A power information physical system security risk assessment system and method

Abstract

This invention belongs to the technical field of power system information security, specifically relating to a security risk assessment system and method for power cyber-physical systems. The system includes: edge nodes for preprocessing collected target risk element data from the power cyber-physical system to obtain preprocessed target risk element data; and a cloud platform for using the preprocessed target risk element data as input to a pre-established risk assessment model to predict the risk level of the power cyber-physical system. The risk assessment model is established using historical risk element data from the power cyber-physical system. The technical solution provided by this invention combines edge computing and cloud-based distributed training, with both cloud and edge nodes participating in the training of the risk assessment model. This reduces the complexity of model training, improves the accuracy and efficiency of risk assessment, effectively protects data privacy, and reduces computational and storage costs.

Description

Technical Field

[0001] This invention belongs to the technical field of power system information security, specifically relating to a power information physical system security risk assessment system and method. Background Technology

[0002] In recent years, with the rapid development of my country's new energy power generation, energy storage, and electric vehicle charging industries, the number and installed capacity of large-scale power stations connected to the power system at different voltage levels have been increasing, posing a huge challenge to the power system in terms of information security.

[0003] With the deep integration of information technology and physical infrastructure, cyber-physical systems (CPS) in the power sector have driven the intelligent and automated development of power systems. However, this integration has also introduced new information security risks, particularly in data transmission, equipment control, and privacy protection. Power information systems not only need to handle massive amounts of data and complex control commands, but also must ensure stable operation in the face of various security threats. System security involves not only the protection of information technology but also the protection of physical equipment. Unlike traditional power systems that rely on closed control networks, CPS systems connect various subsystems through more open communication methods, increasing the risk of external attacks. Hacking, equipment failure, data tampering, and human error can all trigger power system failures or data breaches, thereby affecting power supply and disrupting normal life. Furthermore, incorrect or insufficient risk assessments may lead to flawed decision-making, affecting the security and stability of the system. Therefore, accurate and comprehensive risk assessments play a crucial role in ensuring the security of power IoT information communication systems.

[0004] As a complex and massive nonlinear system, describing the security vulnerabilities of the power system using mechanism-driven models is extremely challenging. Thanks to advancements in data mining techniques, data-driven methods such as deep learning can effectively extract and learn these nonlinear relationships from massive amounts of power data, thereby improving the accuracy of risk assessment. However, to further enhance the accuracy of assessments, end-side data needs to include not only the operating status of equipment but also user privacy information. With the gradual expansion of data sharing and applications in the power system, effectively protecting privacy has become a pressing issue, and the risk of privacy breaches cannot be ignored. Summary of the Invention

[0005] In response to the security risks posed by a high proportion of large-scale power plant access to the power system, and to overcome the shortcomings of existing risk assessment processes such as data privacy leakage, complex assessment modeling, and low assessment accuracy, this invention provides a security risk assessment system and method for power cyber-physical systems.

[0006] According to a first aspect of the present invention, a security risk assessment system for a power information physical system is provided, comprising: Edge nodes are used to preprocess the target risk element data of the collected power information physical system to obtain preprocessed target risk element data. In the cloud, the preprocessed target risk element data is used as input to a pre-established risk assessment model to predict the risk level of the power information physical system. The risk assessment model is established using historical risk factor data from the power cyber-physical system.

[0007] Preferably, the edge node includes: The processing unit is used to sequentially perform data cleaning, noise reduction and normalization on the target risk element data to obtain normalized target risk element data. The alignment unit is used to perform time alignment on the normalized target risk element data according to the timestamp of the normalized target risk element data to obtain the preprocessed target risk element data.

[0008] Preferably, the edge node further includes: a building unit for building the risk assessment model; the building unit includes: The data acquisition module is used to collect historical risk element data and historical risk levels of the power information physical system; The processing module is used to preprocess the historical risk element data to obtain preprocessed historical risk element data. The training module is used to train the CNN-Transformer deep learning model using the preprocessed historical risk element data and the historical risk level of the power information physical system, so as to obtain the risk assessment model.

[0009] Preferably, the processing module is specifically used for: The historical risk element data is sequentially cleaned, denoised, and normalized to obtain normalized historical risk element data. Based on the timestamps of the normalized historical risk element data, the normalized historical risk element data is time-aligned to obtain the preprocessed historical risk element data.

[0010] Preferably, the CNN-Transformer deep learning model includes: a convolutional neural network (CNN) submodule and a Transformer main module; The CNN submodule includes: convolutional layers, max pooling layers, and global average pooling layers.

[0011] Preferably, the training module is specifically used to perform the following steps: Step 1: Establish a connection with the cloud and receive the initial model weights distributed by the cloud, and use the initial model weights as model parameters; Step 2: Based on the preset classification rules, classify the preprocessed historical risk element data within the preset time window to obtain the classified historical risk element data; Step 3: Using the CNN submodule, perform feature extraction, dimensionality reduction, and transformation on the classified historical risk element data in sequence to obtain input features; Step 4: Input the initial model weights and the input features into the Transformer main module, so that the Transformer main module, under the constraint of the initial model weights, uses the input features to perform multi-head attention calculation, outputs the prediction result of the risk level, constructs a loss function based on the error between the prediction result and the historical risk level, and updates the model parameters through the backpropagation algorithm to obtain the updated model weights; Step 5: Upload the updated model weights to the cloud so that the cloud can perform weighted aggregation on the updated model weights, generate globally updated model weights, and redistribute them to the edge nodes; Step 6: After receiving the globally updated model weights, iterate through steps 3-5 until the globally updated model weights converge, then terminate the iteration, so that the cloud can use the globally updated model weights generated in the last iteration to determine the risk assessment model.

[0012] Preferably, step 3 includes: Each of the classified historical risk element data is input into the convolutional layer to extract the multi-scale features of the classified historical risk element data; The max pooling layer is used to reduce the dimensionality of the multi-scale features of the classified historical risk element data. The multi-scale features after dimensionality reduction are converted into one-dimensional feature vectors by using a global average pooling layer, thus obtaining one-dimensional feature vectors of historical risk element data after each classification. The input features are obtained by concatenating the one-dimensional feature vectors of the various classified historical risk element data.

[0013] Preferably, the formula for calculating the globally updated model weights includes:

[0014] In the above formula, ,N The total number of nodes is calculated at the edge. For the first r +1 round of global update of model weights For the first i The size of the dataset on each edge computing node For the first i The edge node at the ... r The amount of local model weight updates in the round.

[0015] Preferably, the objective function of the risk assessment model is calculated as follows:

[0016] In the above formula, These are the globally updated model weights generated in the last iteration. y Based on the risk level assessment results, F ( x , ω Let ) be the objective function. x Input data into the model.

