A fault root cause localization method and system
By performing cross-domain fusion noise reduction and threat information addition and updates on multi-source alarm data from power networks, and combining this with network topology maps for root cause localization of faults, the problems of accuracy and redundant alarms in root cause analysis in power networks have been solved, enabling efficient localization of power-specific threats and identification of new types of attacks.
Patent Information
- Application Number
- CN202610599711.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-04-30
- Publication Date
- 2026-08-25
AI Technical Summary
Existing technologies have low accuracy in root cause analysis of heterogeneous alarm logs in power networks. In particular, they have a high false alarm rate for power-specific threats such as 'relay protection device malfunction' and 'DC control anomaly'. Furthermore, they have a high false negative rate when facing new types of attacks and cannot understand the attack intent and context, resulting in a large number of redundant alarms.
By acquiring multi-source alarm data, network topology maps, and threat intelligence data from the power transmission network, cross-domain fusion noise reduction and threat information addition and updates are performed. The network topology map is combined to locate the root cause of the fault. A pre-trained large model is used for semantic understanding and threat analysis. Semantic similar security event objects are aggregated to identify attack intent and attack chains, thereby reducing the false positive rate and false negative rate.
It improves the accuracy of root cause localization, reduces the number of redundant alarms, enables timely detection of new attacks, reduces the false positive rate of power-specific threats, and improves the quality of root cause localization.
Smart Images
Figure CN122640296A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of power grid safety technology, and in particular to a method and system for locating the root cause of a fault. Background Technology
[0002] With the continuous advancement of digital and intelligent transformation of power transmission networks, millions of heterogeneous alarm logs are generated daily on the network side (such as firewalls, IDS, IPS), host side (such as terminal detection and response EDR), and service side (such as SCADA, industrial control).
[0003] Currently, the relevant technologies typically use general NLP large models to perform root cause analysis on heterogeneous alarm logs. This approach has a high misjudgment rate when facing power-specific threats such as "relay protection device malfunction" and "DC control anomaly," and the accuracy of root cause location is unsatisfactory.
[0004] Therefore, the problems with the relevant technologies still need to be solved and optimized. Summary of the Invention
[0005] The purpose of this invention is to at least partially solve one of the technical problems existing in the related art.
[0006] Therefore, one objective of this invention is to provide a method and system for locating the root cause of a fault, wherein the method can effectively improve the accuracy of locating the root cause of a fault.
[0007] To achieve the above-mentioned technical objectives, the technical solutions adopted in the embodiments of this application include: In a first aspect, embodiments of this application provide a method for locating the root cause of a fault, including: Acquire multi-source alarm data, network topology diagrams, and threat intelligence data from power transmission networks; Cross-domain fusion and noise reduction are performed on the multi-source alarm data to obtain an effective alarm set; Based on the threat intelligence data, the effective alert set is updated with added threat information to obtain the abnormal alert set; Based on the network topology diagram, the root cause of the fault is located in the abnormal alarm set to obtain the root cause location result of the fault in the power transmission network.
[0008] In addition, the method according to the above embodiments of this application may also have the following additional technical features: Furthermore, in one embodiment of this application, the effective alarm set includes several core alarms, and the process of cross-domain fusion and noise reduction of the multi-source alarm data to obtain the effective alarm set includes: Obtain a pre-trained large model, a first event object, and a second event object; the first event object is any one of the security event objects in the multi-source alarm data; the second event object is any one of the security event objects in the multi-source alarm data other than the first event object. Based on the pre-trained large model, semantic encoding is performed on the first event object and the second event object to obtain the first semantic vector of the first event object and the second semantic vector of the second event object; Based on the first semantic vector and the second semantic vector, multidimensional analysis and clustering are performed on the first event object and the second event object to obtain the core alarm.
[0009] Furthermore, in one embodiment of this application, the method further includes: The step of performing multidimensional analysis and clustering on the first event object and the second event object based on the first semantic vector and the second semantic vector to obtain the core alarm includes: Semantic similarity analysis is performed on the first semantic vector and the second semantic vector to obtain the event semantic similarity. Feature similarity analysis is performed on the five-tuple features of the first event object and the five-tuple features of the second event object to obtain the event feature similarity. Perform time window similarity analysis on the event timestamps of the first event object and the second event object to obtain the event time similarity. Based on the event semantic similarity, the event feature similarity, and the event time similarity, the first event object and the second event object are clustered to obtain the core alarm.
[0010] Furthermore, in one embodiment of this application, the method further includes: Obtain the network security level and business importance level corresponding to the isolated alarm, wherein the isolated alarm is an isolated security event object among all security event objects in the multi-source alarm data; An asset criticality analysis is performed on the network security level and the business importance level to obtain the asset criticality level of the isolated alarm; Based on the asset criticality level and the isolated alarms, the valid alarm set is updated to obtain the updated valid alarm set.
