Security evaluation method and device of digital power grid, computer equipment, readable storage medium and program product

Abstract

The application relates to a security evaluation method and device of a digital power grid, computer equipment, a readable storage medium and a program product. Based on security indexes of digital power grid assets, a multi-dimensional asset feature vector is constructed, and based on attribute information of a current attack event suffered by the digital power grid assets, an attack feature vector is constructed; the security indexes include at least one of a port exposure index, a patch gap index and a security permission index; based on the multi-dimensional asset feature vector and the attack feature vector, a damage prediction function is constructed; the damage prediction function is used for quantifying instant damage caused by any attack to a single asset, and the output of the damage prediction function is damage intensity and a confidence interval; based on the multi-dimensional asset feature vector and the damage prediction function, a security evaluation model is constructed; and based on the security evaluation model, security evaluation is performed on the digital power grid assets. The security evaluation accuracy of the digital power grid is improved.

Description

Technical Field

[0001] This application relates to the field of digital power grid technology, and in particular to a method, apparatus, computer equipment, readable storage medium, and computer program product for security assessment of digital power grids. Background Technology

[0002] With the digitalization and intelligentization of the power grid, security threats have shifted from physical isolation to network penetration. To address risks such as vulnerabilities, intrusions, and unauthorized operations, manufacturers and operators have deployed various security management platforms. These platforms typically employ a modular architecture, integrating components such as asset management, vulnerability scanning, intrusion detection, log and event management, threat intelligence, rule engines, and visual dashboards. They periodically collect data through probes, proxies, and APIs, performing baseline comparisons, anomaly detection, and alerts, ultimately presenting the risk situation in the form of dashboards and topology maps.

[0003] However, security assessments of digital power grid assets based on traditional security management platforms suffer from poor accuracy. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer equipment, readable storage medium, and program product for security assessment of digital power grids that can improve the accuracy of assessment, addressing the aforementioned technical problems.

[0005] Firstly, this application provides a security assessment method for digital power grids, including:

[0006] Based on the security indicators of digital power grid assets, a multi-dimensional asset feature vector is constructed, and an attack feature vector is constructed based on the attribute information of the current attack events suffered by the digital power grid assets; the security indicators include at least one of port exposure indicators, patch gap indicators, and security permission indicators.

[0007] Based on the multi-dimensional asset feature vector and the attack feature vector, a hazard prediction function is constructed; the hazard prediction function is used to quantify the immediate hazard caused by any attack to a single asset, and the output of the hazard prediction function is the hazard intensity and confidence interval;

[0008] A safety assessment model is constructed based on the multi-dimensional asset feature vector and the hazard prediction function.

[0009] The security assessment of the digital power grid assets is conducted based on the aforementioned security assessment model.

[0010] In one embodiment, constructing a hazard prediction function based on the multi-dimensional asset feature vector and attack feature vector includes:

[0011] Based on the multi-dimensional asset feature vectors, a heterogeneous graph is constructed; the heterogeneous graph is used to characterize the relationship between assets and the security indicators.

[0012] Based on the heterogeneous graph, a graph neural network is constructed, and based on the prior distribution of the trainable parameters of the hazard prediction function, a hierarchical Bayesian model is constructed.

[0013] A hazard prediction function is constructed based on the graph neural network, the hierarchical Bayesian model, and the attack feature vector.

[0014] In one embodiment, constructing the hazard prediction function based on the graph neural network, the hierarchical Bayesian model, and the attack feature vector includes:

[0015] A feature fusion layer is constructed; the feature fusion layer is used to fuse the asset embedding vector output by the graph neural network with the attack feature vector;

[0016] The hazard prediction function is constructed based on the feature fusion layer and the hierarchical Bayesian model.

[0017] In one embodiment, constructing a security assessment model based on the multi-dimensional asset feature vector and the hazard prediction function includes:

[0018] Determine the propagation weight of each directed edge in the heterogeneous graph;

[0019] Based on the hazard intensity output by the constructed hazard prediction function, the infection probability of each directed edge is determined;

[0020] The security assessment model is constructed based on the propagation weight and the infection probability.

[0021] In one embodiment, the security assessment of the digital power grid assets based on the security assessment model includes:

[0022] Obtain real-time data on current attack events and digital power grid assets;

[0023] Based on the security assessment model, the current attack event, and real-time data of the digital power grid assets, a propagation simulation is performed to obtain the impact domain, impact radius, and propagation path of the current attack event.

[0024] The digital power grid assets are assessed for security based on the influence domain, the influence radius, and the propagation path.

[0025] In one embodiment, the security assessment of the digital power grid based on the influence domain, the influence radius, and the propagation path includes:

[0026] The risk level of the current attack event is determined based on the affected area, the affected radius, and the propagation path.

[0027] Secondly, this application also provides a security assessment device for a digital power grid, comprising:

[0028] The first construction module is used to construct a multi-dimensional asset feature vector based on the security indicators of digital power grid assets, and to construct an attack feature vector based on the attribute information of the current attack event suffered by the digital power grid assets; the security indicators include at least one of port exposure indicators, patch gap indicators, and security permission indicators.

[0029] The second construction module is used to construct a hazard prediction function based on the multi-dimensional asset feature vector and the attack feature vector; the hazard prediction function is used to quantify the immediate hazard caused by any attack to a single asset, and the output of the hazard prediction function is the hazard intensity and confidence interval;

[0030] The third construction module is used to construct a security assessment model based on the multi-dimensional asset feature vector and the hazard prediction function, wherein the weighted edges are determined by propagation, medium coupling strength and time delay.

[0031] An assessment model is used to conduct a security assessment of the digital power grid assets based on the security assessment model.

[0032] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0033] Based on the security indicators of digital power grid assets, a multi-dimensional asset feature vector is constructed, and an attack feature vector is constructed based on the attribute information of the current attack events suffered by the digital power grid assets; the security indicators include at least one of port exposure indicators, patch gap indicators, and security permission indicators.

[0034] Based on the multi-dimensional asset feature vector and the attack feature vector, a hazard prediction function is constructed; the hazard prediction function is used to quantify the immediate hazard caused by any attack to a single asset, and the output of the hazard prediction function is the hazard intensity and confidence interval;

[0035] A safety assessment model is constructed based on the multi-dimensional asset feature vector and the hazard prediction function.

[0036] The security assessment of the digital power grid assets is conducted based on the aforementioned security assessment model.

[0037] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0038] Based on the security indicators of digital power grid assets, a multi-dimensional asset feature vector is constructed, and an attack feature vector is constructed based on the attribute information of the current attack events suffered by the digital power grid assets; the security indicators include at least one of port exposure indicators, patch gap indicators, and security permission indicators.