[0017] Preferably, the risk factor data includes at least the following four types: power equipment status data, network security information, geographic and meteorological information, and user behavior data.

[0018] According to a second aspect of the present invention, a method for security risk assessment of a power information physical system is provided, comprising: The target risk element data of the collected power information physical system is preprocessed using edge nodes to obtain preprocessed target risk element data; Using the pre-processed target risk element data as input to a pre-established risk assessment model via the cloud, the risk level of the power information physical system is predicted. The risk assessment model is established using historical risk factor data from the power cyber-physical system.

[0019] Preferably, the step of preprocessing the target risk element data of the collected power information physical system using edge nodes to obtain preprocessed target risk element data includes: The target risk element data is sequentially cleaned, denoised, and normalized to obtain normalized target risk element data. Based on the timestamps of the normalized target risk element data, the normalized target risk element data is time-aligned to obtain the preprocessed target risk element data.

[0020] Preferably, the method further includes: establishing the risk assessment model using edge nodes; the establishment of the risk assessment model using edge nodes includes: Collect historical risk factor data and historical risk levels of the power information physical system; The historical risk element data is preprocessed to obtain preprocessed historical risk element data; The risk assessment model is obtained by training a CNN-Transformer deep learning model using the preprocessed historical risk factor data and the historical risk level of the power information physical system.

[0021] Preferably, the preprocessing of the historical risk element data to obtain preprocessed historical risk element data includes: The historical risk element data is sequentially cleaned, denoised, and normalized to obtain normalized historical risk element data. Based on the timestamps of the normalized historical risk element data, the normalized historical risk element data is time-aligned to obtain the preprocessed historical risk element data.

[0022] Preferably, the CNN-Transformer deep learning model includes: a convolutional neural network (CNN) submodule and a Transformer main module; The CNN submodule includes: convolutional layers, max pooling layers, and global average pooling layers.

[0023] Preferably, training the CNN-Transformer deep learning model using the preprocessed historical risk factor data includes: Step 1: Establish a connection with the cloud and receive the initial model weights distributed by the cloud, and use the initial model weights as model parameters; Step 2: Based on the preset classification rules, classify the preprocessed historical risk element data within the preset time window to obtain the classified historical risk element data; Step 3: Using the CNN submodule, perform feature extraction, dimensionality reduction, and transformation on the classified historical risk element data in sequence to obtain input features; Step 4: Input the initial model weights and the input features into the Transformer main module, so that the Transformer main module, under the constraint of the initial model weights, uses the input features to perform multi-head attention calculation, outputs the prediction result of the risk level, constructs a loss function based on the error between the prediction result and the historical risk level, and updates the model parameters through the backpropagation algorithm to obtain the updated model weights; Step 5: Upload the updated model weights to the cloud so that the cloud can perform weighted aggregation on the updated model weights, generate globally updated model weights, and redistribute them to the edge nodes; Step 6: After receiving the globally updated model weights, iterate through steps 3-5 until the globally updated model weights converge, then terminate the iteration, so that the cloud can use the globally updated model weights generated in the last iteration to determine the risk assessment model.

[0024] Preferably, step 3 includes: Each of the classified historical risk element data is input into the convolutional layer to extract the multi-scale features of the classified historical risk element data; The max pooling layer is used to reduce the dimensionality of the multi-scale features of the classified historical risk element data. The multi-scale features after dimensionality reduction are converted into one-dimensional feature vectors by using a global average pooling layer, thus obtaining one-dimensional feature vectors of historical risk element data after each classification. The input features are obtained by concatenating the one-dimensional feature vectors of the various classified historical risk element data.

[0025] Preferably, the formula for calculating the globally updated model weights includes:

[0026] In the above formula, , N The total number of nodes is calculated at the edge. For the first r +1 round of global update of model weights For the first i The size of the dataset on each edge computing node For the first i The edge node at the ... r The amount of local model weight updates in the round.

[0027] Preferably, the objective function of the risk assessment model is calculated as follows:

[0028] In the above formula, These are the globally updated model weights generated in the last iteration. y Based on the risk level assessment results, F ( x , ω Let ) be the objective function. x Input data into the model.

[0029] Preferably, the risk factor data includes at least the following four types: power equipment status data, network security information, geographic and meteorological information, and user behavior data.

[0030] According to a third aspect of the present invention, an electronic device is provided, comprising: at least one processor and a memory; the memory and the processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the power cyber-physical system security risk assessment method is implemented.

[0031] According to a fourth aspect of the present invention, a readable storage medium is provided having an executable program stored thereon, wherein when the executable program is executed, the power information physical system security risk assessment method is implemented.

[0032] The technical solution provided by this invention has the following beneficial effects: This invention provides a security risk assessment system and method for power cyber-physical systems, comprising: an edge node for preprocessing collected target risk element data of the power cyber-physical system to obtain preprocessed target risk element data; and a cloud node for using the preprocessed target risk element data as input to a pre-established risk assessment model to predict the risk level of the power cyber-physical system. The risk assessment model is established using historical risk element data of the power cyber-physical system. The technical solution provided by this invention, by combining edge computing and cloud-based distributed training, allows both the cloud and edge nodes to participate in the training of the risk assessment model, reducing the complexity of model training, improving the accuracy and efficiency of risk assessment, while effectively protecting data privacy and reducing computational and storage costs. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a structural block diagram of a power information physical system security risk assessment system provided in an embodiment of the present invention; Figure 2 This is a flowchart of a security risk assessment method for a power information physical system provided in an embodiment of the present invention; Figure 3 This is a flowchart of the main steps of a security risk assessment method for a power information physical system provided in an embodiment of the present invention; Figure 4 This is a flowchart of a security risk assessment method for a power information physical system provided in an embodiment of the present invention; Figure 5 This is a structural block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the following embodiments are only some embodiments of this invention, not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0036] Example 1 This invention provides a security risk assessment system for power information physical systems, such as... Figure 1 As shown, it includes: Edge nodes are used to preprocess the target risk element data of the collected power information physical system to obtain preprocessed target risk element data. In the cloud, pre-processed target risk element data is used as input to a pre-established risk assessment model to predict the risk level of the power cyber-physical system; The risk assessment model is established using historical risk factor data from the power cyber-physical system.

[0037] Specifically, risk factor data should include at least the following four types: power equipment status data, cybersecurity information, geographic and meteorological information, and user behavior data.

[0038] Furthermore, edge nodes include: The processing unit is used to perform data cleaning, noise reduction and normalization processing on the target risk element data in sequence to obtain the normalized target risk element data. The alignment unit is used to align the normalized target risk element data with time based on the timestamp of the normalized target risk element data to obtain the preprocessed target risk element data.