[0011] Furthermore, in one embodiment of this application, the step of adding and updating threat information to the valid alert set based on the threat intelligence data to obtain an abnormal alert set includes: The effective alarm set is input into the pre-trained large model for attack identification, and several information groups output by the pre-trained large model are obtained. Each information group corresponds to a core alarm in the effective alarm set. The information group includes attack intent information and attack chain information. Based on the threat intelligence data, threat analysis is performed on each of the core alerts and the information groups to obtain several threat analysis information; Based on all the threat analysis information, the attack intent information, and the attack chain information, the valid alarm set is updated to obtain the abnormal alarm set.
[0012] Furthermore, in one embodiment of this application, the step of performing fault root cause localization on the abnormal alarm set based on the network topology diagram to obtain the fault root cause localization result of the power transmission network includes: Based on the abnormal alarm set, extract several abnormal leaf nodes from the network topology graph; Based on all the abnormal leaf nodes, the network topology graph is traced back to the root cause node to obtain the root cause candidate set for each abnormal leaf node. The root cause candidate set of each abnormal leaf node is sorted and filtered in descending order to obtain the fault root cause location result of the power transmission network.
[0013] Further, in this embodiment of the application, the step of performing reverse root cause node tracing on the network topology graph based on all the abnormal leaf nodes to obtain a root cause candidate set for each abnormal leaf node includes: Based on the abnormal leaf nodes, a reverse root cause search is performed on the network topology graph to obtain several intermediate root cause nodes and the root cause posterior probability of each intermediate root cause node. Based on the abnormal alarm time of the abnormal leaf node, the abnormal occurrence time of each intermediate root cause node is subjected to time-series constraint filtering to obtain several target root cause nodes; the total number of target root cause nodes is less than or equal to the total number of intermediate root cause nodes. The root cause candidate set is obtained based on all the target root cause nodes and the root cause posterior probability.
[0014] Furthermore, in this embodiment of the application, the method further includes: Obtain the root cause localization node and the asset criticality level set corresponding to the abnormal alarm set; the root cause localization node is any one of the target root cause nodes in the fault root cause localization result; Based on the root cause localization node, a dependency node search is performed on the network topology graph to obtain several downstream dependency nodes of the root cause localization node. Based on the asset criticality level set, a fault impact surface analysis is performed on all downstream dependent nodes to obtain the fault impact surface analysis results.
[0015] Secondly, embodiments of this application provide a fault root cause localization system, comprising: The first processing unit is used to acquire multi-source alarm data, network topology map and threat intelligence data of the power transmission network; The second processing unit is used to perform cross-domain fusion and noise reduction on the multi-source alarm data to obtain an effective alarm set. The third processing unit is used to add and update threat information to the valid alarm set based on the threat intelligence data to obtain the abnormal alarm set; The fourth processing unit is used to locate the root cause of the fault in the abnormal alarm set according to the network topology diagram, and obtain the root cause location result of the fault in the power transmission network.
[0016] Thirdly, embodiments of this application also provide an electronic device, including: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method described above.
[0017] Fourthly, embodiments of this application also provide a computer-readable storage medium storing a processor-executable program, which, when executed by the processor, is used to implement the above-described method.
[0018] Fifthly, embodiments of this application also provide a computer program product, which includes a computer program stored in a computer-readable storage medium. A processor of an electronic device reads the computer program from the computer-readable storage medium and executes the computer program, causing the electronic device to perform the method described above.
[0019] The advantages and beneficial effects of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application: This application discloses a fault root cause localization method and system. The method acquires multi-source alarm data, network topology diagrams, and threat intelligence data from a power transmission network; performs cross-domain fusion and noise reduction on the multi-source alarm data to obtain a valid alarm set; updates the valid alarm set with threat information based on the threat intelligence data to obtain an abnormal alarm set; and performs fault root cause localization on the abnormal alarm set based on the network topology diagram to obtain the fault root cause localization result for the power transmission network. This method performs fault root cause localization on the abnormal alarm set based on the network topology diagram, which can inject power grid context information into fault root cause localization, effectively improving the accuracy of fault root cause localization. Attached Figure Description
[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the following description is provided with accompanying drawings of the relevant technical solutions in the embodiments of this application or the prior art. It should be understood that the accompanying drawings described below are only for the purpose of clearly illustrating some embodiments of the technical solutions in this application. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.
[0021] Figure 1 A flowchart illustrating a fault root cause localization method provided in an embodiment of this application; Figure 2 A schematic diagram of the framework of a fault root cause localization system provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation
[0022] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application. The step numbers in the following embodiments are set only for ease of explanation, and there is no limitation on the order between the steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.
[0023] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.
