Power generation side industrial control system network security risk assessment and vulnerability repair linkage method

Abstract

The application discloses a power generation side industrial control system network security risk assessment and vulnerability repair linkage method, comprising: based on the vulnerability information of assets in the power generation side industrial control system and the business context information of the assets, a business risk value for representing the actual threat degree of the vulnerability to power generation business is calculated; according to the business risk value and the real-time operation condition and plan information of the power plant production management system, a low business risk period for executing repair operation is obtained as a repair time window, and a corresponding repair plan is matched for the assets; and the repair plan is executed in the repair time window. Through the dynamic linkage of the risk assessment based on the business context, the repair time window decision combining the real-time operation condition and the repair plan execution, the problem that the network security risk is disconnected with the actual production business in the prior art and the repair operation may introduce secondary risk is solved, and the security vulnerability is accurately and efficiently disposed under the premise of guaranteeing the continuity of power generation.

Description

Technical Field

[0001] This invention relates to the field of industrial control system network security technology, and in particular to a method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system. Background Technology

[0002] As a core component of power generation, the cybersecurity of the power generation-side industrial control system directly impacts the stable operation of the power grid and the reliability of power supply. With the deep integration of industrial internet technology, the network interconnectivity of power generation systems is continuously increasing. While improving production efficiency, this also exposes them to increasingly severe cyberattack threats. Security vulnerabilities in assets such as application servers, operator stations, and controllers within the system can be maliciously exploited, leading to serious consequences such as unplanned unit shutdowns, production data tampering, and even damage to critical equipment.

[0003] Currently, in the field of industrial control system cybersecurity, commonly used risk assessment methods tend to focus on the technical aspects, such as quantifying the severity level of vulnerabilities using general vulnerability scoring systems (e.g., CVSS scoring). These methods primarily evaluate vulnerabilities based on their inherent attributes, such as exploitation difficulty and scope of impact. While they can reflect the general threat level of vulnerabilities, they fail to adequately consider their actual business impact in specific industrial environments. Power generation operations have high requirements for continuity and real-time performance; the actual risk posed by the same vulnerability varies significantly across assets with different business roles and operating conditions. This disconnect between current assessment methods and business context can easily lead to distorted risk assessments, potentially causing maintenance personnel to pay insufficient attention to vulnerabilities with high business impact or overreact to vulnerabilities with low business impact.

[0004] In the vulnerability remediation phase, the traditional approach is often to attempt to install patches or implement isolation measures immediately after a vulnerability is discovered, lacking coordination with the power plant's production scheduling plan. Power plant production processes are complex, with dynamic changes in factors such as unit load and equipment start-up / shutdown status. Performing remediation operations at inappropriate times can itself cause system disturbances or even production interruptions. Although some solutions suggest remediation during planned maintenance periods, current technologies have not yet provided an effective linkage mechanism for dynamically and accurately identifying the "safe window" with the least impact on production and executing the corresponding remediation plan within this window.

[0005] Therefore, the main shortcomings of existing technologies are: the disconnect between cybersecurity risk assessment and actual power generation operations, and the isolation between vulnerability remediation operations and the real-time operational status of production systems. This makes it difficult to accurately assess the true threat posed by vulnerabilities to power generation operations, and the remediation process may introduce secondary business risks. Summary of the Invention

[0006] The purpose of this invention is to provide a method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system. By dynamically linking risk assessment based on business context, remediation time window decision based on real-time operating conditions, and remediation plan execution, this method solves the problems in the prior art where network security risks are disconnected from actual production operations and remediation operations may introduce secondary risks. This method enables accurate and efficient handling of security vulnerabilities while ensuring the continuity of power generation.

[0007] To address the aforementioned technical problems, a first aspect of this invention provides a method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system, comprising the following steps: Based on the vulnerability information of assets in the power generation side industrial control system and the business context information of the assets, a business risk value is calculated to characterize the actual threat level of the vulnerability to the power generation business. Based on the business risk value and the real-time operating status and planning information of the power plant production management system, a low business risk period for performing repair operations is obtained as the repair time window, and a corresponding repair plan is matched for the asset. The repair plan is executed within the repair time window.

[0008] Furthermore, the business risk value, calculated based on the vulnerability information of assets in the power generation side industrial control system and the business context information of those assets, to characterize the actual threat level of the vulnerability to power generation operations, includes: Obtain several business impact factors associated with the asset and the vulnerability, each business impact factor corresponding to a type of power generation production business interruption, and having a benchmark weight determined based on historical operation and maintenance data; Obtain the corresponding business criticality level of the asset; Real-time acquisition of the asset's operational status parameters; Based on the vulnerability information, the business impact factors and their benchmark weights, the business criticality level, and the operational status parameters, the business risk value is calculated using a risk fusion algorithm. The risk fusion algorithm dynamically adjusts the benchmark weights based on the operational status parameters and the business criticality level.

[0009] Furthermore, the step of calculating the business risk value using a risk fusion algorithm based on the vulnerability information, the business impact factor and its benchmark weight, the business criticality level, and the operational status parameters includes: Based on the aforementioned operating status parameters, calculate the operating status correction coefficient; Based on the baseline weight of each business impact factor, the operational status correction coefficient, and the business criticality level, the dynamic weight of the business impact factor for the current operational status is calculated. The basic score of the vulnerability information is weighted and fused with the dynamic weights of all business impact factors to calculate a comprehensive impact value that reflects both the inherent threat of the vulnerability and the specific risks of the power generation business context. The comprehensive impact value is mapped to the business risk scoring range to obtain the corresponding business risk value.

[0010] Furthermore, the operating status parameters include at least: unit load rate, equipment start-up / shutdown phase identifier, system network load rate, and alarm status of adjacent systems; The calculation of the operating state correction coefficient based on the operating state parameters includes: Obtain the unit load rate, equipment start-up / shutdown phase identifier, system network load rate, and alarm status of adjacent systems for the assets; A multi-dimensional operating state vector is constructed based on the unit load rate, the equipment start-up and shutdown phase identifier, the system network load rate, and the alarm status of the adjacent systems. The multidimensional operating state vector is input into the multidimensional operating state influence rule base for matching. The multidimensional operating state influence rule base includes several preset multidimensional operating state vectors with different degrees of comprehensive influence on the stability of power generation business and the safety of repair operations. Based on the matching results, obtain the basic impact evaluation value corresponding to the preset multidimensional operating state vector; The operating status correction coefficient is obtained by superimposing the basic impact evaluation value with the dynamic adjustment factor that corresponds to the real-time change trend of the unit load rate.

[0011] Further, the step of inputting the multidimensional operating state vector into the multidimensional operating state influence rule base for matching includes: Calculate the absolute difference in each dimension between the multidimensional running state vector and each preset multidimensional running state vector in the rule base; The absolute differences in all dimensions corresponding to each preset multidimensional running state vector are weighted and summed to obtain the comprehensive distance measure between the preset multidimensional running state vector and the input multidimensional running state vector. The preset multidimensional running state vector with the smallest comprehensive distance measure is selected as the optimal matching result.

[0012] Furthermore, the step of obtaining a low-risk period for performing repair operations as a repair time window based on the business risk value and the real-time operating status and planning information of the power plant production management system includes: Obtain production plan information from the power plant production management system, wherein the production plan information includes planned maintenance periods and future load curve forecast data; Based on the future load curve prediction data, consecutive periods with predicted load rates lower than a first preset threshold are selected and marked as load safe periods. The planned maintenance period and the equipment standby period determined based on real-time equipment status monitoring are logically joined together to obtain the system's permitted intervention period. Perform a logical intersection operation on the load safety period and the system's allowed intervention period to generate an initial candidate repair period set; Calculate the availability score of each time period in the initial candidate repair time period set, and select time periods with scores higher than the second preset threshold to form the final candidate repair time period set; The repair urgency coefficient is calculated based on the business risk value, and the time periods in the final candidate repair time period set are prioritized according to the repair urgency coefficient, and the time period with the highest priority is determined as the repair time window.

[0013] Further, calculating the availability score of each time period in the initial candidate repair time period set includes: Based on the future load curve forecast data, calculate the standard deviation of the load change rate during the time period, and obtain the load stability coefficient corresponding to the standard deviation based on the stability mapping table; Obtain the duration of the time period and calculate the time period length adaptation coefficient based on the estimated repair time corresponding to the business risk value; Identify the overlapping portion between the time period and the planned maintenance time period, calculate the proportion of the overlapping portion duration to the total duration of the time period, and obtain the maintenance overlap coefficient; The load stability coefficient, the time period length adaptation coefficient, and the maintenance overlap coefficient are weighted and summed to obtain the time period availability score.

[0014] Furthermore, the calculation of the time period length adaptation coefficient includes: Obtain the duration of the time period and the estimated repair time; Calculate the difference between the duration and the estimated repair time to obtain the repair time margin; The repair time margin is compared with the baseline safety margin, and the basic adaptation level is determined based on the comparison result. Based on the ratio of the repair time margin to the estimated repair time, the time adequacy correction factor is calculated. The time period length adaptation coefficient is calculated based on the value corresponding to the basic adaptation level and the time adequacy correction factor.

[0015] Furthermore, the step of matching the asset with a corresponding repair plan includes: Based on the type of the asset and the vulnerability type in the vulnerability information, all applicable candidate remediation plans are obtained from the preset remediation plan library; The duration of the repair time window is obtained, and candidate repair plans with an estimated execution time shorter than the duration are selected to form a set of feasible repair plans. Based on the business criticality level of the asset and the basic score of the vulnerability information, calculate the remediation operation risk coefficient for each feasible remediation plan; The feasible repair plan with the lowest risk coefficient is selected as the repair plan that matches the asset.