[0039] Furthermore, the edge node also includes: a building unit for building a risk assessment model; the building unit includes: The data acquisition module is used to collect historical risk element data and historical risk levels of the power information physical system; The processing module is used to preprocess historical risk element data to obtain preprocessed historical risk element data. The training module is used to train the CNN-Transformer deep learning model using preprocessed historical risk factor data and historical risk levels of the power information physical system, so as to obtain a risk assessment model.

[0040] Furthermore, the processing module is specifically used for: The historical risk element data is sequentially cleaned, denoised, and normalized to obtain normalized historical risk element data. Based on the timestamps of the normalized historical risk element data, the normalized historical risk element data is time-aligned to obtain the preprocessed historical risk element data.

[0041] It should be noted that the "data cleaning", "denoising", "normalization" and "time alignment" methods involved in this invention are well known to those skilled in the art, therefore, their specific implementation methods will not be described in detail.

[0042] Furthermore, the CNN-Transformer deep learning model includes: a Convolutional Neural Network (CNN) submodule and a Transformer main module; The CNN submodules include: convolutional layers, max pooling layers, and global average pooling layers.

[0043] Furthermore, the training module is specifically used to perform the following steps: Step 21: Establish a connection with the cloud and receive the initial model weights distributed by the cloud, and use the initial model weights as model parameters; Step 22: Based on the preset classification rules, classify the preprocessed historical risk element data within the preset time window to obtain the classified historical risk element data; Step 23: Using the CNN submodule, extract features, reduce dimensionality, and transform the classified historical risk element data sequentially to obtain the input features; Step 24: Input the initial model weights and input features into the Transformer main module so that the Transformer main module can perform multi-head attention calculation using the input features under the constraint of the initial model weights, output the prediction result of the risk level, construct the loss function based on the error between the prediction result and the historical risk level, and update the model parameters through the backpropagation algorithm to obtain the updated model weights. Step 25: Upload the updated model weights to the cloud so that the cloud can perform weighted aggregation of the updated model weights, generate globally updated model weights, and redistribute them to edge nodes; Step 26: After receiving the globally updated model weights, iterate through steps 23-25 ​​until the globally updated model weights converge, then terminate the iteration so that the cloud can use the globally updated model weights generated in the last iteration to determine the risk assessment model.

[0044] Further, step 23 includes: Step 231: Input the classified historical risk element data into the convolutional layer to extract the multi-scale features of the classified historical risk element data; Step 232: Use a max pooling layer to reduce the dimensionality of the multi-scale features of the classified historical risk factor data; Step 233: Use a global average pooling layer to convert the dimensionality-reduced multi-scale features into one-dimensional feature vectors, and obtain one-dimensional feature vectors of historical risk element data after each classification. Step 234: Concatenate the one-dimensional feature vectors of the historical risk element data after each classification to obtain the input features.

[0045] Furthermore, the formula for calculating the globally updated model weights includes:

[0046] In the above formula, , N The total number of nodes is calculated at the edge. For the first r +1 round of global update of model weights For the first i The size of the dataset on each edge computing node For the first i The edge node at the ... r The amount of local model weight updates in the round.

[0047] Furthermore, the formula for calculating the objective function of the risk assessment model includes:

[0048] In the above formula, These are the globally updated model weights generated in the last iteration. y Based on the risk level assessment results, F ( x , ω Let ) be the objective function. x Input data into the model.

[0049] To further explain the aforementioned power cyber-physical system security risk assessment system, an application example is provided: The development of smart grids, smart devices, and big data technologies has significantly improved the automation and intelligence of power systems. Cyber-physical systems (CPS) enhance the efficiency and reliability of power systems by tightly integrating information technology with physical infrastructure. However, this integration also exposes the system to more potential security threats; security issues in any link can affect the stable operation of the entire power system. To ensure the security of the power system, real-time assessment and monitoring of potential risks are essential. Various sensors and terminal devices deployed at the edge (such as smart meters) constantly generate massive amounts of data, which are diverse in type and contain sensitive information. To effectively process this data, edge computing nodes bring data preprocessing and preliminary analysis to the network edge, reducing the risk of privacy leaks and latency caused by data transmission. After fusing and cleaning multi-source data, edge computing nodes upload only valuable information to the cloud. The cloud then performs global analysis and risk assessment on the data aggregated from various edge nodes, generating accurate predictions of system security risks. This cloud-edge-device collaborative approach enables efficient and secure risk assessment of cyber-physical systems in the power sector.

[0050] The specific implementation plan is as follows: (1) The edge devices are deployed in different physical locations to collect and transmit various types of data to the edge computing nodes in real time. These data are initially classified according to different types and then preliminarily cleaned by the embedded processing module. (2) Edge computing nodes denoise, preprocess, and fuse the collected multi-source data, and align the data into a unified time series sample according to the time sequence; (3) The cloud server establishes a connection with each edge node. The edge node receives the initial model weights from the cloud. Each edge node contains a local computing unit and is responsible for computing local data and training the model. (4) After the edge node completes local training and extracts features, the edge node uploads the updated model weights to the cloud server. The cloud uses the weighted aggregated weight parameters to generate the final risk assessment model, and then uses the risk assessment model to predict the risk level of the power information physical system based on the target risk element data.

[0051] The present invention provides a security risk assessment system for power information physical systems. By combining edge computing and cloud-based distributed training, cloud and edge nodes jointly participate in the training of the risk assessment model, which improves the accuracy and efficiency of risk assessment, while effectively protecting data privacy and reducing computing and storage costs.

[0052] Example 2 This invention also provides a method for security risk assessment of power information physical systems, such as... Figure 2 As shown, it includes: Step 11: Use edge nodes to preprocess the target risk element data of the collected power information physical system to obtain preprocessed target risk element data; Step 12: Using the pre-processed target risk element data as input to a pre-established risk assessment model via the cloud, the risk level of the power information physical system is predicted; The risk assessment model is established using historical risk factor data from the power cyber-physical system.

[0053] Further, step 11 includes: Step 111: Perform data cleaning, noise reduction and normalization on the target risk element data in sequence to obtain the normalized target risk element data; Step 112: Based on the timestamps of the normalized target risk element data, perform time alignment on the normalized target risk element data to obtain the preprocessed target risk element data.

[0054] Furthermore, the method also includes: Step 10: Establishing a risk assessment model using edge nodes; Step 10 includes: Step 101: Collect historical risk element data and historical risk levels of the power information physical system; Step 102: Preprocess the historical risk element data to obtain preprocessed historical risk element data; Step 103: Using the preprocessed historical risk factor data and the historical risk level of the power information physical system, train the CNN-Transformer deep learning model to obtain the risk assessment model.

[0055] Further, step 102 includes: Step 1021: Perform data cleaning, noise reduction and normalization on the historical risk element data in sequence to obtain the normalized historical risk element data; Step 1022: Based on the timestamps of the normalized historical risk element data, perform time alignment on the normalized historical risk element data to obtain the preprocessed historical risk element data.