[0024] Currently, root cause analysis techniques based on heterogeneous alarm logs typically use general NLP models to perform root cause analysis on these logs. However, this approach often only performs root cause analysis at a single level, such as only at the IT network layer (OSI L3-L4) in the transmission network. It ignores power service layer dependencies (e.g., cross-layer propagation from "DC power control anomaly → valve group controller → station control layer switch → security camera"), resulting in unsatisfactory accuracy in root cause localization. Furthermore, due to the lack of vertical contextual knowledge such as power control protocol semantics, grid topology, and equipment asset criticality, this method has a high misjudgment rate when facing power-specific threats such as "relay protection device malfunction" and "DC control anomaly," further complicating subsequent root cause localization.
[0025] Furthermore, some existing technologies rely on predefined regular expressions or ATT&CK rules to filter massive amounts of heterogeneous alarm logs before performing root cause analysis. This approach suffers from rule lag, resulting in a high false negative rate when facing new attacks without matching rules. It also fails to understand attack intent and context, easily leading to situations where similar attacks changing ports or paths are treated as new alarms, leaving a significant number of redundant alarms and ultimately rendering the alarm log filtering ineffective.
[0026] Furthermore, some existing technologies employ a multi-agent collaborative approach to achieve root cause analysis of heterogeneous alarm logs. However, because the agents built in this way are mostly single-point designs—for example, the noise reduction agent filtering alarm logs only considers the traffic characteristics of the alarm logs, without considering information such as the host process chain of the alarm logs in the power transmission network; the analysis agent performing root cause analysis of alarm logs only considers the corresponding topology information, without considering threat intelligence—this approach easily makes it difficult to correlate cross-domain attacks (external network penetration → internal network lateral movement → industrial control nodes) that led to the alarm logs, resulting in a broken attack chain and consequently poor quality of subsequent root cause localization.
[0027] It should be noted that the aforementioned related technologies are only used to assist in understanding the technical solutions of this application and do not mean that they belong to the publicly disclosed prior art.
[0028] In view of this, embodiments of this application provide a fault root cause localization method and system. This method performs cross-domain fusion and noise reduction on multi-source alarm data. Specifically, by leveraging the semantic understanding capabilities of a pre-trained large model, it aggregates security event objects with similar semantics, five-tuple features, and temporal similarities from multiple security event objects in the multi-source alarm data. This allows for a thorough understanding of the implicit attack intent of the security event objects, effectively addressing the situation where similar attacks changing ports / paths are considered new alarms, reducing the number of redundant alarms remaining after alarm filtering, and thus improving the alarm log filtering effect. Simultaneously, this method also analyzes the asset criticality level of isolated alarms and updates the effective alarm set. This enables the transmission network to promptly detect new types of attacks, thereby reducing the false negative rate when facing new attacks without matching rules.
[0029] Furthermore, this method adds and updates threat information to the effective alert set through threat intelligence data. Specifically, it identifies the information group (including attack intent and attack chain stage) of each core alert through a pre-trained large model, and adds the information group along with threat analysis information to each core attack in the effective alert set. This can fully correlate relevant information of cross-domain attacks with alert logs, thereby improving the quality of subsequent root cause localization.
[0030] Furthermore, this method also achieves root cause analysis of faults by combining an abnormal alarm set, which includes information such as attack intent, attack chain stage, and isolated alarms provided by the aforementioned cross-domain fusion noise reduction and threat information addition and update synergy, with the network topology map. This can effectively reduce the misjudgment rate when facing power-specific threats such as "relay protection device malfunction" and "DC control anomaly", and effectively improve the accuracy of root cause location.
[0031] Reference Figure 1 In this application embodiment, a fault root cause localization method includes: Step 110: Obtain multi-source alarm data, network topology diagram, and threat intelligence data of the power transmission network; In this embodiment, the power transmission network can be an ultra-high voltage power transmission network in the power grid system, and the network topology diagram can be a three-layer directed topology diagram of the power transmission network at the "equipment layer - network layer - service layer" based on the configuration management database (CMDB) and the network structure topology drawing of the power transmission network. The set of vertices of the directed topological graph ,in Network device nodes (such as network security devices, routers, switches, servers, and terminals). This refers to the top of a network node (such as IP address, port, or network segment). For business node vertices (such as network security device alarms, Cloud Shield IT-SCADA data collection); edge sets ,in For physical connection edges, For logical communication edge, For business-dependent edges, the edge weight represents the degree of correlation between nodes, with a value range of [0, 1]. Furthermore, the attribute information of each node in this network topology can be the equipment asset information of the corresponding equipment in the power transmission network.
[0032] Multi-source alarm data can be collected from network-side alarm data, host-side data, and service-side data within the power transmission network. Network-side alarm data includes interception logs from firewalls, IDS, and / or IPS, as well as abnormal traffic logs within the power transmission network. Host-side data includes process logs, file operation logs, and port occupancy logs collected by the power transmission network's EDR (Electronic Data Retrieval System). Service-side data includes equipment operating parameters of the power transmission network's SCADA system, relay protection device logs, valve control system status logs, and industrial control protocol interaction logs. Threat intelligence data can be collected from the power transmission network's internal threat intelligence database or obtained by receiving threat intelligence from external third parties.
