A power grid terminal device malicious program rapid linkage disposal method based on threat-disposal direct mapping

Abstract

The application discloses a kind of based on threat-disposal direct reflection power grid terminal equipment malicious program rapid linkage disposal method, comprising: the behavior sequence of formation behavior sequence is formed by collecting the multi-dimensional behavior characteristics of power grid terminal equipment, and the behavior sequence is input into multi-label one-dimensional convolutional neural network, threat identification and disposal decision are completed simultaneously;According to the multi-label disposal action of output, generate disposal action set, and execute process disposal and network disposal according to priority scheduling, effect score verification is carried out after disposal and continues to monitor;From the malicious behavior of triggering multi-label disposal action, extract associated structured threat information, realize cross-device millisecond level sharing and collaborative disposal distribution using TCP long connection pool multiplexing, dictionary compression transmission and multi-path load balancing;Based on the adjacency relationship of equipment, construct threat propagation model, and generate differentiated prevention strategies according to risk level.The application combines threat identification and disposal into the same forward inference link, reduces response delay, and has global active defense capability.

Description

Technical Field

[0001] This invention belongs to the field of power grid information security technology, and particularly relates to security protection technology for power grid terminal equipment, specifically a method for rapid linkage and handling of malicious programs on power grid terminal equipment. Background Technology

[0002] Currently, power grid terminal equipment faces increasingly severe threats from ransomware, worms, and botnets, among other malicious programs. These viruses possess highly contagious and destructive attack methods. Since these devices directly participate in core operations such as dispatch control and status awareness, their security has a decisive impact on the stable operation of the system. However, existing malicious program handling processes generally adopt a serial processing mode of "threat identification → policy query → action matching → execution," relying on multi-step judgment and rule matching logic. Response times are typically in the seconds or even minutes, far from meeting the stringent requirements of power grid operations for millisecond-level real-time response and closed-loop handling. Regarding identification mechanisms, existing threat detection methods are mostly based on single-dimensional judgments such as static feature matching or behavioral sequence analysis, lacking the comprehensive identification capability for complex hybrid attacks. Some solutions that incorporate machine learning mostly use single-label classification models, unable to generate multi-dimensional handling strategy combinations while detecting threats, still requiring subsequent policy matching and rule reasoning steps, resulting in a lengthy and delayed overall handling process. In dealing with complex advanced persistent threats and rapidly propagating attacks, failure to complete threat identification and coordinated response within tens of milliseconds could lead to serious consequences such as data encryption failures, service interruptions, and control anomalies, ultimately causing instability in the entire power grid dispatching system. Therefore, there is an urgent need for a rapid response technology capable of simultaneously completing threat identification and multi-tag response decision output to improve the efficiency and closed-loop capability of the overall response chain and meet the practical deployment requirements of power grid industrial-grade terminal security. Summary of the Invention

[0003] Purpose of the invention: In order to solve the problems of high response delay in serial processes, low efficiency of strategy matching, and untimely cross-device linkage in the handling of malicious programs in power grid terminal equipment, this invention proposes a rapid linkage handling scheme based on multi-label neural network threat-handling direct mapping and lightweight linkage communication. It realizes the synchronous output of threat identification and handling strategies, the millisecond-level collaborative handling distribution, and the formation of hierarchical prevention and protection by combining propagation risk assessment, so as to improve the real-time security defense capability of power grid infrastructure.

[0004] Technical Solution: This invention provides a rapid linkage method for handling malicious programs on power grid terminal equipment based on threat-handling direct mapping. The method includes the following steps:

[0005] The system collects multi-dimensional behavioral characteristics of power grid terminal equipment and forms a behavioral sequence. The behavioral sequence is then input into a multi-label neural network, which simultaneously outputs the threat type and multi-label handling actions. A set of handling actions is generated based on the output multi-label handling actions, and the process handling and network handling are scheduled and executed according to priority. After handling, the effect is evaluated and verified, and the threat residue is continuously monitored according to statistical criteria. When an anomaly is detected, secondary handling is triggered.

[0006] The associated structured threat information is extracted from the malicious behavior that triggers the multi-tag handling action. The TCP long connection pool is used to reuse the inter-device connection. The structured threat information is compressed into a dictionary before transmission. In combination with the multi-path load balancing mechanism, traffic is allocated according to the network transmission quality to realize cross-device threat information sharing and collaborative handling.

[0007] A threat propagation model is constructed based on the adjacency relationship between devices to assess the probability of threat propagation and the scope of impact. Devices are classified according to risk level, and prevention strategies corresponding to the risk level are generated.

[0008] Furthermore, the multi-dimensional behavioral features include at least process call sequences, network connection patterns, and file access behaviors, with the behavioral sequences collected using a fixed-length sliding window.

[0009] Furthermore, the multi-label neural network simultaneously outputs threat type and multi-label response actions, including:

[0010] The input action sequence is subjected to multiple convolution operations with different kernel sizes in sequence. Each convolution operation is followed by an activation function to extract features at different time scales.

[0011]

[0012] X is the input sequence of actions. , , This represents a one-dimensional convolution operation with kernel sizes k1, k2, and k3. For activation function, The extracted feature vector;

[0013] Extracted feature vectors The input to the first fully connected layer, after a linear transformation and ReLU nonlinear activation, is mapped to intermediate hidden state. Based on the intermediate hidden state, it is output in parallel through two branches: the action decision branch, after the intermediate hidden state is transformed by the second fully connected layer, outputs the action probability vector through the Sigmoid activation function. Each element in the probability vector corresponds to a action label, and each label is independently judged to synchronously output multi-label actions:

[0014]

[0015] After the intermediate hidden state in the threat type identification branch is transformed by the third fully connected layer, the threat type probability vector is output through the Sigmoid activation function. :

[0016]

[0017] in, , , These are the weight matrices for the first, second, and third fully connected layers, respectively. , and These are the corresponding bias vectors.