[0016] Furthermore, after executing the repair plan within the repair time window, the process further includes: Real-time acquisition of operational index data of key physical equipment in the power generation side industrial control system, including at least unit vibration amplitude, bearing temperature and outlet steam pressure; The collected operational indicator data is compared with their respective safe operation threshold ranges. If any operational indicator data exceeds its safe operation threshold range for a preset duration, it is determined to be an abnormal key operational indicator. When the aforementioned key operational indicators become abnormal, the execution of the current remediation plan shall be immediately suspended, and a rollback process shall be triggered. The rollback process includes: invoking the system rollback plan corresponding to the currently executed repair plan, executing the operation sequence defined in the system rollback plan, and restoring the control system of the critical physical equipment to the state before the repair operation began.

[0017] Accordingly, a second aspect of the present invention provides a network security risk assessment and vulnerability remediation linkage device for a power generation side industrial control system, comprising: The risk calculation module is used to calculate a business risk value that characterizes the actual threat level of vulnerabilities to power generation operations based on vulnerability information of assets in the power generation side industrial control system and the business context information of the assets. The window acquisition module is used to acquire a low-risk period for performing repair operations as a repair time window based on the business risk value and the real-time operating conditions and planning information of the power plant production management system, and to match the corresponding repair plan for the asset. The repair execution module is used to execute the repair plan within the repair time window.

[0018] Accordingly, a third aspect of the present invention provides an electronic device, including: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to execute the above-described method for linking network security risk assessment and vulnerability remediation of a power generation side industrial control system.

[0019] Accordingly, a fourth aspect of the present invention provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the above-described method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system.

[0020] The above-described technical solutions of the embodiments of the present invention have the following beneficial technical effects: 1. By introducing the business criticality level of assets, real-time operating status parameters, and multi-dimensional business impact factors, and using a risk fusion algorithm to dynamically adjust the weight of the basic vulnerability score, the quantitative assessment of security risks is no longer limited to the inherent attributes of the vulnerability itself, but is deeply integrated into the specific business context of power generation production. This solves the problem of traditional general scoring systems such as CVSS being "unsuitable" in industrial control scenarios, and can accurately reflect the actual threat level of a specific vulnerability to power generation business (such as unit control, data acquisition, etc.) under the current operating state, providing a scientific basis for prioritizing the handling of vulnerabilities that pose the greatest threat to production stability. 2. By linking repair actions with the real-time operating status and future plans (such as load forecasting and maintenance plans) of power plant production management systems (such as SIS and MIS), and by comprehensively calculating the load safety period and the system's allowable intervention period, and evaluating the availability score of the period, it is possible to dynamically identify and select the "low business risk period" with the least impact on production as the repair time window; this avoids the secondary risks that may be caused by repairs during high unit load or critical operation periods, minimizes the interference of network security maintenance work on the continuity of power generation, and achieves a high degree of synergy between safe operation and maintenance and production scheduling; 3. It not only provides intelligent matching of remediation plans (based on asset type, vulnerability type, window duration, and operational risk coefficient), but also introduces a real-time security monitoring and automatic rollback mechanism based on the operating indicators of key physical equipment during the remediation execution phase. Once it detects that the remediation operation may cause equipment abnormality, it immediately stops and triggers the rollback process to quickly restore the system to a safe state. This forms a complete closed loop of "assessment-decision-execution-monitoring-rollback", which greatly improves the security and reliability of the remediation operation itself and effectively prevents safety production accidents caused by improper remediation measures. Attached Figure Description

[0021] Figure 1This is a flowchart of the method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system provided in this embodiment of the invention; Figure 2 This is a block diagram of the network security risk assessment and vulnerability repair linkage device for the power generation side industrial control system provided in this embodiment of the invention.

[0022] Figure label: 1. Risk Calculation Module, 2. Window Acquisition Module, 3. Repair Execution Module. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments and the accompanying drawings. It should be understood that these descriptions are merely exemplary and not intended to limit the scope of the invention. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0024] Please refer to Figure 1 The first aspect of this invention provides a method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system, comprising the following steps: Step S100: Based on the vulnerability information of assets in the power generation side industrial control system and the business context information of the assets, calculate the business risk value used to characterize the actual threat level of the vulnerability to the power generation production business.

[0025] First, a dynamic risk assessment model closely linked to power generation operations needs to be constructed. Specifically, this requires obtaining identified vulnerability information of target assets (such as engineering workstations and PLC controllers) from a network security awareness platform, including but not limited to basic scores and types from internationally recognized vulnerability databases. More importantly, the business context information of the asset needs to be collected synchronously. This involves determining the asset's role in the power generation process (such as participation in unit coordination control and boiler safety monitoring) and accordingly associating it with its business criticality level (e.g., categorized as critical, important, and general). Simultaneously, by integrating real-time data streams from the power plant monitoring information system (SIS) or distributed control system (DCS), the current operating status parameters of the unit or system to which the asset belongs should be obtained, such as the unit's real-time load rate, whether the equipment is in the start-up or shutdown process, network communication load rate, and alarm status of adjacent systems with which it interacts with data.

[0026] Based on this, a pre-defined multi-dimensional operational state impact rule base is invoked. This rule base defines the degree of impact of different combinations of operational states on business stability and operational security. By matching real-time state vectors with the rule base and incorporating dynamic factors such as load change trends, an operational state correction coefficient is calculated. Finally, through a risk fusion algorithm, the basic score of the vulnerability, the baseline weights of various business impact factors (such as potential reductions in unit output, unplanned outages, etc.), the business criticality level, and the operational state correction coefficient are comprehensively calculated to output a quantified business risk value. The business risk value not only reflects the general severity of the vulnerability but also dynamically characterizes the expected actual impact on power generation production after the vulnerability is exploited in the current specific business operating environment.

[0027] Step S200: Based on the business risk value and the real-time operating conditions and planning information of the power plant production management system, obtain the low business risk period for performing repair operations as the repair time window, and match the corresponding repair plan for the asset.

[0028] Based on the business risk value calculated by S100, the system intelligently decides the optimal timing and plan for repair actions. First, it needs to interact with the power plant's production management system (such as MIS) to obtain future power generation plans, approved planned maintenance periods, and load forecast curves. Analyzing the load forecast data, it identifies stable periods where the load rate remains below a certain safety threshold (e.g., 60% of rated load) over a future period, marking these as safe load periods. Simultaneously, planned maintenance periods are merged with equipment standby periods determined through real-time equipment status monitoring to form an intervention window where the system allows maintenance operations.

[0029] Subsequently, a logical intersection operation is performed on the load safety period and the system intervention-permitted period to generate an initial set of candidate repair periods. To further filter for the optimal window, the availability score of each candidate period is calculated. The scoring factors include the stability of load fluctuations within the period, the degree of matching between the period length and the estimated repair time, and the degree of overlap with planned maintenance work within the period. On the other hand, the urgency coefficient of the repair is calculated based on the level of business risk. Finally, the candidate periods are prioritized by combining the availability score and the urgency of the repair, thereby determining the repair time window. While determining the window, feasible plans that match the estimated execution time and have the lowest repair operation risk coefficient (assessing the degree of interference of the repair action itself on the system) are selected from a pre-set repair plan library based on asset type, vulnerability type, and the duration of the selected time window, achieving precise matching of repair plans.

[0030] Step S300: Execute the repair plan within the repair time window.

[0031] Within the repair time window defined by S200, the matching repair plan is executed safely and in a controlled manner, including safety mechanisms for abnormal situations. When the system time enters the preset repair time window, the automated repair process starts, executing repair operations according to the predefined and tested operation sequence in the selected repair plan (e.g., installing specific patches, adjusting firewall policies, changing configuration files, etc.). To ensure that the repair operations do not unexpectedly affect production safety, throughout the entire execution process, core operating indicator data of key physical equipment (such as steam turbines and feedwater pumps) are continuously collected in real time from SIS or underlying sensors via data interfaces. These data include unit shaft vibration amplitude, bearing temperature, and main steam pressure. This real-time data is continuously compared with preset safe operating threshold ranges.

[0032] Through the coordinated steps described above, deep collaboration between cybersecurity risk management and production operation maintenance of the power generation side industrial control system is achieved. This transforms previously isolated vulnerability remediation work into a planned maintenance activity based on precise business risk perception and optimized production operation conditions. This not only allows for a more accurate assessment of the actual threat posed by vulnerabilities in specific business environments, avoiding over- or under-remediation, but also proactively selects the time with the least impact on production and adopts the most prudent remediation approach. Furthermore, the introduction of real-time security monitoring and automatic rollback mechanisms during the remediation process significantly reduces secondary operational risks that may arise from the remediation operation itself, effectively addressing security vulnerabilities and ensuring the continuity and stability of power production.

[0033] Furthermore, in step S100, based on the vulnerability information and business context information of assets in the power generation side industrial control system, a business risk value is calculated to characterize the actual threat level of the vulnerability to the power generation production business, including: Step S110: Obtain several business impact factors associated with assets and vulnerabilities. Each business impact factor corresponds to a type of power generation business interruption and has a baseline weight determined based on historical operation and maintenance data.