[0056] Furthermore, the CNN-Transformer deep learning model includes: a Convolutional Neural Network (CNN) submodule and a Transformer main module; The CNN submodules include: convolutional layers, max pooling layers, and global average pooling layers.

[0057] Further, step 103 includes: Step 1031: Establish a connection with the cloud and receive the initial model weights distributed by the cloud, and use the initial model weights as model parameters; Step 1032: Based on the preset classification rules, classify the preprocessed historical risk element data within the preset time window to obtain the classified historical risk element data; Step 1033: Using the CNN submodule, extract features, reduce dimensionality, and transform the classified historical risk element data sequentially to obtain the input features; Step 1034: Input the initial model weights and input features into the Transformer main module so that the Transformer main module can perform multi-head attention calculation using the input features under the constraint of the initial model weights, output the prediction result of the risk level, construct the loss function based on the error between the prediction result and the historical risk level, and update the model parameters through the backpropagation algorithm to obtain the updated model weights. Step 1035: Upload the updated model weights to the cloud so that the cloud can perform weighted aggregation of the updated model weights, generate globally updated model weights, and redistribute them to edge nodes; Step 1036: After receiving the globally updated model weights, iterate through steps 1033-1035 until the globally updated model weights converge, then terminate the iteration, so that the cloud can use the globally updated model weights generated in the last iteration to determine the risk assessment model.

[0058] Further, step 1033 includes: Step 1033a: Input the classified historical risk element data into the convolutional layer to extract the multi-scale features of the classified historical risk element data; Step 1033b: Use a max pooling layer to reduce the dimensionality of the multi-scale features of the classified historical risk factor data; Step 1033c: Use a global average pooling layer to convert the dimensionality-reduced multi-scale features into one-dimensional feature vectors, and obtain one-dimensional feature vectors of historical risk element data after each classification. Step 1033d: Concatenate the one-dimensional feature vectors of the historical risk element data after each classification to obtain the input features.

[0059] Furthermore, the formula for calculating the globally updated model weights includes:

[0060] In the above formula, , N The total number of nodes is calculated at the edge. For the first r +1 round of global update of model weights For the first i The size of the dataset on each edge computing node For the first i The edge node at the ... r The amount of local model weight updates in the round.

[0061] Furthermore, the formula for calculating the objective function of the risk assessment model includes:

[0062] In the above formula, These are the globally updated model weights generated in the last iteration. y Based on the risk level assessment results, F ( x , ω Let ) be the objective function. x Input data into the model.

[0063] Furthermore, risk factor data should include at least the following four types: power equipment status data, cybersecurity information, geographic and meteorological information, and user behavior data.

[0064] It is understood that the method embodiments provided above correspond to the system embodiments described above, and the specific details can be referred to each other, which will not be repeated here.

[0065] Example 3 The security risk assessment method for power cyber-physical systems provided by this invention is a quantitative assessment method for the security risks of power cyber-physical fusion systems based on cloud-edge-device collaboration. It mainly considers two aspects: (1) The power information physical fusion system involves a large amount of sensitive data. How can we ensure that the privacy of the data is fully protected during the data transmission and fusion process, while maintaining the validity of the data so as to conduct risk assessment? (2) Traditional risk assessment methods rely on complex system operation mechanisms. How can we use data mining methods to integrate multi-source data, extract the correlation and nonlinear characteristics between different data sources, and construct an accurate quantitative risk assessment model between risk level and risk characteristics?

[0066] Therefore, this invention aims to address the problems of low accuracy in security risk assessment, privacy breaches, and low data processing efficiency faced by power systems in the context of cyber-physical integration. It mainly comprises three parts: edge-side risk factor collection, edge multi-source data fusion, and cloud-based quantitative risk assessment. This invention utilizes cloud-edge-device collaborative work, combining edge computing and distributed training mechanisms, and employs data mining to model the relationship between risk levels and risk factors, avoiding the need for complex operational modeling of cyber-physical systems in traditional methods. Through the method of this invention, the security risks of power systems can be assessed efficiently and accurately, while effectively protecting data privacy and improving the system's intelligence level.

[0067] Therefore, the present invention provides a specific example, such as Figure 3 As shown, it comprises three parts: edge-side risk factor collection, edge multi-source data fusion, and cloud-based quantitative risk assessment. Edge-side risk factor collection is mainly used to collect data on various risk factors that may affect system security on the edge devices of the power information physical fusion system; edge multi-source data fusion is to better process and integrate the multi-source data collected at the edge, perform localized model training at the edge, reduce the computing burden on the cloud, and ensure data privacy protection; cloud-based quantitative risk assessment involves transmitting the models at each edge node to the cloud for integration and updates, and using deep learning to establish a quantitative relationship between the system risk level and its influencing factors.

[0068] End-side risk factor collection: End-side data collection is the foundation of risk assessment, ensuring that the operational status of each node in the system is monitored and recorded, thus providing a key data source for subsequent data processing and fusion. This module mainly collects various risk factor data related to the safe operation of the system from various terminal devices in the power information physical fusion system.

[0069] Edge multi-source data fusion: Due to the coupled and intertwined nature of the information and physical ends of the power system, the data collected by terminal devices comes from multiple different nodes and systems. Therefore, data fusion needs to be performed at edge computing nodes. Considering the privacy leakage issues during data sharing, edge training is performed using the computing power of one-stop computing and storage services provided by the edge side.

[0070] Cloud-based quantitative risk assessment: Various types of data are stored on trusted edge nodes instead of being uploaded to the cloud for centralized storage. This module mainly receives and aggregates the models trained on edge nodes to build a complete assessment model between risk levels and risk characteristics.

[0071] Furthermore, such as Figure 4 As shown, the process of the security risk assessment method for power cyber-physical systems connected to large power stations includes the following steps: Step 1: End-side risk factor collection End-side risk factor collection is a fundamental module for risk assessment in power cyber-physical systems. Real-time monitoring and data collection at each node of the system provide crucial information for subsequent data processing and risk assessment. To comprehensively assess the risk status of a power cyber-physical system, the risk factor data collected at the end-side includes the following categories: (1) Power equipment status data: such as current, voltage, power, etc., used to monitor the operating status of the equipment and whether any abnormalities occur; (2) Network security information: such as intrusion detection, network traffic, communication delay, etc., to help identify whether there is a malicious attack or communication failure; (3) Geographic and meteorological information: such as geographical location, weather conditions (temperature, humidity, rainfall, etc.), severe disasters and other natural environmental changes, these factors may affect the safe operation of power equipment; (4) User behavior data: such as electricity consumption patterns, load demand, etc., to analyze the interaction between user behavior and the power system, and identify potential risks and abnormal patterns.