[0018] Furthermore, a set of action actions is generated based on the output multi-label action actions, including: during the training phase, multi-label actions are generated based on threat type. Combined with threat type-action mapping matrix and runtime rules Generate training action labels: During the runtime phase, action labels that reach the action threshold are selected based on the action probability vector to form a set of actions. The action labels used for training are generated according to the following formula:

[0019]

[0020] in Let C be the indicator function, K be the total number of threat types, and K be the total number of response actions. The model is trained with the following joint loss, so that threat type discrimination and response action output are completed in the same forward inference:

[0021]

[0022] Here, BCE represents the binary cross-entropy loss function, used to measure the difference between the true values ​​of the multi-label data and the model's output probabilities. , , These are the weighting coefficients for each loss.

[0023] Furthermore, each processing action is scheduled for execution based on priority, including process processing and network processing, wherein the priority is determined by a pre-configured basic weight for the action. The following is obtained by combining the model output probability, current threat severity, and business impact penalty:

[0024]

[0025] in For the first The output probability of each action label Threat type severity, Penalty for actions that disrupt critical power grid services; when multiple actions are activated simultaneously, they are ranked by priority. Execution is scheduled from high to low.

[0026] Furthermore, the process handling includes: recursively traversing the parent-child relationship, shared memory region, and process group affiliation of processes, constructing a malicious process family topology graph, and implementing layered handling of associated processes within the topology graph, including process suspension, graceful termination, and immediate termination;

[0027] The network handling includes: identifying threatening connections based on a five-tuple consisting of source IP address, destination IP address, source port, destination port, and transmission protocol; verifying the connections using a power grid protocol whitelist; and blocking only connections not on the whitelist.

[0028] After the action is taken, the effectiveness of the action is evaluated and verified by a score, which is a weighted sum of threat clearance degree, business continuity and equipment stability.

[0029] Threat residues are continuously monitored according to statistical criteria. The continuous monitoring adopts the three-standard-deviation criterion to determine whether the deviation between the residual anomaly score of the current monitoring window after treatment and the historical normal behavior baseline exceeds a threshold.

[0030] Furthermore, the associated structured threat information is extracted from the malicious behavior that triggers the multi-label handling action, including: locating the process, network connection and file that triggers the multi-label handling action, extracting the process feature vector of the process, the network connection quintuple and the hash value of the file respectively, and combining the above information into structured threat information, wherein the quintuple includes the source IP address, the target IP address, the source port, the target port and the transmission protocol.

[0031] Furthermore, the multi-path load balancing mechanism distributes traffic according to network transmission quality, including:

[0032] For each path, a comprehensive weight is determined based on network latency, bandwidth capacity, and link reliability, where link reliability is obtained based on historical transmission success rate;

[0033] Differentiated traffic allocation is based on comprehensive weight, threat type, and urgency.

[0034] Furthermore, a threat propagation model is constructed based on the adjacency relationships between devices to assess the probability and scope of threat propagation. Devices are classified according to risk level, and prevention strategies corresponding to the risk level are generated, including:

[0035] A global topology is established with power grid terminal equipment as nodes and communication connections as edges. Weights are assigned to each connection to form a weighted adjacency matrix.

[0036] The probability of infection is predicted for each pair of infected devices and target devices with a connection relationship, calculated using the following formula:

[0037]

[0038] in, Threatening from infected equipment propagation to target device The probability of; Assign connection weights between devices; For target equipment The level of protection; For infection equipment The severity of the vulnerability; the protection level and vulnerability severity are obtained by real-time or periodic normalization of the power grid terminal equipment asset ledger, patch or vulnerability scans, host security agents, and current malicious behavior evidence.

[0039] For each target device, its infection probability, device importance, and device connectivity are weighted and summed to obtain the risk level of the device;

[0040] Based on the risk level, a combination of prevention strategies is generated for high-risk devices, including network isolation, process monitoring, file protection, and log enhancement; a combination of prevention strategies is generated for medium-risk devices, including enhanced monitoring sensitivity, strengthened access control, and backup activation; and a combination of prevention strategies is generated for low-risk devices, including enhanced alarms and status reporting.

[0041] A rapid response system for handling malicious programs on power grid terminal equipment based on threat-handling direct mapping includes:

[0042] The core module of the threat-handling direct mapping is used to collect multi-dimensional behavioral characteristics of power grid terminal equipment and form a behavioral sequence. The behavioral sequence is input into a multi-label neural network, which simultaneously outputs the threat type and multi-label handling actions. Based on the output multi-label handling actions, a set of handling actions is generated, and the process handling and network handling are scheduled for execution according to priority. After handling, the effect is evaluated and verified, and the threat residue is continuously monitored according to statistical criteria. When an anomaly is detected, secondary handling is triggered.

[0043] The rapid linkage communication module is used to extract associated structured threat information from malicious behaviors that trigger the multi-tag handling actions. It uses a TCP long connection pool to reuse inter-device connections, performs dictionary compression on the structured threat information before transmission, and combines a multi-path load balancing mechanism to allocate traffic according to network transmission quality, so as to realize cross-device threat information sharing and collaborative handling.

[0044] The preventative protection module is used to build a threat propagation model based on the adjacency relationship between devices, assess the probability and scope of threat propagation, classify devices according to risk level, and generate prevention strategies corresponding to the risk level.

[0045] The present invention also provides an electronic device, comprising: a processor; a memory; and a computer program, the computer program being stored in the memory and configured to be executed by the processor, wherein when the computer program is executed by the processor, it implements a method for rapid linkage and handling of malicious programs in power grid terminal equipment based on threat-handling direct mapping as described above.

[0046] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the above-described method for rapid linkage and handling of malicious programs on power grid terminal equipment based on threat-handling direct mapping.

[0047] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements a method for rapid linkage and handling of malicious programs on power grid terminal equipment based on threat-handling direct mapping, as described above.