[0033] It should be noted that after collecting multi-source alarm data from the power transmission network, the data can be preprocessed using a data acquisition agent to obtain preprocessed multi-source alarm data. Specifically, multiple fields can be extracted from the original multi-source alarm data, such as alarm time, source IP, destination IP, source port, destination port, transmission protocol, alarm description, alarm level, device ID, and asset ID. Next, all extracted fields are cleaned to remove missing and outlier values. Simultaneously, several field types are normalized; for example, alarm levels for different devices are uniformly converted to levels 1-5, transmission protocols are uniformly converted to standard terms (such as "TCP", "UDP", "IEC 61850"), and alarm descriptions are converted to standardized semantics (such as "port scan" and "malicious code execution"). Finally, a unified security time object is constructed for all fields. ,in, Alarm timestamp; Alarm The source IP address; Alarm Destination IP address; Alarm The source port; Alarm Destination port; Alarm The transmission protocol; Alarm Standardized description; Alarm The original levels (levels 1-5); : Generate alarm The device ID; : Generate alarm Asset ID.
[0034] Step 120: Perform cross-domain fusion and noise reduction on the multi-source alarm data to obtain an effective alarm set; In this embodiment of the application, in practical applications, a noise reduction agent can receive multi-source alarm data output by a data acquisition agent and perform cross-domain fusion noise reduction on the multi-source alarm data to obtain an effective alarm set.
[0035] In some embodiments, the effective alarm set includes several core alarms, and the process of cross-domain fusion and noise reduction of the multi-source alarm data to obtain the effective alarm set includes: Obtain a pre-trained large model, a first event object, and a second event object; the first event object is any one of the security event objects in the multi-source alarm data; the second event object is any one of the security event objects in the multi-source alarm data other than the first event object. Based on the pre-trained large model, semantic encoding is performed on the first event object and the second event object to obtain the first semantic vector of the first event object and the second semantic vector of the second event object; In this embodiment, the noise reduction agent can aggregate similar security event objects from multi-source alarm data. The aggregation can be implemented in a loop to obtain the core alarm. Specifically, for any security event object in the multi-source alarm data, denoted as the first event object, the similarity between the first event object and other security event objects (i.e., the second event objects) at the multi-dimensional level can be determined in a loop to obtain the corresponding core alarm.
[0036] Understandably, the pre-trained large model can be a large language model built on the Transformer architecture, obtained through incremental pre-training on power safety and operation corpora (such as alarm logs, scheduling procedures, and equipment ledgers). For any loop process, the first event object and the second event object in the current loop process can be input into the pre-trained large model for semantic encoding to determine the semantic vector of the first event object, denoted as the first semantic vector, and the semantic vector of the second event object, denoted as the second semantic vector.
[0037] Based on the first semantic vector and the second semantic vector, multidimensional analysis and clustering are performed on the first event object and the second event object to obtain the core alarm.
[0038] Further, the step of performing multi-dimensional analysis and clustering on the first event object and the second event object based on the first semantic vector and the second semantic vector to obtain the core alarm includes: Semantic similarity analysis is performed on the first semantic vector and the second semantic vector to obtain the event semantic similarity. Feature similarity analysis is performed on the five-tuple features of the first event object and the five-tuple features of the second event object to obtain the event feature similarity. Perform time window similarity analysis on the event timestamps of the first event object and the second event object to obtain the event time similarity. Based on the event semantic similarity, the event feature similarity, and the event time similarity, the first event object and the second event object are clustered to obtain the core alarm.
[0039] In this embodiment, semantic similarity analysis can be based on any of the methods such as cosine distance or Euclidean distance to calculate the similarity between the first semantic vector and the second semantic vector, so as to obtain the event semantic similarity between the first event object and the second event object; while feature similarity analysis can first obtain the five-tuple features of the first event object and the second event object, which is an array representation of source IP, destination IP, source port, destination port and transmission protocol, and then calculate the feature similarity between the two five-tuple features. Specifically, the calculation method can be to calculate the matching degree between the two five-tuple features to obtain the event feature similarity between the first event object and the second event object.
[0040] Time window similarity analysis can calculate the time difference between the alarm times of the first time object and the second time object. If the time difference is less than a preset threshold (such as 1 minute, 1 minute, 5 minutes), the event time similarity value is 1; otherwise, the event time similarity value is 0.
[0041] Event clustering can combine multi-dimensional similarity, such as event semantic similarity, event feature similarity, and event temporal similarity, to determine the comprehensive alarm similarity between the first event object and the second event object. This comprehensive alarm similarity can be expressed as:
[0042] in, To assess the similarity of alarms; For event semantic similarity; Similarity of event features; For event time similarity; , and These are the weighting coefficients. One of the optional examples can be , , .