[0034] In practice, a database of business impact factors closely linked to power generation operations is established beforehand. Each business impact factor corresponds to a specific type of power generation disruption, such as "unplanned unit outage (UOT)," "mandatory load reduction (MRC)," "data tampering or loss of critical production processes," and "cascading shutdown of auxiliary equipment." These impact factors are not arbitrarily set but are determined based on summarizing historical power plant operation and maintenance data, incident reports, and simulation analyses. Each factor is assigned a baseline weight, reflecting the average impact of this type of business disruption on the power plant's safety and economy in historical statistics. For example, a factor that may cause a plant-wide shutdown will have a significantly higher weight than a factor that only affects the monitoring of a single auxiliary machine. When assessing vulnerabilities on a specific asset, all business impact factors associated with the asset type, its functions, and potential exploitation paths are selected from the factor database, providing business-dimensional input parameters for subsequent risk fusion.

[0035] Step S120: Obtain the corresponding business criticality level of the asset.

[0036] The business criticality level of an asset needs to be predefined and classified based on its role and function in the power generation production chain. For example, assets directly involved in the main control of the unit (such as DCS controllers), responsible for critical protection logic (such as TSI system servers), or centrally storing core production data (such as real-time database servers) are usually classified as "critical"; while assets responsible for some auxiliary system monitoring, historical data backup, or office networks may be classified as "important" or "general". This classification is a relatively static attribute, usually defined and entered into the asset management system when the system is built or the asset is connected to the grid. During risk assessment, the pre-defined business criticality level of the asset is obtained by querying the asset list database. This level will become an important amplification or reduction factor in the subsequent risk fusion algorithm, ensuring that the assessment results reflect the basic logic that the same vulnerability has a greater potential threat to overall production when it occurs on a critical asset than when it occurs on a non-critical asset.

[0037] Step S130: Obtain the asset's operating status parameters in real time.

[0038] Operating status parameters need to be acquired in real time from the power plant's existing monitoring systems. The data sources primarily include the plant-level Information System (SIS), Distributed Control System (DCS), and network monitoring systems. Key operating status parameters include at least: the real-time load rate of the generating unit to which the asset belongs (reflecting production intensity), whether the equipment is in a transition phase between startup and shutdown (during which the control system is typically more sensitive and vulnerable), the real-time communication load rate of the network (reflecting network congestion), and whether adjacent systems with close data interaction relationships with the asset (such as the superior dispatch system and the control systems of adjacent units) have generated alarm signals. These parameters together constitute a multi-dimensional state vector reflecting the stability of the current operating environment. By continuously collecting this data, the assessment system can perceive changes in the external operating environment, for example, identifying whether the system is currently operating under different conditions such as high-load stable operation, low-load peak shaving, or emergency shutdown.

[0039] Step S140: Based on vulnerability information, business impact factors and their benchmark weights, business criticality level, and operational status parameters, calculate the business risk value using a risk fusion algorithm.

[0040] The risk fusion algorithm receives multiple inputs: a basic vulnerability score (such as CVSS score) from a vulnerability database, business impact factors and their baseline weights selected in step S110, the business criticality level obtained in step S120, and real-time operational status parameters collected in step S130. The algorithm does not simply add these parameters together; instead, it performs a multi-layered weighting and adjustment process. First, the algorithm calculates a dynamic operational status correction coefficient using the operational status parameters. This coefficient quantifies the combined impact of the current operating conditions on system stability and the security of remediation operations. For example, when the unit is operating under high load and the network is busy, the correction coefficient increases, indicating a decrease in the system's ability to withstand disturbances. Then, the algorithm dynamically adjusts the baseline weight of each business impact factor based on the business criticality level and the operational status correction coefficient, obtaining its dynamic weight in the current specific scenario. Finally, the algorithm weights and fuses the basic vulnerability score with all the dynamically adjusted business impact factor weights to calculate a comprehensive impact value, maps this value to a preset business risk score range, and ultimately outputs a quantified business risk value.

[0041] Step S150: The risk fusion algorithm dynamically adjusts the benchmark weights based on the operating status parameters and the business criticality level.

[0042] Specifically, the algorithm calculates an operational status correction coefficient in real time based on the real-time operational status parameters obtained from S130, using predefined rules or models. This coefficient directly affects the baseline weights of business impact factors. For example, when operational status parameters indicate that the unit is operating at high load and the network load is high, the algorithm will increase the dynamic weights of business impact factors that may lead to production interruptions (such as "causing unplanned unit shutdown"), because the consequences of interruptions are more severe under such conditions. Simultaneously, the business criticality level, as a stable amplification factor, globally scales the weights of all business impact factors associated with the asset, ensuring that risks on critical assets are always fully highlighted. Through this dynamic adjustment, the algorithm ensures that the final calculated business risk value is not a static, detached number, but a dynamic indicator that sensitively reflects the real threat posed by the vulnerability to the critical asset "at this moment," under "this operational status."

[0043] Through refined and process-oriented design, a dynamic, accurate, and deeply integrated cybersecurity risk assessment method has been developed. This method transforms the general threat assessment of vulnerabilities into a context-aware risk metric that closely integrates specific business scenarios, asset importance, and real-time operational status. This approach overcomes the shortcomings of traditional assessment methods, such as insufficient specificity and timeliness in industrial control environments. It enables risk assessment results to accurately reflect the immediate potential impact of vulnerabilities on power generation operations, thus providing a more scientific and reliable basis for subsequent risk-driven remediation strategies coordinated with production plans. This effectively improves the accuracy and effectiveness of security management of power generation-side industrial control systems.

[0044] Furthermore, in step S140, based on vulnerability information, business impact factors and their baseline weights, business criticality level, and operational status parameters, a risk fusion algorithm is used to calculate the business risk value, including: Step S141: Calculate the operating status correction coefficient based on the operating status parameters.

[0045] In practice, the real-time operating status parameters collected in step S130 are acquired, including unit load rate, equipment start-up / shutdown phase identifier, system network load rate, and adjacent system alarm status. These parameters are constructed into a multi-dimensional operating status vector. Subsequently, this vector is input into a preset multi-dimensional operating status impact rule base for matching. This rule base contains a large number of predefined typical operating status scenarios and their corresponding basic impact evaluation values ​​based on historical operating data, expert experience, and simulation analysis. For example, the rule base may define "unit load rate > 90%, equipment in normal operation phase, network load rate > 70%, and no adjacent system alarms" as a high-stability state scenario with a low basic impact evaluation value; while "unit in start-up phase, network load rate fluctuating drastically, and important adjacent system alarms" is defined as a high-vulnerability state scenario with a high basic impact evaluation value. The matching process typically calculates the difference between the real-time vector and each preset vector in the rule base in each dimension, and then performs a weighted summation to obtain the comprehensive distance, ultimately selecting the basic evaluation value corresponding to the closest scenario. To further enhance real-time performance, a dynamic adjustment factor is introduced. This factor is correlated in real-time with the changing trend of the unit load rate. If the load rate shows a rapid upward or downward trend, the dynamic adjustment factor will increase accordingly to reflect the additional risks brought about by the system being in a dynamic transition process. Finally, the basic impact assessment value and the dynamic adjustment factor are superimposed to obtain the final operating state correction coefficient. The larger the coefficient value, the more unfavorable the current operating state is for safe operation, and the weaker the ability to withstand additional disturbances (such as repair operations).

[0046] Step S142: Based on the baseline weight, operational status correction coefficient, and operational criticality level of each business impact factor, calculate the dynamic weight of the business impact factor for the current operational status.

[0047] The calculation process is performed independently for each business impact factor selected in step S110. The dynamic weight of each factor is a function of its baseline weight, the operational status correction coefficient calculated in step S141, and the business criticality level obtained in step S120. Specifically, the operational status correction coefficient, as a global sensitivity regulator, generally affects the weights of all factors. For example, when the correction coefficient is high (indicating that the system is in a vulnerable state), the weights of factors that may lead to serious production disruptions (such as "unplanned unit outages") will be significantly amplified because the system is more overburdened at this time. At the same time, the business criticality level, as an amplification factor for a specific asset, will perform a basic scaling on the weights of all business impact factors associated with that asset. The factor weights of critical-level assets will receive a scaling multiplier greater than 1, while the multiplier for general-level assets may be equal to or less than 1. Through this mechanism, dynamic weights not only reflect the severity of a specific type of business interruption (through baseline weights), but also sensitively capture the current operating environment's ability to withstand interruptions (through operating status correction coefficients), and highlight the importance of the asset itself (through business criticality level), thereby achieving contextualized and real-time weight values.

[0048] Step S143: The basic score of the vulnerability information is weighted and fused with the dynamic weights of all business impact factors to calculate a comprehensive impact value that reflects both the inherent threat of the vulnerability and the specific risks of the power generation business context.

[0049] First, the base score obtained from the vulnerability information is the CVSS base score from a standard vulnerability database (such as NVD), representing the technical severity of the vulnerability itself. Then, the dynamic weights of all previously calculated related business impact factors are aggregated. The specific algorithm for weighted fusion can vary; a typical implementation is to multiply the vulnerability base score by the sum (or weighted sum) of all dynamic weights. For example, a high CVSS score vulnerability, if the asset it inhabits has low business criticality and its current operating state is stable (resulting in a low total dynamic weight), may have a moderate overall impact value; conversely, a medium-score vulnerability, if it exists on a critical asset and the system is in a vulnerable operating state (resulting in a high total dynamic weight), may have its overall impact value amplified to a very high level. Through this fusion calculation, the final overall impact value is no longer an isolated technical score, but a composite risk indicator that integrates the vulnerability's technical threat, the asset's business importance, and the system's real-time operational health.

[0050] Step S144: Map the comprehensive impact value to the business risk scoring range to obtain the corresponding business risk value.