[0048] Beneficial effects:

[0049] (1) This invention uses a multi-label neural network to achieve end-to-end direct mapping from terminal device behavioral features to composite action labels, which can output multiple action labels at once, replacing the traditional serial link of "threat identification-policy query-action execution", significantly shortening the response path and improving the handling efficiency. The multi-label neural network extracts key behavioral sequence features at multiple time scales based on a one-dimensional convolutional structure, ensuring both detection and handling accuracy and real-time performance, so that the model can still run efficiently and stably in resource-constrained terminal environments.

[0050] (2) This invention constructs a lightweight and fast linkage communication mechanism, which uses TCP long connection pool reuse and structured dictionary compression transmission, combined with simplified multi-path load balancing scheduling, to achieve millisecond-level sharing of threat intelligence and improve cross-device collaborative processing capabilities.

[0051] (3) This invention integrates threat propagation modeling based on adjacency relationship with risk classification strategy generation, which can dynamically deploy differentiated preventive protection measures for equipment with different risk levels, achieve predictive propagation blocking, and improve the overall security level of the power grid while minimizing the disturbance to key business. Attached Figure Description

[0052] Figure 1 This is a flowchart of a rapid linkage handling method for malicious programs on power grid terminal equipment based on threat-handling direct mapping, according to the present invention.

[0053] Figure 2 This is a structural block diagram of a rapid linkage response system for malicious programs on power grid terminal equipment based on threat-handling direct mapping, according to the present invention.

[0054] Figure 3 This is a flowchart of the multi-label neural network threat-handling direct mapping algorithm of the present invention. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below through specific embodiments and in conjunction with the accompanying drawings.

[0056] This invention constructs a rapid, coordinated response method and system for malicious programs on terminal devices based on a threat-response direct mapping mechanism. It introduces a multi-label neural network to achieve end-to-end direct mapping of malicious behavior characteristics to combined response strategies. Simultaneously, it designs a lightweight inter-device rapid communication mechanism and a threat propagation risk assessment system based on adjacency weights, enabling efficient collaboration in resource-constrained terminal environments. This solution breaks through the traditional serial response process, significantly improving the real-time performance, accuracy, and automation of malicious program handling. It is particularly suitable for critical infrastructure such as power systems, facing high-risk threat scenarios such as ransomware, worms, and botnets, achieving automated, refined, and millisecond-level response capabilities.

[0057] Reference Figure 1 and Figure 2 This embodiment describes, from the perspective of actual system deployment and operation, a method and system for rapid linkage handling of malicious programs on terminal devices based on a threat-handling direct mapping mechanism.

[0058] Step S1: Threat-Response Direct Mapping and Real-Time Response Stage Based on Multi-Label Neural Network

[0059] Traditional threat handling processes employ a multi-step, sequential approach: threat identification → policy query → action matching → execution. Overall response times are typically in the seconds or even minutes range. Furthermore, when facing high-risk threats such as ransomware and worms, delays can lead to data loss or threat propagation. Power grid environments require millisecond-level real-time responses, and different threats necessitate combinations of actions. Traditional single-label classification methods cannot directly output combined strategies. Therefore, this invention designs a multi-label neural network to simultaneously complete threat identification and response decisions, directly outputting combined response solutions.

[0060] Reference Figure 3Step S1 proposes a threat-response direct mapping algorithm based on a multi-label neural network, constructing a threat identification and response strategy direct mapping mechanism based on a multi-label neural network to achieve end-to-end direct mapping from threat features to specific response actions. Unlike traditional single-label classification methods, this invention adopts a multi-label output architecture, which can simultaneously identify threat types and directly output corresponding response strategy combinations, avoiding the time overhead of secondary queries and strategy matching, and achieving seamless connection from threat discovery to response execution.

[0061] The algorithm receives multi-dimensional behavioral features from power grid terminal devices, including key indicators such as process call sequences, network connection patterns, and file access behavior. These multi-dimensional features are aligned, cleaned, and normalized, converting the raw behavioral data into standard input tensors that are time-synchronized, formatted uniformly, and have consistent numerical scales. To accommodate the computational resource limitations of the terminal devices, a feature window of length 128 is used, and the feature dimension is optimized to 64 dimensions, ensuring real-time processing capability while maintaining threat identification accuracy. Threat feature extraction employs a one-dimensional convolutional neural network architecture, extracting temporal feature patterns through three layers of convolutional operations. The convolutional kernel design is optimized for the power grid environment: the first layer focuses on short-term behavioral patterns (kernel size 3), the second layer captures medium-term threat sequences (kernel size 5), and the third layer identifies long-term attack chain features (kernel size 7). The network structure is represented as follows:

[0062]

[0063]

[0064] Where X is the input sequence of actions, This represents a one-dimensional convolution operation with a kernel size of k. The activation function (modified linear unit) is used to introduce nonlinearity, enabling the network to learn more complex mapping relationships. It is a multi-dimensional probability vector of actions, which directly guides the selection of subsequent execution strategies. This is the weight matrix of the first fully connected layer, used to weight the extracted feature vectors. Perform a linear transformation. This is the bias vector for the first fully connected layer. The weight matrix of the second fully connected layer further maps the features after ReLU activation to the output dimension (i.e., the number of action labels). This is the bias vector for the second fully connected layer.

[0065] To explicitly obtain the threat type probability, the network sets a threat type auxiliary output head after the shared feature layer (linear transformation of the first fully connected layer and ReLU nonlinear activation), the formula of which is as follows:

[0066]

[0067] in This is a probability vector for threat types. and The output header contains the weight matrix and bias vector for threat type; threat identification is performed by... Completed, the handling strategy is... Completed. By independently determining the labels of each action using the Sigmoid activation function, end-to-end synchronous output of threat identification and handling strategies is achieved, thereby avoiding response delays caused by intermediate processes such as strategy querying.

