Intelligent algorithm data security method and system for electric energy metering box

Abstract

The present application relates to the technical field of electric energy metering box, and more particularly to an intelligent algorithm data security method and system for electric energy metering box. The method generates an evaluation result by obtaining metering data flow and performing time sequence feature analysis and abnormality identification, performs hierarchical encryption on data fields according to risk levels, dynamically schedules cipher data transmission path and timing according to abnormality types, writes into a storage medium and generates integrity check information, verifies integrity based on the check information when data is accessed, and updates a multi-dimensional security evaluation model, thereby improving data security protection capability and integrity guarantee.

Description

Technical Field

[0001] This invention relates to the field of electricity metering box technology, and in particular to an intelligent algorithm data security method and system for electricity metering boxes. Background Technology

[0002] In the field of data security for electricity metering boxes, conventional practices mainly rely on static encryption strategies to uniformly process all metering data streams. Typically, a single encryption algorithm or key is preset, applying the same encryption strength to all fields, and the data is written to storage media at fixed time intervals or along fixed paths after generation. Transmission scheduling is generally based on preset timed tasks or event-triggered mechanisms, lacking the ability to respond to real-time risks in the data stream. Integrity verification is commonly achieved by attaching hash values ​​or digital signatures, but the verification process is independent of subsequent adjustments to security strategies.

[0003] Existing conventional practices have two significant drawbacks. Firstly, static encryption strategies cannot adapt to the dynamic risk characteristics of metering data streams. Because electricity metering boxes experience sudden anomalies or prolonged periods of low risk during operation, applying uniform encryption strength to all data leads to wasted computational resources (e.g., over-encryption in low-risk scenarios) or insufficient encryption strength in high-risk scenarios, making it difficult to balance security and efficiency. Secondly, the disconnect between transmission scheduling and integrity verification limits the self-evolution capability of the security system. Fixed transmission paths and timings are prone to information leakage or transmission congestion during malicious attacks or data anomalies. Furthermore, integrity verification results are only used for data verification and do not form a feedback loop with the encryption strategy or scheduling algorithm, preventing the system from optimizing subsequent security model parameters based on historical verification results. Over long-term operation, the security protection capability gradually weakens. This static architecture struggles to cope with complex and ever-changing new attack methods. Summary of the Invention

[0004] This invention provides a smart algorithm data security method and system for electricity metering boxes, which can solve the problems in the prior art.

[0005] A first aspect of the present invention provides a smart algorithm data security method for electricity metering boxes, comprising: Acquire the metering data stream generated during the operation of the electricity metering box; The measurement data stream is analyzed for time-series features to obtain feature vectors. Anomaly identification is performed on the measurement data stream based on the feature vectors to generate evaluation results. Based on the risk level in the assessment results, the data fields that need to be protected in the metering data stream are subjected to hierarchical encryption processing through a multi-dimensional security assessment model to generate encrypted data. Based on the anomaly type identifier in the evaluation results, the transmission path and timing of the encrypted data are dynamically scheduled, and transmission control instructions are generated. Based on the transmission control command, the encrypted data is written to the storage medium and integrity verification information corresponding to the metering data stream is generated. When the encrypted data is accessed or called, the integrity of the data is verified based on the integrity verification information, and the multi-dimensional security assessment model is updated based on the verification result.

[0006] The measurement data stream is subjected to time-series feature analysis to obtain feature vectors. Based on the feature vectors, anomaly identification is performed on the measurement data stream to generate evaluation results, including: The metering data stream is segmented according to a time window to obtain multiple data segments; For each data segment, extract the time-series statistical features that reflect the trend of data change and the structural features that reflect the distribution pattern of data, and obtain the feature vector based on the time-series statistical features and the structural features; The feature vector is converted into a security status representation by feature space mapping, and the deviation of the security status representation from the preset multi-dimensional security baseline is measured to calculate the deviation quantification index. Based on the deviation quantification index and the temporal correlation of the measurement data stream, the risk level of the current data segment is calculated; Based on the risk level and the preset anomaly determination rules, the anomaly patterns existing in the metering data stream are determined, and the anomaly type identifier is determined. The assessment result is generated based on the anomaly type identifier and the risk level.

[0007] Based on the risk level in the assessment results, the data fields requiring protection in the metering data stream are subjected to graded encryption processing using a multi-dimensional security assessment model to generate ciphertext data, including: The risk level from the assessment results is input into the multi-dimensional security assessment model. The multi-dimensional security assessment model is used to assess the security sensitivity of the data fields in the metering data stream, identify the data fields that need to be protected, and output the corresponding initial encryption level. The multi-dimensional security assessment model is used to analyze the business logic relationships between the data fields that need to be protected, generate a dependency graph, and adjust the initial encryption level of the data field group with related dependencies based on the dependency graph to obtain the adjusted encryption level configuration. The risk level and the adjusted encryption level configuration are used as seed parameters to input the key derivation function, and the derivation key corresponding to each data field in the adjusted encryption level configuration is generated by combining the correlation strength between data fields in the dependency graph. The derived key is used to perform an encryption transformation on the data field to be protected using the encryption strategy determined by the multi-dimensional security assessment model, thereby generating the ciphertext data.

[0008] The multi-dimensional security assessment model analyzes the business logic relationships between the data fields requiring protection, generates a dependency graph, and adjusts the initial encryption level within groups of data fields with dependencies based on the dependency graph to obtain the adjusted encryption level configuration, including: The data fields that need to be protected are input into the multi-dimensional security assessment model. The semantic attributes and business function identifiers of each data field are extracted through the multi-dimensional security assessment model. The semantic similarity and business dependency strength between data fields are calculated based on the semantic attributes and business function identifiers. The data fields are used as nodes, and the relationships and dependencies between data fields are used as edges to generate a dependency graph that reflects the semantic relationships between data fields. The business dependency strength is marked on the edges of the dependency graph. Based on the dependency graph, data field groups with related dependencies are identified. The overall security risk index of each data field group is calculated according to the business dependency strength using the multi-dimensional security assessment model. Based on the overall security risk index, the target encryption level of the data field group is determined. The initial encryption level of each data field in the data field group is compared with the target encryption level. When there is a data field in the data field group with an initial encryption level lower than the target encryption level, the initial encryption level of the data field is adjusted to the target encryption level to obtain the adjusted encryption level configuration.

[0009] Based on the anomaly type identifier in the evaluation results, the transmission path and timing of the encrypted data are dynamically scheduled, and transmission control instructions are generated, including: Based on the anomaly type identifier in the assessment results, extract the threat level and attack pattern characteristics corresponding to the anomaly type identifier; Based on the threat level and attack pattern characteristics, the security of currently available transmission paths is scored, and high-risk transmission paths that match the attack pattern characteristics are identified. The high-risk transmission paths are excluded from the currently available transmission paths to obtain a set of candidate transmission paths, and a path security metric and path load capacity are calculated for each transmission path in the set of candidate transmission paths. Based on the path security metric and path load capacity, a transmission path is selected for the encrypted data, and a transmission timing scheduling strategy for the encrypted data is determined according to the threat level. Based on the transmission path and the transmission timing scheduling strategy, a transmission control instruction containing a transmission path identifier and a transmission time window is generated.

