A power plant network security situation awareness and disposal method and device
Patent Information
- Application Number
- CN202610545375.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-04-23
- Publication Date
- 2026-09-15
Smart Images
Figure CN122764533A_ABST
Abstract
Description
Technical Field
[0001] The invention belongs to the technical field of network security of power monitoring systems, and specifically relates to a method and device for situation awareness and disposal of power plant network security. Background Art
[0002] With the continuous improvement of power plant informatization, networking and centralized monitoring level, the power monitoring system has gradually formed a complex network environment composed of production control network, management information network, security protection equipment and multiple types of business systems. In this environment, the network scale continues to expand, and the types of equipment are increasingly diverse. Besides, the security protection system is usually constructed by means of partitioned and zoned security, in-depth defense and superposition of multi-level security devices, which makes security protection data have wide sources and strong heterogeneity, covering multi-source data such as intrusion detection / defense systems, border firewalls, host and application log audit, situation awareness platforms, and industrial control protocol security monitoring. Different data sources have differences in event granularity, field caliber, time precision and semantic expression, which leads to that the same attack process may be dispersedly recorded as multiple alarm or log fragments, and objectively forms the analysis problem of "multi-source heterogeneity, difficult to unify and correlate".
[0003] In power plant network security scenarios, attack behaviors are often not triggered at a single point, but gradually evolve in the form of "event chains" among different devices and different security domains, with obvious characteristics of temporal continuity, causal dependence and cascade propagation. For example, an attack may go through stages such as reconnaissance scanning, credential acquisition, lateral movement, privilege escalation, control instruction injection or data tampering. Alarms corresponding to each stage are correlated before and after in time, span multiple network objects in space, and spread along network topology and business dependency paths. Such a process can hardly restore the real attack link and risk evolution trend only by relying on a single alarm or isolated events, nor can it support system-level risk assessment and disposal decision-making.
[0004] In the prior art, research, judgment and disposal of power plant network security are mostly implemented based on rule matching, threshold alarming, black and white lists, predefined association rules or static topology association. Such methods usually rely on manual experience or a priori rule base, which are relatively effective for identifying known attack patterns. However, when facing scenarios such as modified attack methods, inconsistent semantics of cross-source events, high alarm noise and complex linkage propagation, problems such as incomplete correlation, false positives and false negatives, and difficulty in portraying the overall situation are prone to occur. At the same time, static correlation methods are often difficult to explicitly express the sequential relationship and causal relationship of security events evolving over time, and difficult to identify key risk nodes, potential attack paths and risk propagation trends from a global perspective, thereby affecting the accuracy of situation awareness and the timeliness of disposal.
[0005] Furthermore, the response chain for power plant network security typically involves multiple stages, including alarm confirmation, cross-source correlation, impact assessment, and selection and execution verification of response strategies. Traditional response methods rely heavily on manual analysis and experience-based decision-making, which can easily lead to delays, inconsistent responses, and difficulties in implementing coordinated responses when the scale of alarms increases or the attack chain becomes more complex. Especially under the conditions of multi-security domain and multi-system collaborative protection, there is a lack of technical means to uniformly model the "object-relationship-time" relationship and output structured analysis results, making it difficult to further transform situational analysis results into actionable strategy recommendations and automated responses. Summary of the Invention
[0006] The present invention aims to at least partially solve one of the technical problems in the related art.
[0007] Therefore, the first objective of this invention is to propose a method for power plant network security situational awareness and handling.
[0008] The second objective of this invention is to provide a power plant network security situational awareness and response device.
[0009] The third objective of this invention is to provide a computer device.
[0010] A fourth objective of this invention is to provide a non-transitory computer-readable storage medium.
[0011] To achieve the above objectives, a first aspect of the present invention provides a method for power plant network security situation awareness and handling, comprising:
[0012] Collect multi-source data on power plant network security, and perform standardized preprocessing on the multi-source data to obtain a structured security event sequence; A time-series security event graph is constructed based on the structured security event sequence. The time-series security event graph is a directed graph with time attributes. The node set includes network object nodes and security event nodes, the edge set includes edges of inter-object relationships and edges of causal relationships between events, and the time information is contained in the attribute set. The temporal security event graph is input into the information entropy guided graph neural network for inference. Key neighbor nodes are selected and weighted aggregation is performed through information entropy neighbor perception. Features of different relationship types are fused through a multi-head attention mechanism. Finally, a comprehensive temporal representation of nodes is obtained by multi-scale temporal feature fusion. Based on the comprehensive time-series representation, the output node risk score, event chain / attack path confidence, and response strategy recommendation results are used to execute or trigger automated processing according to the response strategy recommendation results.