[0072] The collected data undergoes preprocessing, starting with cleaning to remove outliers, extreme values, and missing values. Due to numerous external interferences, the power sensor data needs to be denoised to avoid impacting the quality of risk decision-making. Assume the raw data collected by the sensors satisfies the following formula:

[0073] In the above formula, t The moment of data collection L ( t The data represents the raw, noisy data. f ( t This provides useful quality data. e ( t ) represents noise.

[0074] Through wavelet basis functions To filter out noise signals, among which, k As a time factor, As the offset factor, As a scaling factor, >0, , R For real numbers, For wavelet basis functions, For the mother wavelet function.

[0075] Finally, for different feature types, the formula is used. Perform data normalization to eliminate the influence of biases between features. For the normalized first i 1 eigenvalue, Let be any feature value of the data. Represents the minimum value of the characteristic. Represents the maximum value of the characteristic.

[0076] Step 2: Edge Multi-Source Data Fusion Edge computing is a distributed computing framework that enables real-time data analysis and aggregation at the network edge, avoiding the need to send large amounts of sensitive data to cloud computing centers. This effectively protects data privacy, reduces response time, and alleviates bandwidth pressure.

[0077] Storing multi-source data collected by the terminal on edge computing nodes requires data alignment to ensure that data from different sources have the same timestamp in order to achieve effective data fusion. First, data collected by different sensors, devices, or systems is aligned according to a unified time format, specifically for time intervals. t The location and time of the power terminal equipment are obtained through geographic information systems and meteorological systems. t Corresponding historical weather data. The aligned data can be merged into a single time series sample containing information from multiple data sources. For each time point... t The merged sample will contain data from different data sources, represented as follows:

[0078] In the above formula, For power equipment at a specific time point t Status data, It is network data at a certain point in time. t Data, Meteorological data at a specific point in time. t The value, Geographic information at a point in time t The data. In this way, the final time series sample will contain synchronous data from all sources, which can be used for subsequent risk assessment and modeling. For each time point... t Repeat the above process to finally obtain a complete time series sample set. ,in, It refers to a point in time during the entire data collection period.

[0079] From a data mining perspective, the risk assessment problem can be described as a multi-classification problem, and the risk assessment model can be represented by the following formula:

[0080] In the above formula, These are the model weights, i.e., the model parameters; y Based on the risk level assessment results, F ( x , ω Let ) be the objective function. Input data for the model, including data from various sensors (voltage) V Current I User electricity load P (etc.), network protocol layer data (protocol name) Proto Flag position F Package length L (etc.), meteorological data (wind speed) W Temperature T, radiation intensity R (etc.) and geographical location information Loc , y As the model output, four numerical labels are used to identify the risk level. This model adopts a data-driven approach, without performing any mathematical modeling of the system's operation, that is, without involving any internal system parameters, and only takes the above-mentioned collected data as input to output the corresponding predicted risk level.

[0081] To meet the requirements of privacy data protection, the fused data is not sent to the cloud for centralized training, but is stored on edge nodes for local model training and optimization, generating a risk assessment model suitable for the local environment. This invention uses deep learning to construct a time-aligned multi-scale risk assessment model. Based on the time-series characteristics of the fused data, a Transformer is used as the main module of the risk assessment model, supplemented by a convolutional neural network submodule to extract important features from the fused data, which are then fed into the Transformer module.

[0082] Furthermore, model training and optimization are achieved through a combination of local training on edge nodes and cloud-based weight aggregation and collaboration. The core process is as follows: Step a: Model architecture construction: A deep learning architecture of "Convolutional Neural Network (CNN) sub-module + Transformer main module" is adopted to adapt to the time series characteristics of fused data, and is used to extract multi-scale features and establish risk associations; Step b: Training data preparation: Edge nodes store multi-source fusion data (including power equipment status, network security, geographic meteorology, user behavior data, etc.) after time alignment, denoising, and normalization to form a unified time series sample set. Only local data is used for training, and no raw sensitive data is transmitted to the cloud. Step c: Local training execution: (1) Group the time series samples according to data type (such as sensor data group, meteorological data group, etc.) and input them into independent CNN sub-modules respectively; (2) After multi-scale features are extracted by the CNN submodule, they are reduced in dimensionality by pooling and concatenated into a one-dimensional vector, which is then fed into the Transformer module; (3) Edge nodes are based on local datasets and aim to minimize the error between the predicted risk level and the actual risk level by iteratively optimizing model parameters (weights). Step d: Collaborative optimization mechanism: (1) Initialize model weights in the cloud and distribute them to all edge nodes as initial parameters for local training; (2) After each round of local training, the edge nodes only upload the updated model weights (not the original data) to the cloud; (3) The weights of all nodes are aggregated in the cloud according to the size of the dataset of each edge node, and the globally optimized model weights are generated and redistributed; (4) After receiving the new weights, the edge nodes continue to train locally, repeating the process of “local training - weight upload - cloud aggregation - weight distribution” until the model converges and the final training optimization is completed.

[0083] The submodule consists of single-step convolutional layers, max pooling layers, and global average pooling layers. This is used to predict and assess the risk level at future time points (e.g., ...). t Risk level at +3 y t+3 ), which fuses various types of time-aligned data: sensor data ( V t , I t , P t , V t+1 , I t+1 , P t+1 , V t+2 , I t+2 , P t+2 ), network protocol layer data ( Proto t , F t , L t , Proto t , +1 , F t+1 , Lt+1 , Proto t+2 , F t+2 , L t+2 ), meteorological data ( W t , T t , R t , W t+1 , T t+1 , R t+1 , W t+2 , T t+2 , R t+2 and geographic location information As a model The input; where, V t for t Voltage at time, I t for t Current at any moment P t for t User electricity load at any given time V t+1 for t Voltage at time +1 I t+1 for t The current at time +1 P t+1 for t User electricity load at time +1 V t+2 for t Voltage at time +2, I t+2 for t The current at time +2, P t+2 for t User electricity load at +2 o'clock Proto t for t The protocol name at that moment, F t for t The time marker, L t for t Packet length at any given moment Proto t+1 fort The protocol name at time +1, F t+1 for t The flag bit at time +1, L t+1 for t Packet length at time +1 Proto t+2 for t The protocol name at time +2. F t+2 for t The flag at time +2 L t+2 for t Packet length at time +2, W t for t Wind speed at any moment T t for t Temperature at any moment R t for t Radiation intensity at any given time W t+1 for t Wind speed at +1 hour T t+1 for t The temperature at time +1 R t+1 for t Radiation intensity at time +1 W t+2 for t Wind speed at +2 o'clock, T t+2 for t The temperature at +2, R t+2 for t Radiation intensity at time +2.