[0068] This invention establishes a direct mapping relationship between threat types and handling strategies. Through multi-label output, threat identification and handling decisions are completed simultaneously. Specifically, the threat type is not obtained through a secondary lookup of the strategy table during the handling execution phase, but is synchronously provided by the threat type output header after the shared feature layer. The handling action output header learns combined actions based on the threat type-action mapping relationship formed during the training phase. During the handling phase, only one forward inference is needed to simultaneously obtain the threat type probability and the handling action probability. For example, for botnet threats, the algorithm simultaneously outputs the labels "process terminated" and "network disconnected," executing a combined handling action of ending the malicious process and cutting off the network connection; for worm virus threats, it outputs the labels "process paused" and "port closed," achieving a coordinated handling action of pausing suspicious processes and closing propagation ports; for ransomware threats, it outputs the labels "immediate termination" and "system isolation," executing an emergency handling action of forcibly terminating the process and implementing device network isolation.

[0069] Specifically, during the training phase, the behaviors collected by power grid terminal equipment, such as process calls, network connections, and file accesses, are first divided into behavior sequence samples using a fixed-length sliding window. For each sample, a multi-label threat type is generated by combining sandbox analysis, malicious sample family tags, IOC hit results, manual review results, and power grid business whitelist filtering results. Then, based on the threat type-action mapping matrix... and runtime rules Generate action tags:

[0070]

[0071] The model is trained with the following joint loss, which enables threat type identification and response action output to be completed in the same forward inference.

[0072]

[0073] Here, BCE stands for Binary Cross-Entropy Loss Function, which measures the difference between the true values ​​of multiple labels and the output probabilities of the model. , , These are the weighting coefficients for each loss.

[0074] Based on the output of a multi-label neural network, this invention implements a hierarchical and parallelized response execution mechanism. The core innovation of this mechanism lies in dynamically combining response strategies according to multi-label activation patterns to achieve precise matching between threat types and response actions. Furthermore, it determines the priority sequence of response actions through label weight analysis, ensuring that key response measures are executed in the shortest possible time and effectively avoiding conflicts between response actions. The label weights are scheduling weights set for the labels of response actions, rather than neural network parameters; they include pre-configured basic action weights. The model output probability, current threat severity, and business impact penalty are combined to dynamically generate a priority score:

[0075]

[0076] in For the first The output probability of each action label Threat type severity, This action incurs a penalty for disrupting critical power grid services; when multiple actions are activated simultaneously, the penalty is applied according to... Execution is scheduled from high to low.

[0077] This invention establishes a complete label-action mapping table, converting the probability vectors output by the neural network into specific execution instructions. When multiple labels are activated simultaneously, a priority scheduling algorithm based on threat severity and business impact penalties is used to prioritize the execution of actions corresponding to higher risk levels. For example, when the model simultaneously detects ransomware characteristics and network propagation behavior, the "Immediate Termination" label has a higher execution priority than the "Port Closure" label, ensuring that the most serious threat receives the fastest response. When the "Process Termination," "Process Suspension," or "Immediate Termination" label is activated in the multi-label output, a process-level handling execution flow is initiated. This flow first determines the complete range of threat processes using a lightweight process family identification algorithm, avoiding the omission of child processes or related processes that could lead to threat remnants. The identification of malicious process families employs a recursive traversal mechanism, constructing a complete threat process topology by analyzing parent-child relationships between processes, shared memory regions, and process group affiliations. Differentiated process handling strategies are implemented based on the threat type and severity.

[0078] The handling actions include at least one or more of the following: process suspension, graceful termination, immediate termination, network disconnection, port closure, and system isolation. Multi-label output indicates that each action label is independently determined. The actual set of handling actions can contain only one action or multiple actions. Time action Selected for the action set. The default basic priority, from highest to lowest, is: immediate termination, system isolation, network disconnection, port closure, graceful termination, and process suspension; if it hits the power grid critical business whitelist or there is a mutual exclusion relationship between actions, then it will be processed according to... Reorder and perform conflict resolution.

[0079] For high-risk threats such as ransomware, activating the "immediate termination" mode skips the usual graceful shutdown process and directly sends a SIGKILL signal or an equivalent forced termination command to the target process, ensuring that malicious behavior is stopped in the shortest possible time. While this aggressive approach may result in data loss, it effectively prevents the further spread of ransomware attacks.

[0080] For threats with propagation characteristics, such as worms, a "process suspension" strategy is employed. This involves suspending the execution of suspicious processes using the SIGSTOP signal or an equivalent suspension command, while preserving the process state for subsequent analysis. While suspended processes cannot continue executing malicious code, their memory images and file descriptors are retained, providing valuable on-site data for threat tracing and forensic analysis.

[0081] For threats with latent characteristics, such as botnets and trojans, a "graceful termination" strategy is adopted. Standard termination signals (such as SIGTERM or equivalent termination commands) are sent first, requesting the target process to exit voluntarily, with a short waiting window set. During this period, the process's exit status and cleanup behavior are continuously monitored, and any abnormal operations or suspected anti-forensic behaviors are recorded. If the process fails to terminate itself within a reasonable time, it will automatically switch to forced termination mode to ensure the threat is eliminated promptly.

[0082] To ensure the continuity of power grid operations, critical processes are identified and protected before execution of termination operations. By maintaining a whitelist of core power grid business processes, it is possible to avoid mistakenly terminating critical components such as the dispatching system and protection control system. When a threat process has a dependency on a critical business process, a state snapshot and backup mechanism for the business process is first activated, followed by isolation operations to ensure rapid business recovery.

[0083] When the "Network Disconnected," "Port Closed," or "System Isolation" labels are activated, a network-level handling process is initiated. This process is deeply optimized for the specific characteristics of the power grid communication environment, ensuring the normal operation of power grid dispatching and protection communications while blocking threat communications. The execution of the network handling strategy is based on a precise connection 5-tuple identification mechanism, which constructs a complete profile of the threat connection by analyzing information such as source IP address, destination IP address, source port, destination port, and transport protocol.