[0013] In one embodiment of the present invention, the step of collecting multi-source data on power plant network security and performing standardized preprocessing on the multi-source data to obtain a structured security event sequence includes: Multi-source security data from intrusion detection systems, firewalls, host logs, and situational awareness platforms are acquired in batches through standardized interfaces. Log fields in the multi-source security data are then uniformly mapped and timestamp aligned to obtain multi-source log data with consistent time references. For the same source destination in the same time window of the multi-source log data with the same time base, the repeated triggered events are merged and counted or the maximum level is taken to obtain the deduplicated security event data. Based on preset event abstraction rules, the deduplicated security event data is standardized and represented, and records from different data sources pointing to the same network object or the same security event are mapped to a unified identifier to obtain the structured security event sequence.
[0014] In one embodiment of the present invention, the construction of a time-series security event graph based on the structured security event sequence is a directed graph with time attributes. The node set includes network object nodes and security event nodes, the edge set includes edges representing inter-object relationships and edges representing causal relationships between events, and the time information is included in the attribute set, including: Node construction is performed, mapping key objects in the power plant network security scenario to nodes, resulting in a node set including network device nodes, security protection device nodes, host and business system nodes, and security event nodes; Perform edge construction to build directed edges to describe the relationships between nodes, resulting in an edge set that includes network communication relationship edges, control and management relationship edges, and event relationship edges; Add timestamps by introducing timestamp information into node and edge attributes to describe the specific time or time sequence of events, thereby characterizing the dynamic evolution of security events.
[0015] In one embodiment of the present invention, the step of inputting the temporal security event graph into an information entropy-guided graph neural network for inference, filtering key neighbor nodes through information entropy neighbor perception and performing weighted aggregation, fusing features of different relationship types through a multi-head attention mechanism, and obtaining a comprehensive temporal representation of nodes through multi-scale temporal feature fusion includes: The information entropy guided graph neural network includes: an information entropy neighbor perception module, a multi-head attention relationship fusion module, a multi-scale temporal feature fusion module, and an output mapping layer; wherein, the information entropy guided graph neural network is used to jointly model and globally infer the node attributes, relationship edges, and time attributes in the temporal security event graph.
[0016] In one embodiment of the present invention, the step of outputting node risk scores, event chain / attack path confidence levels, and response strategy recommendation results based on the comprehensive temporal representation, and executing or triggering automated processing according to the response strategy recommendation results, includes: A node risk score is calculated using a linear mapping and the Sigmoid function to characterize the degree to which a node is in a high-risk state within the current time window. For an event chain or attack path composed of node sequences, the node embeddings in the path are aggregated and their confidence as a valid attack path is calculated, which is used to characterize the credibility of the event chain or attack path and the risk of its propagation. The generated response strategy recommendation results are used to provide the recommendation results or probability distribution of each strategy in the preset disposal strategy set to support alarm linkage, risk location and disposal decision-making. The node risk score, attack path confidence and response strategy recommendation results are all obtained by output mapping of the node temporal association representation obtained by information entropy guided graph neural network inference.
[0017] In one embodiment of the present invention, the information entropy-guided graph neural network includes: The information entropy neighbor perception module calculates the information entropy of neighbor nodes in the target node's neighbor set, filters a subset of high information entropy neighbors based on a preset threshold, performs feature aggregation only on the subset of high information entropy neighbors, and determines the neighbor weights based on the neighbor information entropy to achieve weighted aggregation of key neighbors. The multi-head attention relationship fusion module calculates relationship-level attention weights for different relationship types and computes multiple attention heads in parallel to capture relationship features in different subspaces. The outputs of each attention head are concatenated and linearly mapped to obtain the node representation after relationship fusion. The multi-scale temporal feature fusion module constructs a set of multi-scale temporal feature representations for nodes in different time windows of different lengths, and uses learnable weights to weight and fuse the multi-scale temporal features to form a comprehensive temporal representation of the nodes.
