three time patterns: short-term fluctuations, medium-term cycles, and long-term trends. The three features are then concatenated and fused to form a unified spatiotemporal feature matrix. And output, its dimension is N× ,in The length of the spatiotemporal feature vector for each power asset node.

[0039] The fifth layer takes the unified spatiotemporal feature matrix Z output from the fourth layer as input. This layer uses an inner product function to calculate the similarity of this unified spatiotemporal feature matrix to obtain the similarity between any two power asset nodes. exist Probability of link existence at time t. And construct a reconstructed adjacency matrix based on the existence probabilities of all the obtained links. And output, its dimension is N×N, where Indicates the activation function; The sixth layer takes the unified spatiotemporal feature matrix Z, output from the fourth layer, as its input. This layer then inputs the unified spatiotemporal feature matrix into the multilayer perceptron, where it learns a nonlinear mapping function. Calculate the i-th power asset node in Offline probability value after time step ,in This indicates the length of the prediction time window; subsequently, the calculated i-th power asset node is... Offline probability value after time step The value is compared with a preset dynamic risk threshold θ (which ranges from [0.6, 0.95], preferably 0.85), and the result satisfies... All power asset nodes with a value greater than θ are marked as high-risk power asset nodes; finally, all marked high-risk power asset nodes are ranked according to their offline probability values ​​to generate a potential blind spot warning list.

[0040] The dynamic monitoring model for blind spots in power assets of this invention is obtained through the following steps: (A1) Obtain a multi-source heterogeneous dataset from the power monitoring system network environment, and divide the multi-source heterogeneous dataset into a training set and a test set in an 8:2 ratio; Specifically, the multi-source heterogeneous dataset contains power asset information from multiple dimensions, including network traffic, active scanning, system ledgers, and security logs, and is used to record the attributes of power asset nodes, the communication relationships between power assets, and their changes over time.

[0041] (A2) Perform data preprocessing on the training set obtained in step (A1) to obtain the preprocessed training set.

[0042] Specifically, this step involves: first, performing time alignment processing on the training set obtained in step (A1) to obtain a time-aligned training set; then, performing entity parsing processing on the time-aligned training set to obtain a unified power asset entity view; subsequently, performing feature engineering processing on the obtained unified power asset entity view to obtain initial node feature vectors; finally, normalizing the obtained initial node feature vectors to obtain standardized node dynamic feature vectors, and constructing a dynamic adjacency matrix sequence based on the obtained standardized node dynamic feature vectors as the preprocessed training set.

[0043] (A3) According to the preset time window The preprocessed training set obtained in step (A2) is subjected to serialization and slicing to obtain a dynamic spatiotemporal map sequence. ,in Time-based graph structure , This represents the dynamic adjacency matrix at time t. This represents the dynamic characteristic moment vector of the power asset node at time t.

[0044] (A4) The graph at time t in the dynamic spatiotemporal map sequence obtained in step (A3) Adjacency matrix in Sample sampling is conducted, randomly selecting 50% of the power asset node pairs with interconnected relationships as positive samples, and randomly selecting 50% of the power asset node pairs without interconnected relationships as negative samples. (A5) Extract the dynamic node feature vector of each power asset node from the dynamic spatiotemporal graph sequence obtained in step (A3) and combine it with the static node feature matrix extracted from the system ledger. Perform a concatenation operation to obtain the fused node feature matrix at time t. ; (A6) Based on the fusion feature matrix at time t obtained in step (A5) and the dynamic adjacency matrix at time t obtained in step (A3), and using the graph attention mechanism to calculate the attention weight between each power asset node and each neighboring power asset node in the dynamic adjacency matrix, extract the feature vector of each power asset from the fusion feature matrix at time t, and perform weighted aggregation of the fusion features of all neighboring power asset nodes of the power asset node according to the attention weight to form the spatial augmentation feature at time t. ; (A7) Input the spatially enhanced node feature matrix obtained in step (A6) into three one-dimensional convolutional neural networks with different receptive fields to obtain features of three time patterns: short-term fluctuations, medium-term cycles, and long-term trends. Then, concatenate and fuse the three features to form a unified spatiotemporal feature matrix. And output it.