[0010] The high-risk transmission paths are excluded from the currently available transmission paths to obtain a candidate transmission path set. For each transmission path in the candidate transmission path set, a path security metric and path load capacity are calculated, including: The currently available transmission paths are compared with the high-risk transmission paths, and the transmission paths that match the high-risk transmission paths are removed from the currently available transmission paths to obtain a set of candidate transmission paths. For each transmission path in the candidate transmission path set, based on the network node information and link connection information traversed by the transmission path, the historical security event records and current protection capability parameters of each network node are extracted, and the encryption strength and access control level of each link are extracted. The node security coefficient of each network node is calculated based on the historical security event records and current protection capability parameters, and the link security coefficient of each link is calculated based on the encryption strength and access control level. The path security metric of the transmission path is obtained by weighted aggregation of the node security coefficients of all network nodes and the link security coefficients of all links. The path load capacity of the transmission path is determined based on the current transmission load and maximum transmission capacity of each transmission path in the candidate transmission path set.

[0011] Based on the transmission control command, the encrypted data is written to the storage medium and integrity verification information corresponding to the metering data stream is generated. When the encrypted data is accessed or retrieved, the data integrity is verified based on the integrity verification information. Based on the verification result, the multi-dimensional security assessment model is updated, including: The encrypted data is written to the storage medium according to the transmission control command, and the encrypted data is divided into blocks during the writing process, and a block-level checksum is calculated for each data block. The data stream identifier of the measurement data stream is associated and bound with the storage location information of the encrypted data, and the block-level checksum of all data blocks is combined with the data stream identifier to generate integrity check information corresponding to the measurement data stream. When the encrypted data is accessed or called, the currently accessed data block is obtained, and the block-level checksum corresponding to the data block is extracted from the integrity verification information. The real-time block-level checksum is recalculated for the currently accessed data block, and the real-time block-level checksum is compared with the block-level checksum to verify the data integrity, thereby obtaining the verification result; Based on the spatiotemporal distribution characteristics and access behavior characteristics of the verification results, the multi-dimensional security assessment model is updated.

[0012] A second aspect of this invention provides an intelligent algorithm data security system for electricity metering boxes, comprising: The data acquisition unit is used to acquire the metering data stream generated during the operation of the electricity metering box; An anomaly identification unit is used to perform time-series feature parsing on the metering data stream to obtain feature vectors, perform anomaly identification on the metering data stream based on the feature vectors, and generate evaluation results. The hierarchical encryption unit is used to perform hierarchical encryption processing on the data fields that need to be protected in the metering data stream according to the risk level in the assessment results, and generate ciphertext data through a multi-dimensional security assessment model. The dynamic scheduling unit is used to dynamically schedule the transmission path and timing of the encrypted data according to the anomaly type identifier in the evaluation result, and generate transmission control instructions. The integrity verification unit is used to write the encrypted data into the storage medium based on the transmission control command and generate integrity verification information corresponding to the metering data stream. When the encrypted data is accessed or called, the integrity of the data is verified based on the integrity verification information, and the multi-dimensional security assessment model is updated based on the verification result.

[0013] A third aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0014] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0015] This invention enables real-time anomaly identification of electricity metering data streams. Based on time-series feature analysis, it obtains feature vectors, accurately capturing anomaly patterns in the data stream and generating accurate assessment results. According to the risk level in the assessment results, data fields are subjected to tiered encryption processing. This ensures strong encryption protection for high-risk data while avoiding excessive encryption loss for low-risk data, thus achieving an optimal balance between encryption strength and processing efficiency, significantly improving the overall targeting of security protection and resource utilization.

[0016] This invention dynamically schedules the transmission path and timing of encrypted data based on anomaly type identifiers in the evaluation results, effectively avoiding potential interception or attack windows and reducing the risk of data tampering or leakage during transmission. Integrity verification information is generated synchronously when encrypted data is written to the storage medium, automatically verifying data integrity during subsequent access or retrieval, ensuring data reliability throughout its entire lifecycle from generation to use. If integrity breaches are detected, a timely response and cause tracing are possible.

[0017] This invention updates a multi-dimensional security assessment model based on integrity verification results, enabling the model to continuously optimize itself according to data anomalies encountered in actual operation, adapting to new attack methods and changes in metering data, forming a feedback loop. Under long-term operation, the security protection strategy remains synchronized with real risks, avoiding the lag of static models and significantly improving the long-term stability and adaptability of the electricity metering box data security system. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the intelligent algorithm data security method for electricity metering boxes according to an embodiment of the present invention. Figure 2 This is a schematic diagram of the process for generating evaluation results according to an embodiment of the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0021] Figure 1 This is a flowchart illustrating the intelligent algorithm data security method for electricity metering boxes according to an embodiment of the present invention. Figure 1 As shown, the method includes: Acquire the metering data stream generated during the operation of the electricity metering box; The measurement data stream is analyzed for time-series features to obtain feature vectors. Anomaly identification is performed on the measurement data stream based on the feature vectors to generate evaluation results. Based on the risk level in the assessment results, the data fields that need to be protected in the metering data stream are subjected to hierarchical encryption processing through a multi-dimensional security assessment model to generate encrypted data. Based on the anomaly type identifier in the evaluation results, the transmission path and timing of the encrypted data are dynamically scheduled, and transmission control instructions are generated. Based on the transmission control command, the encrypted data is written to the storage medium and integrity verification information corresponding to the metering data stream is generated. When the encrypted data is accessed or called, the integrity of the data is verified based on the integrity verification information, and the multi-dimensional security assessment model is updated based on the verification result.

[0022] Figure 2 This is a schematic diagram illustrating the process of generating evaluation results according to an embodiment of the present invention. Figure 2 As shown, a feature vector is obtained by performing time-series feature analysis on the metering data stream. Based on the feature vector, anomaly identification is performed on the metering data stream to generate an evaluation result, including: The metering data stream is segmented according to a time window to obtain multiple data segments; For each data segment, extract the time-series statistical features that reflect the trend of data change and the structural features that reflect the distribution pattern of data, and obtain the feature vector based on the time-series statistical features and the structural features; The feature vector is converted into a security status representation by feature space mapping, and the deviation of the security status representation from the preset multi-dimensional security baseline is measured to calculate the deviation quantification index. Based on the deviation quantification index and the temporal correlation of the measurement data stream, the risk level of the current data segment is calculated; Based on the risk level and the preset anomaly determination rules, the anomaly patterns existing in the metering data stream are determined, and the anomaly type identifier is determined. The assessment result is generated based on the anomaly type identifier and the risk level.

[0023] When performing time-series feature analysis on metering data streams, the primary operation is to segment the continuous data stream according to time windows. The length of the time window can be flexibly configured based on the sampling frequency of the electricity metering box and the business scenario. For example, for high-frequency sampling scenarios, the window length can be set to the level of several seconds, while for low-frequency sampling scenarios, the window length can be set to the level of minutes. The data within each time window constitutes an independent data segment, and a certain proportion of overlapping areas can be set between adjacent windows to avoid feature breakage caused by window boundary cutting. By segmenting the data stream, the continuous time-series signal is transformed into discrete data units that can be analyzed one by one, laying the foundation for subsequent feature extraction.