[0043] For any given loop, if the overall alarm similarity between the first event object and the second event object is greater than or equal to a preset threshold (such as any one of 0.7, 0.8, or 0.92), it indicates that the first event object has redundant alarm events. The first and second event objects are then classified as the same security event object, and the second event object is removed from the multi-source alarm data as a redundant alarm event, retaining only the first event object as the representative of the core alarm. Alternatively, if the overall alarm similarity between the first and second event objects is less than the preset threshold, it indicates that the first event object does not have redundant alarm events, and both the first and second event objects are retained in the multi-source alarm data.
[0044] It should be noted that in practical applications, if there are other second event objects that have not been clustered for the first event object, the steps of obtaining the pre-trained large model, the first event object, and the second event object can be returned; or, if the first event object has been clustered for all second event objects, the final first event object can be identified as a core alarm.
[0045] In some embodiments, the method further includes: Obtain the network security level and business importance level corresponding to the isolated alarm, wherein the isolated alarm is an isolated security event object among all security event objects in the multi-source alarm data; An asset criticality analysis is performed on the network security level and the business importance level to obtain the asset criticality level of the isolated alarm; Based on the asset criticality level and the isolated alarms, the valid alarm set is updated to obtain the updated valid alarm set.
[0046] In this embodiment, an isolated alarm is an isolated security event object, specifically a security event object that does not have redundant alarm events during the aforementioned security event object aggregation process. The network security level characterizes the security level of the power transmission network equipment asset corresponding to the isolated alarm, while the business importance level characterizes the business importance of the power transmission network equipment asset corresponding to the isolated alarm. The specific values of both the network security level and the business importance level can be preset.
[0047] The asset criticality level can be obtained by weighting the cybersecurity level and the business importance level. This asset criticality level can be expressed as:
[0048] in, It is classified as an asset criticality level; The business importance level of the equipment asset corresponding to alarm i is specified. For example, the business importance level of the core production business of the power transmission network is 1, that of the auxiliary production business is 0.5, and that of the office business is 0.1. The network security level of the device asset corresponding to alarm i is similar to the aforementioned business importance level. and The weighting coefficients and For example , .
[0049] Understandably, alarm updates can first determine whether the level of an isolated alarm is less than or equal to level 2, and whether the asset criticality level is less than or equal to the level threshold corresponding to non-core assets of the transmission network. The level threshold corresponding to non-core assets can be set according to the actual situation. For example, the equipment assets of the transmission network can be divided into five levels from 1 to 5, and equipment assets less than or equal to level 2 can be identified as non-core assets, while equipment assets greater than level 2 can be identified as core assets.
[0050] Specifically, if the level of an isolated alarm is less than or equal to level 2 and the asset criticality level is less than the threshold corresponding to non-core assets of the transmission network, the current set of valid alarms can be directly determined as the updated set of valid alarms. Alternatively, if the level of an isolated alarm is greater than level 2, or the asset criticality level is greater than or equal to the threshold corresponding to non-core assets of the transmission network, the isolated alarm can be added to the current set of valid alarms to obtain the updated set of valid alarms.
[0051] Step 130: Based on the threat intelligence data, add and update the threat information in the valid alert set to obtain the abnormal alert set; In this embodiment, the noise reduction agent can transmit the effective alarm set to the threat agent, which then adds and updates the previously received threat intelligence data to the effective alarm set to obtain the abnormal alarm set.
[0052] In some embodiments, the step of adding and updating threat information to the valid alert set based on the threat intelligence data to obtain an abnormal alert set includes: The effective alarm set is input into the pre-trained large model for attack identification, and several information groups output by the pre-trained large model are obtained. Each information group corresponds to a core alarm in the effective alarm set. The information group includes attack intent information and attack chain information. Based on the threat intelligence data, threat analysis is performed on each of the core alerts and the information groups to obtain several threat analysis information; Based on all the threat analysis information, the attack intent information, and the attack chain information, the valid alarm set is updated to obtain the abnormal alarm set.
[0053] In this embodiment, a valid alarm set and a preset prompt word template can be input into a pre-trained large model. This allows the pre-trained large model to map each core alarm in the valid alarm set to the MITRE ATT&CK for ICS industrial control system attack matrix, thereby identifying the attack intent and attack chain information of each core alarm in the valid alarm set, and ultimately obtaining the information group for each core alarm. Specifically, the prompt word template can be produced based on prompt engineering technology. This prompt word template is used to instruct the pre-trained large model to map the core alarms to the industrial control system attack matrix to identify the attack intent and attack chain information of the core alarms. The prompt word template can take many forms in practical applications, which will not be elaborated upon here.
[0054] Understandably, the MITRE ATT&CK for ICS Industrial Control System Attack Matrix is a knowledge base of network attack behaviors targeting industrial control systems. It records attack tactics (i.e., attack intentions) such as initial access, command execution, persistence, privilege escalation, defense evasion, and lateral movement, as well as several complete attack chains (such as "initial access → lateral movement → command execution → affecting physical processes").
