A power network attack damage propagation analysis method, system, device and storage medium

Abstract

The application discloses a kind of electric power network attack damage propagation analysis method, system, equipment and storage medium, it is related to electric power network attack analysis technical field.The method includes obtaining the multi-source monitoring data in attack process, including time stamp sequence, device network address and physical topology position, OT device type and industrial protocol type, service node state and permission access record;Extract the space-time feature vector of multi-source monitoring data;Based on the pre-constructed electric power service space-time correlation model and hard rule, carry out space-time correlation analysis, generate the continuous damage propagation path that spreads from the initial attack point to the surrounding device and service system;The influence evaluation result of attack damage to electric power service is calculated.The application constructs the space-time correlation rule and hard constraint that adapt to electric power system, makes damage propagation path deduction fit electric power service logic, can restore attack continuous propagation path completely, improves the accuracy of attack damage analysis.

Description

Technical Field

[0001] This invention relates to the field of power network attack analysis technology, and in particular to a method, system, device, and storage medium for analyzing the damage propagation of power network attacks. Background Technology

[0002] With the deep integration of smart grids and the industrial internet, power monitoring systems are gradually developing towards networking and intelligence. In recent years, cyberattacks targeting power industrial control systems have occurred frequently, with attack behaviors exhibiting characteristics of cross-time and space, cross-device, and cross-business propagation, which can easily lead to major security risks such as abnormal power grid operation and business interruption.

[0003] Existing power grid attack damage analysis methods mostly rely on a single-dimensional assessment of network alarm information or physical device status, failing to correlate attack attributes with power business processes. Furthermore, these methods lack the construction of spatiotemporal correlation rules and hard constraints adapted to the power system, resulting in a lack of adaptability to power business operations. Damage propagation path deduction is detached from power business logic, making it difficult to reconstruct the complete continuous attack path, leading to significant discrepancies between analysis results and actual impact. Summary of the Invention

[0004] To address the problem that existing power network attack damage analysis methods often detach from power business logic in their propagation path deduction, making it difficult to reconstruct the complete and continuous attack path and resulting in significant discrepancies between analysis results and actual impacts, this invention provides a power network attack damage propagation analysis method, system, device, and storage medium. By constructing spatiotemporal correlation rules and hard constraints adapted to the power system, the damage propagation path deduction aligns with power business logic, enabling a complete reconstruction of the continuous attack propagation path and improving the accuracy of attack damage analysis. The specific technical solution is as follows: This invention provides a method for analyzing the propagation of damage from power grid attacks, comprising the following steps: Acquire multi-source monitoring data during a cyber attack on a power system. The multi-source monitoring data includes at least: timestamp sequences of attack behaviors, network addresses and physical topology locations of the devices involved in the attack, OT device types and industrial protocol types of the attacked devices, business node status at the time of the attack, and access records. Based on the multi-source monitoring data, a spatiotemporal feature vector of the attack behavior is extracted. The spatiotemporal feature vector includes a time identifier, a space identifier, an OT device identifier, a service node identifier, and a permission status identifier. Based on the pre-constructed spatiotemporal correlation model of power business and the spatiotemporal hard rules of power business, spatiotemporal correlation analysis is performed on the spatiotemporal feature vector to generate a continuous damage propagation path that spreads from the initial attack point to surrounding equipment and business systems. Based on the damage propagation path, the impact assessment results of the attack damage on power services are calculated. The power business spatiotemporal correlation model predefines the correlation rules between business process nodes, equipment topology, permission hierarchy, and time constraints of the power system; the power business spatiotemporal hard rules include time propagation rules, spatial propagation rules, and permission constraint rules.

[0005] Preferably, performing spatiotemporal correlation analysis on the spatiotemporal feature vectors to generate a continuous damage propagation path from the initial attack point to surrounding devices and business systems includes: The spatiotemporal similarity between attack behaviors is calculated, which comprehensively considers the degree of temporal proximity, spatial proximity, and the degree of matching between the attack operation and the spatiotemporal rules of power business. Based on the spatiotemporal similarity, missing attack links in the monitoring data are filled in, generating a continuous damage propagation path from the initial attack point to surrounding devices and business systems.

[0006] Preferably, the spatiotemporal similarity is calculated using a dynamic time warping algorithm, and the calculation formula is as follows: in, , These represent the times when attack behaviors i and j occur, respectively. , These are the spatial nodes for attack behaviors i and j, respectively; This represents the topological distance between two spatial nodes; This is a Boolean function. If the attack operation conforms to the hard spatiotemporal rules of the power business, the value is 1; otherwise, it is 0. , , For the weighting coefficients, satisfying .