[0024] For each data segment, temporal statistical features and structural features are extracted. Temporal statistical features reflect the changing trend of the data over time, specifically including statistics such as the mean, variance, slope, range, and autocorrelation coefficient of the data within the segment. The mean reflects the overall level of the data, the variance measures the degree of data fluctuation, the slope describes the direction and strength of the linear trend, and the autocorrelation coefficient characterizes the dependence of the data at different times. Structural features reflect the distribution pattern of the data, specifically including kurtosis, skewness, frequency domain energy distribution, and the number of abrupt changes. Kurtosis and skewness describe the sharpness and symmetry of the data distribution relative to a normal distribution, the frequency domain energy distribution is obtained through spectral analysis of the data segment, and the number of abrupt changes is counted by detecting the number of times the absolute value of the difference between adjacent sampling points exceeds a threshold. The above temporal statistical features and structural features are concatenated to form a feature vector v describing the comprehensive characteristics of the current data segment, the dimension of which depends on the total number of extracted features.

[0025] After obtaining the feature vector v, it is transformed into a safety state representation through feature space mapping. Feature space mapping uses a pre-trained mapping function to project the high-dimensional feature vector onto the safety state space, obtaining the safety state representation s. The mapping function can be implemented using linear transformation, kernel function mapping, or nonlinear mapping based on deep networks, with the specific choice determined based on the computing resources and accuracy requirements of the electricity metering box. The position of the safety state representation s in the safety state space directly reflects the safety state of the current data segment.

[0026] The deviation between the safety status representation *s* and the preset multi-dimensional safety baseline *b* is measured, and the deviation quantification index *d* is calculated. The multi-dimensional safety baseline *b* is obtained through statistical analysis of historical normal operation data and represents the safety status center of the electricity metering box under normal operating conditions. The deviation quantification index *d* comprehensively considers the differences between the safety status representation and the baseline in various dimensions, and can be measured using weighted Euclidean distance. , where s k For the k-th component of the safety state characterization s, b k For the k-th component of the multi-dimensional security baseline b, w k Let w be the weight coefficient for the k-th dimension, where K is the total number of dimensions in the safe state space. k Based on the pre-defined importance of each dimension in assessing safety status, higher weights are assigned to dimensions directly related to electricity metering accuracy, while lower weights are assigned to auxiliary dimensions. The larger the deviation quantification index d, the greater the degree to which the current data segment deviates from the normal safety baseline.

[0027] Based on the calculated deviation quantification index d, the risk level of the current data segment needs to be comprehensively assessed by combining the temporal correlation of the measurement data stream. Temporal correlation analysis is achieved through the deviation quantification index sequence of multiple consecutive data segments within a sliding window. If the deviation quantification indices of multiple consecutive segments all show a continuously increasing trend, a strong temporal correlation anomaly is considered to exist, requiring correction by introducing a temporal accumulation factor λ in the risk level calculation. The risk level R is calculated by combining the deviation quantification index d and the temporal accumulation factor λ, specifically expressed as R = d·(1 + α·λ), where α is the adjustment coefficient for temporal correlation, used to control the weight ratio of the temporal accumulation effect in the risk level assessment. The risk level R is ultimately mapped to a predefined level range, such as divided into four levels: low risk, medium risk, high risk, and extremely high risk, with different subsequent processing strategies corresponding to different levels.

[0028] Based on the calculated risk level R and preset anomaly judgment rules, anomaly patterns in the metering data stream are identified and classified to determine anomaly type identifiers. These anomaly judgment rules are stored in a rule base, covering various typical anomaly patterns, including data tampering anomalies, equipment failure anomalies, communication interference anomalies, and energy theft anomalies. Each rule in the rule base consists of a mapping relationship between feature conditions and anomaly types. The feature conditions are described based on the specific feature value range and combination patterns in the feature vector v. For example, when the skewness feature exceeds the normal range and the number of abrupt change points increases significantly, the rule base matches it to a data tampering anomaly; when the variance feature is consistently low and the frequency domain energy distribution is abnormal, the rule base matches it to an equipment failure anomaly. In cases where multiple rules are satisfied simultaneously, the rule is adjudicated according to its priority, and the anomaly type identifier corresponding to the rule with higher priority is ultimately adopted. The anomaly type identifier is represented in encoded form, facilitating efficient parsing and scheduling in subsequent processing flows.

[0029] Based on the identified anomaly type identifier and risk level R, a complete assessment result is generated. This result includes three core fields: a risk level marker for the current data segment, an anomaly type identifier code, and its associated timestamp. The risk level marker guides subsequent tiered encryption processing strategies, the anomaly type identifier code guides dynamic scheduling decisions regarding transmission paths and timing, and the timestamp ensures a precise correspondence between the assessment result and the original metering data stream. The assessment result is stored in a structured data format after generation and synchronously transmitted to subsequent processing stages, ensuring information consistency and traceability throughout the entire data security processing flow. In practical applications, if a data segment is determined to be at an extremely high risk level and the anomaly type identifier indicates data tampering, the subsequent processing flow will immediately trigger the highest-strength encryption strategy and initiate emergency transmission scheduling, thereby achieving rapid response and effective protection against threats to electricity metering data security.

[0030] Based on the risk level in the assessment results, the data fields requiring protection in the metering data stream are subjected to graded encryption processing using a multi-dimensional security assessment model to generate ciphertext data, including: The risk level from the assessment results is input into the multi-dimensional security assessment model. The multi-dimensional security assessment model is used to assess the security sensitivity of the data fields in the metering data stream, identify the data fields that need to be protected, and output the corresponding initial encryption level. The multi-dimensional security assessment model is used to analyze the business logic relationships between the data fields that need to be protected, generate a dependency graph, and adjust the initial encryption level of the data field group with related dependencies based on the dependency graph to obtain the adjusted encryption level configuration. The risk level and the adjusted encryption level configuration are used as seed parameters to input the key derivation function, and the derivation key corresponding to each data field in the adjusted encryption level configuration is generated by combining the correlation strength between data fields in the dependency graph. The derived key is used to perform an encryption transformation on the data field to be protected using the encryption strategy determined by the multi-dimensional security assessment model, thereby generating the ciphertext data.

[0031] After inputting the risk level from the assessment results into the multi-dimensional security assessment model, the model first performs a security sensitivity assessment on each data field in the metering data stream. The core of the security sensitivity assessment lies in comprehensively scoring the content attributes, business uses, and potential leakage hazards of each data field. Specifically, for common data fields in the electricity metering box scenario, including user identifiers, electricity readings, timestamps, rate parameters, device serial numbers, and communication verification codes, the multi-dimensional security assessment model assigns scores to each field in three sub-dimensions—privacy, integrity requirements, and substitutability—based on a preset sensitivity rule base, and then comprehensively weights these scores to obtain the security sensitivity score for that field. When the risk level is high, the model will correspondingly increase the sensitivity threshold of each field, so that more fields are identified as fields requiring protection, and output an initial encryption level for them. The initial encryption level is usually divided into three levels: low, medium, and high, corresponding to different strengths of encryption algorithm selection. For example, low level corresponds to lightweight stream encryption, medium level corresponds to symmetric block encryption, and high level corresponds to an authentication-based encryption mode.

[0032] After identifying the data fields requiring protection and obtaining the initial encryption level for each field, the multi-dimensional security assessment model further analyzes the business logic relationships between these fields. This analysis relies on the inherent data dependency structure in electricity metering operations: for example, there is a strong dependency between the rate parameter field and the electricity reading field, as the rate parameter directly affects the calculation of the billing result; there is a temporal correlation between the timestamp field and the electricity reading field, because the reading must be bound to the time of collection to have business significance; and there is a mapping relationship between the user identifier field and the device serial number field, as both jointly determine the subject of the metering data. Through a systematic analysis of these relationships, the multi-dimensional security assessment model constructs a dependency graph with data fields as nodes and relationships as edges. Each edge in the dependency graph also includes a relationship strength value, used to quantify the degree of dependency between two fields. A higher relationship strength means that the two fields are more difficult to separate and process in terms of business logic.