[0018] In one embodiment of the present invention, the step of executing or triggering automated processing based on the response strategy recommendation result includes: When the node risk score exceeds the preset threshold and the path confidence reaches the credible threshold, cross-source alarm association and merging, impact scope assessment and work order generation are triggered. When the response policy recommendation result is access restriction or policy issuance, a blocking or isolation policy is issued to the firewall, switch access control or host protection system. When the response strategy recommendation result is manual review, the output includes an evidence chain containing key nodes, key edges, key event sequences and their temporal relationships, and triggers security personnel to review it.
[0019] To achieve the above objective, an embodiment of the second aspect of the present invention provides a power plant network security situation awareness and disposal device, comprising: a data acquisition and preprocessing module, configured to acquire multi-source data of power plant network security, perform standardized preprocessing on the multi-source data, and obtain a structured security event sequence; a temporal security event graph construction module, configured to construct a temporal security event graph based on the structured security event sequence, wherein the temporal security event graph is a directed graph with time attributes, a node set comprises network object nodes and security event nodes, an edge set comprises inter-object association edges and inter-event causal association edges, and time information is contained in an attribute set; a graph reasoning module, configured to input the temporal security event graph into an information entropy-guided graph neural network for reasoning, screen key neighbor nodes and perform weighted aggregation through information entropy neighbor perception, fuse features of different relationship types through a multi-head attention mechanism, and obtain comprehensive temporal representation of nodes through multi-scale temporal feature fusion; an output mapping and disposal module, configured to output node risk scores, event chain / attack path confidence levels and response strategy recommendation results based on the comprehensive temporal representation, and execute or trigger automatic disposal according to the response strategy recommendation results.
[0020] The temperature calculation method and device for the side reflector isotope irradiation channel of a pebble-bed high-temperature gas-cooled reactor in the embodiment of the present invention can uniformly map multi-source heterogeneous security data into a graph structure with time attributes, suppress noise through information entropy-guided neighbor perception, improve cross-relationship modeling capability through multi-relationship attention fusion, and characterize risk evolution through multi-scale temporal fusion, so as to identify key risk nodes and potential attack paths from a global perspective, form structured and interpretable situation assessment results, output response strategy suggestions, realize the upgrade from single-point alarm assessment to system-level linkage analysis and intelligent disposal, and improve the accuracy of power plant network security situation awareness and the effectiveness of disposal decision-making.
[0021] To achieve the above objective, an embodiment of the third aspect of the present application provides a computer device, comprising: a processor and a memory; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to be used for implementing the power plant network security situation awareness and disposal method according to the embodiment of the first aspect.
[0022] To achieve the above objective, an embodiment of the fourth aspect of the present application provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the power plant network security situation awareness and disposal method according to the embodiment of the first aspect is implemented.
[0023] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description
[0024] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart of a power plant network security situation awareness and response method according to an embodiment of the present invention; Figure 2 This is a schematic diagram illustrating the construction and element mapping of the Time Sequence Security Event Graph (TSEG) according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the overall structure of the Information Entropy Guided Graph Neural Network ESIR-GNN according to an embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the output results and processing linkage according to an embodiment of the present invention; Figure 5 This is a structural diagram of a power plant network security situational awareness and response device according to an embodiment of the present invention; Figure 6 It is a computer device according to an embodiment of the present invention. Detailed Implementation
[0025] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.
[0026] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.
[0027] The following description, with reference to the accompanying drawings, describes a method and apparatus for power plant network security situational awareness and response according to an embodiment of the present invention.
[0028] Example 1 This invention provides a method for power plant network security situational awareness and response based on a time-series security event graph and an information entropy-guided graph neural network. This method can be deployed on the power plant network security management side or the security management side, such as on a situational awareness platform, log auditing platform, security operation and maintenance management server, or a security analysis server on the centralized control side. It is executed by a situational analysis service program according to a preset cycle, a sliding time window, or in an event-triggered manner when a critical alarm is triggered. The method of this invention can be used in both single-plant environments and multi-plant centralized monitoring environments; it can employ both online inference and near-real-time batch processing modes, and this invention does not limit the specific methods used.