[0039] Based on the multi-dimensional asset feature vector and the attack feature vector, a hazard prediction function is constructed; the hazard prediction function is used to quantify the immediate hazard caused by any attack to a single asset, and the output of the hazard prediction function is the hazard intensity and confidence interval;

[0040] A safety assessment model is constructed based on the multi-dimensional asset feature vector and the hazard prediction function.

[0041] The security assessment of the digital power grid assets is conducted based on the aforementioned security assessment model.

[0042] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0043] Based on the security indicators of digital power grid assets, a multi-dimensional asset feature vector is constructed, and an attack feature vector is constructed based on the attribute information of the current attack events suffered by the digital power grid assets; the security indicators include at least one of port exposure indicators, patch gap indicators, and security permission indicators.

[0044] Based on the multi-dimensional asset feature vector and the attack feature vector, a hazard prediction function is constructed; the hazard prediction function is used to quantify the immediate hazard caused by any attack to a single asset, and the output of the hazard prediction function is the hazard intensity and confidence interval;

[0045] A safety assessment model is constructed based on the multi-dimensional asset feature vector and the hazard prediction function.

[0046] The security assessment of the digital power grid assets is conducted based on the aforementioned security assessment model.

[0047] The aforementioned security assessment methods, devices, computer equipment, readable storage media, and program products for digital power grids construct multi-dimensional asset feature vectors based on security indicators of digital power grid assets, and attack feature vectors based on the attribute information of current attack events affecting digital power grid assets. Security indicators include at least one of port exposure indicators, patch vulnerability indicators, and security privilege indicators. A hazard prediction function is constructed based on the multi-dimensional asset feature vectors and attack feature vectors. This hazard prediction function quantifies the immediate harm caused by any attack to a single asset, and its output is the hazard intensity and confidence interval. A security assessment model is constructed based on the multi-dimensional asset feature vectors and the hazard prediction function. Based on this model, a security assessment of digital power grid assets is performed. By unifying and quantifying multi-source security indicators and attack attributes into standardized feature vectors, the bias caused by data heterogeneity is eliminated, enabling the constructed hazard prediction function to output hazard intensity with a confidence interval. Furthermore, the established security assessment model incorporates the propagation probability between assets, cross-domain coupling strength, and time delay into edge weights, making the attack propagation simulation closer to the actual characteristics of the power grid, reducing calculation errors in propagation paths and impact domains, thereby improving the accuracy of digital power grid security assessments. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a diagram illustrating the application environment of a digital power grid security assessment method in one embodiment.

[0050] Figure 2 This is a flowchart illustrating a security assessment method for a digital power grid in one embodiment;

[0051] Figure 3 This is a flowchart illustrating a security assessment method for a digital power grid in another embodiment;

[0052] Figure 4 This is a flowchart illustrating a security assessment method for a digital power grid in another embodiment;

[0053] Figure 5 This is a flowchart illustrating a security assessment method for a digital power grid in another embodiment;

[0054] Figure 6 This is a flowchart illustrating a security assessment method for a digital power grid in another embodiment;

[0055] Figure 7 This is a structural block diagram of a security assessment device for a digital power grid in one embodiment. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0057] The digital power grid security assessment method provided in this application embodiment can be applied to, for example... Figure 1 The application environment shown is as follows. The computer device can be a server, and it includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores security assessment data for digital power grids. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a security assessment method for digital power grids.

[0058] Those skilled in the art will understand that Figure 1 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0059] In one embodiment, such as Figure 2 As shown, a security assessment method for digital power grids is provided, which can be applied to... Figure 1 Taking the server in the example of this, the explanation includes:

[0060] S201 constructs a multi-dimensional asset feature vector based on the security indicators of digital power grid assets, and constructs an attack feature vector based on the attribute information of the current attack events suffered by digital power grid assets.

[0061] The security metrics include at least one of the following: port exposure metrics, patch gap metrics, and security permission metrics.

[0062] In this embodiment, a port open list for each digital power grid asset is obtained, thereby deriving security indicators for the digital power grid asset based on the port open list. Optionally, the port open list includes all network ports on the asset that are in listening mode, as well as the port number, transport layer protocol type, and service name associated with each network port.

[0063] Optionally, the port number can be compared with a preset risk level mapping table to mark industrial control protocol ports and remote management ports as high-risk ports and ordinary web ports as low-risk ports. The number of open ports can be counted, and an initial score can be calculated using a preset weighting formula based on the number of occurrences of high-risk ports and the total number of open ports. Then, the score can be normalized to the 0 to 1 range to obtain the port exposure index.

[0064] Optionally, a list of installed patches on digital power grid assets can be obtained and compared with high-risk vulnerability records related to the asset's operating system and applications in the vulnerability database. For each vulnerability without a corresponding patch, an original gap score can be calculated by summing the base score level of the Common Vulnerability Scoring System (CVSS) and the duration of the vulnerability's existence. This score is then normalized to the 0-1 range to obtain a patch gap index.

[0065] Optionally, the system can read account configuration files on the asset and check whether there are any default accounts that have not been disabled or whose default passwords have been changed, whether there are any accounts with blank passwords or password strengths below a preset threshold, and whether any ordinary users have been granted administrator or system-level privileges. For each type of problem found, the corresponding points are deducted from the initial score according to preset deduction rules. After lower limit truncation and reverse mapping, a security permission index is obtained. The higher the score, the worse the permission security.

[0066] In this embodiment, the port exposure index, patch gap index, security permission index, and data sensitivity index are normalized to a range of 0 to 1. Then, the normalized indices are weighted and summed according to preset business weights, where the business weights are pre-set based on the criticality of the business corresponding to the asset. The weighted sum is then normalized to obtain a multi-dimensional asset feature vector, which can be represented as z = [E, I, P, D], where E is the asset exposure level. I represents the credibility of the identity. P represents the access control strength, and D represents the data sensitivity. This represents the normalization function, with weights dynamically determined based on business criticality and relevance to historical attacks. W pW u W r W b E respectively p E u E r E b The corresponding dynamic weight; E p E u E r E b These are the core quantitative indicators of exposure, all of which are sub-items under exposure, corresponding to port exposure, patch gap rate, access reachability, and perimeter protection strength, respectively; α, β, and γ are I α I β I γ Corresponding dynamic weights; I α I β I γ These are the core quantitative indicators of identity credibility, corresponding to the strength of the authentication mechanism, the level of account credibility, and the effectiveness of identity auditing.