[0055] For any core alert and its information group, threat analysis can be based on threat intelligence data to analyze its threat confidence. Specifically, this can involve inputting the core alert and information group into a pre-trained large model, generating its threat confidence through inference using the pre-trained large model, and obtaining its model threat confidence. Additionally, based on the core alert and information group, it can be matched with threat intelligence data to obtain intelligence matching confidence. Various methods exist for implementing confidence matching, which will not be elaborated upon here. Finally, based on the model threat confidence and intelligence matching confidence, the threat level corresponding to the core alert is determined and recorded as threat analysis information.
[0056] For example, this threat analysis information can be represented as:
[0057] in, Threat analysis information for core alerts; Threat confidence level for the model; Match confidence levels to intelligence; This is the weighting coefficient, and its value can be any one of 0.4, 0.5, 0.7, etc. The alarm level for core alarms.
[0058] For any core alert, the threat analysis information, attack intent information, and attack chain information can be added and updated to the core alert. After all core alerts have been added, the final set of valid alerts is determined as the set of abnormal alerts.
[0059] Step 140: Based on the network topology diagram, perform fault root cause location on the abnormal alarm set to obtain the fault root cause location result of the power transmission network.
[0060] In this embodiment of the application, the threat agent can transmit the abnormal alarm set to the root cause analysis agent. The root cause analysis agent performs fault root cause location on each core alarm in the abnormal alarm set based on the previously received network topology map, thereby obtaining the fault root cause location result of the power transmission network.
[0061] In some embodiments, the step of performing fault root cause localization on the abnormal alarm set based on the network topology map to obtain the fault root cause localization result of the power transmission network includes: Based on the abnormal alarm set, extract several abnormal leaf nodes from the network topology graph; In this embodiment of the application, for any core alarm in the abnormal alarm set, the corresponding topology node can be determined from the network topology diagram based on the equipment asset corresponding to the core alarm in the power transmission network, and the corresponding topology node can be determined as the abnormal leaf node.
[0062] Based on all the abnormal leaf nodes, the network topology graph is traced back to the root cause node to obtain the root cause candidate set for each abnormal leaf node. Further, the step of performing reverse root cause tracing on the network topology graph based on all the abnormal leaf nodes to obtain a root cause candidate set for each abnormal leaf node includes: Based on the abnormal leaf nodes, a reverse root cause search is performed on the network topology graph to obtain several intermediate root cause nodes and the root cause posterior probability of each intermediate root cause node. Based on the abnormal alarm time of the abnormal leaf node, the abnormal occurrence time of each intermediate root cause node is subjected to time-series constraint filtering to obtain several target root cause nodes; the total number of target root cause nodes is less than or equal to the total number of intermediate root cause nodes. The root cause candidate set is obtained based on all the target root cause nodes and the root cause posterior probability.
[0063] In this embodiment of the application, for any anomalous leaf node, the reverse root cause search can be performed by starting with the anomalous leaf node in the network topology graph and calculating the posterior probability that several upstream nodes of the anomalous leaf node are the root cause using the Monte Carlo Tree Search (MCTS) algorithm. This posterior probability can be expressed as:
[0064] in, This represents the posterior probability. upstream node Anomaly triggers an alarm The conditional probability of alarm A is that the alarm A can be the aforementioned abnormal alarm set or any core alarm in the abnormal alarm set. upstream node There are various methods for calculating the prior anomaly probability, such as based on upstream nodes. The ratio of the total number of all types of alarms triggered in the past to the total number of all types of alarms triggered in the past in the transmission network is used to determine the alarms. For warning The probability of an event occurring can be calculated in various ways, such as by analyzing the upstream nodes over a recent period. The ratio of the number of times alarm A is triggered to the number of times alarm A is triggered in the transmission network is determined.
[0065] For any intermediate root cause node, the timing constraint filtering can be to determine whether the anomaly occurrence time of the intermediate root cause node is earlier than the anomaly alarm time of the abnormal leaf node, and the absolute difference between the anomaly occurrence time and the anomaly alarm time is less than a preset time constraint threshold (such as 5 minutes, 10 minutes, etc.).
[0066] Specifically, if the anomaly occurrence time of an intermediate root cause node is not earlier than the anomaly alarm time of an abnormal leaf node, or if the absolute difference between the anomaly occurrence time and the anomaly alarm time is greater than or equal to a preset time constraint threshold, then the intermediate root cause node can be removed. Alternatively, if the anomaly occurrence time of an intermediate root cause node is earlier than the anomaly alarm time of an abnormal leaf node, and the absolute difference between the anomaly occurrence time and the anomaly alarm time is less than a preset time constraint threshold, then the intermediate root cause node can be identified as the target root cause node.