[0051] Since the comprehensive impact value calculated in step S143 may be a wide-ranging and non-intuitive numerical value, direct use is inconvenient for risk comparison and decision-making. Therefore, it is necessary to predefine a business risk scoring range, such as setting it as an integer between 0 and 100, or dividing it into several consecutive level bandwidths such as "low," "medium," "high," and "urgent" and their corresponding numerical ranges. The mapping process usually uses linear or non-linear transformation functions. For example, by determining the minimum and maximum values ​​of the comprehensive impact value in historical cases, a minimum-maximum normalization method can be used to linearly map it to the 0-100 range. Alternatively, several key thresholds can be set based on expert experience, and piecewise linear mapping or non-linear mapping such as a sigmoid function can be used to better highlight the differentiation of key risk areas. Finally, through this mapping function, the comprehensive impact value is converted into a standardized business risk value. This business risk value intuitively represents the real-time threat level of the vulnerability to the power generation business in the current specific business context and operating state, providing a clear and unified quantitative basis for subsequent remediation priority ranking and time window decision-making.

[0052] Specifically, the above-mentioned operating status parameters include at least: unit load rate, equipment start-up and shutdown phase indicators, system network load rate, and alarm status of adjacent systems.

[0053] The unit load factor, referring to the percentage of the generator unit's current actual output power to its rated nameplate power, is a core indicator for measuring the unit's operational intensity and stability. This parameter is obtained by real-time acquisition of the generator unit's power signals from the plant-level monitoring information system (SIS) or distributed control system (DCS). In risk assessment, the unit load factor has a dual significance. On the one hand, a high load factor (e.g., consistently above 90% of rated capacity) usually indicates that the unit is operating at its stress limit, with each subsystem (such as boiler, turbine, and auxiliary equipment) under high stress. At this time, any external disturbance, including system operations performed to repair vulnerabilities, is more likely to trigger a chain reaction, leading to unit tripping or equipment damage, thus increasing system vulnerability. On the other hand, the load factor also reflects the unit's importance in the power grid; high-load units often bear base load or important peak-shaving tasks, and their unexpected outages result in greater power losses and social impact. The assessment algorithm compares this continuously changing parameter with a preset threshold range as an important basis for judging the system's current ability to withstand disturbances.

[0054] The equipment start-up / shutdown phase identifier is a discrete state variable characterizing whether a generator set or major auxiliary equipment is in a transient process such as startup or shutdown. This identifier typically originates from the logical status bits of the sequential control system (SCS) or the automatic start-up / shutdown system (APS) of the DCS system. Compared to stable operating conditions, the start-up / shutdown phase is a complex dynamic process. The control system needs to strictly control parameters such as temperature, pressure, and speed according to preset curves, with a large number of sequential control logics and interlocking protections in operation. The system itself is in a non-equilibrium and sensitive state. Performing vulnerability repair operations during this phase, such as updating the controller program or restarting services, can easily disrupt the normal start-up / shutdown sequence, leading to interruptions, equipment over-temperature or over-pressure, or even startup failure or unplanned shutdown. Therefore, when this identifier indicates that the equipment is in the start-up / shutdown phase, it is considered to have extremely high operational risks, and the assessment algorithm will significantly improve the vulnerability rating of the operating state.

[0055] The system network load rate refers to the percentage of real-time data traffic in a specific network segment of an industrial control system (such as the process control layer network or the monitoring layer network) relative to the total bandwidth of that segment. This parameter is calculated using network traffic data collected by network management software or mirrored ports of switches, directly reflecting the busyness of network communication and the potential risk of congestion. A high network load rate (e.g., exceeding 70% bandwidth utilization) means increased network latency, a higher probability of packet loss, and decreased real-time performance and reliability of network transmission. In this context, vulnerability remediation operations (such as distributing large patch files or performing security scans) will further exacerbate the network burden, potentially affecting the timely delivery of critical production instructions (such as valve opening and burner commands), leading to deterioration of control loop performance. Simultaneously, a congested network environment may also cause the remediation operation itself to fail due to communication timeouts. Therefore, the network load rate is a key parameter for assessing the potential interference of remediation operations on network control services.

[0056] The alarm status of adjacent systems refers to the presence of active alarm information in other systems (such as power grid dispatch automation systems, DCS systems of adjacent generating units, and plant power protection systems) that have close data interaction or logical coupling with the system containing the target asset. This status is obtained through data subscription via inter-system interfaces (such as OPC UA) and is differentiated by alarm severity level (e.g., general, important, urgent). Alarms from adjacent systems are significant external risk signals. For example, when the power grid dispatch system issues a frequency fluctuation alarm, the local unit may need to respond quickly to adjust the frequency; when a neighboring generating unit experiences a significant auxiliary equipment failure alarm, the local unit may need to bear a heavier load. In such situations, the local unit's control system needs to maintain high availability and stability to cope with potential coordinated operations. Performing repair operations within the local system at this time will reduce the system's responsiveness to emergencies and may amplify the impact of the initial fault. Therefore, the alarm status of adjacent systems is used as an important basis for assessing the stability of the external environment and whether the local system needs to remain in a "standby" state.

[0057] Accordingly, step S141, which calculates the operating state correction coefficient based on the operating state parameters, includes: Step S1411: Obtain the unit load rate, equipment start-up / shutdown phase identifier, system network load rate, and alarm status of adjacent systems for the asset.

[0058] In practical implementation, integration with the power plant's existing monitoring system is achieved through predefined data interfaces. Unit load factor is obtained by accessing the real-time database of the plant-level monitoring information system (SIS) or distributed control system (DCS), directly reflecting the output and operational intensity of the generating units. Equipment start-up and shutdown phase indicators are read from the logical state variables of the DCS's sequential control system (SCS) or unit automatic start-up and shutdown system (APS). These indicators are typically discrete enumeration values, such as "shutdown," "starting up," "normal operation," and "outage," precisely describing the dynamic process of the equipment. System network load factor is obtained by querying the traffic statistics of the corresponding port from the management interface of the core switch using network management protocols (such as SNMP) and calculating its percentage relative to the port's rated bandwidth. Alarm status of adjacent systems is obtained by subscribing to the alarm lists of relevant systems through the inter-system data bus (such as OPC UA) and filtering out alarms that are currently active and have reached a preset severity level (such as "important" or higher). This step ensures the timeliness and accuracy of the raw data upon which subsequent calculations rely, providing reliable input for subsequent analysis.

[0059] Step S1412: Construct a multi-dimensional operating status vector based on unit load rate, equipment start-up and shutdown phase identifier, system network load rate, and alarm status of adjacent systems.

[0060] The four parameters acquired have different dimensions and numerical ranges (e.g., load rate as a percentage, start-up and shutdown phases as enumerated values), making direct comparison or calculation difficult. Therefore, each parameter is first preprocessed and standardized. For example, non-numerical data such as equipment start-up and shutdown phase identifiers are mapped to specific numerical codes based on their corresponding risk levels (e.g., "normal operation" mapped to 0, "starting up" to 0.8, and "out of service" to 0.6). Subsequently, the processed unit load rate values, equipment start-up and shutdown phase codes, system network load rate values, and adjacent system alarm statuses (which can be represented by the number of active alarms or their severity weighted values) are combined in a predetermined order into a fixed-dimensional mathematical vector, namely a multi-dimensional operating status vector. This vector comprehensively encapsulates the comprehensive operating condition information of the target asset at the current moment, which comes from the production process, equipment status, network environment, and external systems, providing a standardized input format for subsequent rule matching.

[0061] Step S1413: Input the multidimensional operating state vector into the multidimensional operating state influence rule base for matching. The multidimensional operating state influence rule base includes several preset multidimensional operating state vectors with different degrees of comprehensive influence on the stability of power generation business and the safety of repair operations.

[0062] The multidimensional operational state impact rule base is a pre-built knowledge base that stores a large number of typical operational state scenarios defined by domain experts based on historical operational experience, accident analysis reports, and system simulation results. Each scenario is represented by a preset multidimensional operational state vector with the same vector structure as that built in S1412, and associated with a label describing the comprehensive impact of the scenario on the stability of power generation operations and the safety of repair operations. For example, the rule base may contain multiple typical scenarios such as "stable operation under high load," "network congestion during startup," and "normal operation but neighboring unit failure." The matching process involves using specific algorithms (such as calculating Euclidean distance, cosine similarity, or more complex pattern recognition methods) to calculate the similarity between the currently constructed multidimensional operational state vector and all preset vectors in the rule base, finding one or more preset scenarios that are closest to the current state.

[0063] Step S1414: Based on the matching results, obtain the basic impact evaluation value corresponding to the preset multi-dimensional operating state vector.

[0064] Each preset multidimensional operating state vector in the rule base is pre-associated with a basic impact assessment value. This value is a quantitative assessment of the risk level of system maintenance operations under the stated scenario based on expert knowledge, and is usually set within a standard range (e.g., between 0 and 10). The higher the value, the more unstable or fragile the operating state is, and the greater the potential risk of performing repair operations. After step S1413 completes the matching and determines the preset scenario most similar to the current real-time state, the basic impact assessment value corresponding to that preset scenario is directly read. For example, if the matched scenario is "units operating at full load and network load rate high," its basic impact assessment value may be preset to 8.5; while if the matched scenario is "units shut down for standby and network idle," its basic impact assessment value may only be 1.0. This basic impact assessment value constitutes the static basic part of the operating state correction coefficient.

[0065] Step S1415: The basic impact assessment value is superimposed with the dynamic adjustment factor that corresponds to the real-time change trend of the unit load rate to obtain the operating status correction coefficient.