[0033] Based on the dependency graph, the initial encryption level of data fields with related dependencies is adjusted for consistency. The principle of consistency adjustment is that fields within the same dependency group should adopt a unified encryption level no lower than the highest initial encryption level within the group. This prevents attackers from indirectly inferring the content of high-protection-level fields by attacking related fields with lower protection levels. For example, if the initial encryption level of the rate parameter field is high, while the initial encryption level of its strongly dependent energy reading field is medium, then after consistency adjustment, the encryption level of the energy reading field is increased to high, thus ensuring consistent security protection strength across the entire dependency group. After consistency adjustment, all data fields requiring protection receive the adjusted encryption level configuration, which better reflects the actual security needs arising from the mutual influence between fields compared to the initial encryption level.

[0034] In the key derivation phase, the risk level and the adjusted encryption level configuration are used as seed parameters input to the key derivation function. The design of the key derivation function must meet the requirements of one-wayness, collision resistance, and randomness of the output key, and is usually constructed based on a hash function with a key. Let the numerical representation of the risk level be r, and a certain data field f i The adjusted encryption level is numerically represented as e. i The mean association strength between this field and other fields in its dependency group is ρ. i Then for field f i Derived key K i Generate in the following way: r, e i ρ i The system-level master key M is concatenated and input into the key derivation function, which outputs a fixed-length derived key K. i Correlation strength ρ iThe introduction of this feature allows keys derived from fields within high-association-strength dependency groups to incorporate more contextual information during generation. This ensures traceable relationships between derived keys from different fields, aiding in the detection of cross-field tampering during subsequent integrity verification. For isolated fields in the dependency graph that do not belong to any dependency group, their association strength ρ... i By setting the value to zero, key derivation relies solely on the risk level and encryption level configuration, ensuring the consistency of the derivation process.

[0035] When using derived keys to perform encryption transformations on each data field requiring protection, the multi-dimensional security assessment model determines a specific encryption strategy for each field based on the adjusted encryption level configuration. The determination of the encryption strategy includes not only the selection of the encryption algorithm but also detailed parameters such as the encryption mode, the generation method of the initialization vector, and whether to attach a message authentication code. For high-level fields, an authentication-enabled encryption mode is used to encrypt the field content. During encryption, the field name and its node identifier in the dependency graph are used as additional authentication data in the calculation of the authentication tag, thereby binding the field's structural information to the ciphertext and preventing the ciphertext from being shifted or replaced during storage or transmission. For medium-level fields, a block cipher algorithm combined with a random initialization vector is used to encrypt the field content. The initialization vector is generated independently each time encryption is performed and stored along with the ciphertext to ensure that the same plaintext produces different ciphertexts in different encryption instances. For low-level fields, a lightweight stream cipher algorithm is used to encrypt the field content, reducing computational overhead while ensuring basic confidentiality, adapting to the deployment environment where edge computing resources are limited for electricity metering boxes.

[0036] After undergoing the aforementioned encryption transformation, all data fields requiring protection, along with their ciphertext and the plaintext of unprotected non-sensitive fields, constitute the final ciphertext data. Each encrypted field in the ciphertext data carries its corresponding encryption level identifier, initialization vector or random number, and authentication tag (if applicable) to accurately reconstruct the encryption context during subsequent decryption and integrity verification stages. The overall structure of the ciphertext data retains the field layout framework of the original metering data stream, only replacing the content of sensitive fields with their corresponding ciphertext. This structured ciphertext design facilitates rapid retrieval and statistical analysis of non-sensitive fields without complete decryption, while maintaining complete encryption protection for sensitive fields. Through the aforementioned hierarchical encryption process, data fields with different security requirements in the metering data stream receive encryption protection strengths matching their risk levels and business relevance, achieving refined allocation of security protection resources.

[0037] The multi-dimensional security assessment model analyzes the business logic relationships between the data fields requiring protection, generates a dependency graph, and adjusts the initial encryption level within groups of data fields with dependencies based on the dependency graph to obtain the adjusted encryption level configuration, including: The data fields that need to be protected are input into the multi-dimensional security assessment model. The semantic attributes and business function identifiers of each data field are extracted through the multi-dimensional security assessment model. The semantic similarity and business dependency strength between data fields are calculated based on the semantic attributes and business function identifiers. The data fields are used as nodes, and the relationships and dependencies between data fields are used as edges to generate a dependency graph that reflects the semantic relationships between data fields. The business dependency strength is marked on the edges of the dependency graph. Based on the dependency graph, data field groups with related dependencies are identified. The overall security risk index of each data field group is calculated according to the business dependency strength using the multi-dimensional security assessment model. Based on the overall security risk index, the target encryption level of the data field group is determined. The initial encryption level of each data field in the data field group is compared with the target encryption level. When there is a data field in the data field group with an initial encryption level lower than the target encryption level, the initial encryption level of the data field is adjusted to the target encryption level to obtain the adjusted encryption level configuration.

[0038] Before implementing tiered encryption on the data fields requiring protection, the multi-dimensional security assessment model does not evaluate each field in isolation. Instead, it first analyzes the potential business logic relationships between fields. During operation, electricity metering boxes generate various types of data fields, such as active power readings, reactive power readings, voltage sampling values, current sampling values, rate period identifiers, and user numbers. These fields often have deep semantic dependencies at the business level—for example, rate calculation results depend on period identifiers and power readings, and power settlement data depends on user numbers and metering pulse counts. If fields are encrypted independently while ignoring the relationships between them, high-risk fields may be "dragged down" by lower-protection-level fields due to dependency chains, creating a data security vulnerability.

[0039] After inputting the data fields requiring protection into the multi-dimensional security assessment model, the model performs semantic attribute extraction and business function identifier parsing for each field. Semantic attribute extraction refers to obtaining a semantic description vector for the field by comprehensively analyzing its name, value range, data type, and semantic role in the metering business process. The business function identifier reflects the specific functional category that the field undertakes in the metering business process, such as metering collection, settlement calculation, identity identification, and time sequence control. Based on the above semantic attributes and business function identifiers, the semantic similarity and business dependency strength between any two data fields are calculated. Semantic similarity measures the degree of closeness between two fields at the semantic level, while business dependency strength quantifies the degree to which the value or validity of one field depends on the other field in terms of business logic. Let field f... i With field f j The business dependency strength between them is The larger the value, the tighter the coupling between the two fields in terms of business logic, and the more consistent the encryption level configuration needs to be.

[0040] Using data fields as nodes and the relationships between fields as directed edges, construct a dependency graph that reflects the semantic relationships between fields. In the dependency graph, if field f i The business logic depends on field f. j Then establish a diagram from f i Point to f j The directed edges are labeled with the corresponding business dependency strength. This graph structure visually presents the dependency topology between data fields, identifying which fields are at the core of the dependency chain (i.e., key nodes depended on by multiple fields) and which fields are at the end of the dependency chain (i.e., only dependent on other fields and not depended on by other fields). The construction of this dependency graph not only provides a structural foundation for subsequent adjustments to encryption level consistency but also offers a visual data association reference for security auditing and anomaly tracing.