[0007] Preferably, the step of filling in missing attack links in the monitoring data based on the spatiotemporal similarity to generate a continuous damage propagation path from the initial attack point to surrounding devices and business systems includes: Based on the spatiotemporal similarity between attack behaviors, identify adjacent behavior pairs in the current attack sequence whose similarity is lower than a preset threshold, and mark them as breakpoints in the propagation path. For each breakpoint, based on the predefined business process nodes, equipment topology, permission levels and time constraints in the power business spatiotemporal correlation model, combined with the historical attack propagation knowledge base, Bayesian inference method is used to infer the type of missing attack link and its spatiotemporal attributes. The inferred missing attack links are inserted into the breakpoint location to ensure that the spatiotemporal similarity between adjacent behaviors meets the preset requirements and conforms to the time propagation rules, spatial propagation rules and permission constraint rules, thus forming a continuous damage propagation path.

[0008] Preferably, the time propagation rule limits the temporal evolution of the attack behavior as follows: reconnaissance, vulnerability exploitation, privilege acquisition, local damage, cross-node propagation, and large-scale spread; The spatial propagation rules define the topological order of damage spread as follows: edge device layer, regional gateway, substation control node, and main network scheduling node; The permission constraint rules include: Damage to low-privilege nodes cannot be directly propagated to critical nodes with privilege levels higher than a preset threshold. Attacks that do not break through the industrial control protocol authentication mechanism cannot spread across devices.

[0009] Preferably, the step of calculating the impact assessment result of the attack damage on power services based on the damage propagation path includes: In accordance with power safety regulations, compliance checks are performed on the damage propagation path, including authorization compliance, process compliance, and threshold compliance, to generate a compliance score. ; Based on the OT device type and attack operation, query the preset device function impact mapping table to obtain the OT device function impact risk value. ; Calculate the risk value of sensitive data leakage based on the data sensitivity level of the attacked device. ; The comprehensive risk value is calculated using the following formula. : in, This indicates the risk value affected by the functionality of OT equipment; Indicates the risk value of sensitive data leakage; , These are the weighting coefficients.

[0010] Preferably, the step of performing permission compliance verification, process compliance verification, and threshold compliance verification on the damage propagation path according to the power safety regulations generates a compliance score. ,include: According to power safety regulations, the system determines whether the attack behavior exceeds preset permission boundaries, whether the damage propagation path violates power business process constraints, and whether the scope or extent of the damage exceeds preset security thresholds. Based on the determination results, a compliance score is output. .

[0011] This invention also provides a power grid attack damage propagation analysis system, which applies the aforementioned method and includes: The data acquisition unit is used to acquire multi-source monitoring data during the process of the power system being attacked by the network. The multi-source monitoring data includes at least: the timestamp sequence of the attack behavior, the network address and physical topology location of the attacked equipment, the OT equipment type and industrial protocol type of the attacked equipment, the status of the business node when the attack occurred, and the access permission records. The feature extraction unit is used to extract the spatiotemporal feature vector of the attack behavior based on the multi-source monitoring data. The spatiotemporal feature vector includes time identifier, space identifier, OT device identifier, service node identifier, and permission status identifier. The propagation simulation unit is used to perform spatiotemporal correlation analysis on the spatiotemporal feature vectors based on a pre-built spatiotemporal correlation model and spatiotemporal hard rules for power business, and generate a continuous damage propagation path from the initial attack point to surrounding equipment and business systems. The spatiotemporal correlation model for power business predefines the correlation rules between business process nodes, equipment topology, permission hierarchy, and time constraints of the power system. The spatiotemporal hard rules for power business include time propagation rules, spatial propagation rules, and permission constraint rules.

[0012] The impact assessment unit is used to calculate the impact assessment results of the attack damage on the power business based on the damage propagation path.

[0013] Preferably, the propagation deduction unit includes: The similarity calculation module is used to calculate the spatiotemporal similarity between attack behaviors. The spatiotemporal similarity comprehensively considers the degree of temporal proximity, spatial proximity, and the degree of matching between the attack operation and the spatiotemporal rules of power business. The trajectory completion module is used to complete the missing attack links in the monitoring data based on the spatiotemporal similarity, and generate a continuous damage propagation path from the initial attack point to surrounding devices and business systems.