[0066] The dynamic adjustment factor is primarily used to reflect the real-time trend of unit load rate changes. Because a rapid rise or fall in load is inherently an unstable dynamic process, even if the current absolute load value is not high, its trend may indicate that the system is about to enter a more stressful or complex operating condition. The unit load rate is recorded periodically, and its direction and rate of change are quantified through time series analysis (e.g., calculating the slope of linear regression within a short-term sliding window). Based on the magnitude and direction of this rate of change, a corresponding dynamic adjustment factor is calculated using a predefined mapping function (e.g., the factor is positive when the load rate rises rapidly; zero when it is stable; and also positive when it falls rapidly, but the value may differ). Finally, this dynamic adjustment factor is superimposed (e.g., directly added or weighted added) with the basic impact assessment value obtained in step S1414 to obtain the final operating state correction coefficient. This mechanism ensures that the assessment results not only reflect a static snapshot of the current state but also sensitively respond to dynamic changes occurring in the system, making the coefficient more timely and providing early warning.

[0067] By integrating previously isolated and heterogeneous operating parameters into a comprehensive state assessment index, and through matching with an expert knowledge base and trend fine-tuning, the calculation results can reflect both the static characteristics of the current operating state and capture its dynamic changing trends. This provides accurate and sensitive environmental state input for subsequent risk fusion algorithms, significantly improving the responsiveness and accuracy of business risk values ​​to the real-time operating conditions of the system, thereby making the final risk decision more closely aligned with the actual safety situation of power generation production.

[0068] Furthermore, step S1413, which involves inputting the multidimensional running state vector into the multidimensional running state influence rule base for matching, includes: Step S1413a: Calculate the absolute difference between the multidimensional running state vector and each preset multidimensional running state vector in the rule base in each dimension.

[0069] Specifically, firstly, it is ensured that the input real-time multidimensional operating state vector is completely consistent with each preset multidimensional operating state vector in the rule base in terms of dimension, scale, and numerical range. Then, for the i-th preset vector in the rule base, the absolute difference between the value of each dimension and the value of the real-time vector in the corresponding dimension is calculated sequentially. For example, in the dimension of "unit load rate," the absolute difference between the preset vector load rate value and the real-time collected load rate value is calculated; in the dimension of "equipment start / stop phase identifier," which is numerically coded, the absolute difference between their code values ​​is calculated; similarly, the same calculation is performed for the dimensions of "system network load rate" and "adjacent system alarm status." This process generates a set of absolute differences for each preset vector, equal to the number of dimensions. These differences intuitively reflect the degree of deviation between the current real state and a certain preset typical state in each single dimension.

[0070] Step S1413b: The absolute differences in all dimensions corresponding to each preset multidimensional running state vector are weighted and summed to obtain the comprehensive distance measure between the preset multidimensional running state vector and the input multidimensional running state vector.

[0071] After obtaining the absolute differences for each dimension, these differences are not simply averaged, but rather weighted and summed. Each dimension is assigned a specific weight coefficient, determined based on the importance of that dimension's parameter to the stability of power generation operations and the safety of repair operations. This coefficient is typically derived from the experience of domain experts or statistical analysis of historical data. For example, "equipment start-up / shutdown phase identification" and "unit load rate" are usually considered key dimensions with a greater impact on system vulnerability and are therefore given higher weights; while "system network load rate" and "adjacent system alarm status" may be given relatively lower weights. During calculation, the absolute difference for each dimension is multiplied by its corresponding weight coefficient, and then the weighted differences for all dimensions are summed. The result is the comprehensive distance measure between the preset vector and the real-time vector. This comprehensive distance measure is a dimensionless scalar value; the smaller the value, the more similar the typical operating state represented by the preset vector is to the current actual operating state. The weighting mechanism ensures that the matching results focus more on changes in key parameters that have a greater impact on system safety.

[0072] Step S1413c: Select the preset multidimensional running state vector with the smallest comprehensive distance measure as the optimal matching result.

[0073] After completing step S1413b, a comprehensive distance metric value is obtained for each preset vector in the rule base. Next, all these comprehensive distance metric values ​​are iterated through, and an algorithm for finding the minimum value (such as linear scan comparison) is used to identify the comprehensive distance metric with the smallest value. The preset multidimensional operating state vector corresponding to this minimum comprehensive distance metric is selected as the optimal matching result. Based on the algorithm's judgment, the typical operating scenario described by this preset vector in the rule base best matches the current actual system operating status. This optimal matching result will serve as the basis for subsequent steps, and its associated basic impact evaluation value will be adopted to calculate the operating state correction coefficient. Through this minimum distance-based matching principle, the most relevant background information can be automatically and intelligently retrieved from the knowledge base, providing contextual basis for risk assessment.

[0074] Specifically, in step S200, based on the business risk value and the real-time operating status and planning information of the power plant production management system, a low-business-risk period is selected as the repair time window for performing the repair operation, including: Step S210: Obtain production plan information from the power plant production management system. The production plan information includes planned maintenance periods and future load curve forecast data.

[0075] Structured production planning information is obtained through predefined data interfaces (e.g., data interaction with the power plant management information system (MIS) or production scheduling system). This information mainly includes two core components: First, planned maintenance periods, which refer to the equipment or system shutdown and maintenance periods that have been formally approved and clearly listed in the plant-level production plan, such as the A-level maintenance cycle of Unit #1 and the planned troubleshooting schedule for the #2 slurry circulation pump. These periods are reserved for maintenance work, and the system intervention has a high degree of permissibility. Second, future load curve forecast data, which comes from the power generation load plan curve for the next day or several days in the future issued by the power grid dispatch center, or the plant load forecast generated based on historical data and weather models. This data describes the planned or predicted active power output values ​​of the units at various future time points in time series form. Obtaining this forward-looking information lays the data foundation for analyzing which periods have low-risk operating conditions.

[0076] Step S220: Based on the future load curve forecast data, filter out continuous periods with predicted load rates lower than a first preset threshold and mark them as load safe periods.

[0077] The acquired future load curve forecast data is loaded and analyzed according to a preset time granularity (e.g., one data point every 15 minutes or hour). A first preset threshold is set (e.g., 50% or 60% of rated load), which is determined based on power plant operating procedures and historical data analysis of unit stability. Subsequently, the entire load forecast curve is scanned, and periods where the predicted load rate at all consecutive time points is lower than the threshold are selected. These periods are marked as load safety periods. Because under these low-load conditions, the unit operating pressure is lower, and the parameters of each subsystem are relatively relaxed, the impact risk on the overall power generation stability of repair operations, such as system restarts or patch installations, which may cause short-term fluctuations, is significantly lower than during high-load periods. The identified load safety periods are an important time element constituting the ideal repair window.

[0078] Step S230: Perform a logical union operation on the planned maintenance period and the equipment standby period determined based on real-time equipment status monitoring to obtain the system's allowed intervention period.

[0079] In addition to planned maintenance periods, there may be temporary opportunity windows arising from normal equipment rotation and standby. The system allows intervention periods to be generated through logical union: firstly, planned maintenance periods explicitly included in the production plan obtained from S210; secondly, equipment standby periods dynamically determined based on real-time equipment status monitoring data. For example, when a standby water pump is detected to have successfully started and been put into operation, and the original operating pump switches to standby status, the control system corresponding to that pump enters a maintainable window. These two types of periods are merged on the timeline, and overlapping parts are removed to form a comprehensive set of system-allowed intervention periods. This set represents the time range within which maintenance operations can be performed, formally or de facto approved by the production management process, ensuring the compliance of repair activities with the management process.

[0080] Step S240: Perform a logical intersection operation on the load safety period and the system allowable intervention period to generate an initial candidate repair period set.

[0081] The load-safe periods obtained in step S220 and the system-permitted intervention periods obtained in step S230 are logically intersected on the time axis. Only periods that belong to both load-safe periods (low operational risk) and system-permitted intervention periods (management-permitted) are included in the initial candidate repair period set. For example, a period with a low load rate late at night, but not included in the maintenance plan and without backup equipment, will not be selected; conversely, a planned maintenance period with a still high load forecast will not be initially selected due to its high operational risk. The intersection operation ensures that each period in the initial candidate set meets the two basic prerequisites of "low operational risk" and "operation permitted," providing a high-quality candidate pool for subsequent fine-tuning.

[0082] Step S250: Calculate the availability score of each time period in the initial candidate repair time period set, and select time periods with scores higher than the second preset threshold to form the final candidate repair time period set.

[0083] For each time slot in the initial candidate repair time slot set, a time slot availability score is calculated. This score is a comprehensive indicator, typically considering multiple factors: for example, calculating the standard deviation of the load change rate within the time slot; the more stable the load, the higher the score; assessing the match between the time slot duration and the estimated repair time; the more time allowed, the higher the score; examining the degree of overlap between the time slot and the planned maintenance time slot; a higher overlap ratio means that the repair operation is synchronized with the planned maintenance activities, and the smaller the impact on additional production, the higher the score. Each factor is assigned a different weight according to its importance, and the weighted sum is used to obtain the final time slot availability score. A second preset threshold is set, and time slots with scores higher than this threshold are selected to form the final candidate repair time slot set. This is equivalent to "selecting the best from the best" among the initially qualified windows, selecting the time slots with the highest overall quality and the highest operation success rate.

[0084] Step S260: Calculate the repair urgency coefficient based on the business risk value, and prioritize the time periods in the final candidate repair time period set according to the repair urgency coefficient, and determine the time period with the highest priority as the repair time window.