[0041] Based on dependency graphs, groups of data fields with associated dependencies are identified through connectivity analysis or community detection algorithms. (p = 1, 2, ..., P, where P is the total number of field groups). The fields within each field group are logically interconnected, forming a functional semantic unit. For each field group, the multi-dimensional security assessment model assesses the initial security risk score of each field within the group and the strength of business dependencies between fields. Calculate the overall security risk index Q for this field group. p Overall security risk indicator Q pThe risk level of the highest-risk field within a field group, the weighted distribution of dependencies between fields, and the importance of the field group in the overall metering process were all taken into consideration. p The higher the value, the greater the exposure risk of this field group within the overall data security system, requiring a higher level of encryption protection. Based on Q... p The calculation results are used to determine the target encryption level for each field group. There is a monotonic mapping relationship between the target encryption level and the overall security risk index, i.e., Q p The larger, The higher.

[0042] Determine the target encryption level Then, for each data field f in the field group i Initial encryption level Encryption level of the target Perform a comparison one by one. When If the initial encryption level of this field is lower than the overall security requirement of its field group, it indicates a security vulnerability due to dependency chain propagation. In this case, the encryption level of this field should be adjusted upwards. That is, the adjusted encryption level ;when At that time, the initial encryption level of this field already meets the overall security requirements of the field group, and the original encryption level remains unchanged. This adjustment logic ensures that the encryption level of all fields within a field group is no lower than the group-level target encryption level, thereby eliminating security vulnerabilities caused by inconsistencies in encryption levels between fields.

[0043] After the aforementioned consistency adjustments, the adjusted encryption level configuration is obtained. Each data field requiring protection is assigned a final encryption level that comprehensively considers its own risk score and the overall security requirements of the field group. This configuration will serve as the input basis for subsequent derived key generation and encryption algorithm selection, ensuring that at the field-level encryption granularity, both the security requirements of individual fields are taken into account, and the consistency and coordination of the overall encryption strength of field groups with business relationships are guaranteed. The dependency graph itself will also be dynamically updated as the metering business logic evolves or new data fields are introduced. The multi-dimensional security assessment model will revise the business dependency strength estimate between fields after each integrity verification result feedback, so that the dependency graph continuously reflects the latest business relationship structure, ensuring the timeliness and accuracy of the encryption level configuration.

[0044] Based on the anomaly type identifier in the evaluation results, the transmission path and timing of the encrypted data are dynamically scheduled, and transmission control instructions are generated, including: Based on the anomaly type identifier in the assessment results, extract the threat level and attack pattern characteristics corresponding to the anomaly type identifier; Based on the threat level and attack pattern characteristics, the security of currently available transmission paths is scored, and high-risk transmission paths that match the attack pattern characteristics are identified. The high-risk transmission paths are excluded from the currently available transmission paths to obtain a set of candidate transmission paths, and a path security metric and path load capacity are calculated for each transmission path in the set of candidate transmission paths. Based on the path security metric and path load capacity, a transmission path is selected for the encrypted data, and a transmission timing scheduling strategy for the encrypted data is determined according to the threat level. Based on the transmission path and the transmission timing scheduling strategy, a transmission control instruction containing a transmission path identifier and a transmission time window is generated.

[0045] After obtaining the anomaly type identifier from the assessment results, dynamically scheduling the transmission path and timing of the encrypted data is a crucial step in ensuring secure data transmission. The anomaly type identifier is not a simple Boolean symbol but carries multi-dimensional semantic information, including the source type of the anomaly (such as replay attacks, man-in-the-middle attacks, data tampering, denial-of-service attacks, etc.) and the corresponding threat level. By parsing the anomaly type identifier, the threat level and attack pattern characteristics corresponding to that anomaly type can be extracted. The threat level reflects the severity of potential attacks in the current network environment, while the attack pattern characteristics describe the attacker's habitual path selection preferences, time window patterns, and traffic characteristics. These two types of information together form the input basis for subsequent transmission scheduling decisions.

[0046] After extracting threat levels and attack pattern characteristics, a security score is assigned to the currently available transmission paths. This score comprehensively considers the path's historical anomaly records, the trustworthiness rating of the nodes the path traverses, the path's encryption protocol support capabilities, and the path's exposure risk under the current attack pattern. Specifically, the attack pattern characteristics are matched against a known attack vector library to identify transmission paths that highly match the current attack pattern characteristics, marking these paths as high-risk transmission paths. The identification of high-risk transmission paths relies on similarity calculations between the attack pattern feature vector and the path risk profile. Let the current attack pattern feature vector be 'a', and the risk profile vector of the nth transmission path be 'c'. n Then the matching score σ between the two is n It can be represented as: ; When σ nWhen the risk exceeds the preset high-risk threshold θ, the nth path is identified as a high-risk transmission path and removed from the set of available paths, thus obtaining a set of candidate transmission paths.

[0047] After the candidate transmission path set is determined, the path security metric and path load capacity are calculated for each transmission path in the set. This comprehensively reflects the overall security of the path under the current threat environment. Its calculation integrates three sub-indicators: the average trustworthiness of path nodes, the path's historical integrity pass rate, and the security strength of the path protocol. Each sub-indicator is weighted and aggregated according to preset weights. Path load capacity. This describes the maximum data transmission capacity that the path can currently carry. It is dynamically estimated by collecting the path bandwidth utilization and queue buffer status in real time, ensuring that the selected path can carry encrypted data without causing transmission delays or packet loss due to excessive load, thereby avoiding data integrity risks.

[0048] Based on path security metrics With path load capacity The paths in the candidate transmission path set are comprehensively ranked, and the path with the best comprehensive score is selected as the transmission path for the encrypted data. (Comprehensive score) The calculation method is as follows: ; in Let μ be the normalized load capacity of the nth path, and μ be the balance coefficient between security and load capacity, with a value range of (0, 1). Its specific value is dynamically adjusted by the current threat level. The higher the threat level, the larger the value of μ, which means that in high-threat scenarios, priority is given to ensuring transmission security rather than pursuing high throughput.

[0049] The timing of transmission scheduling also depends on the threat level. At low threat levels, an immediate transmission mode is used, where encrypted data is transmitted immediately after the path is selected. At medium threat levels, a time-distributed transmission mode is used, where encrypted data is split into several fragments and sent randomly over time to reduce the possibility of attackers locating data transmission patterns through traffic analysis. At high threat levels, a delayed obfuscation transmission mode is used, introducing random delays before transmission. Furthermore, it inserts noisy traffic during transmission, making genuine data transmission behavior difficult to identify. Delay time Based on the normalized value η of the current threat level and the base latency parameters of the system configuration. The specific relationship is jointly determined as follows: ; Where η is the normalized value of the current threat level, and the value range is [0, 1]. The higher the threat level, the larger η is, and the longer the corresponding transmission delay is, thus providing stronger protection for encrypted data in the time dimension.

[0050] After the transmission path and transmission timing scheduling strategy are determined, the above decision results are encapsulated into a structured transmission control instruction. The transmission control instruction contains two core fields: a transmission path identifier and a transmission time window. The transmission path identifier is a unique code for the selected transmission path, containing the identification information of the path's starting point, the sequence of nodes passed through, and the ending point. This allows the execution layer to accurately route data according to the specified path, avoiding ciphertext data passing through high-risk nodes due to path drift. The transmission time window is generated by the transmission timing scheduling strategy, describing the start and end times when ciphertext data is allowed to be transmitted, as well as the transmission interval for each data fragment in the time-distributed mode. After generation, the transmission control instruction is appended with a timestamp and an integrity digest to prevent the instruction itself from being tampered with during transmission.