[0045] (A8) The unified spatiotemporal feature matrix obtained in step (A7) Two decoders are input in parallel to obtain the joint loss: Specifically, this step involves: First, processing the unified spatiotemporal feature matrix through inner product operations to obtain the connection probabilities between each pair of power asset nodes. All connection probabilities constitute the reconstructed adjacency matrix. Then, based on the positive and negative samples sampled in step (A4), the difference between the reconstructed adjacency matrix and the dynamic adjacency matrix obtained in step (A3) is calculated as the reconstruction loss; subsequently, the unified spatiotemporal feature matrix is ​​input into the multilayer perceptron, and the future of each power asset node is predicted through nonlinear mapping. Offline probability value at time Compare the offline probability value with the future The online status of power asset nodes is compared at any time to obtain the predicted loss; finally, the reconstruction loss obtained in this step is weighted and summed with the predicted loss according to preset weights to obtain the joint loss.

[0046] (A9) Based on the joint loss obtained in step (A8), and using the backpropagation algorithm and the adaptive moment estimation optimizer, iteratively update all parameters of the graph attention network, multi-scale temporal convolution and decoder in the dynamic monitoring model of power asset blind spots until the loss function converges, thereby obtaining the initially trained dynamic monitoring model of power asset blind spots.

[0047] (A10) Use the test set obtained in step (A1) to test the model initially trained in step (A9) and evaluate its performance indicators on the two tasks of real-time identification of power asset blind spots and offline risk prediction. When the indicators reach the optimal and stable, the final trained dynamic monitoring model of power asset blind spots is obtained.

[0048] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A dynamic monitoring method for power asset blind spots based on a dual mechanism, characterized in that, Includes the following steps: (1) Obtain multi-source heterogeneous data from the security monitoring platform, and preprocess the multi-source heterogeneous data to obtain a normalized feature matrix; (2) Construct a spatiotemporal knowledge graph based on the normalized feature matrix obtained in step (1), and perform serialization slicing on the dynamic spatiotemporal graph according to the preset time window to obtain the dynamic graph structure sequence; (3) Input the dynamic graph structure sequence at time t obtained in step (2) into the multi-scale spatiotemporal feature encoder constructed based on graph attention network to obtain a unified spatiotemporal feature matrix; (4) Input the unified spatiotemporal feature matrix obtained in step (3) into the decoder to obtain the real-time alarm list and the potential blind spot warning list; (5) Input the real-time alarm list and potential blind spot warning list obtained in step (4) into the pre-trained dynamic monitoring model of power asset blind spots to obtain the dynamic monitoring results of power asset blind spots.

2. The method for dynamic monitoring of power asset blind spots based on a dual mechanism according to claim 1, characterized in that, Step (1) includes the following sub-steps: (1-1) Collect heterogeneous data from multiple sources from the network security monitoring platform and the power asset management system; Specifically, this step involves first collecting network traffic data from the network security monitoring platform and then obtaining the fingerprint characteristics of power assets from the network traffic data using power asset fingerprinting technology; then, obtaining the online status of power assets from the power asset management system through periodic or triggered Nmap scans. Subsequently, multiple core attributes of power assets are obtained from the power asset management system, including IP address, MAC address, hostname, department, and importance level. Finally, security log data, including firewall logs and intrusion detection system / intrusion prevention system logs, are read from the network security monitoring platform. All network traffic data, fingerprint features of all power assets, online status of all power assets, core attributes of all power assets, and security log data constitute multi-source heterogeneous data. (1-2) The multi-source heterogeneous data obtained in (1-1) are preprocessed to obtain the normalized feature matrix.