[0014] Preferably, the impact assessment unit includes: The compliance analysis module is used to perform permission compliance verification, process compliance verification, and threshold compliance verification on the damage propagation path according to power safety regulations, and generate a compliance score. ; The risk level assessment module is used to query a preset device function impact mapping table based on the OT device type and attack operation to obtain the OT device function impact risk value. Calculate the risk value of sensitive data leakage based on the data sensitivity level of the attacked device. ; The comprehensive risk value is calculated using the following formula. : in, This indicates the risk value affected by the functionality of OT equipment; Indicates the risk value of sensitive data leakage; , These are the weighting coefficients.

[0015] The present invention also provides a computer device, comprising: processor; Memory used to store processor-executable instructions; The processor implements the aforementioned power network attack damage propagation analysis method by running the executable instructions.

[0016] The present invention also provides a computer-readable storage medium storing computer instructions thereon, which, when executed by a processor, implement the steps of the aforementioned power network attack damage propagation analysis method.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: The power network attack damage propagation analysis method of this invention solves the problems of single-dimensional judgment and disconnection from business logic in traditional methods by deeply coupling attack characteristics with power business processes. By constructing spatiotemporal correlation rules and hard constraint mechanisms adapted to the characteristics of the power system, and performing damage propagation path deduction based on power business logic, it can completely and continuously reconstruct the diffusion process of the attack in devices, permissions, spatiotemporal and business chains, avoiding problems such as propagation link breaks and path distortion, reducing the deviation between analysis results and the actual operation of the power grid, improving the accuracy of attack impact assessment, effectively enhancing the power system's accurate identification and rapid early warning of network attacks, and ensuring the safe and stable operation of critical power information infrastructure. Attached Figure Description

[0018] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0019] Figure 1 A flowchart of a power network attack damage propagation analysis method provided in an embodiment of the present invention.

[0020] Figure 2 A schematic diagram of a power network attack damage propagation analysis system provided in an embodiment of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] It should be understood that, when used in this specification, the terms “comprising” and “including” indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0023] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0024] It should also be further understood that the term "and / or" as used in this specification refers to any combination of one or more of the associated listed items, as well as all possible combinations, and includes such combinations.

[0025] Please see Figure 1 This application provides a method for analyzing the propagation of damage from power network attacks, comprising the following steps: Step S1: Obtain multi-source monitoring data during the network attack on the power system. The multi-source monitoring data includes at least the timestamp sequence of the attack behavior, the network address and physical topology location of the attacked devices, the OT device type and industrial protocol type of the attacked devices, the status of the business nodes when the attack occurred, and the access permission records. During a cyberattack on a power system, in this embodiment, the following multi-source monitoring data are collected in real time using sensors, log collection probes, and traffic monitoring tools deployed in power monitoring networks, industrial control systems, and security equipment: Attack behavior timestamp sequence: Records and stores the time when each attack behavior or abnormal event occurs, forming a time series that covers the entire process from reconnaissance to dissemination.

[0026] The network address and physical topology location of the devices involved in the attack: This includes the device's IP address, MAC address, physical location identifier of the substation / dispatch center where the device is located, and the device's hierarchical relationship in the network topology. Examples include edge devices, regional gateways, substation nodes, and main network dispatch nodes.

[0027] OT device type and industrial protocol type of the attacked device: Record the device type and the industrial protocols it supports, and capture abnormal messages, illegal commands, abnormal session timings, etc. during the protocol interaction process.

[0028] The state of the business node at the time of the attack: This maps the stage of the power business process at the time the attack occurred, such as dispatching instructions, data acquisition, and fault handling; as well as the business functions carried by the equipment, such as relay protection, load control, and status monitoring.

[0029] Access permission logs: Record the permission level, permission change operations, access duration, and operation scope of users or processes before and after an attack.

[0030] After the above data is collected, it needs to be preliminarily cleaned to remove false alarms and redundant information, and sensitive data needs to be desensitized to retain structural features.

[0031] Step S2: Based on the multi-source monitoring data, extract the spatiotemporal feature vector of the attack behavior. The spatiotemporal feature vector includes time identifier, space identifier, OT device identifier, service node identifier, and permission status identifier. The multi-source monitoring data collected by S1 is standardized, and each attack behavior or abnormal event is mapped to a unified spatiotemporal feature vector, represented as: in ， Assign a unique code to identify the attack type, based on the attack behavior, such as scanning, vulnerability exploitation, command tampering, privilege escalation, etc. To identify time nodes, timestamps are normalized into relative or absolute time codes; It serves as a spatial node identifier, encoded according to the device's position in the network topology; Identify OT equipment and record its type and model; As a business node identifier, it maps the business process to which the device belongs; This serves as a permission status identifier, recording the permission level at the time of the attack, such as 1=ordinary user, 2=advanced operations and maintenance, 3=system administrator; Encode the attack operations by breaking down the specific operations into quantifiable values, such as vulnerability exploitation = 1, instruction tampering = 2; For attack parameters, record the specific parameters of the operation, such as tampering with voltage values ​​and illegal message fields; For time series features, local features such as attack frequency and interval distribution are extracted. For spatial correlation features, record the connection relationship and physical distance between the device and other nodes.