[0084] (1) First, the data are grouped and input into the convolutional neural network module. Each group of data (e.g., sensor data group, meteorological data group, etc.) will be processed by an independent convolutional layer. The important features of various data are extracted simultaneously at multiple scales through parallel processing. (2) Then, the features extracted after single-step convolution enter the max pooling layer. The dimension of the feature vector is reduced by extracting the maximum value in each local region, thereby reducing the amount of computation and retaining the most significant features. (3) Next, the feature values ​​of multiple channels are converted into a one-dimensional vector through global average pooling, which contains the important feature information in the data. (4) Finally, the features extracted from each convolutional module are concatenated together and fed into the Transformer module as a single input feature. This module associates the features at multiple scales and outputs the final risk level assessment.

[0085] Furthermore, in step (1), the data will be processed through independent convolutional layers. Important features from various data types will be extracted simultaneously at multiple scales through parallel processing. Parallel extraction is achieved through a design of "data grouping + independent convolutional layers + multi-scale convolutional kernels," specifically including the following steps: Step e: Data grouping and classification: Divide the multi-source data after edge node fusion into independent data groups according to type, such as sensor data group (voltage, current, power, etc.), network protocol layer data group (protocol name, packet length, etc.), meteorological data group (wind speed, temperature, etc.), and geographic information group to ensure that similar data are processed centrally. Step f: Configure independent convolutional layers: Assign a dedicated convolutional layer (CNN submodule) to each data set. Each convolutional layer runs independently and does not interfere with each other, forming a parallel processing channel. Step g: Multi-scale convolutional kernel design: In each independent convolutional layer, configure convolutional kernels of various sizes (such as 3×3, 5×5, 7×7, etc.): (1) Small-sized convolution kernels (such as 3×3) are used to extract fine-grained features of data (such as instantaneous current fluctuations of equipment). (2) Medium / large-sized convolution kernels (such as 5×5, 7×7) are used to extract coarse-grained features (such as the time-varying trend of meteorological data); Step h: Parallel feature extraction: All data sets are simultaneously input into corresponding independent convolutional layers. Multi-scale convolutional kernels within each convolutional layer operate synchronously to extract important features at different scales from different types of data, achieving parallel acquisition of "multi-data types + multi-scale features".

[0086] Furthermore, in step (2), the dimensionality of the feature vector is reduced by extracting the maximum value in each local region. The dimensionality reduction is achieved through max pooling operation of "sliding window + local maximum value filtering", which specifically includes the following steps: Step i: Define pooling window parameters: Set a fixed-size local region window (e.g., 2×2, 3×3) and a sliding step size (e.g., 1 or 2). The window size and step size determine the degree of dimensionality reduction (the larger the window and the larger the step size, the more obvious the dimensionality reduction). Step j: Window traversal of feature map: The data after convolution exists in the form of "feature map" (dimension: height H × width W × number of channels C). The max pooling window slides on the feature map along the height and width directions with a preset stride, covering all local areas one by one, and the windows do not repeat or overlap according to the stride. Step k: Local maximum extraction: Within the local region covered by each sliding window, all feature values ​​are compared, and only the maximum value is retained as the output feature value of that window, while other non-maximum values ​​are discarded, thus achieving feature filtering; Step 1: Dimensionality Reduction Effect: Assuming the feature map after convolution is H×W×C, using a k×k window and a stride of s, the height of the feature map after pooling = (Hk) / s+1 Width = (Wk) / s+1 The number of channels C remains unchanged. For example, when H=16, W=16, k=2, and s=2, the feature map after pooling is 8×8×C, the feature map size is reduced to 1 / 4 of the original size, the dimension of the corresponding feature vector is reduced synchronously, and the maximum value retains the most significant features of the local area (such as abnormal current peaks).

[0087] Furthermore, step (3) global average pooling is achieved through "channel-level global statistics + dimensionality compression", specifically including the following steps: Step m: Input feature format: The input for global average pooling is a multi-channel feature map after max pooling, with dimensions H'×W'×C (H' is the height after pooling, W' is the width after pooling, and C is the number of channels, with each channel corresponding to a data feature class). Step n: Calculate the global mean of a single channel: For each channel's H'×W' feature values, calculate its arithmetic mean - that is, traverse all feature points of the channel, sum them and divide by the total number (H'×W'). Each channel outputs only one average feature value, which represents the global feature trend of the channel. Step o: One-dimensional vector concatenation: The average feature values ​​output by each of the C channels are concatenated end to end in a preset channel order (e.g., sensor data channel → network data channel → meteorological data channel) to form a one-dimensional vector with dimension 1×C. Step p: Feature Preservation Logic: Global average pooling covers the feature information of the entire image of each channel. Its average value can effectively integrate the core features of the channel (such as the overall operating status of a certain type of sensor data). Therefore, a one-dimensional vector condenses the important feature information of all channels.

[0088] Furthermore, step (4) is divided into three core steps: "feature concatenation → Transformer feature association → risk level mapping", specifically implemented as follows: Step q: Feature splicing implementation: (1) Input: One-dimensional feature vectors output by each CNN submodule after global average pooling (e.g., sensor data vector A: 1×C1, network data vector B: 1×C2, meteorological data vector C: 1×C3, geographic information vector D: 1×C4). (2) Operation: Connect vectors A, B, C, and D in a fixed order (such as the priority of data impact on risk) to form a unified input feature vector E with a dimension of 1×(C1+C2+C3+C4), ensuring that all multi-scale and multi-type features are integrated into a single input; Step r: Implementation of feature association in the Transformer module: (1) Embedding mapping: The concatenated feature vector E is fed into the embedding layer of the Transformer and mapped to the feature dimension adapted by the Transformer (e.g., from 1×(C1+C2+C3+C4) to 1×d_model, where d_model is the preset dimension of the Transformer). (2) Multi-head attention computation: Through multiple parallel attention heads, the correlation weights of different positions (corresponding to different data group features) in the feature vector E are calculated. For example, the dependency relationship between "sensor abnormal data" and "meteorological disaster data" is captured, and feature fusion across scales and data types is realized. (3) Feedforward neural network processing: The fused features after association are further processed by a two-layer fully connected network (feedforward neural network) to enhance effective features and suppress redundant information; Step s: Risk level output implementation: (1) Output layer mapping: The fused feature vector after Transformer processing is fed into the Softmax output layer, which maps the feature vector to a probability distribution of a preset risk level (0=low risk, 1=low to medium risk, 2=high to medium risk, 3=high risk); (2) Risk level determination: Select the risk level label corresponding to the maximum value in the probability distribution as the final assessment result output (e.g., if the label with the highest probability is "2", then the output risk level is medium to high risk).