[0029] Figure 1 A flowchart illustrating the method of the present invention is shown, as follows. Figure 1 As shown, this method includes at least steps S1 to S4. Figure 2 A schematic diagram of the construction of the Time Sequenced Security Event Graph (TSEG) is shown to illustrate how multi-source events are mapped to nodes, edges, and time attributes in the graph. Figure 3 A schematic diagram of the Information Entropy Guided Graph Neural Network (ESIR-GNN) is shown to illustrate the connection relationships between ENS, MHA-RF, MSTF, and the output mapping layer. Figure 4 A schematic diagram illustrating the linkage between output results and handling is provided to explain node risk scoring. Event chain / attack path confidence Recommended response strategies How to support a closed loop of alarm linkage and automated handling.
[0030] like Figure 1 As shown, the method of the present invention includes the following steps.
[0031] S1. Collect multi-source security data from the power plant network and perform standardized preprocessing to obtain a structured security event sequence that can be used for unified mapping and inference. In this embodiment, the multi-source data includes at least one or more of the following: Intrusion Detection / Prevention System (IDS / IPS) alarms, firewall logs, host or server security logs, log auditing platform data, situational awareness platform alarms, bastion host audit logs, switch / router session summaries, industrial network / protocol monitoring data, etc. Because different sources differ in field definitions, object identifiers, time precision, and semantic expression, this step performs standardized preprocessing on the multi-source data to form a structured event sequence that can be used for unified mapping and inference.
[0032] Specifically, preprocessing includes at least: log field unification, timestamp alignment, duplicate event merging, and security event abstraction: mapping key fields such as source IP / asset, destination IP / asset, port / protocol, alarm signature / rule ID, severity level, and trigger count to a unified set of fields; unifying the timestamps of different devices to the same time base (e.g., second-level or millisecond-level), and correcting collection points with clock offsets when necessary; merging and counting duplicate triggers of the same source-destination pair and the same rule within a short time window, or taking the highest level to reduce alarm noise; and abstracting the original logs / alarms into a unified security event representation. To facilitate subsequent cross-source linkage, this embodiment maps the same network object (such as the same host appearing in different systems in various forms such as IP, hostname, asset number, etc.) to a unified object identifier, enabling alignment of "the same object, the same event" across different data sources.
[0033] After the above processing, within the time window Internally obtain structured security event sequences Each of these events can be summarized as follows:
[0034] in The timestamp of the event. and These are the source object and the destination object (both are unified object identifiers). For event categories, For event level / intensity, This is a set of event attributes (such as port, protocol, rule ID, count, etc.). This sequence serves as input for subsequent TSEG construction.
[0035] S2, as Figure 2 As shown, the Temporal Security Event Graph (TSEG) constructed in this embodiment is a directed graph with time attributes. Where V is the set of nodes, E is the set of edges, and A is the set of attributes; time information is contained in A as attributes, so that the graph can simultaneously express object attributes, relational semantics, and event evolution time.
[0036] S21 Node Construction: Nodes are used to represent key objects and events in a power plant network security scenario. This embodiment constructs at least four types of nodes: (1) Network device node, used to describe network bearer objects such as switches, routers, and firewalls; (2) Security protection equipment nodes, used to describe monitoring / blocking / auditing objects such as IDS, IPS, situational awareness, and log auditing; (3) Host and business system nodes, used to describe the business-bearing entities such as monitoring hosts, servers, operation and maintenance terminals, and key business applications; (4) Security event nodes are used to describe event entities that are meaningful for analysis, such as alarm events, abnormal access, and policy triggers.
[0037] In terms of implementation, asset-type nodes can be generated from asset ledgers or configuration management systems, and carry attributes such as object type, business role, security domain / partition, and IP set; event-type nodes are generated from structured security event sequences. Generate an event node and include attributes such as event type, level / intensity, protocol port, and rule ID. The timestamp attribute of the event node is directly taken as its occurrence time. This is used for subsequent temporal reasoning.
[0038] S22 Edge Construction: Edges are used to describe the relationships between nodes and are directed to express the direction of influence or propagation. This embodiment constructs at least three types of edges: (1) Network communication relationship edge: describes the connection relationship or session direction between hosts / devices, such as "host A → host B has communication"; (2) Control and management relationship edge: describes the monitoring, protection and control relationship of security devices on network objects, such as "firewall applies policies to host A" and "IDS detects abnormal traffic on host A"; (3) Event association edge: describes the relationship between events before and after the same attack chain / security process, such as "scanning → abnormal login → privilege escalation".