[0084] This invention maintains a protocol whitelist mechanism specifically optimized for the power grid environment. This whitelist includes standard ports, extended ports, and necessary Modbus RTU gateway mapping rule configurations for mainstream power grid communication protocols such as ModbusTCP, DNP3, IEC 61850, and IEC 61970. When a threatening connection is detected, it first verifies whether the connection belongs to critical power grid business communication; only after confirming it as a malicious connection will a blocking operation be performed.

[0085] Different network response intensities are applied to different threat types. When a worm virus is detected, the focus is on shutting down commonly used virus propagation ports, such as SMB-related ports like 445, 135, and 139, while maintaining normal communication on power grid service ports. When a botnet is detected, the primary focus is on blocking connections to external command and control servers, cutting off the channels for receiving malicious commands. For ransomware, a network isolation strategy is implemented, temporarily disconnecting devices from non-whitelisted external networks to prevent the leakage of encryption keys and the reception of attack commands.

[0086] Network isolation is implemented in a layered and progressive manner. First, connection blocking is implemented at the application layer, achieving precise control by modifying local routing tables and firewall rules. If application-layer isolation fails to effectively prevent threat propagation, network interface-level isolation is initiated, temporarily disabling the relevant network interfaces. In extreme cases, physical isolation mechanisms can be triggered, provided security policies permit and critical business continuity is not affected, by severing network connections via hardware switches.

[0087] To ensure the effectiveness of threat handling, this invention employs a simplified multi-indicator verification mechanism, evaluating the handling effect through three dimensions: system performance monitoring, network status checks, and file integrity verification. The effectiveness verification uses a weighted scoring model, comprehensively considering three core indicators: handling integrity, system stability, and business continuity. The comprehensive score calculation formula is as follows:

[0088]

[0089] in, To score the overall effectiveness of the treatment; Indicates the degree of threat elimination. Indicates business continuity. Indicates equipment stability. , , These are weighting coefficients used to balance the importance of the three core indicators. Considering the extremely high requirements of the power grid environment for business continuity and equipment stability, these weighting coefficients can be selected with reference values, for example: , , Threat clearance score is based on the handling status at three levels: process, network, and file. "Existing threats" refers to the initial threat evidence set formed when step S1 triggers the handling process. This set consists of malicious process families, malicious network connections, abnormal file hashes, persistent entries, and associated IOCs output by the triggering model; a residual evidence set is obtained by rescanning after processing. Threat clearance is calculated using the following formula:

[0090]

[0091] when This scoring process is not triggered at certain times. Business continuity scoring focuses on key business statuses such as whether power grid communication is normal and whether equipment is online; equipment stability scoring is measured by indicators such as CPU utilization, memory usage, and response time. The continuous monitoring mechanism employs a lightweight anomaly detection algorithm, identifying threat remnants based on statistical methods. A baseline of normal behavior is established, and anomalies are detected using the 3σ criterion.

[0092]

[0093] in This represents the historical average of normal behavior. The standard deviation is denoted as . This is the residual anomaly score in the current monitoring window after processing; it can be obtained by normalizing the number of abnormal processes, the number of abnormal connections, and the proportion of abnormal files, and its calculation formula is:

[0094]

[0095] in This is the normalized value for the number of residual suspicious processes. This is the normalized value for the number of residual abnormal connections. This represents the percentage of abnormal file rewrites. These are the weighting coefficients; and These represent the mean and standard deviation of the residual anomaly score within the historical normal behavior window, respectively. When an anomaly is detected, a secondary processing procedure is triggered. Through this simplified design, the module significantly reduces computational complexity and resource consumption while maintaining core functionality, making it more suitable for deployment on power grid terminal equipment and improving the practical feasibility of the solution.

[0096] Step S2, Lightweight and Fast Linkage Communication Stage

[0097] The necessity of coordinated handling of malicious programs on power grid terminal equipment stems from two key issues: First, devices in the power grid industrial control network are highly interconnected via protocols such as Modbus and DNP3. Modern APT attacks and worm viruses have strong lateral movement capabilities, and the threat can spread rapidly after a single device is infected. Traditional single-device independent protection has limited effectiveness against point-to-point breaches and area-wide spread attack patterns. Second, there are complex business dependencies among power grid devices. The lack of global coordination in threat handling decisions for a single device may lead to cascading failures such as protection malfunctions and communication interruptions. Therefore, establishing a rapid coordinated communication mechanism to achieve threat information sharing and collaborative handling is an essential requirement for responding to modern network threats and ensuring power grid security.

[0098] In step S2, this invention establishes a lightweight communication framework for power grid terminal equipment, employing TCP long connection pooling, cache reuse, and dictionary compression to achieve rapid transmission of threat information. Considering the stability of the power grid communication environment and the resource constraints of terminal equipment, targeted optimizations are made based on the mature TCP protocol. Long connection pooling technology is used to achieve efficient reuse of communication connections between devices, thereby avoiding the overhead of frequent connection establishment and termination. The connection pool size is dynamically adjusted according to the device communication frequency, calculated using the following formula:

[0099]

[0100] in The coefficient represents the total number of devices within the current linkage range. A value of 0.3 is acceptable. This value is determined based on statistical analysis of the communication patterns of power grid equipment, indicating that on average, each device needs to maintain an active connection with 30% of other devices. The maximum number of concurrent connections supported by the device, typically between 200 and 500.

[0101] To further optimize transmission efficiency, this invention implements a lightweight data compression mechanism targeting threat information characteristics. Threat information mainly includes structured data such as process feature vectors, network connection quintuples, and file hash values, exhibiting obvious repetitive patterns and sparse characteristics. The aforementioned structured threat information originates from the same malicious behavior window that triggers the multi-tag handling action and the local data collection results before and after the action: the process monitoring module extracts the triggering process family and its call sequence to generate process feature vectors; malicious connection quintuples are extracted from the connection table, firewall logs, or traffic mirroring; the file monitoring module calculates the hash value of files that are read / written, encrypted, stored, or persisted; and the device identifier, timestamp, threat type probability, and activated action tag are encapsulated together into a linked message. The quintuple includes the source IP address, destination IP address, source port, destination port, and transmission protocol. This invention employs a dictionary compression algorithm based on Huffman coding, establishing a dedicated compression dictionary for information such as process names, IP address ranges, and port numbers commonly found in the power grid environment.