[0089] Step 3: Cloud-based quantitative risk assessment In the process of quantitative risk assessment in the cloud, the processed and fused data transmitted from edge computing nodes will be further analyzed to derive the system's risk assessment results. The goal of cloud processing is to build and update risk assessment models through comprehensive analysis of multi-source data, providing more accurate and comprehensive security risk predictions.

[0090] (1) The cloud server communicates with each edge computing node to obtain the set of participants. ,in, , N The total number of nodes is calculated at the edge. n 1 represents the first edge computing node. n 2 is the second edge computing node. n i For the first i One edge computing node, n N For the first N There are several edge computing nodes. Each edge node has its own dataset. ,in, For the first i Data sets on edge computing nodes For the first i Each edge node at time... t The input feature vector, For the first i Each edge node at time... t The true risk level label.

[0091] (2) Then, the cloud server initializes a model weight. The model is then distributed to each edge computing node connected to it. Each edge node trains the entire risk assessment model locally and updates its model weights accordingly. Uploaded to the cloud server, among which, r For the first r Number of communication rounds, For the first i The edge node at the ... r The amount of local model weight updates in the round.

[0092] (3) Upon receiving the uploaded weight Then, the cloud server performs aggregated updates. And redistribute, among which, For the first edge node in the... r The amount of local model weight updates in the round. For the second edge node in the r The amount of local model weight updates in the round. For the first N The edge node at the ...r The amount of local model weight updates in the round. For the first r +1 round of global model weight update, The size of the dataset.

[0093] (4) Each edge computing node continues to use the new model weights distributed in the cloud. Perform local training, utilizing its local dataset Update the model. After each round of training and weight upload, the cloud server will re-aggregate the weights based on the updates received from each node, and continue to distribute the new model, repeating the above process until the model converges.

[0094] In summary, the examples provided by this invention mainly include the following steps: Step 31: Collect and clean risk factor data related to system security from various power equipment and sensors. The data comes from multiple sub-information or physical systems, including power equipment status data, network security information, geographic and meteorological data, user behavior data, etc.; Proceed to Step 32; Step 32: According to the formula The cleaned data is then denoised, and then processed according to the formula. Linearly normalize all data; proceed to step 33; Step 33: Analyze multi-source data from different terminal devices based on timestamps. Alignment is performed to form uniform time series samples. Proceed to step 34; Step 34: Establish connection between the cloud and edge nodes and distribute initial model weights. Proceed to step 35; Step 35: Set the time t At the time t The data from +2 are input into separate convolutional network blocks according to their categories to extract important features at multiple scales; proceed to step 36; Step 36: By using max pooling and global average pooling, the dimensionality of the features is reduced and transformed into a one-dimensional vector. The features proposed from each category are then recombine to obtain the input features, which are then fed into the Transformer module. Under the constraint of the initial model weights, the Transformer module uses the input features to perform multi-head attention calculation, outputs the risk level prediction result, and constructs a loss function based on the error between the prediction result and the true risk level. The model parameters are then updated using the backpropagation algorithm to obtain the updated model weights of the edge nodes after training in the r-th round; proceed to step 37. Step 37: The edge nodes will update the model weights. Upload to the cloud server; proceed to step 38; Step 38: The cloud uses the formula The model weights of each edge node are weighted and aggregated to generate the globally updated model weights. And redistribute; proceed to step 39; Step 39: Repeat steps 35-38 iteratively until the model converges. Then terminate the iteration and send the globally updated model weights generated in the last iteration to the cloud so that the cloud can use these updated weights to determine the final risk assessment model. Proceed to step 310; Step 310: The cloud platform inputs the data to be evaluated into the trained risk assessment model, according to the formula... y = F ( x , w ), to obtain the risk level assessment results. y .

[0095] It should be noted that the model weight update process will iterate for r rounds. That is, the process of iteratively updating the model weight is: prediction - error calculation - backpropagation - weight update.

[0096] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0097] Example 4 like Figure 5 As shown, the present invention also provides an electronic device, which may be a computer device, a microcontroller device, a smart mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, processor, and transceiver component are connected via a bus; the memory can be used to store executable programs, and an exemplary executable program may include instructions; the processor is used to execute the instructions stored in the memory. The memory can also be used to store data, which can be accessed and / or modified when instructions are executed.

[0098] The processor may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, and it is suitable for implementing one or more instructions. Specifically, it is suitable for loading and executing one or more instructions in the storage medium to realize the corresponding method flow or corresponding function, so as to realize the steps of the power information physical system security risk assessment method in the above embodiments.

[0099] Example 5 Based on the same inventive concept, this invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory). This readable storage medium is a memory device within an electronic device used to store programs and data. It is understood that the storage medium here can include both built-in storage media within the electronic device and extended storage media supported by the electronic device. The storage medium provides storage space, which stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more executable programs (including program code). It should be noted that the storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. Loading and executing one or more instructions stored in the storage medium by the processor can implement the steps of the power information physical system security risk assessment method described in the above embodiments.

[0100] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0101] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0102] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0103] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0104] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A cyber-physical system security risk assessment system, comprising: include: Edge nodes are used to preprocess the target risk element data of the collected power information physical system to obtain preprocessed target risk element data. In the cloud, the preprocessed target risk element data is used as input to a pre-established risk assessment model to predict the risk level of the power cyber-physical system. The risk assessment model is established using historical risk factor data from the power cyber-physical system.

2. The system according to claim 1, characterized in that, The edge nodes include: The processing unit is used to sequentially perform data cleaning, noise reduction and normalization on the target risk element data to obtain normalized target risk element data. The alignment unit is used to perform time alignment on the normalized target risk element data according to the timestamp of the normalized target risk element data to obtain the preprocessed target risk element data.

3. The system according to claim 1, characterized in that, The edge node further includes: a setup unit for establishing the risk assessment model; the setup unit includes: The data acquisition module is used to collect historical risk element data and historical risk levels of the power information physical system; The processing module is used to preprocess the historical risk element data to obtain preprocessed historical risk element data. The training module is used to train the CNN-Transformer deep learning model using the preprocessed historical risk element data and the historical risk level of the power information physical system, so as to obtain the risk assessment model.

4. The system according to claim 3, characterized in that, The processing module is specifically used for: The historical risk element data is sequentially cleaned, denoised, and normalized to obtain normalized historical risk element data. Based on the timestamps of the normalized historical risk element data, the normalized historical risk element data is time-aligned to obtain the preprocessed historical risk element data.

5. The system according to claim 3, characterized in that, The CNN-Transformer deep learning model includes: a convolutional neural network (CNN) submodule and a Transformer main module; The CNN submodule includes: convolutional layers, max pooling layers, and global average pooling layers.