[0051] The activation process of transmission control commands is tightly coupled with the actual transmission of encrypted data. Upon receiving a transmission control command, the execution layer first verifies the integrity digest of the command. After confirming that the command has not been tampered with, it establishes a transmission channel according to the transmission path identifier in the command and triggers the data transmission process when the transmission time window arrives. If a change in path status is detected within the transmission time window (e.g., the selected path experiences a sharp drop in security score due to node failure or new attack behavior), a path rescheduling process is triggered. A suboptimal path is reselected from the candidate transmission path set, and the transmission path identifier in the transmission control command is updated, ensuring that encrypted data is always transmitted via a secure and reliable path. This entire dynamic scheduling process forms a closed-loop feedback mechanism, continuously adapting to changes in the network threat environment and providing reliable protection for the secure transmission of metering data from the electricity metering box.

[0052] The high-risk transmission paths are excluded from the currently available transmission paths to obtain a candidate transmission path set. For each transmission path in the candidate transmission path set, a path security metric and path load capacity are calculated, including: The currently available transmission paths are compared with the high-risk transmission paths, and the transmission paths that match the high-risk transmission paths are removed from the currently available transmission paths to obtain a set of candidate transmission paths. For each transmission path in the candidate transmission path set, based on the network node information and link connection information traversed by the transmission path, the historical security event records and current protection capability parameters of each network node are extracted, and the encryption strength and access control level of each link are extracted. The node security coefficient of each network node is calculated based on the historical security event records and current protection capability parameters, and the link security coefficient of each link is calculated based on the encryption strength and access control level. The path security metric of the transmission path is obtained by weighted aggregation of the node security coefficients of all network nodes and the link security coefficients of all links. The path load capacity of the transmission path is determined based on the current transmission load and maximum transmission capacity of each transmission path in the candidate transmission path set.

[0053] In obtaining the candidate transmission path set, each currently available transmission path needs to be compared with the identified high-risk transmission paths one by one. During the comparison, the path identifier is used as the index key to perform a matching check on each path in the currently available transmission path set. If the identifier of a path matches the identifier of any path in the high-risk transmission path set, that path is marked as an item to be removed. After all comparisons are completed, all marked paths are removed in batches from the currently available transmission path set, and the remaining paths constitute the candidate transmission path set. This process ensures that subsequent path evaluation and selection are only conducted within the scope of paths with controllable security risks, avoiding the risk of data leakage or tampering caused by the transmission of encrypted data on known high-risk paths.

[0054] For each transmission path in the candidate transmission path set, it is necessary to extract all network node information and link connection information traversed by the path. Network node information includes node number, node type (e.g., switching node, routing node, gateway node), network region where the node is located, and the node's current operating status. Link connection information includes the node numbers at both ends of the link, link type (wired or wireless), current communication protocol, and physical layer parameters. Based on the above topology information, historical security event records for each network node are further extracted from the security event log database. These records contain the frequency and severity of various security events, such as the number of intrusion attempts, abnormal login events, and abnormal packet drops, that occurred within the past statistical period. Simultaneously, the current protection capability parameters for each node are extracted, including the version of the firewall policy deployed on the node, the timestamp of intrusion detection rule updates, vulnerability patch completion rate, and security patch coverage, among other quantitative indicators.

[0055] At the link level, the encryption strength and access control level of each link are extracted. The encryption strength is quantified based on the type of encryption algorithm and key length used in the link. For example, a link using a high-strength symmetric encryption algorithm and a key length of 256 bits corresponds to a higher encryption strength value, while a link using lower-strength encryption or no encryption corresponds to a lower value. The access control level is graded and evaluated according to the strictness of the identity authentication mechanism implemented by the nodes at both ends of the link, the granularity of the access control policy, and the level of permission control. The higher the level, the stronger the link's ability to resist unauthorized access.

[0056] Calculate the node security coefficient for each network node based on its historical security event records and current protection capability parameters. Here, j is the network node index. The calculation of the node security coefficient comprehensively considers the weighted average severity of historical security events and the comprehensive score of the current protection capability parameters. The higher the severity and frequency of historical security events, the more negatively they contribute to the node security coefficient; conversely, the higher the score of the current protection capability parameters, the more positively they contribute to the node security coefficient. Specifically, let H be the comprehensive risk score of historical security events for node j. j The current overall rating for protection capability is C. j Then the node safety factor can be expressed as This expression ensures that nodes with stronger protection capabilities and lower historical risks have a higher security coefficient. Regarding the link security coefficient... (where l is the link index), based on the link encryption strength quantization value E l Access control level quantization value A l We obtain the result by weighted summation, i.e. , where β E β is a weighting factor for encryption strength. A These are the weighting coefficients for the access control level; both are preset positive numbers and satisfy β. E +β A =1, to ensure that the link security coefficient is normalized within a reasonable range.

[0057] The path security metric for the transmission path is obtained by weighted aggregation of the node security coefficients of all network nodes and the link security coefficients of all links along the transmission path. (n is the index of the candidate transmission path, consistent with the existing parameter system). During aggregation, node weights are assigned to the security coefficients of each node on the path. Assign link weights to each link's security coefficient. The path security metric is obtained by combining the weighted average of node security coefficients and the weighted average of link security coefficients in a certain proportion. Node weights can be differentiated based on the importance of a node's position in the path (e.g., entry and exit nodes have higher weights than intermediate forwarding nodes); link weights can be set based on the proportion of data carried by the link or the link's criticality in the path. The result of the weighted aggregation... The higher the value, the stronger the overall security of the candidate transmission path, and the more suitable it is as a transmission channel for encrypted data.

[0058] Path load capacity The determination is based on two indicators: the current transmission load of the candidate transmission path and the maximum transmission capacity. The maximum data throughput that this transmission path can carry per unit time under ideal conditions is determined by the bottleneck value of the bandwidth of each link on the path (i.e., the capacity of the minimum bandwidth link); the current transmission load. This represents the actual data traffic carried by the path at the current moment. Path load capacity is defined as the ratio of the path's remaining available transmission capacity to its maximum transmission capacity, i.e. This value ranges from 0 to 1. The closer the value is to 1, the lighter the current load on the path and the more abundant the available transmission resources. The closer the value is to 0, the more saturated the path is. The introduction of path load capacity ensures that not only safety is considered when selecting a path, but also transmission efficiency and reliability are taken into account. This avoids excessive data transmission delays or increased packet loss rates due to path overload, which would affect the real-time performance and integrity of electricity metering data.

[0059] Through the above process, each path in the candidate transmission path set obtains a corresponding path security metric value. With path load capacity This provides a complete quantitative basis for subsequent comprehensive scoring and optimal transmission path selection. In actual deployment, the extraction of network node information and link connection information can be achieved through periodic reporting by the network topology-aware agent, while historical security event records and protection capability parameters are centrally maintained by the security event management platform and provided with query interfaces, ensuring that the data sources on which path evaluation relies are timely and accurate.