[0032] Step S3: Based on the pre-built spatiotemporal correlation model of power business and the spatiotemporal hard rules of power business, perform spatiotemporal correlation analysis on the spatiotemporal feature vector to generate a continuous damage propagation path from the initial attack point to the surrounding equipment and business system; The spatiotemporal correlation model for power business predefines the correlation rules between business process nodes, equipment topology, permission hierarchy, and time constraints of the power system; the ontology model of the spatiotemporal correlation model for power business is represented as follows: Wherein, C represents power context elements: time-based, space-based, business-based, OT device-based, and permission-based; R represents element relationships: spatial mapping of attack behavior and device topology, time constraints of attack timing and business processes, matching relationship between permission level and operation scope, and business process constraints of OT device operation; A represents association attributes: time threshold for attack propagation (e.g., penetration from edge devices to core scheduling nodes ≤ 10 min), topological weight of spatial propagation (e.g., probability of propagation from devices in the same area ≥ 0.8), and security threshold for permission breach (e.g., risk coefficient of cross-permission access ≥ 0.9).

[0033] The construction of a spatiotemporal correlation model for power operations requires the systematic integration of knowledge related to the power system's business logic, equipment topology, access control, and time constraints. The following describes the model's construction method: Collect and analyze the following data from the target power system: The business process diagram includes the business processes of each link such as power generation, transmission, transformation, distribution, and dispatch, and clarifies each business node and its upstream and downstream relationships.

[0034] Equipment topology: Obtain the physical connection relationships, network hierarchy, and communication links of primary and secondary equipment in the power system.

[0035] Access control strategies define the permission levels, access scopes, and operation authorization rules for different user roles.

[0036] The time constraint specifications, based on the "Electric Power Safety Work Regulations" and actual operating experience, define time thresholds for critical operations, such as fault response time ≤ 5 seconds, and attack propagation time windows, such as from the edge to the core ≤ 10 minutes.

[0037] Industrial Protocol Specifications: This section collects the message formats, session flows, and security mechanisms of commonly used industrial protocols in power systems (IEC60870-5-104, ModbusTCP, DNP3).

[0038] The ontology concept class C consists of the following core classes, each containing several attributes, as shown in the table below: The association R defines semantic relationships between classes to describe the contextual dependencies of attack propagation, as shown in the table below: The association attribute A is defined as a quantitative attribute attached to the relationship and class, used for subsequent calculations, as shown in the table below: An ontology description language is used to formalize the aforementioned classes, relations, and attributes, constructing a knowledge graph. Tools such as Protégé are used to create the ontology, defining the class hierarchy, object attributes, and data attributes. Real-world instance data from the power system is populated into the ontology, forming an instantiated knowledge base. This is stored as RDF triples or a graph database, such as Neo4j, supporting efficient querying and reasoning. The final model is a scalable knowledge base that can be dynamically updated based on changes in the power system architecture or the emergence of new attack methods. Once pre-built, this model is directly invoked during method execution.

[0039] The spatiotemporal hard rules for power operations include time propagation rules, spatial propagation rules, and permission constraint rules. The spatiotemporal hard rules for power operations are mandatory propagation constraints used to guide path deduction, and include: Preferably, the time propagation rule limits the temporal evolution of the attack behavior as follows: reconnaissance, vulnerability exploitation, privilege acquisition, local damage, cross-node propagation, and large-scale spread; The spatial propagation rules define the topological order of damage spread as follows: edge device layer, regional gateway, substation control node, and main network scheduling node; The permission constraint rules include: Damage to low-privilege nodes cannot be directly propagated to critical nodes with privilege levels higher than a preset threshold. Attacks that do not break through the industrial control protocol authentication mechanism cannot spread across devices.

[0040] Step S4: Calculate the impact assessment results of the attack damage on power services based on the damage propagation path. In practice, the calculation of impact assessment results includes: In accordance with power safety regulations, compliance checks are performed on the damage propagation path, including authorization compliance, process compliance, and threshold compliance, to generate a compliance score. ; In practice, based on power safety regulations, it is determined whether the attack behavior exceeds the preset permission boundaries, whether the damage propagation path violates power business process constraints, and whether the scope or extent of the damage exceeds the preset security threshold. Based on the judgment results, a compliance score is output. The following explanation will take into account the characteristics of the power industry: The purpose of compliance verification is to assess the degree to which attack behaviors and their propagation paths deviate from the safety operation standards of the power system. In this embodiment, based on a preset power safety knowledge base (which includes the "Power Safety Work Regulations," power grid enterprise accident measures, and equipment operation specifications), each attack link and the overall path in the damage propagation trajectory is evaluated item by item, and finally a normalized compliance score is output. The lower the score, the more serious the violation.