[0067] Optionally, the access control strength is determined by extracting key security attributes such as access depth, privilege escalation difficulty, and privileged account management strength from multiple sources of data, including the 4A unified identity platform, bastion host, and access audit system; data sensitivity is determined by extracting key security attributes such as data classification level, business importance, and data real-time performance from multiple sources of data, including the data classification and grading platform, data asset ledger, and database audit system.

[0068] In this embodiment, a heterogeneous graph structure is used in the data layer to store the relationship between assets and metrics. Nodes represent assets, edges represent dependencies or access channels, and node attributes are vectors. In the hierarchical aggregation stage, matrix operations are used to summarize features from equipment to substations, plants, and regional scheduling, represented as: Based on business weight The importance of different nodes is controlled. The final output is a database of timestamped feature vectors, used for subsequent lethality modeling and propagation calculations. The core of this step lies in using feature engineering and hierarchical aggregation to transform the originally scattered security indicators into a high-dimensional representation with unified dimensions and semantics, providing a learnable, traceable, and dynamically updatable input foundation for subsequent models.

[0069] S202 constructs a hazard prediction function based on multi-dimensional asset feature vectors and attack feature vectors.

[0070] The hazard prediction function is used to quantify the immediate harm caused to a single asset by any attack. The output of the hazard prediction function is the hazard intensity and confidence interval.

[0071] In this embodiment, a multi-dimensional asset feature vector is obtained for each asset. This multi-dimensional asset feature vector includes four dimensions: exposure, identity strength, permission depth, and data sensitivity. The attack feature vector for the current attack event is also obtained, and it may include dimensions such as attack technique type, payload characteristics, duration, and stealth. The multi-dimensional asset feature vector and the attack feature vector are then concatenated into a joint vector.

[0072] Furthermore, based on multi-dimensional asset feature vectors and attack feature vectors, a hazard prediction function is constructed. Specifically, a multi-layer fully connected neural network is built as the hazard prediction function. The input layer dimension of this neural network is the sum of the dimensions of the multi-dimensional asset feature vector and the attack feature vector. The input layer contains multiple hidden layers, and the output layer is a single neuron. The output value is mapped to the 0-1 interval using the Sigmoid function, serving as the hazard intensity. Multiple forward propagations are performed on the same input to obtain multiple hazard intensity values. The mean and standard deviation of these multiple hazard intensity values ​​are calculated. The mean is used as the final output hazard intensity, and the standard deviation is multiplied by a fixed coefficient to determine the confidence interval radius.

[0073] In this embodiment, the training sample data for the hazard prediction function is obtained through historical security events and simulated security events. Each training sample includes an asset feature vector, an attack feature vector, and a corresponding actual damage label. The loss function uses mean squared error. After training, the network can be used for hazard prediction of any asset and any attack.

[0074] S203, based on multi-dimensional asset feature vectors and hazard prediction functions, constructs a safety assessment model.

[0075] In this embodiment, a security assessment model is constructed based on a heterogeneous graph and the hazard intensity of each asset. This security assessment model is a directed weighted graph, where each directed edge is associated with three preset parameters: propagation rate, medium coupling strength, and reference time delay. For each edge, the propagation weight is first calculated, and then the infection probability is calculated based on the hazard intensity of the source node.

[0076] Optionally, the propagation weight can be obtained by multiplying the propagationability by the medium coupling strength and then by the time delay attenuation factor. The time delay attenuation factor is equal to the negative reference time delay of e divided by the time constant T raised to the power of T.

[0077] Optionally, the infection probability is equal to 1 minus the value of an exponential function multiplied by a negative scaling factor λ, the propagation weight, and the source node's hazard intensity. The risk cost of each edge can be the negative logarithm of the infection probability.

[0078] Optionally, propagability can be pre-determined and stored in a configuration table based on the network connectivity between the two assets, such as whether they are in the same subnet, port open status, and protocol support; media coupling strength can be pre-calibrated based on the control dependencies or data flow tightness between the asset domains, which may include control domains and physical domains; and reference time delay can be pre-obtained and stored through network probing tools such as ping or custom measurements.

[0079] S204, based on a security assessment model, conducts security assessments of digital power grid assets.

[0080] In this embodiment, upon receiving a current attack event, the asset associated with the current attack event is first located as the attack source. A hazard prediction function is then called to calculate the hazard intensity and confidence interval of the attack source. Furthermore, the current network topology is obtained and input into the security assessment model to perform an independent cascading propagation simulation. Specifically, starting from the common source point, the simulation proceeds in discrete time steps. Each infected node attempts to infect its neighboring nodes with an infection probability, and success is determined by random numbers. At the end of each time step, newly infected nodes are recorded and the influence domain is updated. The simulation stops when no new nodes are infected or the preset maximum time step is reached, thereby simulating the influence domain and kill radius curve for each time step. Simultaneously, a shortest path algorithm is run with risk cost as the edge weight to calculate the shortest risk path from the attack source point to all other nodes. The top K paths are sorted by cumulative risk score and output. Based on the influence domain size, kill radius expansion speed, and path risk score, a risk level and situation report are generated to complete the security assessment.

[0081] The aforementioned digital power grid security assessment method constructs a multi-dimensional asset feature vector based on the security indicators of digital power grid assets, and an attack feature vector based on the attribute information of the current attack events affecting the digital power grid assets. Security indicators include at least one of port exposure indicators, patch gap indicators, and security privilege indicators. A hazard prediction function is constructed based on the multi-dimensional asset feature vector and attack feature vector. This hazard prediction function quantifies the immediate harm caused by any attack to a single asset, and its output is the hazard intensity and confidence interval. A security assessment model is constructed based on the multi-dimensional asset feature vector and hazard prediction function. Based on this model, a security assessment of the digital power grid assets is performed. By unifying the quantification of multi-source security indicators and attack attributes into standardized feature vectors, the bias caused by data heterogeneity is eliminated, enabling the constructed hazard prediction function to output a hazard intensity with a confidence interval. Furthermore, the established security assessment model incorporates the propagation probability between assets, cross-domain coupling strength, and time delay into the edge weights, making the attack propagation simulation closer to the actual power grid characteristics, reducing the calculation errors of propagation paths and impact domains, and thus improving the accuracy of digital power grid security assessment.

[0082] In one embodiment, one implementation of S202 above is provided, such as... Figure 3 As shown, the above-mentioned "construction of a hazard prediction function based on multi-dimensional asset feature vectors and attack feature vectors" includes:

[0083] S301 constructs a heterogeneous graph based on multi-dimensional asset feature vectors.

[0084] Among them, heterogeneous graphs are used to characterize the relationship between assets and security indicators.