3. The method for dynamic monitoring of power asset blind spots based on a dual mechanism according to claim 1 or 2, characterized in that, Step (1-2) specifically includes the following sub-steps: (1-2-1) Time alignment processing is performed on the network traffic data and security log data in the multi-source heterogeneous data obtained in (1-1), that is, the network traffic data and security log data from different collection sources are sliced ​​and aggregated according to a unified time window to obtain multiple time-series aligned data; (1-2-2) Entity parsing processing is performed on the multi-source heterogeneous data obtained in (1-1) and the time-series aligned data obtained in (1-2-1) to obtain a unified power asset entity view; Specifically, this step involves first performing association matching processing on the fingerprint features of power assets and the core attributes of power assets in all time-series aligned data to obtain a preliminary mapping relationship of power assets; then, performing conflict detection and resolution processing on the obtained preliminary mapping relationship of power assets to obtain a power asset association table. Subsequently, the obtained power asset association table is merged with the power asset's flow data, log data, and core attributes to obtain an enhanced attribute set of power assets as a unified power asset entity view. (1-2-3) Standardize the unified power asset entity view generated in step (1-2-2) to obtain a normalized feature matrix; Specifically, this step involves: First, formatting and encoding the original power asset data in the unified power asset entity view. This involves standardizing the data format of core attributes and performing one-hot encoding or label encoding on discrete attributes to obtain standardized power asset attribute vectors, including equipment type, operating system, open ports, and protocol behavior. Next, expanding and integrating the standardized power asset attribute vectors involves one-hot encoding or word embedding quantization of equipment type and operating system, multi-value binarization of open ports, extraction of statistical features from protocol behavior, and Z-score standardization of all numerical features to obtain processed standardized fingerprint feature vectors. Finally, merging and aligning the processed power asset attribute vectors with the standardized fingerprint feature vectors according to power assets to form a normalized feature matrix.

4. The dynamic monitoring method for power asset blind spots based on a dual mechanism according to any one of claims 1 to 3, characterized in that, Step (2) includes the following sub-steps: (2-1) Obtain the spectral snapshot at time t based on the normalized feature matrix obtained in step (1). , where t∈[1,T], and T is the total number of time segments; (2-2) Snapshot of the spectrum at time t obtained in step (2-1) Perform node and edge feature construction processing to obtain the dynamic graph structure sequence at time t; Specifically, this step involves first mapping each active power asset in the normalized feature matrix obtained in step (1) at time t to a power asset node in a graph structure. Then, construct the edge set at time t based on all the power asset nodes obtained at time t. Specifically, based on network traffic data from the security monitoring platform, if at time t any two power asset nodes... and If a communication relationship exists between them, then an edge is established between them. All the edges obtained constitute the edge set at time t. The dynamic interaction relationships between power assets are transformed into connections in a graph structure, representing communication links in the network, where i and j are both ∈ [1, the total number of power asset nodes N]. Subsequently, based on the edge set at time t... Construct the dynamic adjacency matrix at time t The dynamic adjacency matrix The element in row x, column y and the element in row y, column x are respectively the edge set. Connect an edge in the middle Two power asset nodes and , where x∈[1, dynamic adjacency matrix [row number], y∈[1, dynamic adjacency matrix] [Number of columns] Finally, extract the feature vector of the i-th power asset from the normalized feature matrix. and assign it to the dynamic adjacency matrix. Corresponding element in That is, the i-th power asset node at time t, all power asset nodes at time t that have been assigned feature vectors, and the edges between these power asset nodes at time t together constitute the dynamic graph structure sequence at time t.