[0067] In the first implementation, after obtaining all target root cause nodes of the abnormal leaf node, a root cause candidate set can be easily obtained based on all target root cause nodes of the abnormal leaf node and their corresponding posterior probabilities. In the second implementation, the posterior probability of each target root cause node can be corrected, and the root cause candidate set can be easily obtained using all corrected posterior probabilities and target root cause nodes.
[0068] For example, the corrected posterior probability can be expressed as:
[0069] This is the corrected posterior probability; This is a correction factor, and its value can be 0.1, 0.2, etc. To correct the similarity, it can be obtained by matching the historical alarm event most similar to the alarm event corresponding to the target root cause node from a pre-set historical database based on the Retrieval Enhanced Generation (RAG) technology. The corrected similarity is the similarity between the historical alarm event and the alarm event corresponding to the target root cause node.
[0070] The root cause candidate set of each abnormal leaf node is sorted and filtered in descending order to obtain the fault root cause location result of the power transmission network.
[0071] In this embodiment of the application, for any abnormal leaf node's root cause candidate set, the root cause candidate set can be sorted in descending order based on the posterior probability of each target root cause node in the root cause candidate set, and several (such as 3, 5, etc.) target root cause nodes ranked at the top and their posterior probabilities can be selected as the final root cause candidate set. Then, based on the final root cause candidate set of each abnormal leaf node, the fault root cause location result of the power transmission network can be obtained.
[0072] In some embodiments, the method further includes: Obtain the root cause localization node and the asset criticality level set corresponding to the abnormal alarm set; the root cause localization node is any one of the target root cause nodes in the fault root cause localization result; Based on the root cause localization node, a dependency node search is performed on the network topology graph to obtain several downstream dependency nodes of the root cause localization node. Based on the asset criticality level set, a fault impact surface analysis is performed on all downstream dependent nodes to obtain the fault impact surface analysis results.
[0073] In this embodiment, the asset criticality level set is the set of asset criticality levels for each core alarm in the abnormal alarm set; the dependent node search can be based on the network topology graph, traversing all downstream dependent nodes of the root cause location node, with each downstream dependent node representing the equipment assets affected in the power transmission network; and the fault impact surface analysis can determine the asset criticality level corresponding to each downstream dependent node from the asset criticality level set, and based on the asset criticality level set and the asset criticality levels corresponding to all downstream dependent nodes, determine the impact surface analysis result, which is used to characterize the business impact surface caused by the root cause location node failure in the power transmission network. This impact surface analysis result can be expressed as:
[0074] in, This is the result of the impact surface analysis; For asset criticality level set; The criticality level of assets for downstream dependent nodes; It is a set of asset criticality levels for downstream dependent nodes.
[0075] Reference Figure 2 The fault root cause localization system proposed in this application includes: The first processing unit 101 is used to acquire multi-source alarm data, network topology map and threat intelligence data of the power transmission network; The second processing unit 102 is used to perform cross-domain fusion and noise reduction on the multi-source alarm data to obtain an effective alarm set. The third processing unit 103 is used to add and update threat information to the valid alarm set according to the threat intelligence data to obtain an abnormal alarm set; The fourth processing unit 104 is used to locate the root cause of the fault in the abnormal alarm set according to the network topology diagram, and obtain the root cause location result of the fault in the power transmission network.
[0076] It is understood that the content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.
[0077] Reference Figure 3 This application also provides an electronic device, including: At least one processor 201; At least one memory 202 is used to store at least one program; When the at least one program is executed by the at least one processor 201, the at least one processor 201 implements the method embodiment described above.
[0078] Similarly, it can be understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.
[0079] This application also provides a computer-readable storage medium storing a program executable by a processor 201, which, when executed by the processor 201, is used to implement the above-described method embodiments.
[0080] Similarly, the content of the above method embodiments is applicable to the present computer-readable storage medium embodiments. The specific functions implemented by the present computer-readable storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.
[0081] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.
[0082] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods.
[0083] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this application are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.
[0084] Furthermore, although this application is described in the context of functional modules, it should be understood that, unless otherwise stated to the contrary, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding this application. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional technology for an engineer. Therefore, those skilled in the art can implement the application set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of this application, which is determined by the full scope of the appended claims and their equivalents.
[0085] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods in the embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0086] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.
[0087] More specific examples (a non-exhaustive list) of computer-readable media include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.
[0088] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.
[0089] In the foregoing description of this specification, the references to terms such as "one embodiment," "another embodiment," or "some embodiments," etc., indicate that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.
[0090] Although embodiments of this application have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of this application, the scope of which is defined by the claims and their equivalents.
[0091] The above is a detailed description of the preferred embodiments of this application, but this application is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application, and these equivalent modifications or substitutions are all included within the scope defined by the claims of this application.
Claims
1. A method for locating the root cause of a fault, characterized in that, include: Acquire multi-source alarm data, network topology diagrams, and threat intelligence data from power transmission networks; Cross-domain fusion and noise reduction are performed on the multi-source alarm data to obtain an effective alarm set; Based on the threat intelligence data, the effective alert set is updated with added threat information to obtain the abnormal alert set; Based on the network topology diagram, the root cause of the fault is located in the abnormal alarm set to obtain the root cause location result of the fault in the power transmission network.