[0085] In this embodiment, a heterogeneous graph is constructed based on multi-dimensional asset feature vectors, with each digital power grid asset as a node and the network connection relationship or business dependency relationship between assets as edges. The initial feature vector of each node is the multi-dimensional asset feature vector of that asset, which consists of four dimensions: port exposure index, patch gap index, security permission index, and data sensitivity index.

[0086] S302. Based on the heterogeneous graph, a graph neural network is constructed, and based on the prior distribution of the trainable parameters of the hazard prediction function, a hierarchical Bayesian model is constructed.

[0087] In this embodiment, the graph neural network adopts a multi-layer message passing mechanism. In each layer, each node aggregates the feature vectors of its neighboring nodes and updates its own node representation through a learnable weight matrix. After passing through multiple layers, the topology-aware embedding vector of each node is output.

[0088] In this embodiment, a hierarchical Bayesian model is constructed based on the prior distribution of all trainable parameters in the hazard prediction function. The prior distribution is set according to the statistical regularity of historical power grid safety events. For example, the weight parameters of the graph neural network are set to follow a normal distribution, and the mean and variance of the weight parameters of the graph neural network are used as hyperparameters.

[0089] S303 constructs a hazard prediction function based on graph neural networks, hierarchical Bayesian models, and attack feature vectors.

[0090] In this embodiment, the asset topology-aware embedding vector output by the graph neural network is fused with the attack feature vector using vector concatenation or bilinear interaction. The fused feature vector is then input into a fully connected network, and the output of the fully connected network is mapped to the 0-1 interval via a sigmoid activation function, representing the threat intensity.

[0091] Furthermore, multiple samplings are performed on the posterior distribution of parameters inferred from the hierarchical Bayesian model. After each sampling, forward propagation is performed to obtain a hazard intensity value. The mean and standard deviation of the hazard intensity value are calculated. The mean is used as the final output hazard intensity, and the standard deviation is multiplied by a predetermined coefficient as the radius of the confidence interval.

[0092] In the above-mentioned application embodiments, topological dependencies between assets are captured by heterogeneous graphs, and the influence of neighbors is incorporated into single-asset analysis by graph neural networks, thereby improving global accuracy. The hierarchical Bayesian model introduces prior knowledge and provides inference under limited data, while outputting confidence intervals to quantify uncertainty, thereby enhancing the credibility and generalization ability of the prediction.

[0093] In one embodiment, one implementation of S303 above is provided, such as... Figure 4 As shown, the above-mentioned "construction of a hazard prediction function based on graph neural networks, hierarchical Bayesian models, and attack feature vectors" includes:

[0094] S401, Construct the feature fusion layer.

[0095] The feature fusion layer is used to fuse the asset embedding vector output by the graph neural network with the attack feature vector.

[0096] In this embodiment, the fusion method employs vector concatenation, where each dimension of the asset embedding vector is sequentially concatenated with each dimension of the attack feature vector to form a new vector. Optionally, the asset embedding vector is obtained by forward propagation of a heterogeneous graph through a graph neural network, with a preset dimension. The attack feature vector is obtained by encoding the attributes of the current attack event. The asset embedding vector and the attack feature vector are concatenated and their dimensions are added together. This feature fusion layer serves as an intermediate component in the hazard prediction function, positioned between the output of the graph neural network and the input of the subsequent fully connected network.

[0097] S402 constructs a hazard prediction function based on a feature fusion layer and a hierarchical Bayesian model.

[0098] In this embodiment, the fused vector output from the feature fusion layer is input into a fully connected network parameterized by a hierarchical Bayesian model. This fully connected network contains at least one hidden layer, and all its trainable weight parameters follow a prior distribution set according to the statistical patterns of historical power grid security events. The output of the fully connected network is a real number, which is mapped to the 0-1 interval by an activation function to obtain the hazard intensity. Furthermore, by sampling multiple times from the parameter posterior distribution and performing multiple forward propagations on the same fused vector, the mean and standard deviation of the obtained hazard intensity are calculated. The mean is used as the final output hazard intensity, and the standard deviation is multiplied by a predetermined coefficient as the confidence interval radius to complete the construction of the hazard prediction function. The input to the hazard prediction function is the asset embedding vector and the attack feature vector, and the output is the hazard intensity and its confidence interval.

[0099] For example, using feature vectors As input, a kill effect function is constructed. This system enables real-time quantification of the harm posed to a single asset under specific attack behaviors, where 'a' is the attack feature vector, containing attributes such as attack technique, payload type, duration, and stealth. The function is implemented through joint modeling using a graph neural network (GNN) and hierarchical Bayesian methods. The GNN captures the topology and dependencies between assets, while the Bayesian part provides cross-business and cross-scenario prior knowledge transfer. During the training phase, the system uses historical red team drills, simulated attacks, and security incident backtracking data as the label set, employing variational inference or deep Bayesian optimization methods to minimize the objective function. Where y is the actual damage label. This represents the difference in distribution between the posterior and prior parameters, used to suppress overfitting and introduce uncertainty calibration. To address the scarcity of 0-day attack samples, a split-Bruker bar optimization mechanism is further employed, introducing Wasserstein sphere constraints to improve the model's extrapolation stability. After model training, the system can predict the severity and confidence interval based on any asset vector and attack description. This enables generalized inference from single-point risk to multi-asset inference. The core innovation of this step lies in the introduction of cross-domain graph learning and probabilistic modeling, which makes the kill effect function interpretable, generalizable, and robust, thereby providing high-precision input for subsequent propagation radius calculation.

[0100] In the above-mentioned application embodiments, the combination of asset topology information and attack attributes through the feature fusion layer enables the hazard prediction to simultaneously reflect the asset's position and role in the power grid and the dynamic characteristics of external attacks, thereby improving the consistency between the prediction and the actual risk; the hierarchical Bayesian model imposes prior constraints on network parameters and quantifies prediction uncertainty, thereby enhancing the reliability of the model when the sample is limited or the attack mode changes.

[0101] In one embodiment, one implementation of S203 above is provided, such as... Figure 5 As shown, the aforementioned "constructing a security assessment model based on multi-dimensional asset feature vectors and hazard prediction functions" includes:

[0102] S501 determines the propagation weight of each directed edge in the heterogeneous graph.

[0103] In this embodiment, for each pair of asset nodes u and v with a directed connection in the heterogeneous graph, the corresponding propagation capability, medium coupling strength, and reference time delay are obtained. Further, the propagation capability is multiplied by the medium coupling strength, and then multiplied by the time delay attenuation factor to obtain the propagation weight of the directed edge. This attenuation factor is equal to the value of an exponential function with the natural constant e as the base and the negative reference time delay divided by the time constant T as the exponent.