[0039] In engineering implementation, communication relationship edges can be inferred from topology, configuration, or session summaries; management relationship edges can be inferred from policy configuration, log source pointing relationships, or alarm generation links; event association relationship edges can be generated by rules such as combinations of phased behaviors on the same source and destination, the same session context, and the same asset. To avoid an overly dense graph, this embodiment can filter low-value or weakly related edges, aggregate and count short-term repeated edges, and convert them into edge attributes (such as number of times, duration, and most recent occurrence time) to reduce noise and enhance interpretability.
[0040] S23. Adding Timestamps: To reflect the dynamic evolution of security events, this embodiment introduces timestamp information into node attributes and / or edge attributes: event nodes carry their occurrence time. The event-related edge carries the time difference between the preceding and following events. Alternatively, time window markers can be used; communication edges and control edges can carry time statistical attributes such as "first occurrence time, most recent occurrence time, and number of occurrences". By introducing time attributes, TSEG not only expresses static topology, but also describes the sequence of events, propagation rhythm, and staged evolution process, providing structured support for subsequent time series modeling and situational reasoning.
[0041] S3 uses the TSEG input information entropy to guide the ESIR-GNN graph neural network for inference, such as... Figure 3 As shown, this embodiment constructs an Information Entropy Guided Graph Neural Network (ESIR-GNN) for joint modeling and global inference of node attributes, relation edges, and temporal attributes in the TSEG. ESIR-GNN includes at least an Information Entropy Neighbor Perception (ENS) module, a Multi-Head Attention Relationship Fusion (MHA-RF) module, and a Multi-Scale Temporal Feature Fusion (MSTF) module, which are connected to the output mapping layer to generate situational assessment results.
[0042] In this embodiment, the node and edge attributes in TSEG are first vectorized and encoded. For any node... Construct its initial feature vector It is encoded by attribute fields such as object type, business role, security domain / partition, event category, event level / intensity, protocol port, and rule ID; for any side The relationship type features and time statistical features are constructed (e.g., relationship type "communication / control / event association", direction, frequency of occurrence, time difference or time window marker, etc.). Timestamp information is preferably incorporated into node / edge features in the form of time difference encoding, time window position encoding or time decay factor, so that the model can explicitly perceive time sequence information such as "recent events are more important" and "event chain stage order". This invention does not limit this.
[0043] Subsequently, ESIR-GNN performs inference in the manner of "information entropy neighbor perception → multi-head attention relationship fusion → multi-scale temporal feature fusion" to obtain the comprehensive temporal association representation of each node within the current temporal window.
[0044] (1) Information Entropy Neighbor Awareness (ENS): In the power plant network security scenario, the neighbor scale of nodes in TSEG is usually large and of varying quality. To suppress noise introduced by irrelevant or low-value neighbors, this embodiment introduces a neighbor filtering mechanism based on information entropy before node feature aggregation. Let the set of neighbors of the target node v be N(v), and for each neighbor node... The information entropy H(u) is calculated based on its attribute distribution to characterize the information complexity and uncertainty of the neighbor in the current security scenario. The information entropy is defined as:
[0045] in, This represents the probability distribution of node u in the i-th attribute or state (e.g., it can be obtained from historical statistics, discretized attribute frequencies, or internal model estimation). The greater the information entropy, the more complex and uncertain the node's behavior / state, and it usually also means a higher potential impact on the propagation and evolution of security events.
[0046] Based on this, set the information entropy threshold. Select a subset of neighbors with high information entropy from the neighbor set:
[0047] Only for sets Key neighbors are selected for subsequent aggregation to reduce noise at the structural level. After filtering, weighted feature aggregation is performed on the retained neighbors, and the representation of node v after ENS processing is as follows:
[0048] Where W is the learnable feature transformation matrix. It is a non-linear activation function; The neighbor weights, obtained based on information entropy normalization, are used to emphasize the contribution of neighbors with high information entropy. Their calculation method is as follows:
[0049] Through the above mechanism, ESIR-GNN can focus its aggregation on neighbors that are more likely to "carry key evidence / spread risks" in the attack path while ensuring computational efficiency, thus providing a cleaner and more discriminative input representation for subsequent relation-level attention fusion and temporal modeling.