5. The dynamic monitoring method for power asset blind spots based on a dual mechanism according to claim 4, characterized in that, Step (3) includes the following sub-steps: (3-1) Obtain the power asset system ledger from the network security monitoring platform, and perform vector concatenation processing between the dynamic graph structure sequence obtained in step (2) and the power asset system ledger to obtain the fusion input feature matrix features at time t. ; Specifically, this step involves: first, exporting the power asset system ledger from the network security monitoring platform; then, extracting the static node features of all power assets from the power asset system ledger; and finally, assigning the dynamic node features corresponding to each power asset in the dynamic graph structure sequence obtained in step (2). The static node features of the power asset are concatenated with vectors, and all concatenation results are summarized to obtain the fused input feature matrix at time t. ; (3-2) The fusion feature matrix obtained in step (3-1) at time t With dynamic adjacency matrix The input is fed into the graph attention network of the multi-scale spatiotemporal feature encoder to obtain the attention weights between each power asset node and its neighboring power asset nodes in the graph attention network. Where the i-th power asset node at time t The j-th power asset node at time t in the graph attention network (attention weights between) equal: ； intermediate parameters equal: in It is a learnable linear transformation weight matrix. It is a learnable attention weight vector. This indicates a splicing operation. It is a power asset node In graph attention networks Features of the layer This represents the activation function. ∈[1, total number of layers in the graph attention network]; (3-3) The features of the fused input feature matrix at time t obtained in step (3-1) The i-th power asset node at time t obtained in step (3-2) The j-th power asset node at time t in the graph attention network Attention weights between Input the multi-scale temporal feature extraction model of the multi-scale spatiotemporal feature encoder to obtain a two-dimensional matrix composed of unified spatiotemporal feature vectors of all power asset nodes, and obtain the i-th power asset node at time t based on this two-dimensional matrix. Corresponding unified spatiotemporal feature vector ; Specifically, this step involves first fusing the fusion feature matrix at time t obtained in step (3-1) with the attention weights obtained in step (3-2) to generate a temporal input feature tensor containing spatial neighborhood information. Then, the temporal input feature tensor is fed in parallel into three independent branches of the multi-scale temporal feature extraction model to obtain multi-scale temporal features respectively; Subsequently, the multi-scale temporal features output from the three independent branches are concatenated and nonlinearly activated to generate an intermediate feature representation that integrates multi-scale information. Subsequently, the intermediate feature representation is reduced in dimensionality and vectorized to obtain a two-dimensional matrix with the same number of rows as the total number of power asset nodes at time t. Finally, this two-dimensional matrix is ​​divided by rows to obtain the i-th power asset node at time t. Corresponding unified spatiotemporal feature vector ; (3-4) Stack the unified spatiotemporal feature vectors of all power asset nodes at time t obtained in step (3-3) to obtain a unified spatiotemporal feature matrix.

6. The method for dynamic monitoring of power asset blind spots based on a dual mechanism according to claim 5, characterized in that, The process of obtaining the real-time alarm list in step (4) is as follows: First, the similarity of the unified spatiotemporal feature matrix is ​​calculated using the inner product function to obtain the similarity of any two power asset nodes. The probability of the link existing at time t The existence probabilities of all the obtained links constitute the reconstructed adjacency matrix. ,in This represents the activation function. Represents the i-th power asset node The unified spatiotemporal eigenvectors are then used to reconstruct the adjacency matrix. The dynamic adjacency matrix at time t Perform a consistency comparison analysis to obtain the difference between the expected presence and the actual number of connections for each power asset node; Subsequently, power asset nodes with a difference greater than a preset threshold and an actual number of connections of zero are marked as abnormally offline blind zone power asset nodes; finally, all marked blind zone power asset nodes are summarized into a real-time alarm list. The process of obtaining the potential blind spot warning list in step (4) is as follows: First, the unified spatiotemporal feature matrix is ​​input into the multilayer perceptron, and the nonlinear mapping function is learned. Calculate the i-th power asset node in Offline probability value after time step ,in Indicates the length of the prediction time window; Subsequently, the calculated i-th power asset node is... Offline probability value after time step Compared with the preset dynamic risk threshold θ, it will satisfy All power asset nodes >θ are marked as high-risk power asset nodes; Finally, all high-risk power asset nodes are ranked according to their offline probability values ​​to generate a potential blind spot warning list.