[0104] Optionally, propagation capability is obtained by looking up a table based on the network connectivity from node u to node v, port openness, and protocol support; medium coupling strength is pre-calibrated based on the control domain or physical domain to which node u and node v belong, and the control dependency between them; and reference time delay is pre-measured using network measurement tools.

[0105] S502, based on the hazard intensity output by the hazard prediction function, determine the infection probability of each directed edge.

[0106] In this embodiment, the infection probability of each directed edge is determined based on the hazard intensity output by the hazard prediction function. For each directed edge u to v, the hazard intensity H_u of the source asset node u is obtained, which is between 0 and 1. The globally configured propagation intensity scaling factor λ is obtained, which is set according to the attack type and the current defense level of the power grid. Further, the infection probability is equal to 1 minus the value of an exponential function with base e, negative λ, multiplied by the propagation weight, and then multiplied by H_u.

[0107] For example, the weight of each connection edge in the network Among them, transmissibility This represents the probability of an attack propagating from node u to node v, taking into account factors such as network topology, open ports, and protocol support; medium coupling strength. Consider the interaction strength between the control domain and the physical domain, such as the connectivity of devices or control links within the same subnet; time delay. It is the time it takes for attack information to spread, and is usually estimated using network topology and latency models.

[0108] S503, based on propagation weight and infection probability, constructs a safety assessment model.

[0109] In this embodiment, a heterogeneous graph is used as the basis, and each directed edge is assigned a propagation weight and infection probability as edge attributes. A risk cost is defined for each edge, which is equal to the negative logarithm of the infection probability. This directed graph with edge attributes is used as a security assessment model.

[0110] In this embodiment of the application, the independent cascading propagation rule of the security assessment model is to start from the attack source point and advance in discrete time steps, with each infected node attempting to infect its neighboring nodes with the infection probability on the edge; the shortest path search rule is to calculate the shortest risk path from any source point to other nodes with the risk cost as the edge weight.

[0111] In the above application embodiments, the security assessment model forms a complete quantitative system for attack propagation, from edge weights and infection probability to risk costs, providing a reliable computational basis for assessing the impact range and propagation path of the digital power grid under attack.

[0112] In one embodiment, one implementation of S204 above is provided, such as... Figure 6 As shown, the aforementioned "security assessment of digital power grid assets based on a security assessment model" includes:

[0113] S601 acquires real-time data on current attack events and digital power grid assets.

[0114] In this embodiment, the data for the current attack event includes the attack source address, target asset identifier, attack technique type, payload characteristics, attack start time, and current status; the real-time data for the digital power grid assets includes the latest multi-dimensional asset feature vector for each asset, real-time network latency between assets, link connectivity status, and port open / closed changes. The aforementioned real-time data for the current attack event and the digital power grid assets are acquired in real-time through monitoring interfaces and log collection channels.

[0115] S602 uses a security assessment model, real-time data of the current attack event and digital power grid assets to simulate the propagation of the attack and obtain the impact domain, impact radius and propagation path of the current attack event.

[0116] In this embodiment, the asset associated with the current attack event is taken as the attack source. The asset feature vector and attack feature vector of the source are input into the hazard prediction function to obtain the hazard intensity of the source. The current real-time network topology is substituted into the security assessment model to update the propagation weights and infection probabilities of each edge. Independent cascading propagation simulation is performed starting from the source, progressing in discrete time steps. Each infected node attempts to infect its neighbors with an infection probability until no new nodes are added or the maximum time step is reached. The set of infected asset nodes at each time step is recorded as the influence domain, and the curve of the number of infected nodes changing over time is statistically analyzed as the influence radius. Simultaneously, the shortest path algorithm is run with risk cost as the edge weight, and the minimum risk path sequence from the source to each target node is output as the propagation path.

[0117] Optionally, the process of simulating propagation based on the security assessment model may include: using an independent cascading model to simulate the propagation process. In each round of propagation, if the node... If the attack is successful, node v will have a certain probability. Successful infection. The propagation process expands the attack's influence in each round until no new nodes are infected or a set time threshold is reached: .in, Let represent the hazard intensity of node u. It is a scaling factor for the propagation intensity, which determines the impact of edge weights on propagation.

[0118] Optionally, the process of calculating the shortest propagation path from the attack source to all other assets using the shortest risk path algorithm may include: edge weights being set as risk costs. This represents the difficulty and danger of the spread; the goal is to find the path with the widest impact and lowest cost. The shortest path solution takes the following form: .

[0119] Optionally, to approximate the shift of the control signal from the control domain to the physical domain, a linearized sensitivity matrix or a small perturbation model can be used: Where S is the sensitivity matrix between the control domain and the physical domain. It is a change in the control signal. These are the offsets of state variables in the physical domain. These physical offsets are then extrapolated back to the service interruption range to obtain the final physical impact range and kill radius of the attack propagation.

[0120] In this embodiment, the aforementioned security assessment model can calculate the number of affected nodes reached from the source point at the initial moment of the attack. Using time as the horizontal axis, the propagation range of the attack is gradually expanded, resulting in a "kill radius - time" curve. This curve displays the actual impact range of the attack on the system within a specific time window. During the simulated propagation process, the set of affected domains is a set maintained by the system after each propagation, containing all affected nodes. The system records the attack range at every moment; for each shortest risk path, the system records the path nodes and risk score. The data is then returned to subsequent steps for risk analysis. The API interfaces are GET / propagation / {id}?time= and POST / riskpath / compute. The propagation performance requires parallel processing of large-scale networks to ensure the real-time nature of each propagation calculation, especially in large power grid environments with multi-regional scheduling. The acceptance criteria are that the propagation results should be backtested against historical simulation and actual exercise data to ensure the accuracy of the attack path and the precision of the physical offset, with the error rate controlled within 5%.

[0121] S603 conducts a security assessment of digital power grid assets based on the area of ​​influence, radius of influence, and propagation path.

[0122] In this embodiment, the assets included in the affected area are compared with a preset list of critical assets; if critical assets are involved, the area is classified as high-risk. The expansion speed of the affected radius is compared with preset fast, medium, and slow thresholds to determine the diffusion level. The top K highest-risk paths are identified based on their risk scores. A security assessment conclusion is generated by combining the above information, including the overall risk level of the current attack event, the distribution range of affected assets, and the most likely attack spread chain.

[0123] Optionally, the risk level of the current attack event can be determined based on the affected domain, affected radius, and propagation path. A high-risk event is defined as one where the affected domain includes core control domain assets or the affected radius reaches a preset proportion of all network nodes within a preset short-term threshold; a low-risk event is defined as one where the affected domain only involves non-critical areas and the affected radius expands slowly; and all other cases are defined as medium-risk.