6. The system according to claim 5, characterized in that, The training module is specifically used to perform the following steps: Step 1: Establish a connection with the cloud and receive the initial model weights distributed by the cloud, and use the initial model weights as model parameters; Step 2: Based on the preset classification rules, classify the preprocessed historical risk element data within the preset time window to obtain the classified historical risk element data; Step 3: Using the CNN submodule, perform feature extraction, dimensionality reduction, and transformation on the classified historical risk element data in sequence to obtain input features; Step 4: Input the initial model weights and the input features into the Transformer main module, so that the Transformer main module, under the constraint of the initial model weights, uses the input features to perform multi-head attention calculation, outputs the prediction result of the risk level, constructs a loss function based on the error between the prediction result and the historical risk level, and updates the model parameters through the backpropagation algorithm to obtain the updated model weights; Step 5: Upload the updated model weights to the cloud so that the cloud can perform weighted aggregation on the updated model weights, generate globally updated model weights, and redistribute them to the edge nodes; Step 6: After receiving the globally updated model weights, iterate through steps 3-5 until the globally updated model weights converge, then terminate the iteration, so that the cloud can use the globally updated model weights generated in the last iteration to determine the risk assessment model.

7. The system according to claim 6, characterized in that, Step 3 includes: Each of the classified historical risk element data is input into the convolutional layer to extract the multi-scale features of the classified historical risk element data; The max pooling layer is used to reduce the dimensionality of the multi-scale features of the classified historical risk element data. The multi-scale features after dimensionality reduction are converted into one-dimensional feature vectors by using a global average pooling layer, thus obtaining one-dimensional feature vectors of historical risk element data after each classification. The input features are obtained by concatenating the one-dimensional feature vectors of the various classified historical risk element data.

8. The system according to claim 6, characterized in that, The formula for calculating the globally updated model weights includes: In the above formula, , N The total number of nodes is calculated at the edge. For the first r +1 round of global update of model weights For the first i The size of the dataset on each edge computing node For the first i The edge node at the ... r The amount of local model weight updates in the round.

9. The system according to claim 6, characterized in that, The objective function of the risk assessment model is calculated as follows: In the above formula, These are the globally updated model weights generated in the last iteration. y Based on the risk level assessment results, F ( x , ω Let ) be the objective function. x Input data into the model.

10. The system according to claim 1, characterized in that, The risk factor data includes at least the following four types: power equipment status data, network security information, geographic and meteorological information, and user behavior data.

11. A method for security risk assessment of a power information physical system, characterized in that, include: The target risk element data of the collected power information physical system is preprocessed using edge nodes to obtain preprocessed target risk element data; Using the pre-processed target risk element data as input to a pre-established risk assessment model via the cloud, the risk level of the power information physical system is predicted. The risk assessment model is established using historical risk factor data from the power cyber-physical system.

12. The method according to claim 11, characterized in that, The method of preprocessing the target risk element data of the collected power information physical system using edge nodes to obtain preprocessed target risk element data includes: The target risk element data is sequentially cleaned, denoised, and normalized to obtain normalized target risk element data. Based on the timestamps of the normalized target risk element data, the normalized target risk element data is time-aligned to obtain the preprocessed target risk element data.

13. The method according to claim 11, characterized in that, It also includes: establishing the risk assessment model using edge nodes; the establishment of the risk assessment model using edge nodes includes: Collect historical risk factor data and historical risk levels of the power information physical system; The historical risk element data is preprocessed to obtain preprocessed historical risk element data; The risk assessment model is obtained by training a CNN-Transformer deep learning model using the preprocessed historical risk factor data and the historical risk level of the power information physical system.

14. The method according to claim 13, characterized in that, The preprocessing of the historical risk element data to obtain preprocessed historical risk element data includes: The historical risk element data is sequentially cleaned, denoised, and normalized to obtain normalized historical risk element data. Based on the timestamps of the normalized historical risk element data, the normalized historical risk element data is time-aligned to obtain the preprocessed historical risk element data.

15. The method according to claim 13, characterized in that, The CNN-Transformer deep learning model includes: a convolutional neural network (CNN) submodule and a Transformer main module; The CNN submodule includes: convolutional layers, max pooling layers, and global average pooling layers.

16. The method according to claim 15, characterized in that, The step of training the CNN-Transformer deep learning model using the preprocessed historical risk factor data includes: Step 1: Establish a connection with the cloud and receive the initial model weights distributed by the cloud, and use the initial model weights as model parameters; Step 2: Based on the preset classification rules, classify the preprocessed historical risk element data within the preset time window to obtain the classified historical risk element data; Step 3: Using the CNN submodule, perform feature extraction, dimensionality reduction, and transformation on the classified historical risk element data in sequence to obtain input features; Step 4: Input the initial model weights and the input features into the Transformer main module, so that the Transformer main module, under the constraint of the initial model weights, uses the input features to perform multi-head attention calculation, outputs the prediction result of the risk level, constructs a loss function based on the error between the prediction result and the historical risk level, and updates the model parameters through the backpropagation algorithm to obtain the updated model weights; Step 5: Upload the updated model weights to the cloud so that the cloud can perform weighted aggregation on the updated model weights, generate globally updated model weights, and redistribute them to the edge nodes; Step 6: After receiving the globally updated model weights, iterate through steps 3-5 until the globally updated model weights converge, then terminate the iteration, so that the cloud can use the globally updated model weights generated in the last iteration to determine the risk assessment model.

17. The method according to claim 16, characterized in that, Step 3 includes: Each of the classified historical risk element data is input into the convolutional layer to extract the multi-scale features of the classified historical risk element data; The max pooling layer is used to reduce the dimensionality of the multi-scale features of the classified historical risk element data. The multi-scale features after dimensionality reduction are converted into one-dimensional feature vectors by using a global average pooling layer, thus obtaining one-dimensional feature vectors of historical risk element data after each classification. The input features are obtained by concatenating the one-dimensional feature vectors of the various classified historical risk element data.

18. The method according to claim 16, characterized in that, The formula for calculating the globally updated model weights includes: In the above formula, , N The total number of nodes is calculated at the edge. For the first r +1 round of global update of model weights For the first i The size of the dataset on each edge computing node For the first i The edge node at the ... r The amount of local model weight updates in the round.

19. The method according to claim 16, characterized in that, The objective function of the risk assessment model is calculated as follows: In the above formula, These are the globally updated model weights generated in the last iteration. y Based on the risk level assessment results, F ( x , ω Let ) be the objective function. x Input data into the model.

20. The method according to claim 11, characterized in that, The risk factor data includes at least the following four types: power equipment status data, network security information, geographic and meteorological information, and user behavior data.

21. An electronic device, characterized in that, include: At least one processor and memory; The memory and processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, the method for assessing the security risks of a power cyber-physical system as described in any one of claims 11 to 20 is implemented.

22. A readable storage medium, characterized in that, It contains an execution program, which, when executed, implements the power information physical system security risk assessment method as described in any one of claims 11 to 20.

Images