7. The method for dynamic monitoring of power asset blind spots based on a dual mechanism according to claim 6, characterized in that, The specific structure of the dynamic monitoring model for blind spots in power assets is as follows: The first layer takes as input all N power assets that are active at time t, as well as dynamic behavior data and static ledger data of all power assets at time t collected from the network security monitoring platform, including traffic, number of connections, and importance level of device type. This layer first maps all N power assets to N power asset nodes in a graph structure. Then, the edge set at time t is constructed based on the collected dynamic behavior data. ; Subsequently, based on the edge set Generate the corresponding dynamic adjacency matrix at time t. Finally, static feature data for each power asset node is extracted from the static ledger data to form the static node features of the power asset nodes. The static node features of all power assets constitute a static node feature matrix. The dynamic behavior data at time t is used to construct a feature vector, which is then assigned to the dynamic adjacency matrix. The corresponding power asset nodes are output as static node feature matrices. With dynamic adjacency matrix ; The second layer takes the dynamic adjacency matrix at time t as its input, which is the output of the first layer. and static node feature matrix This layer will use a dynamic adjacency matrix. and static node feature matrix Perform a concatenation operation to form the node feature matrix at time t. And output, its dimension is N× ,in This indicates the length of the dynamic characteristic data for each power asset node. This indicates the length of the static feature data for each power asset node; The third layer takes the fused feature matrix at time t as its input, which is the output of the second layer. The dynamic adjacency matrix at time t of the output of layer 1 This layer first uses a graph attention mechanism to calculate the attention weight between each power asset node and each neighboring power asset node in the dynamic adjacency matrix; Then from the fusion feature matrix at time t The feature vector of each power asset node is extracted, and the fused features of all neighboring power asset nodes of that power asset node are weighted and aggregated according to the attention weight to form the spatial augmentation feature at time t. Its dimension is N× ,in The length of the feature vector for each power asset node; finally, the spatial augmentation features of T consecutive time steps are combined into a spatial augmentation feature sequence { } and output, where i∈[1,T]; The fourth layer takes the spatial augmentation feature sequence output from the third layer as its input. This layer inputs the spatial enhancement feature sequence in parallel into three one-dimensional convolutional neural networks with different receptive fields to obtain features of three time patterns: short-term fluctuations, medium-term cycles, and long-term trends. The three features are then concatenated and fused to form a unified spatiotemporal feature matrix. And output, its dimension is N× ,in The length of the spatiotemporal feature vector for each power asset node; The fifth layer takes the unified spatiotemporal feature matrix Z output from the fourth layer as input. This layer uses an inner product function to calculate the similarity of this unified spatiotemporal feature matrix to obtain the similarity between any two power asset nodes. exist Probability of link existence at time t. And construct a reconstructed adjacency matrix based on the existence probabilities of all the obtained links. And output, its dimension is N×N, where Indicates the activation function; The sixth layer takes the unified spatiotemporal feature matrix Z, output from the fourth layer, as its input. This layer then inputs the unified spatiotemporal feature matrix into the multilayer perceptron, where it learns a nonlinear mapping function. Calculate the i-th power asset node in Offline probability value after time step ,in Indicates the length of the prediction time window; Subsequently, the calculated i-th power asset node is... Offline probability value after time step Compared with the preset dynamic risk threshold θ, it will satisfy All power asset nodes with a value greater than θ are marked as high-risk power asset nodes; finally, all marked high-risk power asset nodes are ranked according to their offline probability values ​​to generate a potential blind spot warning list.

8. The method for dynamic monitoring of power asset blind spots based on a dual mechanism according to claim 7, characterized in that, The dynamic monitoring model for blind spots in power assets is trained through the following steps: (A1) Obtain a multi-source heterogeneous dataset from the power monitoring system network environment, and divide the multi-source heterogeneous dataset into a training set and a test set in an 8:2 ratio; (A2) Perform data preprocessing on the training set obtained in step (A1) to obtain the preprocessed training set; (A3) According to the preset time window The preprocessed training set obtained in step (A2) is subjected to serialization and slicing to obtain a dynamic spatiotemporal map sequence. ,in Time-based graph structure , This represents the dynamic adjacency matrix at time t. This represents the dynamic characteristic moment vector of the power asset node at time t; (A4) The graph at time t in the dynamic spatiotemporal map sequence obtained in step (A3) Adjacency matrix in Sample sampling is conducted, randomly selecting 50% of the power asset node pairs with interconnected relationships as positive samples, and randomly selecting 50% of the power asset node pairs without interconnected relationships as negative samples. (A5) Extract the dynamic node feature vector of each power asset node from the dynamic spatiotemporal graph sequence obtained in step (A3) and combine it with the static node feature matrix extracted from the system ledger. Perform a concatenation operation to obtain the fused node feature matrix at time t. ; (A6) Based on the fusion feature matrix at time t obtained in step (A5) and the dynamic adjacency matrix at time t obtained in step (A3), and using the graph attention mechanism to calculate the attention weight between each power asset node and each neighboring power asset node in the dynamic adjacency matrix, extract the feature vector of each power asset from the fusion feature matrix at time t, and perform weighted aggregation of the fusion features of all neighboring power asset nodes of the power asset node according to the attention weight to form the spatial augmentation feature at time t. ; (A7) Input the spatially enhanced node feature matrix obtained in step (A6) into three one-dimensional convolutional neural networks with different receptive fields to obtain features of three time patterns: short-term fluctuations, medium-term cycles, and long-term trends. Then, concatenate and fuse the three features to form a unified spatiotemporal feature matrix. And output; (A8) The unified spatiotemporal feature matrix obtained in step (A7) Two decoders are input in parallel to obtain the joint loss: (A9) Based on the joint loss obtained in step (A8), and using the backpropagation algorithm and the adaptive moment estimation optimizer, iteratively update all parameters of the graph attention network, multi-scale temporal convolution and decoder in the dynamic monitoring model of power asset blind spots until the loss function converges, thereby obtaining the initially trained dynamic monitoring model of power asset blind spots. (A10) Use the test set obtained in step (A1) to test the model initially trained in step (A9) and evaluate its performance indicators on the two tasks of real-time identification of power asset blind spots and offline risk prediction. When the indicators reach the optimal and stable, the final trained dynamic monitoring model of power asset blind spots is obtained.