[0060] Based on the transmission control command, the encrypted data is written to the storage medium and integrity verification information corresponding to the metering data stream is generated. When the encrypted data is accessed or retrieved, the data integrity is verified based on the integrity verification information. Based on the verification result, the multi-dimensional security assessment model is updated, including: The encrypted data is written to the storage medium according to the transmission control command, and the encrypted data is divided into blocks during the writing process, and a block-level checksum is calculated for each data block. The data stream identifier of the measurement data stream is associated and bound with the storage location information of the encrypted data, and the block-level checksum of all data blocks is combined with the data stream identifier to generate integrity check information corresponding to the measurement data stream. When the encrypted data is accessed or called, the currently accessed data block is obtained, and the block-level checksum corresponding to the data block is extracted from the integrity verification information. The real-time block-level checksum is recalculated for the currently accessed data block, and the real-time block-level checksum is compared with the block-level checksum to verify the data integrity, thereby obtaining the verification result; Based on the spatiotemporal distribution characteristics and access behavior characteristics of the verification results, the multi-dimensional security assessment model is updated.

[0061] When writing encrypted data to the storage medium according to transmission control commands, the write operation is not performed on a per-data-stream basis, but rather the encrypted data is divided into blocks. The granularity of the blocks is dynamically determined based on the storage medium type and the actual size of the data stream. For example, for flash memory media, the block size can be set to a fixed byte length, while for mechanical storage media, blocks can be aligned according to sector boundaries. Each data block independently calculates its corresponding block-level checksum before being written to the storage medium. The block-level checksum is calculated using a hash function to digest the data block content. Let the content of the q-th data block be B... q Its corresponding block-level checksum is h q Then h q =Hash(B q The hash function can be a collision-resistant algorithm such as SHA-256 or SM3. The mechanism of writing in blocks and calculating the checksum block by block ensures that the specific data block where the anomaly occurred can be accurately located during subsequent verification, without having to rescan the entire ciphertext data, which significantly improves the verification efficiency.

[0062] The generation of integrity verification information involves the combination and binding of multiple information layers. Each metering data stream has a unique data stream identifier, which is composed of the data acquisition timestamp, the electricity metering box device number, and the data stream sequence number, enabling it to uniquely identify a metering data stream globally. Storage location information records the starting address of the encrypted data in the storage medium, the offset of each data block, and the block length, forming a complete storage mapping table. After associating and binding the data stream identifier with the storage location information, the block-level checksum sequence {h1, h2, ..., h...} of all data blocks is then... QThe integrity verification information (Q) is combined with the data stream identifier to generate the final integrity verification information. This integrity verification information is stored in a structured manner in a separate verification information storage area, physically isolated from the ciphertext data storage area, to prevent attackers from simultaneously tampering with the verification information while modifying the ciphertext data. The integrity verification information itself is also accompanied by metadata signature to ensure the credibility of the verification information itself.

[0063] When encrypted data is accessed or retrieved, the access request carries the identifier information of the target data block. Based on the data stream identifier, the corresponding verification information record is retrieved from the integrity verification information storage area. Then, based on the block index of the target data block, the corresponding block-level checksum h is extracted from the checksum sequence. q The extraction process requires verifying the validity of the metadata signature of the integrity check information record. If the signature verification fails, it is directly determined as an integrity exception, the access request is rejected, and a security event is recorded. If the signature verification passes, the actual content of the target data block is read, and the same hash operation as in the writing phase is re-executed to obtain the real-time block-level checksum. .Will With the stored h q A bit-by-bit comparison is performed. If the two are completely identical, the data block is determined to be of normal integrity. If any difference exists, the data block is determined to be corrupted, and a verification result record containing the block index, abnormal timestamp, and access source information is generated.

[0064] The verification results record contains rich spatiotemporal distribution features and access behavior features. These features provide input for updating the multi-dimensional security assessment model. Spatiotemporal distribution features include: the address distribution density of anomalous data blocks in the storage medium, the time series pattern of anomalous events, and the spatial distribution pattern of anomalous events among different electricity metering boxes. Access behavior features include: access frequency, access source identifier, operation sequence within the access time window, and whether there is repeated access to the same data block within a short period. After aggregating these features, they are encoded according to the input format of the multi-dimensional security assessment model to form model update samples.

[0065] The multi-dimensional security assessment model employs an incremental learning mechanism for updates, avoiding the need to retrain the entire historical data for each update. When verification results show normal data integrity, the access record is included as a normal sample in the model's normal behavior baseline. The statistical parameters of the baseline are updated using a moving average, enabling the model to adaptively track the evolution of normal access patterns. When verification results show abnormal data integrity, the record serves as an abnormal sample, triggering an update to the model's abnormal pattern library. The spatiotemporal features and access behavior features of the current abnormal event are matched with existing abnormal patterns for similarity. If the similarity exceeds a set threshold, the confidence weight of that pattern is reinforced and updated; if it is dissimilar to all existing patterns, it is added to the pattern library as a new abnormal pattern with an initial confidence weight. Through this continuous update mechanism, the multi-dimensional security assessment model can continuously accumulate the ability to identify data integrity attacks, improving the accuracy and response speed of subsequent anomaly identification.

[0066] In practical deployments, integrity verification operations need to balance security and real-time performance. For frequent, routine read accesses, a lightweight incremental verification strategy can be adopted. This involves recalculating the real-time block-level checksum only for data blocks that have changed since the last verification, while using cached verification results for unchanged data blocks, reducing computational overhead. For accesses involving critical metering data fields, a full recalculation is enforced to ensure the rigor of the verification. The integrity verification information storage area also includes an access log, recording the time, type, and result of each verification operation, forming a traceable audit chain and providing data support for post-event evidence collection and security analysis. The entire integrity verification and model update process forms a closed loop, continuously enhancing the data security protection capabilities of the electricity metering box over time.

[0067] A second aspect of this invention provides an intelligent algorithm data security system for electricity metering boxes, comprising: The data acquisition unit is used to acquire the metering data stream generated during the operation of the electricity metering box; An anomaly identification unit is used to perform time-series feature parsing on the metering data stream to obtain feature vectors, perform anomaly identification on the metering data stream based on the feature vectors, and generate evaluation results. The hierarchical encryption unit is used to perform hierarchical encryption processing on the data fields that need to be protected in the metering data stream according to the risk level in the assessment results, and generate ciphertext data through a multi-dimensional security assessment model. The dynamic scheduling unit is used to dynamically schedule the transmission path and timing of the encrypted data according to the anomaly type identifier in the evaluation result, and generate transmission control instructions. The integrity verification unit is used to write the encrypted data into the storage medium based on the transmission control command and generate integrity verification information corresponding to the metering data stream. When the encrypted data is accessed or called, the integrity of the data is verified based on the integrity verification information, and the multi-dimensional security assessment model is updated based on the verification result.