[0041] The permission status involved in each stage of the attack ( ) and operational behavior ( The matching relationship of ).

[0042] The basis for judgment is the power system's division of permissions for different roles and operations. For example: ordinary maintenance personnel with permission levels 1-3 can only view real-time data and have no right to modify protection settings; dispatchers with permission levels 4-6 can issue adjustment instructions but have no right to modify firmware; system administrators with permission levels 7-10 can perform all operations, but require double verification.

[0043] The judgment logic is set as follows: for each attack stage Obtain the permission level it uses. and the type of operation to be performed Query permission rules table This table defines the operations to be performed. Minimum required privilege level .like If the permission is granted, the access is compliant; otherwise, it is considered a violation of the permission rules.

[0044] By defining permission violation levels: in, This represents the highest privilege level in the system. If a privilege escalation path is involved, such as escalating from a regular user to an administrator, the escalation process must be verified to ensure it complies with regulations. Unauthorized privilege escalation is immediately considered a serious violation.

[0045] Perform process compliance verification: Verification target: the timing and causal logic of attack behavior in the power business process.

[0046] Judgment criteria: the sequence and dependencies of power business processes. For example, power must be cut off and grounded before line maintenance; closed-loop testing must be performed after modifying protection settings; and dispatch instructions must be verified and confirmed before issuance.

[0047] Judgment logic: Determine the damage propagation path Mapping to business process sequence diagram ,in For business nodes, To determine the allowed business flow order, check the sequence of business nodes in the path. Whether or not A directed path in the path is matched. If it exists... But If no directed edges exist, the process is considered to be in violation. Simultaneously, check whether the transition time between business nodes meets the procedural requirements (e.g., the time window for power restoration after maintenance).

[0048] Calculation process violation degree: For critical business operations, the weighting of violations can be appropriately increased.

[0049] The verification process involves checking the compliance of power thresholds, specifically the extent and scope of equipment damage caused by attacks. The criteria for judgment are the safe operating thresholds for power equipment. For example, voltage fluctuations must not exceed ±5% of the rated value, the number of damaged devices in the same area must not exceed 30% of the total, and critical equipment is not allowed any form of unplanned shutdown.

[0050] Decision logic: Based on attack parameters Extract damage quantification values; query the equipment threshold table. This table defines the devices. Each safety threshold is set; if the damage value exceeds the threshold, it is judged as a threshold violation.

[0051] Calculate the threshold violation score: For cascading failures, it is necessary to consider whether the propagation range exceeds the preset isolation boundary.

[0052] Overall compliance score The calculation weights and merges the violation scores from the three dimensions mentioned above to obtain the violation score for each step, and then combines them into an overall compliance score for the entire path. Single-step violation score: in, For the weighting coefficients, satisfying It can be adjusted according to the business focus.

[0053] Calculate the overall violation rate of the path: Calculate the compliance score: If a serious violation occurs in any step, it can be set Or directly determine If multiple violations of the same type exist in the path, consider accumulating them or taking the maximum value.

[0054] Final compliance score It is a value between 0 and 1: It is fully compliant, and the path complies with all power safety regulations; This is a serious violation; the path contains a fatal flaw. The scores indicate varying degrees of violations, with lower scores indicating higher risk. This score will serve as an important input for subsequent risk level assessments, used to calculate the overall risk value. .

[0055] Based on the OT device type and attack operation, query the preset device function impact mapping table to obtain the OT device function impact risk value. ; Calculate the risk value of sensitive data leakage based on the data sensitivity level of the attacked device. ; The comprehensive risk value is calculated using the following formula. : in, This indicates the risk value affected by the functionality of OT equipment; Indicates the risk value of sensitive data leakage; , These are the weighting coefficients.

[0056] For example, in actual settings, it can be The risk level is classified as follows: High risk, Medium risk. Low risk.