[0085] First, based on the business risk value calculated by S100, a remediation urgency coefficient is calculated through a predefined mapping relationship. The higher the risk value, the larger the urgency coefficient, indicating that remediation needs to be arranged as soon as possible. Then, the time periods in the final candidate remediation time period set are prioritized according to this urgency coefficient. For high-urgency vulnerabilities, the closest high availability score time period may be selected to quickly mitigate the risk; for low-urgency vulnerabilities, the time period further in the future but with the highest availability score may be selected to pursue the highest operational security. Finally, the time period at the top of the priority list is officially determined as the time window for this vulnerability remediation. This mechanism achieves a dynamic balance and intelligent decision-making between security risk management and production plan optimization.

[0086] Further, step S250, which calculates the availability score of each time period in the initial candidate repair time period set, includes: Step S251: Based on the predicted data of the future load curve, calculate the standard deviation of the load change rate within the time period, and obtain the load stability coefficient corresponding to the standard deviation based on the stability mapping table.

[0087] Based on the predicted load curve data obtained from production planning information, for each initial candidate repair period, the predicted load values ​​for all time granularities (e.g., one point every 15 minutes) within that period are extracted. First, the rate of change of these continuous load values ​​is calculated, i.e., the difference or relative rate of change of load between adjacent time points. Next, the standard deviation of these rates of change over the entire period is calculated. This standard deviation is a statistical indicator measuring the severity of load fluctuations; a smaller standard deviation indicates a more stable load during that period. Then, a pre-defined stability mapping table is consulted, which defines the load stability coefficient corresponding to different standard deviation ranges. For example, a standard deviation below a certain threshold A is mapped to a higher stability coefficient (e.g., 0.9-1.0), indicating very stable load; a standard deviation between thresholds A and B is mapped to a medium stability coefficient (e.g., 0.6-0.8); and a standard deviation exceeding threshold B is mapped to a lower stability coefficient (e.g., 0.3-0.5). Through this process, the fluctuation characteristics of the load curve are transformed into a normalized load stability coefficient, used to assess the stability of the operating environment within a period.

[0088] Step S252: Obtain the duration of the time period and calculate the time period length adaptation coefficient based on the estimated repair time corresponding to the business risk value.

[0089] First, obtain the duration (T) of the candidate time period currently being evaluated. available Simultaneously, based on the business risk value calculated in step S100, the estimated repair time (T) typically corresponding to this risk level is determined through a preset mapping relationship or lookup table. estimated For example, high-risk vulnerabilities may correspond to more complex remediation processes and longer estimated times. The calculation of the time period length adaptation coefficient mainly considers the remediation time margin, that is, the difference between the duration and the estimated remediation time (T). margin =T available -T estimated ). T margin With a set baseline safety margin (T) safe The comparison is performed, and a basic adaptation level is determined based on the comparison result (e.g., T). margin >2*T safe "Very well-matched" corresponds to a high score; T margin <T safe "Unsuitable" (corresponding to a low score or zero score). In addition, a time adequacy correction factor will be calculated, for example, using T... margin / T estimated The ratio is smoothly adjusted, with a larger ratio indicating more time leeway. Finally, by combining the values ​​corresponding to the basic adaptation level and the time leeway correction factor, the time period length adaptation coefficient is calculated. This coefficient ensures that the selected time period not only meets the basic time requirements but also provides a certain degree of operational flexibility.

[0090] Step S253: Identify the overlapping portion between the time period and the planned maintenance time period, calculate the proportion of the overlapping portion duration to the total duration of the time period, and obtain the maintenance overlap coefficient.

[0091] Assess the degree of overlap between the candidate time periods and the planned maintenance work. A high degree of overlap means that the repair operation can leverage existing maintenance isolation measures, reducing additional impact on normal production. Compare the currently assessed candidate time periods with the planned maintenance time periods obtained in step S210 on the timeline to identify the overlapping portions and calculate the duration (T) of the overlapping portion. overlap Then, the overlap duration as a percentage of the total candidate time period (T) is calculated. total The proportion of ( ), i.e., the maintenance overlap coefficient = T overlap / T total This coefficient ranges from 0 to 1. A coefficient of 1 indicates that the candidate period is completely covered by the planned maintenance period, in which case vulnerability remediation incurs almost no additional production interruption costs, offering the highest security and convenience. A coefficient of 0 indicates that the candidate period does not overlap with any planned maintenance period, requiring independent scheduling of remediation operations, which may involve additional system shutdowns or isolation procedures. A coefficient between 0 and 1 indicates partial overlap. A higher maintenance overlap coefficient is generally considered a positive factor.

[0092] Step S254: The load stability coefficient, time period length adaptation coefficient, and maintenance overlap coefficient are weighted and summed to obtain the time period availability score.

[0093] The independent coefficients obtained from the first three steps, representing load stability, time matching, and schedule synergy respectively, are combined into a single, comparable time-period availability score. Different weight values ​​(W) are assigned to the load stability coefficient, time-period length matching coefficient, and maintenance overlap coefficient. stability W length W overlap These weights reflect the relative importance of each factor in the overall assessment and are typically set based on the priorities of power plant operation and maintenance (e.g., perhaps with more emphasis on time matching and load stability). Then, the weighted summation formula is used: Time Period Availability Score = (Load Stability Coefficient * W) stability )+(Time period length adaptation coefficient * W length )+(Maintenance overlap coefficient * W overlap The system calculates a final score for each candidate time period. This score comprehensively reflects the overall suitability of that time period for performing repair operations. The higher the score, the safer and more reliable the time period is, and the less impact it has on production. This score can then be used for sorting and selection.

[0094] Through meticulous quantitative evaluation, a precise and multi-dimensional assessment of the overall quality of candidate repair periods was achieved. This overcomes the limitations of selecting based solely on period length or a single factor. By comprehensively considering load volatility, time adequacy, and coordination with planned maintenance, it can accurately identify high-quality time windows that not only meet basic time requirements but also offer more stable operating environments and more economical and safer operational arrangements. This provides a scientific and comprehensive basis for finalizing the repair time window, significantly improving the feasibility and safety of the repair plan.

[0095] Furthermore, the calculation of the time period length adaptation coefficient in step S252 includes: Step S2521: Obtain the duration of the time period and the estimated repair time.

[0096] First, the specific start and end times of the current evaluation period are obtained from the initial candidate remediation period set, and its duration is calculated, typically quantified in minutes or hours. Simultaneously, the estimated remediation time required to fix the vulnerability to be repaired during this period is obtained. This estimated remediation time is not a fixed value but is associated with the business risk value calculated in step S100. The system maintains a mapping table that maps different business risk levels to typical remediation operation complexity and estimated time ranges. For example, high-risk vulnerabilities may correspond to complex operations requiring restarting critical controllers or installing multiple patches, resulting in a longer estimated time; while low- to medium-risk vulnerabilities may only require configuration adjustments, resulting in a shorter estimated time. Obtaining accurate operable window length and a scientifically estimated time is the foundation for subsequent calculations.

[0097] Step S2522: Calculate the difference between the duration and the estimated repair time to obtain the repair time margin.

[0098] Subtracting the estimated repair time from the duration of the time period obtained in step S2521, the difference is the repair time margin. This margin is a key indicator; its value directly reflects the remaining available time after the theoretical repair operation is completed. A positive time margin means that the time period length can theoretically meet the repair requirements, while a negative value means that there is insufficient available time, and the time period should be excluded. The repair time margin provides the most direct raw data input for subsequent more refined adaptation level determination.

[0099] Step S2523: Compare the repair time margin with the baseline safety margin, and determine the basic adaptation level based on the comparison result.

[0100] A baseline safety margin is preset, set based on historical operational experience, to handle unexpected delays during the repair process, such as operational errors, slow network transmission, or time buffers required for additional steps like rollback testing. The calculated repair time margin is then compared to this baseline safety margin. Based on the comparison result, a basic fit level is determined. For example, if the repair time margin is greater than or equal to twice the baseline safety margin, it is rated as "very fit"; if the repair time margin is greater than or equal to the baseline safety margin but less than twice it, it is rated as "basically fit"; if the repair time margin is positive but less than the baseline safety margin, it is rated as "critically fit"; if it is negative or zero, it is directly rated as "not fit". Each level corresponds to a basic numerical score.

[0101] Step S2524: Calculate the time adequacy correction factor based on the ratio of repair time margin to estimated repair time.

[0102] The ratio of the repair time margin to the estimated repair time is called the time leeway. For example, if the time margin is 60 minutes and the estimated time is 30 minutes, the ratio is 2. The larger this ratio, the more available buffer time there is relative to the time required for the repair operation itself, the higher the operational flexibility, and the stronger the ability to cope with uncertainty. This ratio is mapped to a time leeway correction factor using a predefined function (such as a piecewise linear function or a logarithmic function). This correction factor is used to fine-tune the score corresponding to the basic fit level; the larger the ratio, the larger the correction factor is usually, indicating better fit.

[0103] Step S2525: Based on the numerical value corresponding to the basic adaptation level and the time adequacy correction factor, calculate the time period length adaptation coefficient.

[0104] The base value corresponding to the basic adaptation level determined in step S2523 is combined with the time adequacy correction factor calculated in step S2524. The combination method can be a simple numerical addition, a weighted addition, or an adjustment using the base value as the base and the correction factor as the multiplier. The final calculated value is the time period length adaptation coefficient for that time period. This coefficient is a normalized quantitative value that not only considers the fundamental issue of whether there is enough time, but also incorporates considerations of safety redundancy and operational flexibility, thus enabling a more scientific measurement of the candidate time period's adaptation degree in the time dimension.