[0050] (2) Multi-head attention relation fusion (MHA-RF): Considering the existence of various semantically distinct relation types in TSEG (such as communication propagation, control impact, event causal association, etc.), different relations contribute differently to risk formation and propagation. To explicitly distinguish relation semantics and capture relation features in different subspaces, this embodiment introduces a multi-head attention relation fusion mechanism based on ENS. Let the set of relation types be... For the target node v, its neighbors after ENS filtering can be divided according to relation type as follows: For any relation type r and the k-th attention head, calculate the relation-level attention weights:
[0051] in, Let r be the feature transformation matrix of relation r under the k-th attention head. For the corresponding attention parameter vector, " denotes a vector concatenation operation. The weights mentioned above characterize the influence of neighbor u on node v under the semantics of relation r. Subsequently, the aggregated representation of node v under relation r and attention head k is obtained:
[0052] To enhance the expressive power for different propagation modes, this embodiment employs multi-head parallel computation of K attention heads, and concatenates and linearly maps the outputs of each attention head to obtain the node representation after relation fusion:
[0053] in, This indicates a splicing operation. To output the mapping matrix, It is a non-linear activation function. Through MHA-RF, the model can explicitly distinguish the differences in the impact of different relation types on the propagation of security events during the aggregation process, thereby improving the semantic expression of attack paths, event chain structures, and cross-security zone propagation behavior.
[0054] (3) Multi-scale temporal feature fusion (MSTF): After completing ENS and MHA-RF, the node representation has fused key neighbor information and relational semantic weights. However, power plant network security events have significant temporal evolution characteristics, and the behavioral patterns at different time scales have different impacts on the overall situation. To simultaneously characterize short-term bursts and long-term accumulations, this embodiment introduces a multi-scale temporal feature fusion mechanism. Specifically, for node v, a multi-scale temporal feature representation set is constructed at multiple given time window scales:
[0055] Here, S represents the number of time scales, with different scales corresponding to different time windows of varying lengths. The representation at each scale is obtained by combining the output features of ENS and MHA-RF with the temporal attribute encoding within that scale, reflecting the security status changes of a node within the corresponding time range. Based on this, the multi-scale features are weighted and fused to form a comprehensive temporal representation of the node.
[0056] in, These are learnable fusion weights used to adaptively adjust the contribution of features at different time scales to the node representation. Through the training process, the model can automatically learn a more discriminative combination of time scales based on the evolution of security events, enabling the node representation to simultaneously contain local anomaly information and overall risk trends, providing a unified high-dimensional temporal correlation representation for subsequent output mapping and response decisions.
[0057] Through the above reasoning process, ESIR-GNN generates a comprehensive representation for each node that integrates structural associations, relational semantics, and temporal evolution features. This serves as the input basis for the S4 output situation assessment results.
[0058] S4 outputs situation assessment results and triggers automated processing, such as Figure 4As shown, this embodiment uses the node synthesis temporal correlation representation obtained based on ESIR-GNN. The output mapping layer generates structured results for security response, including node risk scoring. Event chain / attack path confidence and response strategy recommendations And based on the recommendation results, perform or trigger automated processing.
[0059] (1) Node risk score output: In response to the risk assessment needs of equipment nodes and event nodes in the power plant network, this embodiment calculates the node risk score through linear mapping and the Sigmoid function, which is used to characterize the probability that a node is in a high-risk state within the current time window:
[0060] in, and For learnable parameters, For the Sigmoid function, This represents the risk score of node v. This score can be used to identify key risk nodes and serves as an important basis for subsequent event correlation analysis and handling decisions.
[0061] (2) Event Chain / Attack Path Confidence Output: Based on node-level risk modeling, this embodiment further infers the correlation paths between security events. For event chains or attack paths composed of node sequences... The model aggregates the node embeddings in the path and calculates their confidence as valid attack paths:
[0062] in, This refers to path-level feature aggregation operations (such as average aggregation, weighted aggregation, or max pooling, etc., which are not limited in this invention). and For learnable parameters, For the Sigmoid function, This indicates the confidence level of the event chain / attack path P and its propagation risk level. This output helps identify potential attack propagation paths and high-risk event chain structures, providing a basis for coordinated response.
[0063] (3) Response Strategy Recommendation Output: Based on the comprehensive node risk score and path confidence, this embodiment further maps the output to the response strategy space to assist in the automated handling of power plant network security. Specifically, a response strategy probability distribution is generated for node v:
[0064] in, and For learnable parameters, Used to output the probability distribution over a preset set of treatment strategies. This indicates the recommended response strategy for node v. The strategy set may include various handling methods such as alarm association and merging, access restriction / blocking, isolation, policy issuance, work order generation, and manual review, and this invention does not limit these methods.