[0057] The power network attack damage propagation analysis method of this invention solves the problems of single-dimensional judgment and disconnection from business logic in traditional methods by deeply coupling attack characteristics with power business processes. By constructing spatiotemporal correlation rules and hard constraint mechanisms adapted to the characteristics of the power system, and performing damage propagation path deduction based on power business logic, it can completely and continuously reconstruct the diffusion process of the attack in devices, permissions, spatiotemporal and business chains, avoiding problems such as propagation link breaks and path distortion, reducing the deviation between analysis results and the actual operation of the power grid, improving the accuracy of attack impact assessment, effectively enhancing the power system's accurate identification and rapid early warning of network attacks, and ensuring the safe and stable operation of critical power information infrastructure.

[0058] Specifically, in a preferred embodiment of this application, performing spatiotemporal correlation analysis on the spatiotemporal feature vector to generate a continuous damage propagation path spreading from the initial attack point to surrounding devices and business systems includes: The spatiotemporal similarity between attack behaviors is calculated, which comprehensively considers the degree of temporal proximity, spatial proximity, and the degree of matching between the attack operation and the spatiotemporal rules of power business. In this embodiment, the spatiotemporal similarity is calculated using the dynamic time warping algorithm, and the calculation formula is as follows: in, , These represent the times when attack behaviors i and j occur, respectively. , These are the spatial nodes for attack behaviors i and j, respectively; This represents the topological distance between two spatial nodes; , , For the weighting coefficients, satisfying ; This is a Boolean function. It takes the value 1 if the attack operation conforms to the hard spatiotemporal rules of the power business, and 0 otherwise. The attack operation is determined based on the current context. and Does it conform to the hard rules of spacetime? For example: if It's "vulnerability exploitation". If it is a "permission acquisition" request, and both occur on the same or adjacent devices, and the time sequence is reasonable, then return 1; otherwise... It's "permission acquisition". If it is "cross-node propagation" and the permission level meets the propagation conditions, return 1; otherwise, return 0.

[0059] By integrating multi-dimensional quantitative calculations based on temporal proximity, spatial proximity, and matching degree with power business rules, the correlation between attack behaviors was accurately measured. This improved the accuracy of damage propagation path reconstruction and ensured that the simulation results closely aligned with the actual operating logic and security constraints of the power system.

[0060] In other embodiments, spatiotemporal similarity can also be calculated based on multidimensional Euclidean distance or a weighted vector inner product method based on cosine similarity. For example, spatiotemporal similarity can be calculated based on multidimensional Euclidean distance by mapping time difference, spatial distance, and rule matching degree to coordinates in a multidimensional space, and measuring the similarity of attack behaviors through Euclidean distance. The calculation formula is as follows: The time difference, spatial distance, and rule mismatch are used as coordinate components in the three-dimensional space. The distance between two attack behaviors in the spatiotemporal-rule space is calculated using Euclidean distance. The smaller the distance, the higher the similarity. The denominator is incremented by 1 to ensure that the similarity is normalized to the (0,1) interval. This is a scaling factor for each dimension, used to balance the influence of different dimensions.

[0061] Based on the spatiotemporal similarity, missing attack links in the monitoring data are filled in, generating a continuous damage propagation path from the initial attack point to surrounding devices and business systems.

[0062] In practice, the process of completing the damage propagation path is as follows: Based on the spatiotemporal similarity between attack behaviors, identify adjacent behavior pairs in the current attack sequence whose similarity is lower than a preset threshold, and mark them as breakpoints in the propagation path. For each breakpoint, based on the predefined business process nodes, equipment topology, permission levels and time constraints in the power business spatiotemporal correlation model, combined with the historical attack propagation knowledge base, Bayesian inference method is used to infer the type of missing attack link and its spatiotemporal attributes. The inferred missing attack links are inserted into the breakpoint location to ensure that the spatiotemporal similarity between adjacent behaviors meets the preset requirements and conforms to the time propagation rules, spatial propagation rules and permission constraint rules, thus forming a continuous damage propagation path.

[0063] Please see Figure 2 This application also provides a power network attack damage propagation analysis system, including: The data acquisition unit is used to acquire multi-source monitoring data during the process of the power system being attacked by the network. The multi-source monitoring data includes at least: the timestamp sequence of the attack behavior, the network address and physical topology location of the attacked equipment, the OT equipment type and industrial protocol type of the attacked equipment, the status of the business node when the attack occurred, and the access permission records. The feature extraction unit is used to extract the spatiotemporal feature vector of the attack behavior based on the multi-source monitoring data. The spatiotemporal feature vector includes time identifier, space identifier, OT device identifier, service node identifier, and permission status identifier. The propagation simulation unit is used to perform spatiotemporal correlation analysis on the spatiotemporal feature vectors based on a pre-built spatiotemporal correlation model and spatiotemporal hard rules for power business, and generate a continuous damage propagation path from the initial attack point to surrounding equipment and business systems. The spatiotemporal correlation model for power business predefines the correlation rules between business process nodes, equipment topology, permission hierarchy, and time constraints of the power system. The spatiotemporal hard rules for power business include time propagation rules, spatial propagation rules, and permission constraint rules.