[0105] Through layer-by-layer calculation and correction, a refined and multi-dimensional quantitative assessment method for the adaptability of repair period length has been achieved. This avoids the crude judgment based solely on a simple comparison between the total duration of the period and the estimated time. By introducing a benchmark safety margin comparison to determine the basic level, and using the time sufficiency ratio for dynamic correction, the assessment results can ensure that the repair operation has sufficient safety buffer time and reflect the relative sufficiency of time. This provides an accurate and reliable decision-making basis for selecting the repair window with the optimal time matching, significantly improving the feasibility and risk controllability of the repair plan.

[0106] Furthermore, step S200 involves matching the corresponding remediation plan for the asset, including: Step S271: Based on the asset type and the vulnerability type in the vulnerability information, obtain all applicable candidate remediation plans from the preset remediation plan library.

[0107] Based on the current vulnerability and the basic attributes of the asset, the selection of remediation plans is narrowed down from the knowledge base. First, the specific type of the target asset is identified, such as a programmable logic controller (PLC), operator station (HMI), engineer station, or application server. Simultaneously, the vulnerability type in the vulnerability information is analyzed, such as operating system vulnerability, application software vulnerability, communication protocol vulnerability, or configuration defect. Then, a pre-defined remediation plan library is queried. Each remediation plan in this library predefines its applicable asset type and the types of vulnerabilities it can handle. The matching logic identifies all remediation plans whose "applicable asset type" includes the current asset type and whose "handled vulnerability type" includes the current vulnerability type. For example, for a remote code execution vulnerability existing on an operator station based on a Windows operating system, multiple candidate remediation plans might be retrieved, such as "install Windows security patch KBXXXXXX" or "temporarily enable specific rules on the host firewall," ensuring that the considered plans are technically feasible and address the current problem.

[0108] Step S272: Obtain the duration of the repair time window and filter out candidate repair plans whose estimated execution time is less than the duration to form a set of feasible repair plans.

[0109] From the technically feasible candidate solutions, further screening is performed to select solutions that match the determined repair time window in terms of time, ensuring the operation can be completed. The duration of the repair time window finally determined in step S260 is obtained. Simultaneously, each candidate repair solution obtained from step S271 is accompanied by an estimated execution time. This duration is pre-set based on historical operation records or expert evaluation, including the basic time requirements for major repair steps, verification testing, and potential rollback operations. The estimated execution time of each candidate repair solution is compared with the duration of the repair time window, and all solutions with an estimated execution time shorter than the window duration are filtered out. These solutions constitute the feasible repair solution set, excluding those operation plans that, while technically effective, cannot be completed within the allowed time window. For example, a complex system upgrade solution requiring a 4-hour maintenance window would be excluded from the feasible set if the currently available window is only 2 hours.

[0110] Step S273: Calculate the remediation operation risk coefficient for each feasible remediation plan based on the asset's business criticality level and the basic score of vulnerability information.

[0111] For each feasible remediation plan in the set, a risk assessment is performed to quantify the potential risks associated with its operation. The risk coefficient for remediation operations is calculated primarily based on two factors: the business criticality level of the asset and the base score of the vulnerability information (such as the CVSS base score). A higher business criticality level means a greater potential impact from any operation (even a remediation operation) on that asset, requiring more caution. A higher base score for the vulnerability usually means that the remediation operation may be more complex and invasive, potentially requiring the restart of critical services. These two input parameters are converted into a remediation operation risk coefficient using a predefined algorithm or lookup table. For example, for a business criticality level of "critical" and a vulnerability CVSS base score >= 9.0, the initial risk coefficient for any remediation plan will be higher; while for low-scoring vulnerabilities on "general" assets, the risk coefficient for remediation operations will be relatively lower. In addition, the invasiveness of the plan itself (such as whether a restart is required) can also be used as a fine-tuning factor to assess the "possibility that the remediation operation itself will cause business interruption or system anomalies."

[0112] Step S274: Select the feasible repair plan with the lowest repair operation risk coefficient as the repair plan that matches the asset.

[0113] Among all feasible solutions that meet technical and time constraints, the safest and most reliable option is selected. For each solution in the set of feasible remediation plans, its remediation operation risk coefficient calculated in the previous step is compared. Then, the solution with the smallest remediation operation risk coefficient is selected and formally determined as the final remediation plan matching the asset and vulnerability. This selection principle reflects the decision-making idea of ​​minimizing risk, that is, while ensuring that the vulnerability can be remediated, priority is given to those solutions that have the least interference with system operation, the smoothest execution process, and are least likely to cause unexpected situations. For example, between two solutions that can temporarily block the attack path by adjusting the firewall policy and those that require installing patches and restarting the server, if the former's operation risk coefficient is assessed to be lower, then the former is selected as the matching solution.

[0114] Through hierarchical screening and optimization decision-making, an intelligent, risk-aware remediation plan matching mechanism has been implemented. This mechanism can automatically and quickly select the optimal remediation plan from a pre-set plan library that meets the current vulnerability's technical characteristics, can be completed within a given time window, and carries the lowest operational risk. This avoids the subjectivity and uncertainty that may arise from relying on human experience to select plans, ensuring the scientific and safe nature of the remediation operation. Thus, while effectively eliminating security threats, it minimizes the secondary business risks that may be introduced by the remediation operation, guaranteeing the accuracy and reliability of the power generation side industrial control system maintenance work.

[0115] Furthermore, after executing the repair plan within the repair time window in step S300, the following is also included: Step S310: Real-time acquisition of operational index data of key physical equipment in the power generation side industrial control system. The operational index data includes at least the unit vibration amplitude, bearing temperature and outlet steam pressure.

[0116] Continuous monitoring of real-time parameters reflecting the health status of critical physical equipment is conducted. Through an integrated data interface, real-time communication is maintained with sensor networks and monitoring systems (such as Distributed Control Systems (DCS) and Plant-Level Monitoring Information Systems (SIS) deployed at the power generation site. Predefined operational indicator data for critical physical equipment are collected at a fixed frequency (e.g., once per second or every few seconds). These indicators include, but are not limited to: unit vibration amplitude (obtained through shaft vibration sensors to monitor the balance and mechanical faults of rotating machinery), bearing temperature (obtained through thermocouples embedded in bearing pads to monitor lubrication conditions and overheating risks), and outlet steam pressure (obtained through pressure transmitters to monitor the energy balance and stability of the boiler and turbine systems). These parameters are the most direct and critical physical quantities characterizing the safe and stable operation of the generator unit. Real-time monitoring of these parameters effectively detects whether repair operations have caused unacceptable disturbances to the production process.

[0117] Step S320: Compare the collected operational indicator data with their respective safe operational threshold ranges. If any operational indicator data continues to exceed its safe operational threshold range for a preset duration, it is determined that the key operational indicator is abnormal.

[0118] The system compares real-time acquired physical parameters with safety standards to automatically identify and determine abnormal states. A corresponding safe operating threshold range is preset for each monitored operational indicator data point. This range is typically determined based on the equipment manufacturer's specifications, power plant operating procedures, and historical safe operating data, and includes a lower limit and an upper limit, forming a safe operating interval. Real-time acquired data streams (such as vibration, temperature, and pressure values) are continuously compared with their respective threshold ranges. The judgment logic does not immediately trigger an alarm when data momentarily exceeds the limit; instead, a "preset duration" (e.g., 10 or 30 consecutive seconds) is introduced as a judgment condition. Only when an operational indicator data point continuously (i.e., at every subsequent consecutive sampling point) exceeds its safe operating threshold range, and the cumulative duration of this exceeding state reaches or exceeds the preset duration, is it determined to be an abnormality of a critical operational indicator. This mechanism effectively filters out false alarms caused by measurement noise or instantaneous fluctuations, ensuring the accuracy of anomaly judgment and avoiding unnecessary maintenance interruptions.

[0119] Step S330: When a critical operating indicator is abnormal, immediately suspend the execution of the current repair plan and trigger the rollback process. The rollback process includes: calling the system rollback plan corresponding to the currently executed repair plan, executing the operation sequence defined in the system rollback plan, and restoring the control system of the critical physical equipment to the state before the repair operation began.

[0120] If a repair operation is detected as potentially causing an anomaly in the production system, a rapid response and reversal are initiated to prevent escalation. When step S320 determines that a critical operational indicator is abnormal, a high-priority abort command is immediately sent to the automation engine executing the repair plan, unconditionally halting the execution of all current repair operations, regardless of their current stage. Following this, a pre-defined rollback process is automatically triggered. This process first retrieves the precisely corresponding system rollback plan from the rollback plan library based on the unique identifier of the currently executing repair plan. Each repair plan is designed with a detailed rollback plan, defining a series of reverse operations required to restore the system to its state before the repair operation, such as: uninstalling recently installed patches, restoring the original configuration files, reversing adjusted security policies, and restarting stopped services. The operation sequence defined in this rollback plan is then automatically executed. The goal is to quickly restore the control systems of critical physical equipment (including their software configuration, operating parameters, and logical states) to the snapshot state recorded before the repair operation began, thereby eliminating the instability introduced by the repair operation and returning the production system to a known safe and stable state.

[0121] Accordingly, please refer to Figure 2 The second aspect of this invention provides a network security risk assessment and vulnerability remediation linkage device for a power generation side industrial control system, comprising: Risk calculation module 1 is used to calculate a business risk value that characterizes the actual threat level of vulnerabilities to power generation production based on the vulnerability information and business context information of assets in the power generation side industrial control system. Window acquisition module 2 is used to acquire low business risk periods for performing repair operations as repair time windows based on business risk values ​​and real-time operating conditions and planning information of the power plant production management system, and to match corresponding repair plans for assets. Repair execution module 3 is used to execute the repair plan within the repair time window.