[0065] (4) Response Linkage and Closed-Loop Triggering: Regarding response linkage, this embodiment executes or triggers automated response based on the response strategy recommendation results. For example: when the node risk score... Exceeding the preset threshold and path confidence When the trusted threshold is reached, cross-source alarm association and merging, impact scope assessment, and work order generation are triggered. When the recommended policy is access restriction or policy distribution, blocking or isolation policies can be distributed to firewalls, switch access control systems, host protection systems, etc. When the recommended policy requires manual review, the evidence chain (key nodes, key edges, key event sequences and their temporal relationships) is output and security personnel are triggered to review it. Through the above closed-loop mechanism, this invention achieves linkage from "situational awareness and reasoning" to "policy recommendation and handling execution," improving the efficiency of analysis and the consistency of response in complex power plant network environments.
[0066] Through the above embodiments, the present invention can uniformly map multi-source heterogeneous security data of power plants into a time-series security event graph (TSEG) with time attributes, and jointly model multi-relationship and multi-scale time-series features through an information entropy-guided graph neural network (ESIR-GNN). It identifies key risk nodes and potential attack paths from a global perspective, outputs node risk scores, attack path confidence, and strategy recommendation results, and triggers a closed-loop response, thereby upgrading from single-point alarm analysis to system-level linkage analysis and intelligent response.
[0067] Example 2 To achieve the above embodiments, such as Figure 5 As shown, this embodiment also provides a power plant network security situation awareness and handling device 10, which includes an irradiation target selection module 100, a time-series security event graph construction module 200, a graph reasoning module 300, and an output mapping and handling module 400.
[0068] The data acquisition and preprocessing module 100 is used to acquire multi-source data of power plant network security and perform standardized preprocessing on the multi-source data to obtain a structured security event sequence. The temporal security event graph construction module 200 is used to construct a temporal security event graph based on the structured security event sequence. The temporal security event graph is a directed graph with time attributes, wherein the node set includes network object nodes and security event nodes, the edge set includes inter-object association edges and inter-event causal association edges, and the time information is contained in the attribute set. The graph reasoning module 300 is used to input the temporal security event graph into the information entropy-guided graph neural network for reasoning, filter key neighbor nodes through information entropy neighbor perception and perform weighted aggregation, fuse features of different relationship types through a multi-head attention mechanism, and obtain a comprehensive temporal representation of nodes through multi-scale temporal feature fusion. The output mapping and handling module 400 is used to output node risk scores, event chain / attack path confidence and response strategy recommendation results based on the comprehensive time series representation, and to execute or trigger automated handling according to the response strategy recommendation results.
[0069] To implement the methods of the above embodiments, the present invention also provides a computer device, such as... Figure 6 As shown, the computer device 600 includes a memory 601 and a processor 602; wherein, the processor 602 reads executable program code stored in the memory 601 to run a program corresponding to the executable program code, so as to implement the various steps of the method described above.
[0070] To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method described in the foregoing embodiments.
[0071] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.
[0072] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.
Claims
1. A method for power plant network security situational awareness and response, characterized in that, include: Collect multi-source data on power plant network security, and perform standardized preprocessing on the multi-source data to obtain a structured security event sequence; A time-series security event graph is constructed based on the structured security event sequence. The time-series security event graph is a directed graph with time attributes. The node set includes network object nodes and security event nodes, the edge set includes edges of inter-object relationships and edges of causal relationships between events, and the time information is contained in the attribute set. The temporal security event graph is input into the information entropy guided graph neural network for inference. Key neighbor nodes are selected and weighted aggregation is performed through information entropy neighbor perception. Features of different relationship types are fused through a multi-head attention mechanism. Finally, a comprehensive temporal representation of nodes is obtained by multi-scale temporal feature fusion. Based on the comprehensive time-series representation, the output node risk score, event chain / attack path confidence, and response strategy recommendation results are used to execute or trigger automated processing according to the response strategy recommendation results.