[0124] Optionally, through the kill effect function The system calculates the immediate harm that the current event may cause to the asset. After obtaining the immediate harm score of the asset, the system uses a propagation model to calculate the attack propagation path and obtain a set of high-risk paths. Specifically, the system calculates the propagation capability and risk cost of each path using a defined edge-weight model; it uses an independent cascading model and the shortest risk path algorithm to calculate the propagation path of the attack from the source asset to all other assets, and sorts them according to the risk score of each path, finally obtaining the top K highest-risk paths; and generates a real-time security posture report based on the above path information.

[0125] Optionally, response strategies can be automatically generated based on real-time hazard assessment results and propagation paths. These strategies are based on a predefined safety response rule base and dynamically generated risk analysis results, and involve at least one of the following aspects:

[0126] (1) Isolation strategy: For high-risk assets or paths detected, the system will automatically trigger isolation operations according to preset strategies to prevent the attack from spreading further. For example, automatically disconnecting the attacked assets from critical equipment;

[0127] (2) Demotion strategy: For certain non-critical assets or services, the system will automatically reduce their priority or permissions based on the hazard assessment results to reduce potential risks;

[0128] (3) Rate limiting strategy: For some sensitive network traffic, rate limiting operations can be implemented according to the attack type and propagation path to reduce the chances for attackers to gain more control.

[0129] (4) Whitelist or blacklist update: Automatically update the whitelist or blacklist in the network firewall or intrusion prevention system according to the attack characteristics to further strengthen protection.

[0130] Optionally, to ensure the system's adaptability to new attacks or 0-day attacks, a closed-loop calibration mechanism is introduced. The model parameters and risk thresholds are continuously optimized based on the actual handling results to improve the accuracy of future predictions. Specifically, (1) Feedback data collection: After handling an attack event, the system will collect the handling results, including key indicators such as response time, success rate, impact scope, and business interruption duration; (2) Post-hoc analysis: By comparing with the expected harmful results, Bayesian inference or online variational inference methods will be used to analyze the kill effect function. and parameters of the propagation model The Bayesian posterior inference formula is updated as follows: ,in, Let be the likelihood function of the data. Given the prior distribution, the updated That is, the posterior distribution of the model; (3) Model adjustment and optimization: By adjusting the model parameters and propagating the model threshold, the model can be continuously optimized based on new data and feedback information, thereby improving the predictive ability for complex attack scenarios.

[0131] Optionally, each real-time assessment, strategy response, and model update will generate a detailed audit report, recording key operations, decision-making basis, parameter changes, and final handling results. The audit report will be archived for subsequent audits and compliance checks, ensuring the traceability of system operations and meeting security compliance requirements.

[0132] Optionally, a risk scoring table is generated during the assessment process to record the risk score for each asset, sub-site, and business level, including hazard intensity, propagation path, and strategy implementation status. The strategy interface used for the assessment is POST / action / execute, used to submit strategy suggestions and confirm execution results. The model calibration interface used for the assessment is POST / model / retrain, used to submit feedback data and initiate the model's adaptive learning process.

[0133] For example, in this embodiment of the application, the latency requirement for event stream access and risk assessment is within a few seconds, and the response policy generation time should be less than 10 seconds; the system should have the ability to react quickly in 0-day attack scenarios, with a false positive rate of less than 5% and a false negative rate of less than 3%; based on historical data backtracking, the policy response success rate should reach more than 95%, and the business recovery time for policy execution should be within a preset range.

[0134] The above-mentioned application embodiments realize a closed loop from real-time data collection and dynamic propagation simulation to risk assessment, which improves the timeliness and accuracy of security assessment and enables defense response to be deployed against current real threats.

[0135] In one embodiment, a complete security assessment method for a digital power grid is provided, including:

[0136] S1 constructs a multi-dimensional asset feature vector based on the security indicators of digital power grid assets, and constructs an attack feature vector based on the attribute information of the current attack events suffered by digital power grid assets.

[0137] S2, construct a heterogeneous graph based on multi-dimensional asset feature vectors; the heterogeneous graph is used to characterize the relationship between assets and security indicators.

[0138] S3. Based on the heterogeneous graph, construct a graph neural network, and based on the prior distribution of the trainable parameters of the hazard prediction function, construct a hierarchical Bayesian model.

[0139] S4, Construct the feature fusion layer; the feature fusion layer is used to fuse the asset embedding vector output by the graph neural network with the attack feature vector.

[0140] S5 constructs a hazard prediction function based on a feature fusion layer and a hierarchical Bayesian model.

[0141] S6, determine the propagation weight of each directed edge in the heterogeneous graph.

[0142] S7. Based on the hazard intensity output by the hazard prediction function, determine the infection probability of each directed edge.

[0143] S8 constructs a safety assessment model based on propagation weight and infection probability.

[0144] S9 acquires real-time data on current attack events and digital power grid assets.

[0145] S10 uses a security assessment model, real-time data of the current attack event and digital power grid assets to simulate the propagation of the attack and obtain the impact domain, impact radius and propagation path of the current attack event.

[0146] S11. Determine the risk level of the current attack event based on the affected area, affected radius, and propagation path.

[0147] The aforementioned digital power grid security assessment method constructs a multi-dimensional asset feature vector based on the security indicators of digital power grid assets, and an attack feature vector based on the attribute information of the current attack events affecting the digital power grid assets. Security indicators include at least one of port exposure indicators, patch gap indicators, and security privilege indicators. A hazard prediction function is constructed based on the multi-dimensional asset feature vector and attack feature vector. This hazard prediction function quantifies the immediate harm caused by any attack to a single asset, and its output is the hazard intensity and confidence interval. A security assessment model is constructed based on the multi-dimensional asset feature vector and hazard prediction function. Based on this model, a security assessment of the digital power grid assets is performed. By unifying the quantification of multi-source security indicators and attack attributes into standardized feature vectors, the bias caused by data heterogeneity is eliminated, enabling the constructed hazard prediction function to output a hazard intensity with a confidence interval. Furthermore, the established security assessment model incorporates the propagation probability between assets, cross-domain coupling strength, and time delay into the edge weights, making the attack propagation simulation closer to the actual power grid characteristics, reducing the calculation errors of propagation paths and impact domains, and thus improving the accuracy of digital power grid security assessment.

[0148] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0149] Based on the same inventive concept, this application also provides a digital power grid security assessment device for implementing the aforementioned digital power grid security assessment method. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more embodiments of the digital power grid security assessment device provided below can be found in the limitations of the digital power grid security assessment method described above, and will not be repeated here.