[0102]

[0103] in, Indicates compression ratio; The original volume of the uncompressed threat information; This represents the volume of threat information after processing with a dictionary compression algorithm based on Huffman coding. In typical structured threat information samples, this compression mechanism achieves an average compression rate of 60%, significantly reducing network transmission overhead. Combining long-connection multiplexing and data compression optimization measures, the end-to-end transmission time of threat information is controlled to an extremely short time, providing a reliable communication foundation for rapid coordinated response. Furthermore, a connection health monitoring and automatic recovery mechanism is established, ensuring the continuous availability of coordinated communication through periodic heartbeat packets.

[0104] Considering the multi-path characteristics of power grid communication networks and the reliability requirements of interconnected communication, this invention employs a simplified multi-path load balancing mechanism to ensure high availability of threat information transmission. This mechanism, through a lightweight path evaluation algorithm and intelligent traffic allocation strategy, provides redundancy backup capabilities while ensuring transmission efficiency, effectively addressing network failures and link congestion. Path evaluation uses a multi-dimensional comprehensive scoring model, considering three core indicators: network latency, bandwidth capacity, and link reliability. Real-time status parameters of each path are obtained through periodic probing, and a comprehensive weight is calculated.

[0105]

[0106] in, It is the first The normalized composite weight of each path, It is the index of the target path. It is an index of all available paths, used for summation and normalization in the denominator (from...). arrive ); This is the bandwidth weighting coefficient, with a reference value of 0.3. This is the delay weighting coefficient, with a reference value of 0.4. This is the reliability weighting coefficient, with a reference value of 0.3; It is the first Real-time bandwidth capacity of each path, It is the first Real-time latency of the path, It is the first Link reliability metrics for each path (calculated based on historical transmission success rates). Latency factor uses... Normalization is performed to ensure that low-latency paths receive higher weights.

[0107] Traffic allocation strategies are differentiated based on threat type and urgency. For high-risk threats such as ransomware, priority is given to the path that meets the minimum reliability threshold and has the lowest latency for transmission, ensuring that threat warning information reaches the target device in the shortest possible time, even at the cost of some transmission reliability, to guarantee response speed.

[0108] For medium- to high-risk threats such as worms and viruses with propagation characteristics, a dual-path concurrent transmission strategy is adopted. While transmitting on the main path, redundant data is sent through the backup path to improve the transmission success rate. The selection of the main and backup paths is based on weight ranking, and the two paths with the highest weight are selected. For latent threats such as botnets and Trojans, a multi-path load balancing strategy is used to distribute data traffic according to the weight ratio of each path. This balances the network load while ensuring successful transmission and avoids overloading of a single path from affecting normal business communication.

[0109] This invention constructs a dynamic path status monitoring mechanism to perceive the transmission quality of each communication path in real time. When a significant drop in the transmission success rate of a path is detected, its weight is automatically reduced, and a path quality recovery detection process is initiated. During the recovery process, the path status is evaluated by sending test data packets. If multiple consecutive tests indicate that performance has recovered to a high level, its weight configuration is gradually restored. The load balancing strategy adopts a weighted round-robin algorithm, avoiding the additional computational burden caused by complex mechanisms such as consistent hashing. A path selection queue is maintained, and the frequency of occurrence of each path in the queue is set according to its weight ratio. Relatively even distribution of traffic is achieved through iterative traversal. After the queue round-robin is completed, the weights are dynamically adjusted and the queue is updated according to the latest network status to ensure that the load distribution strategy has good adaptive capabilities. By optimizing the organic combination of the TCP communication mechanism and the multi-path load balancing mechanism, this invention constructs an efficient and reliable linkage communication platform, providing a solid technical foundation for threat information sharing and collaborative handling among power grid terminal equipment.

[0110] Step S3, Lightweight Preventive Protection Phase

[0111] This phase aims to achieve proactive global defense by constructing a global topology map of power grid terminal equipment to comprehensively assess threat propagation risks, thereby providing predictive capabilities for threat spread and a global protection perspective. A periodically updatable network topology model is established, using power grid terminal equipment as nodes and communication connections as edges. A weighted adjacency matrix records the connection relationships and weight allocations between devices. The weight allocation comprehensively considers the hierarchical characteristics of power grid equipment, such as communication frequency, connection reliability, and equipment importance (e.g., critical equipment such as dispatch gateways, station control layer hosts, and protection and monitoring terminals are assigned higher weights), ensuring that threat propagation prediction focuses on critical paths that have a significant impact on power grid operation. First, a simplified probabilistic propagation model is used to calculate the propagation probability and impact range of potential threats based on the weighted adjacency matrix:

[0112]

[0113] in, Threat from equipment Transmitted to device The probability of; For equipment and Connection weights between them; For target equipment Protection level factor; For infection equipment The vulnerability severity factor. Neither the protection level factor nor the vulnerability severity factor is a fixed empirical constant, but rather obtained through real-time or periodic normalization of power grid terminal equipment asset ledgers, patch or vulnerability scans, host security agents, and current malicious behavior evidence; specifically, the formula for calculating the protection level of the target device is:

[0114]

[0115] in Indicates patch completeness. Indicates the coverage of the application whitelist. Indicates the effective status of the host security agent. Indicates the security partition or access control strength; to The corresponding weights are: The formula for calculating the severity of vulnerabilities in infected devices is:

[0116]

[0117] in This is the normalized value for the vulnerability score. The percentage of unpatched vulnerabilities. To expose the normalized value of the number of services, The severity of the malicious program identified in step S1, to The corresponding weights are given for each item. All indicators are normalized to... The weights are configured by historical handling data of the power grid terminal or expert rules and can be periodically calibrated. This model differs from general infectious disease transmission models. Its propagation edges only take the actual communication links between the power grid dispatch layer, substation layer, and field equipment layer. The propagation source strength comes from the malicious program behavior and vulnerability exposure status confirmed in step S1. The target suppression term comes from the local protection and partition isolation status of the power grid terminal. Therefore, the output is the edge-by-edge propagation probability of malicious programs moving laterally towards the power grid terminal.