9. The method for dynamic monitoring of power asset blind spots based on a dual mechanism according to claim 8, characterized in that, The multi-source heterogeneous dataset in step (A1) contains power asset information from multiple dimensions, such as network traffic, active scanning, system ledgers, and security logs, and is used to record the attributes of power asset nodes, the communication relationships between power assets, and their changes over time. Step (A2) specifically involves first performing time alignment processing on the training set obtained in step (A1) to obtain a time-aligned training set. Then, entity parsing processing is performed on the time-aligned training set to obtain a unified power asset entity view; Subsequently, feature engineering is performed on the obtained unified power asset entity view to obtain initial node feature vectors; finally, the obtained initial node feature vectors are normalized to obtain standardized node dynamic feature vectors, and a dynamic adjacency matrix sequence is constructed based on the obtained standardized node dynamic feature vectors as the preprocessed training set. Step (A8) specifically involves: First, processing the unified spatiotemporal feature matrix through inner product operations to obtain the connection probabilities between each pair of power asset nodes. All connection probabilities constitute the reconstructed adjacency matrix. ; Then, based on the positive and negative samples sampled in step (A4), the difference between the reconstructed adjacency matrix and the dynamic adjacency matrix obtained in step (A3) is calculated as the reconstruction loss; Subsequently, the unified spatiotemporal feature matrix is ​​input into the multilayer perceptron, and nonlinear mapping is used to predict the future of each power asset node. Offline probability value at time Compare the offline probability value with the future The online status of power asset nodes is compared at any time to obtain the predicted loss; finally, the reconstruction loss obtained in this step is weighted and summed with the predicted loss according to preset weights to obtain the joint loss.

10. A dynamic monitoring system for blind spots in power assets based on a dual mechanism, characterized in that, Includes the following modules: The first module is used to acquire multi-source heterogeneous data from the security monitoring platform, and preprocess the multi-source heterogeneous data to obtain a normalized feature matrix. The second module is used to construct a spatiotemporal knowledge graph based on the normalized feature matrix obtained from the first module, and to perform serialization slicing on the dynamic spatiotemporal graph according to a preset time window to obtain a dynamic graph structure sequence. The third module is used to input the dynamic graph structure sequence at time t obtained from the second module into a multi-scale spatiotemporal feature encoder constructed based on a graph attention network to obtain a unified spatiotemporal feature matrix. The fourth module is used to input the unified spatiotemporal feature matrix obtained from the third module into the decoder to obtain a real-time alarm list and a potential blind spot warning list. The fifth module is used to input the real-time alarm list and potential blind spot warning list obtained from the fourth module into the pre-trained dynamic monitoring model for power asset blind spots in order to obtain dynamic monitoring results for power asset blind spots.

Images