2. The method according to claim 1, characterized in that, The effective alarm set includes several core alarms. The cross-domain fusion and noise reduction of the multi-source alarm data to obtain the effective alarm set includes: Obtain a pre-trained large model, a first event object, and a second event object; the first event object is any one of the security event objects in the multi-source alarm data; the second event object is any one of the security event objects in the multi-source alarm data other than the first event object. Based on the pre-trained large model, semantic encoding is performed on the first event object and the second event object to obtain the first semantic vector of the first event object and the second semantic vector of the second event object; Based on the first semantic vector and the second semantic vector, multidimensional analysis and clustering are performed on the first event object and the second event object to obtain the core alarm.
3. The method according to claim 2, characterized in that, The step of performing multidimensional analysis and clustering on the first event object and the second event object based on the first semantic vector and the second semantic vector to obtain the core alarm includes: Semantic similarity analysis is performed on the first semantic vector and the second semantic vector to obtain the event semantic similarity. Feature similarity analysis is performed on the five-tuple features of the first event object and the five-tuple features of the second event object to obtain the event feature similarity. Perform time window similarity analysis on the event timestamps of the first event object and the second event object to obtain the event time similarity. Based on the event semantic similarity, the event feature similarity, and the event time similarity, the first event object and the second event object are clustered to obtain the core alarm.
4. The method according to claim 2, characterized in that, The method further includes: Obtain the network security level and business importance level corresponding to the isolated alarm, wherein the isolated alarm is an isolated security event object among all security event objects in the multi-source alarm data; An asset criticality analysis is performed on the network security level and the business importance level to obtain the asset criticality level of the isolated alarm; Based on the asset criticality level and the isolated alarms, the valid alarm set is updated to obtain the updated valid alarm set.
5. The method according to claim 1, characterized in that, The step of adding and updating threat information to the valid alert set based on the threat intelligence data to obtain an abnormal alert set includes: The effective alarm set is input into the pre-trained large model for attack identification, and several information groups output by the pre-trained large model are obtained. Each information group corresponds to a core alarm in the effective alarm set. The information group includes attack intent information and attack chain information. Based on the threat intelligence data, threat analysis is performed on each of the core alerts and the information groups to obtain several threat analysis information. Based on all the threat analysis information, the attack intent information, and the attack chain information, the valid alarm set is updated to obtain the abnormal alarm set.
6. The method according to claim 1, characterized in that, The step of performing fault root cause localization on the abnormal alarm set based on the network topology diagram to obtain the fault root cause localization result of the power transmission network includes: Based on the abnormal alarm set, extract several abnormal leaf nodes from the network topology graph; Based on all the abnormal leaf nodes, the network topology graph is traced back to the root cause node to obtain the root cause candidate set for each abnormal leaf node. The root cause candidate set of each abnormal leaf node is sorted in descending order and filtered to obtain the fault root cause location result of the power transmission network.
7. The method according to claim 6, characterized in that, The step of performing reverse root cause node tracing on the network topology graph based on all the abnormal leaf nodes to obtain a root cause candidate set for each abnormal leaf node includes: Based on the abnormal leaf nodes, a reverse root cause search is performed on the network topology graph to obtain several intermediate root cause nodes and the root cause posterior probability of each intermediate root cause node. Based on the abnormal alarm time of the abnormal leaf node, the abnormal occurrence time of each intermediate root cause node is subjected to time-series constraint filtering to obtain several target root cause nodes; the total number of target root cause nodes is less than or equal to the total number of intermediate root cause nodes. The root cause candidate set is obtained based on all the target root cause nodes and the root cause posterior probability.
8. The method according to any one of claims 1-7, characterized in that, The method further includes: Obtain the root cause localization node and the asset criticality level set corresponding to the abnormal alarm set; the root cause localization node is any one of the target root cause nodes in the fault root cause localization result; Based on the root cause localization node, a dependency node search is performed on the network topology graph to obtain several downstream dependency nodes of the root cause localization node. Based on the asset criticality level set, a fault impact surface analysis is performed on all downstream dependent nodes to obtain the fault impact surface analysis results.
9. A fault root cause localization system, characterized in that, include: The first processing unit is used to acquire multi-source alarm data, network topology map and threat intelligence data of the power transmission network; The second processing unit is used to perform cross-domain fusion and noise reduction on the multi-source alarm data to obtain an effective alarm set. The third processing unit is used to add and update threat information to the valid alarm set based on the threat intelligence data to obtain the abnormal alarm set; The fourth processing unit is used to locate the root cause of the fault in the abnormal alarm set according to the network topology diagram, and obtain the root cause location result of the fault in the power transmission network.
10. An electronic device, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method as described in any one of claims 1-8.