A method and system for calculating power target attack damage

Abstract

The application discloses a power target attack damage calculation method and system, relates to network attack damage calculation, and solves the problem that the prior art lacks a quantitative evaluation mechanism for attack consequences. The calculation method comprises the following steps: collecting multi-source data of a power system, and performing standardization preprocessing on the multi-source data; calculating behavior similarity according to a static reference model and a dynamic behavior model, and judging a system behavior state according to the behavior similarity; constructing a multi-source data attack chain link graph according to an attack chain model and the dynamic behavior model; constructing a multi-dimensional damage quantitative evaluation model according to a damage evaluation system, wherein the damage evaluation system is used for accurately quantifying damage conditions of the system after suffering from attacks or faults, and constructing a system resilience evaluation model according to a resilience evaluation system.

Description

Technical Field

[0001] This invention relates to the field of network attack damage calculation technology, and in particular to a method and system for calculating damage from power target attacks. Background Technology

[0002] With the deepening penetration of cyberspace into critical infrastructure sectors, power systems have become a key target for national-level cyber warfare. New power systems are rapidly evolving towards an integrated architecture that deeply integrates "smart grid + ubiquitous power IoT + new energy + energy storage." Accompanying the diversification of dispatch objects, the increasing complexity of the network structure, and enhanced openness and interactivity, their network exposure surface continues to expand, significantly increasing security risks. Currently, the attack methods faced by the power industry exhibit highly professional, organized, and persistent characteristics. Advanced persistent threats (APTs), supply chain attacks, and new attacks empowered by artificial intelligence are frequently occurring. These, coupled with inherent security shortcomings in industrial control protocols and insufficient protection capabilities of existing aging equipment, further exacerbate the exposure risks of high-value assets.

[0003] Against this backdrop, the existing cybersecurity protection system has shortcomings: First, it lacks a quantitative assessment mechanism for the consequences of attacks, and security decisions rely heavily on expert experience, making it difficult to support risk-oriented and precise resource allocation; Second, the traditional security architecture based on perimeter defense is unable to cope with complex attacks that are dynamic, covert, and multi-stage coordinated, and lacks real-time perception and proactive defense capabilities for the entire attack chain. Summary of the Invention

[0004] To address the lack of quantitative assessment mechanisms for attack consequences in existing technologies, which often rely heavily on expert experience for security decisions and struggle to support risk-oriented, precise resource allocation, this invention provides a method and system for calculating damage from power target attacks. This method integrates business behavior awareness and multi-dimensional damage quantification. The specific technical solution is as follows: A method for calculating damage from power system attacks includes the following steps: collecting multi-source data from the power system and performing standardized preprocessing on the multi-source data; calculating behavioral similarity based on a static benchmark model and a dynamic behavioral model, and determining the system's behavioral state based on behavioral similarity; constructing an attack chain graph based on the multi-source data according to the attack chain model and the dynamic behavioral model; constructing a multi-dimensional damage quantification assessment model based on a damage assessment system, wherein the damage assessment system is used to accurately quantify the damage to the system after it has been attacked or failed; and constructing a system resilience assessment model based on a resilience assessment system.

[0005] Preferably, the power target attack damage calculation method also includes constructing a visualization interface based on the attack link graph and multi-dimensional damage quantification assessment model, and constructing a dynamic inference function based on the attack link graph and damage propagation rules.

[0006] Preferably, the method for calculating damage from an attack on a power target also includes collecting feedback data from range training and calculating and updating the model weight coefficients and threshold parameters based on the feedback data.

[0007] Preferably, the collection of multi-source data provided by the power system and the standardization preprocessing of the multi-source data include: collecting four types of core data provided by the power system; standardizing and mapping numerical data to the [0,1] interval; converting text data into 256-dimensional feature vectors; standardizing protocol data after parsing key fields; integrating multi-source data features and constructing feature vectors based on multi-source data features; and reducing the dimensionality of the feature vectors to obtain effective feature vectors.

[0008] Preferably, calculating behavioral similarity based on a static baseline model and a dynamic behavioral model, and determining the system's behavioral state based on behavioral similarity, includes: constructing a multi-dimensional static baseline model and a dynamic behavioral model; generating a baseline feature vector based on the multi-dimensional static baseline model, and generating a current behavioral feature vector based on real-time collected multi-source data; calculating behavioral similarity based on the baseline feature vector and the current behavioral feature vector, and determining the system's behavioral state based on behavioral similarity; constructing an attack chain feature vector, constructing an attack chain graph based on the attack chain features, and completing the attack chain based on Bayesian inference to generate a directed graph.

[0009] Preferably, constructing an attack chain graph based on attack chain feature vectors includes: constructing attack stage feature vectors; generating an attack chain graph based on a dynamic behavior model; and labeling the attack path weights on the attack chain graph.