[0122] Accordingly, a third aspect of the present invention provides an electronic device, including: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to execute the above-described method for linking network security risk assessment and vulnerability remediation of a power generation side industrial control system.

[0123] Accordingly, a fourth aspect of the present invention provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the above-described method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system.

[0124] This invention aims to protect a method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system, achieving the following effects: 1. By introducing the business criticality level of assets, real-time operating status parameters, and multi-dimensional business impact factors, and using a risk fusion algorithm to dynamically adjust the weight of the basic vulnerability score, the quantitative assessment of security risks is no longer limited to the inherent attributes of the vulnerability itself, but is deeply integrated into the specific business context of power generation production. This solves the problem of traditional general scoring systems such as CVSS being "unsuitable" in industrial control scenarios, and can accurately reflect the actual threat level of a specific vulnerability to power generation business (such as unit control, data acquisition, etc.) under the current operating state, providing a scientific basis for prioritizing the handling of vulnerabilities that pose the greatest threat to production stability. 2. By linking repair actions with the real-time operating status and future plans (such as load forecasting and maintenance plans) of power plant production management systems (such as SIS and MIS), and by comprehensively calculating the load safety period and the system's allowable intervention period, and evaluating the availability score of the period, it is possible to dynamically identify and select the "low business risk period" with the least impact on production as the repair time window; this avoids the secondary risks that may be caused by repairs during high unit load or critical operation periods, minimizes the interference of network security maintenance work on the continuity of power generation, and achieves a high degree of synergy between safe operation and maintenance and production scheduling; 3. It not only provides intelligent matching of remediation plans (based on asset type, vulnerability type, window duration, and operational risk coefficient), but also introduces a real-time security monitoring and automatic rollback mechanism based on the operating indicators of key physical equipment during the remediation execution phase. Once it detects that the remediation operation may cause equipment abnormality, it immediately stops and triggers the rollback process to quickly restore the system to a safe state. This forms a complete closed loop of "assessment-decision-execution-monitoring-rollback", which greatly improves the security and reliability of the remediation operation itself and effectively prevents safety production accidents caused by improper remediation measures.

[0125] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0126] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0127] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0128] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system, characterized in that, Includes the following steps: Based on the vulnerability information of assets in the power generation side industrial control system and the business context information of the assets, a business risk value is calculated to characterize the actual threat level of the vulnerability to the power generation business. Based on the business risk value and the real-time operating status and planning information of the power plant production management system, a low business risk period for performing repair operations is obtained as the repair time window, and a corresponding repair plan is matched for the asset. The repair plan is executed within the repair time window.

2. The method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system according to claim 1, characterized in that, The business risk value, calculated based on vulnerability information of assets in the power generation side industrial control system and the business context information of those assets, characterizes the actual threat level of vulnerabilities to power generation operations. This includes: Obtain several business impact factors associated with the asset and the vulnerability, each business impact factor corresponding to a type of power generation production business interruption, and having a benchmark weight determined based on historical operation and maintenance data; Obtain the corresponding business criticality level of the asset; Real-time acquisition of the asset's operational status parameters; Based on the vulnerability information, the business impact factors and their benchmark weights, the business criticality level, and the operational status parameters, the business risk value is calculated using a risk fusion algorithm. The risk fusion algorithm dynamically adjusts the benchmark weights based on the operational status parameters and the business criticality level.

3. The method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system according to claim 2, characterized in that, The calculation of the business risk value using a risk fusion algorithm, based on the vulnerability information, the business impact factors and their benchmark weights, the business criticality level, and the operational status parameters, includes: Based on the aforementioned operating status parameters, calculate the operating status correction coefficient; Based on the baseline weight of each business impact factor, the operational status correction coefficient, and the business criticality level, the dynamic weight of the business impact factor for the current operational status is calculated. The basic score of the vulnerability information is weighted and fused with the dynamic weights of all business impact factors to calculate a comprehensive impact value that reflects both the inherent threat of the vulnerability and the specific risks of the power generation business context. The comprehensive impact value is mapped to the business risk scoring range to obtain the corresponding business risk value.

4. The method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system according to claim 3, characterized in that, The operating status parameters include at least: unit load rate, equipment start-up and shutdown phase indicators, system network load rate, and alarm status of adjacent systems; The calculation of the operating state correction coefficient based on the operating state parameters includes: Obtain the unit load rate, equipment start-up / shutdown phase identifier, system network load rate, and alarm status of adjacent systems for the assets; A multi-dimensional operating state vector is constructed based on the unit load rate, the equipment start-up and shutdown phase identifier, the system network load rate, and the alarm status of the adjacent systems. The multidimensional operating state vector is input into the multidimensional operating state influence rule base for matching. The multidimensional operating state influence rule base includes several preset multidimensional operating state vectors with different degrees of comprehensive influence on the stability of power generation business and the safety of repair operations. Based on the matching results, obtain the basic impact evaluation value corresponding to the preset multidimensional operating state vector; The operating status correction coefficient is obtained by superimposing the basic impact evaluation value with the dynamic adjustment factor that corresponds to the real-time change trend of the unit load rate.

5. The method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system according to claim 4, characterized in that, The step of inputting the multidimensional operating state vector into the multidimensional operating state influence rule base for matching includes: Calculate the absolute difference in each dimension between the multidimensional running state vector and each preset multidimensional running state vector in the rule base; The absolute differences in all dimensions corresponding to each preset multidimensional running state vector are weighted and summed to obtain the comprehensive distance measure between the preset multidimensional running state vector and the input multidimensional running state vector. The preset multidimensional running state vector with the smallest comprehensive distance measure is selected as the optimal matching result.

6. The method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system according to claim 5, characterized in that, The step of obtaining a low-risk period for performing repair operations as a repair time window based on the business risk value and the real-time operating status and planning information of the power plant production management system includes: Obtain production plan information from the power plant production management system, wherein the production plan information includes planned maintenance periods and future load curve forecast data; Based on the future load curve prediction data, consecutive periods with predicted load rates lower than a first preset threshold are selected and marked as load safe periods. The planned maintenance period and the equipment standby period determined based on real-time equipment status monitoring are logically joined together to obtain the system's permitted intervention period. Perform a logical intersection operation on the load safety period and the system's allowed intervention period to generate an initial candidate repair period set; Calculate the availability score of each time period in the initial candidate repair time period set, and select time periods with scores higher than the second preset threshold to form the final candidate repair time period set; The repair urgency coefficient is calculated based on the business risk value, and the time periods in the final candidate repair time period set are prioritized according to the repair urgency coefficient, and the time period with the highest priority is determined as the repair time window.

7. The method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system according to claim 6, characterized in that, The calculation of the availability score for each time period in the initial candidate repair time period set includes: Based on the future load curve forecast data, calculate the standard deviation of the load change rate during the time period, and obtain the load stability coefficient corresponding to the standard deviation based on the stability mapping table; Obtain the duration of the time period and calculate the time period length adaptation coefficient based on the estimated repair time corresponding to the business risk value; Identify the overlapping portion between the time period and the planned maintenance time period, calculate the proportion of the overlapping portion duration to the total duration of the time period, and obtain the maintenance overlap coefficient; The load stability coefficient, the time period length adaptation coefficient, and the maintenance overlap coefficient are weighted and summed to obtain the time period availability score.

8. The method for linking network security risk assessment and vulnerability remediation in a power generation-side industrial control system according to claim 7, characterized in that, The calculation of the time period length adaptation coefficient includes: Obtain the duration of the time period and the estimated repair time; Calculate the difference between the duration and the estimated repair time to obtain the repair time margin; The repair time margin is compared with the baseline safety margin, and the basic adaptation level is determined based on the comparison result. Based on the ratio of the repair time margin to the estimated repair time, the time adequacy correction factor is calculated. The time period length adaptation coefficient is calculated based on the value corresponding to the basic adaptation level and the time adequacy correction factor.

9. The method for linking network security risk assessment and vulnerability remediation of a power generation-side industrial control system according to any one of claims 1-8, characterized in that, The aforementioned remediation plan for the asset includes: Based on the type of the asset and the vulnerability type in the vulnerability information, all applicable candidate remediation plans are obtained from the preset remediation plan library; The duration of the repair time window is obtained, and candidate repair plans with an estimated execution time shorter than the duration are selected to form a set of feasible repair plans. Based on the business criticality level of the asset and the basic score of the vulnerability information, calculate the remediation operation risk coefficient for each feasible remediation plan; The feasible repair plan with the lowest risk coefficient is selected as the repair plan that matches the asset.

10. The method for linking network security risk assessment and vulnerability remediation of a power generation-side industrial control system according to any one of claims 1-8, characterized in that, After executing the repair plan within the repair time window, the process further includes: Real-time acquisition of operational index data of key physical equipment in the power generation side industrial control system, including at least unit vibration amplitude, bearing temperature and outlet steam pressure; The collected operational indicator data is compared with their respective safe operation threshold ranges. If any operational indicator data exceeds its safe operation threshold range for a preset duration, it is determined to be an abnormal key operational indicator. When the aforementioned key operational indicators become abnormal, the execution of the current remediation plan shall be immediately suspended, and a rollback process shall be triggered. The rollback process includes: invoking the system rollback plan corresponding to the currently executed repair plan, executing the operation sequence defined in the system rollback plan, and restoring the control system of the critical physical equipment to the state before the repair operation began.

Images