[0150] In one embodiment, such as Figure 7 As shown, a security assessment device for a digital power grid is provided, comprising: a first construction module 10, a second construction module 11, a third construction module 12, and an assessment module 13, wherein:

[0151] The first construction module 10 is used to construct a multi-dimensional asset feature vector based on the security indicators of digital power grid assets, and to construct an attack feature vector based on the attribute information of the current attack events suffered by digital power grid assets; the security indicators include at least one of port exposure indicators, patch gap indicators, and security permission indicators.

[0152] The second construction module 11 is used to construct a hazard prediction function based on multi-dimensional asset feature vectors and attack feature vectors. The hazard prediction function is used to quantify the immediate harm caused by any attack to a single asset. The output of the hazard prediction function is the hazard intensity and confidence interval.

[0153] The third building module 12 is used to build a security assessment model based on multi-dimensional asset feature vectors and hazard prediction functions, wherein the weight edges are determined by propagation, medium coupling strength and time delay.

[0154] Assessment Model 13 is used to conduct security assessments of digital grid assets based on a security assessment model.

[0155] In one embodiment, the second building module 11 includes: a first building unit, a second building unit, and a third building unit, wherein:

[0156] The first building unit is used to construct a heterogeneous graph based on multi-dimensional asset feature vectors; the heterogeneous graph is used to represent the relationship between assets and security indicators.

[0157] The second building unit is used to construct a graph neural network based on the heterogeneous graph, and to construct a hierarchical Bayesian model based on the prior distribution of the trainable parameters of the hazard prediction function.

[0158] The third building block is used to construct a hazard prediction function based on graph neural networks, hierarchical Bayesian models, and attack feature vectors.

[0159] In one embodiment, the third building unit is specifically used to build a feature fusion layer; the feature fusion layer is used to fuse the asset embedding vector output by the graph neural network with the attack feature vector; and a hazard prediction function is built based on the feature fusion layer and the hierarchical Bayesian model.

[0160] In one embodiment, the third construction module 12 includes: a first determining unit, a second determining unit, and a third determining unit, wherein:

[0161] The first determining unit is used to determine the propagation weight of each directed edge in the heterogeneous graph.

[0162] The second determining unit is used to determine the infection probability of each directed edge based on the hazard intensity output by the constructed hazard prediction function.

[0163] The third determining unit is used to construct a safety assessment model based on propagation weights and infection probabilities.

[0164] In one embodiment, the evaluation module 13 includes: an acquisition unit, a propagation unit, and an evaluation unit, wherein:

[0165] The acquisition unit is used to acquire real-time data on current attack events and digital power grid assets.

[0166] The propagation unit is used to simulate the propagation of the current attack event based on the security assessment model, the current attack event, and real-time data of the digital power grid assets, so as to obtain the impact domain, impact radius, and propagation path of the current attack event.

[0167] The assessment unit is used to conduct security assessments of digital grid assets based on the impact domain, impact radius, and propagation path.

[0168] In one embodiment, the aforementioned assessment unit is specifically used to determine the risk level of the current attack event based on the impact domain, impact radius, and propagation path.

[0169] Each module in the aforementioned digital power grid security assessment device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0170] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0171] Based on the security indicators of digital power grid assets, a multi-dimensional asset feature vector is constructed, and an attack feature vector is constructed based on the attribute information of the current attack events on digital power grid assets; the security indicators include at least one of port exposure indicators, patch gap indicators, and security permission indicators.

[0172] Based on multi-dimensional asset feature vectors and attack feature vectors, a hazard prediction function is constructed. The hazard prediction function is used to quantify the immediate harm caused by any attack to a single asset. The output of the hazard prediction function is the hazard intensity and confidence interval.

[0173] A safety assessment model is constructed based on multi-dimensional asset feature vectors and hazard prediction functions;

[0174] Security assessments are conducted on digital power grid assets based on a security assessment model.

[0175] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0176] Heterogeneous graphs are constructed based on multi-dimensional asset feature vectors; these graphs are used to characterize the relationship between assets and security indicators.

[0177] Based on the heterogeneous graph, a graph neural network is constructed, and based on the prior distribution of the trainable parameters of the hazard prediction function, a hierarchical Bayesian model is constructed.

[0178] A hazard prediction function is constructed based on graph neural networks, hierarchical Bayesian models, and attack feature vectors.

[0179] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0180] Construct a feature fusion layer; the feature fusion layer is used to fuse the asset embedding vector output by the graph neural network with the attack feature vector;

[0181] A hazard prediction function is constructed based on a feature fusion layer and a hierarchical Bayesian model.

[0182] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0183] Determine the propagation weight of each directed edge in the heterogeneous graph;

[0184] Based on the hazard intensity output by the hazard prediction function, the infection probability of each directed edge is determined.

[0185] A safety assessment model is constructed based on transmission weight and infection probability.

[0186] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0187] Obtain real-time data on current attack events and digital power grid assets;

[0188] Based on the security assessment model, the current attack event, and real-time data of digital power grid assets, a propagation simulation is performed to obtain the impact domain, impact radius, and propagation path of the current attack event;

[0189] Security assessments are conducted on digital grid assets based on their impact domain, impact radius, and propagation path.

[0190] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0191] The risk level of the current attack event is determined based on the affected area, affected radius, and propagation path.

[0192] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0193] Based on the security indicators of digital power grid assets, a multi-dimensional asset feature vector is constructed, and an attack feature vector is constructed based on the attribute information of the current attack events on digital power grid assets; the security indicators include at least one of port exposure indicators, patch gap indicators, and security permission indicators.

[0194] Based on multi-dimensional asset feature vectors and attack feature vectors, a hazard prediction function is constructed. The hazard prediction function is used to quantify the immediate harm caused by any attack to a single asset. The output of the hazard prediction function is the hazard intensity and confidence interval.

[0195] A safety assessment model is constructed based on multi-dimensional asset feature vectors and hazard prediction functions;

[0196] Security assessments are conducted on digital power grid assets based on a security assessment model.

[0197] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0198] Heterogeneous graphs are constructed based on multi-dimensional asset feature vectors; these graphs are used to characterize the relationship between assets and security indicators.

[0199] Based on the heterogeneous graph, a graph neural network is constructed, and based on the prior distribution of the trainable parameters of the hazard prediction function, a hierarchical Bayesian model is constructed.

[0200] A hazard prediction function is constructed based on graph neural networks, hierarchical Bayesian models, and attack feature vectors.