[0010] Preferably, a multi-dimensional damage quantification assessment model is constructed based on the damage assessment system. The damage assessment system is used to accurately quantify the damage to the system after it has been attacked or failed. The construction of the system resilience assessment model includes: constructing a damage assessment dimension system; calculating a comprehensive damage value based on the damage assessment dimension system; and constructing the system resilience assessment model.

[0011] Preferably, collecting feedback data from range training and calculating and updating model weight coefficients and threshold parameters based on the feedback data includes: collecting feedback data from range training and constructing a feedback dataset based on the feedback data; calculating the assessment error based on the feedback dataset, damage assessment value, and toughness assessment value; optimizing the assessment error; and calculating and updating the weight coefficients and threshold parameters based on the optimized assessment error.

[0012] This invention also provides a power target attack damage calculation system, comprising: a multi-source data collaborative acquisition and standardization module, used to acquire multi-source data from the power system and perform standardized preprocessing on the multi-source data; a business behavior profiling and attack chain modeling module, used to calculate behavior similarity based on a static benchmark model and a dynamic behavior model, and to determine the system behavior state based on behavior similarity; to construct an attack link graph based on the attack chain model and the dynamic behavior model; and a multi-dimensional damage quantification assessment module, used to construct a multi-dimensional damage quantification assessment model based on a damage assessment system, wherein the damage assessment system is used to accurately quantify the damage situation of the system after being attacked or experiencing a failure, and to construct a system resilience assessment model based on a resilience assessment system.

[0013] Compared with existing technologies, the beneficial effects of this invention are as follows: By constructing a multi-source data collaborative acquisition and standardization system, this invention achieves comprehensive integration and standardized processing of power system operation data, network traffic data, equipment status data, and business operation data, providing a high-quality data foundation for subsequent analysis. Through comparative analysis of static benchmarks and dynamic behavior, it can accurately identify abnormal system behavior and construct a complete attack chain graph based on the attack chain model, clearly presenting attack paths and potential risk points. The multi-dimensional damage quantification assessment model and system resilience assessment model not only achieve accurate quantification of multi-dimensional damage after the system suffers an attack or failure, but also effectively assess the system's resilience and recovery capabilities. Attached Figure Description

[0014] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0015] Figure 1 This is a flowchart of the power target attack damage calculation method in Example 1; Figure 2 This is a block diagram of the power target attack damage calculation system in Example 2. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0018] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0019] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0020] Example 1 Please refer to Figure 1 , Figure 1 This is a flowchart illustrating a method for calculating damage from an attack on a power target. This embodiment provides a method for calculating damage from an attack on a power target, which includes the following steps: S1. Collect multi-source data provided by the power system and perform standardized preprocessing on the multi-source data.

[0021] Specifically, step S1 includes the following steps: S11. Collect four types of core data provided by the power system.

[0022] In this example, a non-intrusive and zero-interference data acquisition mechanism is used to collect four types of core data. These four types of data are network traffic data, service operation data, device status data, and attack behavior data. Specifically, network traffic data includes at least IEC 60870-5-104, Modbus TCP, DNP3, and other industrial control protocol messages, TCP / UDP session data, and abnormal traffic characteristics (such as replay attack messages and protocol tampering fields). Service operation data includes at least scheduling instruction content, execution sequence, repeat confirmation actions, device parameter adjustment records, and service process node trajectories. Device status data includes at least OT equipment operating parameters, resource utilization, and fault alarm information such as SCADA nodes, relay protection devices, and scheduling terminals. Attack behavior data includes at least attack types, vulnerability exploitation paths, AI-generated malicious instruction characteristics, privilege escalation records, and lateral movement trajectories.

[0023] Preferably, the data acquisition mechanism can adopt mirror traffic acquisition, log bypass analysis and contactless protocol parsing technology, and during the data acquisition process, the CPU utilization rate is controlled to be ≤5% and the memory utilization rate is controlled to be ≤8%.

[0024] S12. Standardize and map numerical data to the [0,1] interval, convert text data into a 256-dimensional feature vector, and standardize the protocol data after parsing the key fields.

[0025] After data collection, the multi-source data undergoes standardization preprocessing, specifically including: mapping numerical data to the [0,1] interval using the Z-Score standardization method to eliminate dimensional differences. The formula is as follows: .

[0026] Text data is converted into 256-dimensional feature vectors using Word2Vec while preserving semantic information. The formula is as follows: The protocol data undergoes key field parsing, followed by min-max normalization, using the following formula: ,in These are the original data values; and These are the minimum and maximum values ​​of the feature in the dataset, respectively.

[0027] S13. Integrate features from multiple data sources and construct feature vectors based on these features.

[0028] Subsequently, by integrating the aforementioned multi-source data features, a joint feature vector is constructed, encompassing four dimensions: network, service, device, and attack. ,in For network traffic data characteristics, For business operation data characteristics, For equipment status data characteristics, This refers to the characteristics of attack behavior data.