[0118] When the target equipment has strong protection capabilities or the threat level of the infection source is low, the probability of transmission will decrease accordingly. The scope of threat impact can be determined by analyzing the reachability within a preset number of hops (e.g., a three-hop path covering the power grid dispatch layer, substation layer, and field equipment layer). This simplified model avoids the computational overhead of complex graph algorithms and provides a scientific basis for the formulation of prevention strategies.

[0119] Based on the above risk assessment results, a rule-based decision-making mechanism is adopted to replace the complex reinforcement learning scheme, ensuring the interpretability and execution efficiency of strategy generation, and generating differentiated, tiered prevention strategies. First, the device risk level is calculated by comprehensively assessing the propagation probability, device importance, and connectivity.

[0120]

[0121] in, The overall risk score for the equipment; The predicted infection probability for this device; This underscores the importance of the equipment; This refers to the connectivity of the device.

[0122] Based on the calculation results, the devices were classified into three risk levels: high, medium, and low. High-risk devices face a greater threat of infection and require comprehensive protective measures (such as network isolation, process monitoring, file protection, and log enhancement). Medium-risk devices require moderate monitoring enhancement measures (such as improving monitoring sensitivity, strengthening access control, and activating backup mechanisms). Low-risk devices only require basic early warning mechanisms (such as enhanced alarms and status reporting functions) to avoid excessive resource consumption. The intensity of all prevention strategies is dynamically adjusted according to device load and business importance, and in principle, it should not exceed 30% of the device's available resources, thereby seeking a balance between security protection and business operation, achieving early threat blocking and improving the overall network security level.

[0123] Based on the same technical concept, the present invention also provides a rapid linkage and handling system for malicious programs on power grid terminal equipment based on threat-handling direct mapping, comprising:

[0124] The core module of the threat-handling direct mapping is used to collect multi-dimensional behavioral characteristics of power grid terminal equipment and form a behavioral sequence. The behavioral sequence is input into a multi-label neural network, which simultaneously outputs the threat type and multi-label handling actions. Based on the output multi-label handling actions, a set of handling actions is generated, and the process handling and network handling are scheduled for execution according to priority. After handling, the effect is evaluated and verified, and the threat residue is continuously monitored according to statistical criteria. When an anomaly is detected, secondary handling is triggered.

[0125] The rapid linkage communication module is used to extract associated structured threat information from malicious behaviors that trigger the multi-tag handling actions. It uses a TCP long connection pool to reuse inter-device connections, performs dictionary compression on the structured threat information before transmission, and combines a multi-path load balancing mechanism to allocate traffic according to network transmission quality, so as to realize cross-device threat information sharing and collaborative handling.

[0126] The preventative protection module is used to build a threat propagation model based on the adjacency relationship between devices, assess the probability and scope of threat propagation, classify devices according to risk level, and generate prevention strategies corresponding to the risk level.

[0127] The present invention also provides an electronic device, comprising: a processor; a memory; and a computer program, the computer program being stored in the memory and configured to be executed by the processor, wherein when the computer program is executed by the processor, it implements the method for rapid linkage and handling of malicious programs on power grid terminal devices based on threat-handling direct mapping as described above.

[0128] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the above-described method for rapid linkage and handling of malicious programs on power grid terminal equipment based on threat-disposal direct mapping.

[0129] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the aforementioned method for rapid linkage and handling of malicious programs on power grid terminal equipment based on threat-handling direct mapping.

Claims

1. A rapid linkage method for handling malicious programs on power grid terminal equipment based on threat-handling direct mapping, characterized in that, Includes the following steps: The system collects multi-dimensional behavioral characteristics of power grid terminal equipment and forms a behavioral sequence. The behavioral sequence is then input into a multi-label neural network, which simultaneously outputs the threat type and multi-label handling actions. A set of handling actions is generated based on the output multi-label handling actions, and the process handling and network handling are scheduled and executed according to priority. After handling, the effect is evaluated and verified, and the threat residue is continuously monitored according to statistical criteria. When an anomaly is detected, secondary handling is triggered. The associated structured threat information is extracted from the malicious behavior that triggers the multi-tag handling action. The TCP long connection pool is used to reuse the inter-device connection. The structured threat information is compressed into a dictionary before transmission. In combination with the multi-path load balancing mechanism, traffic is allocated according to the network transmission quality to realize cross-device threat information sharing and collaborative handling. A threat propagation model is constructed based on the adjacency relationship between devices to assess the probability of threat propagation and the scope of impact. Devices are classified according to risk level, and prevention strategies corresponding to the risk level are generated.

2. The method according to claim 1, characterized in that, The multi-dimensional behavioral features include at least process call sequences, network connection patterns, and file access behaviors, and the behavioral sequences are collected using a fixed-length sliding window.

3. The method according to claim 1, characterized in that, Multi-label neural networks simultaneously output threat types and multi-label response actions, including: The input action sequence is subjected to multiple convolution operations with different kernel sizes in sequence. Each convolution operation is followed by an activation function to extract features at different time scales. X is the input sequence of actions. , , This represents a one-dimensional convolution operation with kernel sizes k1, k2, and k3. For activation function, The extracted feature vector; Extracted feature vectors The input to the first fully connected layer, after a linear transformation and ReLU nonlinear activation, is mapped to intermediate hidden state. Based on the intermediate hidden state, it is output in parallel through two branches: the action decision branch, after the intermediate hidden state is transformed by the second fully connected layer, outputs the action probability vector through the Sigmoid activation function. Each element in the probability vector corresponds to a action label, and each label is independently judged to synchronously output multi-label actions: After the intermediate hidden state in the threat type identification branch is transformed by the third fully connected layer, the threat type probability vector is output through the Sigmoid activation function. : in, , , These are the weight matrices for the first, second, and third fully connected layers, respectively. , and These are the corresponding bias vectors.