[0064] The impact assessment unit is used to calculate the impact assessment results of the attack damage on the power business based on the damage propagation path.

[0065] Specifically, the propagation deduction unit includes: The similarity calculation module is used to calculate the spatiotemporal similarity between attack behaviors. The spatiotemporal similarity comprehensively considers the degree of temporal proximity, spatial proximity, and the degree of matching between the attack operation and the spatiotemporal rules of power business. The trajectory completion module is used to complete the missing attack links in the monitoring data based on the spatiotemporal similarity, and generate a continuous damage propagation path from the initial attack point to surrounding devices and business systems.

[0066] Specifically, the impact assessment unit includes: The compliance analysis module is used to perform permission compliance verification, process compliance verification, and threshold compliance verification on the damage propagation path according to power safety regulations, and generate a compliance score. ; The risk level assessment module is used to query a preset device function impact mapping table based on the OT device type and attack operation to obtain the OT device function impact risk value. Calculate the risk value of sensitive data leakage based on the data sensitivity level of the attacked device. ; The comprehensive risk value is calculated using the following formula. : in, This indicates the risk value affected by the functionality of OT equipment; Indicates the risk value of sensitive data leakage; , These are the weighting coefficients; according to Risk levels are determined by the value: High risk, Medium risk. Low risk.

[0067] The functional explanations of each unit in this embodiment are the same as those in the power network attack damage propagation analysis method of the aforementioned embodiment, and the technical effects are the same, so they will not be repeated here.

[0068] This application also provides a computer device, including: processor; Memory used to store processor-executable instructions; The processor implements the aforementioned power network attack damage propagation analysis method by running the executable instructions.

[0069] The technical effects of this embodiment are the same as those of the power network attack damage propagation analysis method in the embodiment, and will not be repeated here.

[0070] In this embodiment, the processor may be a central processing unit (CPU), a controller, a microcontroller, or other data processing chip.

[0071] This application also provides a computer-readable storage medium storing computer instructions that, when executed by a processor, implement the aforementioned steps of the power network attack damage propagation analysis method.

[0072] The technical effects of this embodiment are the same as those of the power network attack damage propagation analysis method in the embodiment, and will not be repeated here.

[0073] This invention can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0074] Those skilled in the art will recognize that the units of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.

[0075] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical functional division. In actual implementation, there may be other division methods, such as multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored.

[0076] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0077] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0078] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the specification of the present invention.

Claims

1. A method for analyzing the damage propagation of power grid attacks, characterized in that, Includes the following steps: Acquire multi-source monitoring data during a cyber attack on a power system. The multi-source monitoring data includes at least: timestamp sequences of attack behaviors, network addresses and physical topology locations of the devices involved in the attack, OT device types and industrial protocol types of the attacked devices, business node status at the time of the attack, and access records. Based on the multi-source monitoring data, a spatiotemporal feature vector of the attack behavior is extracted. The spatiotemporal feature vector includes a time identifier, a space identifier, an OT device identifier, a service node identifier, and a permission status identifier. Based on the pre-constructed spatiotemporal correlation model of power business and the spatiotemporal hard rules of power business, spatiotemporal correlation analysis is performed on the spatiotemporal feature vector to generate a continuous damage propagation path that spreads from the initial attack point to surrounding equipment and business systems. Based on the damage propagation path, the impact assessment results of the attack damage on power services are calculated. The power business spatiotemporal correlation model predefines the correlation rules between business process nodes, equipment topology, permission hierarchy, and time constraints of the power system; the power business spatiotemporal hard rules include time propagation rules, spatial propagation rules, and permission constraint rules.

2. The power grid attack damage propagation analysis method according to claim 1, characterized in that, Spatiotemporal correlation analysis is performed on the aforementioned spatiotemporal feature vectors to generate a continuous damage propagation path from the initial attack point to surrounding devices and business systems, including: The spatiotemporal similarity between attack behaviors is calculated, which comprehensively considers the degree of temporal proximity, spatial proximity, and the degree of matching between the attack operation and the spatiotemporal rules of power business. Based on the spatiotemporal similarity, missing attack links in the monitoring data are filled in, generating a continuous damage propagation path from the initial attack point to surrounding devices and business systems.