[0068] A third aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0069] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0070] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0071] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for ensuring data security in an electricity metering box, characterized in that, include: Acquire the metering data stream generated during the operation of the electricity metering box; The measurement data stream is analyzed for time-series features to obtain feature vectors. Anomaly identification is performed on the measurement data stream based on the feature vectors to generate evaluation results. Based on the risk level in the assessment results, the data fields that need to be protected in the metering data stream are subjected to hierarchical encryption processing through a multi-dimensional security assessment model to generate encrypted data. Based on the anomaly type identifier in the evaluation results, the transmission path and timing of the encrypted data are dynamically scheduled, and transmission control instructions are generated. Based on the transmission control command, the encrypted data is written into the storage medium and integrity verification information corresponding to the metering data stream is generated. When the encrypted data is accessed or called, the integrity of the data is verified based on the integrity verification information, and the multi-dimensional security assessment model is updated based on the verification result. Based on the risk level in the assessment results, the data fields requiring protection in the metering data stream are subjected to hierarchical encryption processing using a multi-dimensional security assessment model to generate encrypted data, including: The risk level from the assessment results is input into the multi-dimensional security assessment model. The multi-dimensional security assessment model is used to assess the security sensitivity of the data fields in the metering data stream, identify the data fields that need to be protected, and output the corresponding initial encryption level. The multi-dimensional security assessment model is used to analyze the business logic relationships between the data fields that need to be protected, generate a dependency graph, and adjust the initial encryption level of the data field group with related dependencies based on the dependency graph to obtain the adjusted encryption level configuration. The risk level and the adjusted encryption level configuration are used as seed parameters to input the key derivation function, and the derivation key corresponding to each data field in the adjusted encryption level configuration is generated by combining the correlation strength between data fields in the dependency graph. The derived key is used to perform an encryption transformation on the data field to be protected using the encryption strategy determined by the multi-dimensional security assessment model, thereby generating the ciphertext data.

2. The method according to claim 1, characterized in that, The measurement data stream is subjected to time-series feature analysis to obtain feature vectors. Based on the feature vectors, anomaly identification is performed on the measurement data stream to generate evaluation results, including: The metering data stream is segmented according to a time window to obtain multiple data segments; For each data segment, extract the time-series statistical features that reflect the trend of data change and the structural features that reflect the distribution pattern of data, and obtain the feature vector based on the time-series statistical features and the structural features; The feature vector is converted into a security status representation by feature space mapping, and the deviation of the security status representation from the preset multi-dimensional security baseline is measured to calculate the deviation quantification index. Based on the deviation quantification index and the temporal correlation of the measurement data stream, the risk level of the current data segment is calculated; Based on the risk level and the preset anomaly determination rules, the anomaly patterns existing in the metering data stream are determined, and the anomaly type identifier is determined. The assessment result is generated based on the anomaly type identifier and the risk level.

3. The method according to claim 1, characterized in that, The multi-dimensional security assessment model analyzes the business logic relationships between the data fields requiring protection, generates a dependency graph, and adjusts the initial encryption level within groups of data fields with dependencies based on the dependency graph to obtain the adjusted encryption level configuration, including: The data fields that need to be protected are input into the multi-dimensional security assessment model. The semantic attributes and business function identifiers of each data field are extracted through the multi-dimensional security assessment model. The semantic similarity and business dependency strength between data fields are calculated based on the semantic attributes and business function identifiers. The data fields are used as nodes, and the relationships and dependencies between data fields are used as edges to generate a dependency graph that reflects the semantic relationships between data fields. The business dependency strength is marked on the edges of the dependency graph. Based on the dependency graph, data field groups with related dependencies are identified. The overall security risk index of each data field group is calculated according to the business dependency strength using the multi-dimensional security assessment model. Based on the overall security risk index, the target encryption level of the data field group is determined. The initial encryption level of each data field in the data field group is compared with the target encryption level. When there is a data field in the data field group with an initial encryption level lower than the target encryption level, the initial encryption level of the data field is adjusted to the target encryption level to obtain the adjusted encryption level configuration.

4. The method according to claim 1, characterized in that, Based on the anomaly type identifier in the evaluation results, the transmission path and timing of the encrypted data are dynamically scheduled, and transmission control instructions are generated, including: Based on the anomaly type identifier in the assessment results, extract the threat level and attack pattern characteristics corresponding to the anomaly type identifier; Based on the threat level and attack pattern characteristics, the security of currently available transmission paths is scored, and high-risk transmission paths that match the attack pattern characteristics are identified. The high-risk transmission paths are excluded from the currently available transmission paths to obtain a set of candidate transmission paths, and a path security metric and path load capacity are calculated for each transmission path in the set of candidate transmission paths. Based on the path security metric and path load capacity, a transmission path is selected for the encrypted data, and a transmission timing scheduling strategy for the encrypted data is determined according to the threat level. Based on the transmission path and the transmission timing scheduling strategy, a transmission control instruction containing a transmission path identifier and a transmission time window is generated.

5. The method according to claim 4, characterized in that, The high-risk transmission paths are excluded from the currently available transmission paths to obtain a candidate transmission path set. For each transmission path in the candidate transmission path set, a path security metric and path load capacity are calculated, including: The currently available transmission paths are compared with the high-risk transmission paths, and the transmission paths that match the high-risk transmission paths are removed from the currently available transmission paths to obtain a set of candidate transmission paths. For each transmission path in the candidate transmission path set, based on the network node information and link connection information traversed by the transmission path, the historical security event records and current protection capability parameters of each network node are extracted, and the encryption strength and access control level of each link are extracted. The node security coefficient of each network node is calculated based on the historical security event records and current protection capability parameters, and the link security coefficient of each link is calculated based on the encryption strength and access control level. The path security metric of the transmission path is obtained by weighted aggregation of the node security coefficients of all network nodes and the link security coefficients of all links. The path load capacity of the transmission path is determined based on the current transmission load and maximum transmission capacity of each transmission path in the candidate transmission path set.

6. The method according to claim 1, characterized in that, Based on the transmission control command, the encrypted data is written to the storage medium and integrity verification information corresponding to the metering data stream is generated. When the encrypted data is accessed or retrieved, the data integrity is verified based on the integrity verification information. Based on the verification result, the multi-dimensional security assessment model is updated, including: The encrypted data is written to the storage medium according to the transmission control command, and the encrypted data is divided into blocks during the writing process, and a block-level check code is calculated for each data block. The data stream identifier of the measurement data stream is associated and bound with the storage location information of the encrypted data, and the block-level checksum of all data blocks is combined with the data stream identifier to generate integrity check information corresponding to the measurement data stream. When the encrypted data is accessed or called, the currently accessed data block is obtained, and the block-level checksum corresponding to the data block is extracted from the integrity verification information. The real-time block-level checksum is recalculated for the currently accessed data block, and the real-time block-level checksum is compared with the block-level checksum to verify the data integrity, thereby obtaining the verification result; Based on the spatiotemporal distribution characteristics and access behavior characteristics of the verification results, the multi-dimensional security assessment model is updated.

7. A data security system for an electricity metering box, used to implement the method as described in any one of claims 1-6, characterized in that, include: The data acquisition unit is used to acquire the metering data stream generated during the operation of the electricity metering box; An anomaly identification unit is used to perform time-series feature parsing on the metering data stream to obtain feature vectors, perform anomaly identification on the metering data stream based on the feature vectors, and generate evaluation results. The hierarchical encryption unit is used to perform hierarchical encryption processing on the data fields that need to be protected in the metering data stream according to the risk level in the assessment results, and generate ciphertext data through a multi-dimensional security assessment model. The dynamic scheduling unit is used to dynamically schedule the transmission path and timing of the encrypted data according to the anomaly type identifier in the evaluation result, and generate transmission control instructions. The integrity verification unit is used to write the encrypted data into the storage medium based on the transmission control command and generate integrity verification information corresponding to the metering data stream. When the encrypted data is accessed or called, the integrity of the data is verified based on the integrity verification information, and the multi-dimensional security assessment model is updated based on the verification result.

8. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images