2. The method as described in claim 1, characterized in that, The process involves collecting multi-source data on power plant network security and performing standardized preprocessing on this data to obtain a structured security event sequence, including: Multi-source security data is acquired in batches through a standardized interface, and the log fields in the multi-source security data are uniformly mapped and timestamp aligned to obtain multi-source log data with consistent time base. For the same source destination in the same time window of the multi-source log data with the same time base, the repeated triggered events are merged and counted or the maximum level is taken to obtain the deduplicated security event data. Based on preset event abstraction rules, the deduplicated security event data is standardized and represented, and records from different data sources pointing to the same network object or the same security event are mapped to a unified identifier to obtain the structured security event sequence.
3. The method as described in claim 1, characterized in that, The construction of a time-series security event graph based on the structured security event sequence is described. This time-series security event graph is a directed graph with time attributes. The node set includes network object nodes and security event nodes, the edge set includes edges representing relationships between objects and causal relationships between events, and the time information is contained in the attribute set, including: Key objects in the power plant network security scenario are mapped to nodes to obtain a node set; Construct directed edges to describe the relationships between nodes, thus obtaining an edge set; Incorporate timestamp information into node and edge attributes.
4. The method as described in claim 1, characterized in that, The information entropy guided graph neural network includes: an information entropy neighbor perception module, a multi-head attention relationship fusion module, a multi-scale temporal feature fusion module, and an output mapping layer; wherein, the information entropy guided graph neural network is used to jointly model and globally infer the node attributes, relationship edges, and time attributes in the temporal security event graph.
5. The method as described in claim 1, characterized in that, The process of outputting node risk scores, event chain / attack path confidence levels, and response strategy recommendation results based on the comprehensive time-series representation, and executing or triggering automated processing based on the response strategy recommendation results, includes: Node risk scores are calculated using a linear mapping and the Sigmoid function. For a sequence of nodes that constitute an event chain or attack path, the node embeddings in the path are aggregated and their confidence as a valid attack path is calculated. Generate response strategy recommendations, which are used to provide recommendations or probability distributions for each strategy in the preset set of disposal strategies.
6. The method as described in claim 4, characterized in that, The information entropy-guided graph neural network includes: The information entropy neighbor perception module is used to calculate the information entropy of neighbor nodes in the target node's neighbor set, filter high information entropy neighbor subsets according to a preset threshold, perform feature aggregation on the high information entropy neighbor subsets, and determine neighbor weights based on neighbor information entropy. The multi-head attention relationship fusion module is used to calculate relationship-level attention weights for different relationship types, calculate multiple attention heads in parallel to capture relationship features in different subspaces, and concatenate the outputs of each attention head and obtain the node representation after relationship fusion through linear mapping. The multi-scale temporal feature fusion module is used to construct a set of multi-scale temporal feature representations for nodes in different time windows of different lengths, and to use learnable weights for weighted fusion to form a comprehensive temporal representation of the nodes.
7. The method as described in claim 1, characterized in that, The step of executing or triggering automated processing based on the response strategy recommendation results includes: When the node risk score exceeds the preset threshold and the path confidence reaches the confidence threshold, cross-source alarm association and merging, impact scope assessment and work order generation are triggered. When the response strategy recommendation result is access restriction or policy issuance, a blocking or isolation strategy is issued to the protection system. When the response strategy recommendation is manual review, output the chain of evidence and trigger a review by security personnel.
8. A power plant network security situational awareness and response device, characterized in that, include: The data acquisition and preprocessing module is used to collect multi-source data on power plant network security and perform standardized preprocessing on the multi-source data to obtain a structured security event sequence. The temporal security event graph construction module is used to construct a temporal security event graph based on the structured security event sequence. The temporal security event graph is a directed graph with time attributes, wherein the node set includes network object nodes and security event nodes, the edge set includes inter-object association edges and inter-event causal association edges, and the time information is contained in the attribute set. The graph reasoning module is used to input the temporal security event graph into the information entropy-guided graph neural network for reasoning. It filters key neighbor nodes and performs weighted aggregation through information entropy neighbor perception, fuses features of different relationship types through a multi-head attention mechanism, and obtains a comprehensive temporal representation of nodes through multi-scale temporal feature fusion. The output mapping and handling module is used to output node risk scores, event chain / attack path confidence and response strategy recommendation results based on the comprehensive time series representation, and to execute or trigger automated handling based on the response strategy recommendation results.
9. A computer device, characterized in that, Including processor and memory; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement a power plant network security situation awareness and response method as described in any one of claims 1-7.
10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements a power plant network security situation awareness and response method as described in any one of claims 1-7.