3. The power grid attack damage propagation analysis method according to claim 2, characterized in that, The spatiotemporal similarity is calculated using a dynamic time warping algorithm, and the calculation formula is as follows: in, , These represent the times when attack behaviors i and j occur, respectively. , These are the spatial nodes for attack behaviors i and j, respectively; This represents the topological distance between two spatial nodes; This is a Boolean function. If the attack operation conforms to the hard spatiotemporal rules of the power business, the value is 1; otherwise, it is 0. , , For the weighting coefficients, satisfying .

4. The power grid attack damage propagation analysis method according to claim 2, characterized in that, Based on the spatiotemporal similarity, the missing attack links in the monitoring data are filled in to generate a continuous damage propagation path from the initial attack point to surrounding devices and business systems, including: Based on the spatiotemporal similarity between attack behaviors, identify adjacent behavior pairs in the current attack sequence whose similarity is lower than a preset threshold, and mark them as breakpoints in the propagation path. For each breakpoint, based on the predefined business process nodes, equipment topology, permission levels and time constraints in the power business spatiotemporal correlation model, combined with the historical attack propagation knowledge base, Bayesian inference method is used to infer the type of missing attack link and its spatiotemporal attributes. The inferred missing attack links are inserted into the breakpoint location to ensure that the spatiotemporal similarity between adjacent behaviors meets the preset requirements and conforms to the time propagation rules, spatial propagation rules and permission constraint rules, thus forming a continuous damage propagation path.

5. The power grid attack damage propagation analysis method according to claim 1, characterized in that, The time propagation rules define the temporal evolution of attack behavior as follows: reconnaissance, vulnerability exploitation, privilege acquisition, local damage, cross-node propagation, and large-scale spread. The spatial propagation rules define the topological order of damage spread as follows: edge device layer, regional gateway, substation control node, and main network scheduling node; The permission constraint rules include: Damage to low-privilege nodes cannot be directly propagated to critical nodes with privilege levels higher than a preset threshold. Attacks that do not break through the industrial control protocol authentication mechanism cannot spread across devices.

6. The power grid attack damage propagation analysis method according to claim 5, characterized in that, The assessment of the impact of the attack damage on power services, based on the damage propagation path, includes: In accordance with power safety regulations, compliance checks are performed on the damage propagation path, including authorization compliance, process compliance, and threshold compliance, to generate a compliance score. ; Based on the OT device type and attack operation, query the preset device function impact mapping table to obtain the OT device function impact risk value. ; Calculate the risk value of sensitive data leakage based on the data sensitivity level of the attacked device. ; The comprehensive risk value is calculated using the following formula. : in, This indicates the risk value affected by the functionality of OT equipment; Indicates the risk value of sensitive data leakage; , These are the weighting coefficients.

7. The power grid attack damage propagation analysis method according to claim 6, characterized in that, According to power safety regulations, the damage propagation path is subject to compliance checks including authorization, process, and threshold, resulting in a compliance score. ,include: According to power safety regulations, the system determines whether the attack behavior exceeds preset permission boundaries, whether the damage propagation path violates power business process constraints, and whether the scope or extent of the damage exceeds preset security thresholds. Based on the determination results, a compliance score is output. .

8. A power grid attack damage propagation analysis system, using the method as described in any one of claims 1 to 7, characterized in that, include: The data acquisition unit is used to acquire multi-source monitoring data during the process of the power system being attacked by the network. The multi-source monitoring data includes at least: the timestamp sequence of the attack behavior, the network address and physical topology location of the attacked equipment, the OT equipment type and industrial protocol type of the attacked equipment, the status of the business node when the attack occurred, and the access permission records. The feature extraction unit is used to extract the spatiotemporal feature vector of the attack behavior based on the multi-source monitoring data. The spatiotemporal feature vector includes time identifier, space identifier, OT device identifier, service node identifier, and permission status identifier. The propagation simulation unit is used to perform spatiotemporal correlation analysis on the spatiotemporal feature vectors based on a pre-built spatiotemporal correlation model and spatiotemporal hard rules for power business, and generate a continuous damage propagation path from the initial attack point to surrounding equipment and business systems. The spatiotemporal correlation model for power business predefines the correlation rules between business process nodes, equipment topology, permission hierarchy, and time constraints of the power system. The spatiotemporal hard rules for power business include time propagation rules, spatial propagation rules, and permission constraint rules. The impact assessment unit is used to calculate the impact assessment results of the attack damage on the power business based on the damage propagation path.

9. A computer device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor executes the executable instructions to implement the power network attack damage propagation analysis method as described in any one of claims 1-7.

10. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by the processor, this instruction implements the steps of the power network attack damage propagation analysis method as described in any one of claims 1-7.

Images