4. The method according to claim 3, characterized in that, Generate a set of action actions based on the output multi-label action actions, including: during the training phase, based on threat type multi-label... Combined with threat type-action mapping matrix and runtime rules Generate training action labels: During the runtime phase, action labels that reach the action threshold are selected based on the action probability vector to form a set of actions. The action labels used for training are generated according to the following formula: in Let C be the indicator function, K be the total number of threat types, and K be the total number of response actions. The model is trained with the following joint loss, so that threat type discrimination and response action output are completed in the same forward inference: Here, BCE represents the binary cross-entropy loss function, used to measure the difference between the true values ​​of the multi-label data and the model's output probabilities. , , These are the weighting coefficients for each loss.

5. The method according to claim 1, characterized in that, Each processing action is scheduled for execution based on priority, including process processing and network processing. The priority is determined by a pre-configured basic weight for each action. The following is obtained by combining the model output probability, current threat severity, and business impact penalty: in For the first The output probability of each action label Threat type severity, Penalty for actions that disrupt critical power grid services; when multiple actions are activated simultaneously, they are ranked by priority. Execution is scheduled from high to low.

6. The method according to claim 1, characterized in that, The process handling includes: recursively traversing the parent-child relationship, shared memory region, and process group affiliation of processes, constructing a malicious process family topology graph, and implementing layered handling of related processes within the topology graph, including process suspension, graceful termination, and immediate termination. The network handling includes: identifying threatening connections based on a five-tuple consisting of source IP address, destination IP address, source port, destination port, and transmission protocol; verifying the connections using a power grid protocol whitelist; and blocking only connections not on the whitelist. After the action is taken, the effectiveness of the action is evaluated and verified by a score, which is a weighted sum of threat clearance degree, business continuity and equipment stability. Threat residues are continuously monitored according to statistical criteria. The continuous monitoring adopts the three-standard-deviation criterion to determine whether the deviation between the residual anomaly score of the current monitoring window after treatment and the historical normal behavior baseline exceeds a threshold.

7. The method according to claim 1, characterized in that, Extracting associated structured threat information from malicious behaviors that trigger the multi-label handling action includes: locating the process, network connection, and file that trigger the multi-label handling action; extracting the process feature vector of the process, the network connection quintuple, and the hash value of the file; and combining the above information into structured threat information, wherein the quintuple includes the source IP address, the target IP address, the source port, the target port, and the transmission protocol.

8. The method according to claim 1, characterized in that, Multipath load balancing mechanisms distribute traffic based on network transmission quality, including: For each path, a comprehensive weight is determined based on network latency, bandwidth capacity, and link reliability, where link reliability is obtained based on historical transmission success rate; Differentiated traffic allocation is based on comprehensive weight, threat type, and urgency.

9. The method according to claim 1, characterized in that, A threat propagation model is constructed based on the adjacency relationships between devices to assess the probability and scope of threat propagation. Devices are classified according to risk level, and corresponding prevention strategies are generated, including: A global topology is established with power grid terminal equipment as nodes and communication connections as edges. Weights are assigned to each connection to form a weighted adjacency matrix. The probability of infection is predicted for each pair of infected devices and target devices with a connection relationship, calculated using the following formula: in, Threatening from infected equipment propagation to target device The probability of; Assign connection weights between devices; For target equipment The level of protection; For infection equipment The severity of the vulnerability; the protection level and vulnerability severity are obtained by real-time or periodic normalization of the power grid terminal equipment asset ledger, patch or vulnerability scans, host security agents, and evidence of current malicious behavior. For each target device, its infection probability, device importance, and device connectivity are weighted and summed to obtain the risk level of the device; Based on the risk level, a combination of prevention strategies is generated for high-risk devices, including network isolation, process monitoring, file protection, and log enhancement; a combination of prevention strategies is generated for medium-risk devices, including enhanced monitoring sensitivity, strengthened access control, and backup activation; and a combination of prevention strategies is generated for low-risk devices, including enhanced alarms and status reporting.

10. A rapid linkage and handling system for malicious programs on power grid terminal equipment based on threat-handling direct mapping, characterized in that, include: The core module of the threat-handling direct mapping is used to collect multi-dimensional behavioral characteristics of power grid terminal equipment and form a behavioral sequence. The behavioral sequence is input into a multi-label neural network, which simultaneously outputs the threat type and multi-label handling actions. Based on the output multi-label handling actions, a set of handling actions is generated, and the process handling and network handling are scheduled for execution according to priority. After handling, the effect is evaluated and verified, and the threat residue is continuously monitored according to statistical criteria. When an anomaly is detected, secondary handling is triggered. The rapid linkage communication module is used to extract associated structured threat information from malicious behaviors that trigger the multi-tag handling actions. It uses a TCP long connection pool to reuse inter-device connections, performs dictionary compression on the structured threat information before transmission, and combines a multi-path load balancing mechanism to allocate traffic according to network transmission quality, so as to realize cross-device threat information sharing and collaborative handling. The preventative protection module is used to build a threat propagation model based on the adjacency relationship between devices, assess the probability and scope of threat propagation, classify devices according to risk level, and generate prevention strategies corresponding to the risk level.

11. An electronic device, characterized in that, include: processor; Memory; And a computer program, which is stored in the memory and configured to be executed by the processor, wherein when the computer program is executed by the processor, it implements a method for rapid linkage and handling of malicious programs in power grid terminal equipment based on threat-handling direct mapping as described in any one of claims 1-9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements a rapid linkage method for handling malicious programs on power grid terminal equipment based on threat-handling direct mapping as described in any one of claims 1-9.

Images