[0201] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0202] Construct a feature fusion layer; the feature fusion layer is used to fuse the asset embedding vector output by the graph neural network with the attack feature vector;

[0203] A hazard prediction function is constructed based on a feature fusion layer and a hierarchical Bayesian model.

[0204] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0205] Determine the propagation weight of each directed edge in the heterogeneous graph;

[0206] Based on the hazard intensity output by the hazard prediction function, the infection probability of each directed edge is determined.

[0207] A safety assessment model is constructed based on transmission weight and infection probability.

[0208] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0209] Obtain real-time data on current attack events and digital power grid assets;

[0210] Based on the security assessment model, the current attack event, and real-time data of digital power grid assets, a propagation simulation is performed to obtain the impact domain, impact radius, and propagation path of the current attack event;

[0211] Security assessments are conducted on digital grid assets based on their impact domain, impact radius, and propagation path.

[0212] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0213] The risk level of the current attack event is determined based on the affected area, affected radius, and propagation path.

[0214] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0215] Based on the security indicators of digital power grid assets, a multi-dimensional asset feature vector is constructed, and an attack feature vector is constructed based on the attribute information of the current attack events on digital power grid assets; the security indicators include at least one of port exposure indicators, patch gap indicators, and security permission indicators.

[0216] Based on multi-dimensional asset feature vectors and attack feature vectors, a hazard prediction function is constructed. The hazard prediction function is used to quantify the immediate harm caused by any attack to a single asset. The output of the hazard prediction function is the hazard intensity and confidence interval.

[0217] A safety assessment model is constructed based on multi-dimensional asset feature vectors and hazard prediction functions;

[0218] Security assessments are conducted on digital power grid assets based on a security assessment model.

[0219] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0220] Heterogeneous graphs are constructed based on multi-dimensional asset feature vectors; these graphs are used to characterize the relationship between assets and security indicators.

[0221] Based on the heterogeneous graph, a graph neural network is constructed, and based on the prior distribution of the trainable parameters of the hazard prediction function, a hierarchical Bayesian model is constructed.

[0222] A hazard prediction function is constructed based on graph neural networks, hierarchical Bayesian models, and attack feature vectors.

[0223] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0224] Construct a feature fusion layer; the feature fusion layer is used to fuse the asset embedding vector output by the graph neural network with the attack feature vector;

[0225] A hazard prediction function is constructed based on a feature fusion layer and a hierarchical Bayesian model.

[0226] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0227] Determine the propagation weight of each directed edge in the heterogeneous graph;

[0228] Based on the hazard intensity output by the hazard prediction function, the infection probability of each directed edge is determined.

[0229] A safety assessment model is constructed based on transmission weight and infection probability.

[0230] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0231] Obtain real-time data on current attack events and digital power grid assets;

[0232] Based on the security assessment model, the current attack event, and real-time data of digital power grid assets, a propagation simulation is performed to obtain the impact domain, impact radius, and propagation path of the current attack event;

[0233] Security assessments are conducted on digital grid assets based on their impact domain, impact radius, and propagation path.

[0234] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0235] The risk level of the current attack event is determined based on the affected area, affected radius, and propagation path.

[0236] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0237] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0238] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A security assessment method for digital power grids, characterized in that, The method includes: Based on the security indicators of digital power grid assets, a multi-dimensional asset feature vector is constructed, and an attack feature vector is constructed based on the attribute information of the current attack events suffered by the digital power grid assets; the security indicators include at least one of port exposure indicators, patch gap indicators, and security permission indicators. Based on the multi-dimensional asset feature vector and the attack feature vector, a hazard prediction function is constructed; the hazard prediction function is used to quantify the immediate hazard caused by any attack to a single asset, and the output of the hazard prediction function is the hazard intensity and confidence interval; A safety assessment model is constructed based on the multi-dimensional asset feature vector and the hazard prediction function. The security assessment of the digital power grid assets is conducted based on the aforementioned security assessment model.

2. The method according to claim 1, characterized in that, The hazard prediction function is constructed based on the multi-dimensional asset feature vector and attack feature vector, including: Based on the multi-dimensional asset feature vectors, a heterogeneous graph is constructed; the heterogeneous graph is used to characterize the relationship between assets and the security indicators. Based on the heterogeneous graph, a graph neural network is constructed, and based on the prior distribution of the trainable parameters of the hazard prediction function, a hierarchical Bayesian model is constructed. A hazard prediction function is constructed based on the graph neural network, the hierarchical Bayesian model, and the attack feature vector.

3. The method according to claim 2, characterized in that, The construction of a hazard prediction function based on the graph neural network, the hierarchical Bayesian model, and the attack feature vector includes: A feature fusion layer is constructed; the feature fusion layer is used to fuse the asset embedding vector output by the graph neural network with the attack feature vector; The hazard prediction function is constructed based on the feature fusion layer and the hierarchical Bayesian model.

4. The method according to claim 2, characterized in that, The security assessment model constructed based on the multi-dimensional asset feature vector and the hazard prediction function includes: Determine the propagation weight of each directed edge in the heterogeneous graph; Based on the hazard intensity output by the constructed hazard prediction function, the infection probability of each directed edge is determined; The security assessment model is constructed based on the propagation weight and the infection probability.

5. The method according to claim 1, characterized in that, The security assessment of the digital power grid assets based on the security assessment model includes: Obtain real-time data on current attack events and digital power grid assets; Based on the security assessment model, the current attack event, and real-time data of the digital power grid assets, a propagation simulation is performed to obtain the impact domain, impact radius, and propagation path of the current attack event. The digital power grid assets are assessed for security based on the influence domain, the influence radius, and the propagation path.

6. The method according to claim 5, characterized in that, The security assessment of the digital power grid based on the influence domain, the influence radius, and the propagation path includes: The risk level of the current attack event is determined based on the affected area, the affected radius, and the propagation path.

7. A security assessment device for a digital power grid, characterized in that, The device includes: The first construction module is used to construct a multi-dimensional asset feature vector based on the security indicators of digital power grid assets, and to construct an attack feature vector based on the attribute information of the current attack event suffered by the digital power grid assets; the security indicators include at least one of port exposure indicators, patch gap indicators, and security permission indicators. The second construction module is used to construct a hazard prediction function based on the multi-dimensional asset feature vector and the attack feature vector; the hazard prediction function is used to quantify the immediate hazard caused by any attack to a single asset, and the output of the hazard prediction function is the hazard intensity and confidence interval; The third construction module is used to construct a security assessment model based on the multi-dimensional asset feature vector and the hazard prediction function, wherein the weighted edges are determined by propagation, medium coupling strength and time delay. An assessment model is used to conduct a security assessment of the digital power grid assets based on the security assessment model.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images