[0029] S14. Dimensionally reduce the eigenvectors to obtain effective eigenvectors.

[0030] Principal component analysis (PCA) was used to reduce the dimensionality of the eigenvectors, resulting in effective eigenvectors. By performing dimensionality reduction, principal components with a cumulative contribution rate of over 95% in the feature vectors are retained, resulting in effective feature vectors and reducing the computational complexity of subsequent models.

[0031] Step S2: Calculate the behavioral similarity based on the static baseline model and the dynamic behavioral model, and determine the system's behavioral state based on the behavioral similarity. Step S2 specifically includes the following steps: S21. Construct a multidimensional static benchmark model and a dynamic behavior model.

[0032] In this example, based on the "Power Safety Work Regulations", a four-dimensional static baseline vector of "physical entity - business process - permission topology - protocol interaction" is constructed: B_{static}=(E,P,R,L), where E is the set of devices, P is the permission matrix, R is the set of business rules, and L is the protocol interaction constraint.

[0033] By combining temporal analysis with contextual fusion, a dynamic behavior model is constructed: ,in, .

[0034] S22. Generate baseline feature vectors based on the multidimensional static benchmark model. Generate current behavior feature vectors based on real-time multi-source data. .

[0035] S23. Calculate the behavior similarity based on the baseline feature vector and the current behavior feature vector, and determine the system behavior state based on the behavior similarity. The formula for calculating behavior similarity is: ,in, ,when When this occurs, it is judged as abnormal behavior.

[0036] Step S3: Construct a multi-source data attack chain graph based on the attack chain model and dynamic behavior model.

[0037] Step S3 specifically includes: S31. Construct the feature vector for the attack phase.

[0038] Specifically, the attack phase is divided into five stages: reconnaissance, penetration, privilege escalation, lateral movement, and sabotage. For each attack stage, its key behaviors and attributes are abstracted and transformed into a set of quantifiable and computable numerical characteristics: ,in, Characteristics of the investigation phase, Characteristics of the penetration phase, This is a characteristic of the privilege escalation phase. It is a lateral movement feature. This is a characteristic of the destructive stage.

[0039] S32. Generate an attack chain graph based on the dynamic behavior model. An attack chain graph is generated based on the dynamic behavior model, and the attack chain is completed based on Bayesian inference, resulting in a directed graph: .in, For attacking nodes (devices / permissions / business nodes). This represents the attack paths between nodes.

[0040] S33. Label the attack path weights on the attack link graph.

[0041] The expression for path weight is: ,in, To increase the success rate of the attack, Weighting based on business impact.

[0042] Step S4: Construct a multi-dimensional damage quantification assessment model based on the damage assessment system. The damage assessment system is used to accurately quantify the damage to the system after it has been attacked or failed. Construct a system resilience assessment model based on the resilience assessment system.

[0043] Specifically, step S4 includes the following steps: S41. Construct a damage assessment dimension system.

[0044] Specifically, the assessment dimensions of the damage assessment system are determined, constructing a four-dimensional damage assessment system of "business—data—system—permissions" to achieve accurate quantification of attack consequences. The four damage dimensions are defined as follows: Business damage Its formula is: .in, The percentage of time spent on business process interruptions. The scheduling instruction execution deviation rate, This refers to business availability.

[0045] Data damage Its formula is: , in, , The percentage of sensitive data leaks For the extent of data revision, This represents the audit log integrity missing rate.

[0046] System damage can be expressed by the following formula: .in, For equipment malfunction rate, For the probability of cascading fault propagation, This represents the protocol interaction anomaly rate.

[0047] Access Damage Its formula is: , in, This is an overreach of privileges. The number of high-privilege nodes is controlled. Difficulty in restoring permissions.

[0048] S42. Calculate the comprehensive damage value based on the damage assessment dimension system.

[0049] The comprehensive damage value is calculated using a nonlinear fusion function, and the expression for the comprehensive damage value is as follows: in, The initial values ​​were determined using the analytic hierarchy process (AHP). .

[0050] Damage is classified into levels based on the overall damage value, with minor damage being classified as... Moderate injury Severe injury .

[0051] S43. Construct a system resilience assessment model.

[0052] In this example, a four-dimensional resilience model is constructed, comprising "disturbance resistance, recovery efficiency, adaptability, and robustness," and its expression is as follows: .in, For the system's immunity to disturbances, For system recovery efficiency, For the system's adaptability, For the robustness of the system. ,and The closer it is to 1, the stronger its resilience.

[0053] Specifically, System robustness refers to the power system's ability to withstand external interference such as network attacks and equipment failures; that is, its ability to maintain normal business operations and system stability in the face of various interferences. First, data is collected through a non-intrusive, zero-interference mechanism and standardized preprocessing is performed to obtain an effective feature vector with a cumulative contribution rate ≥95%. Then, based on this feature vector, time-series operational indicators such as the availability of core services, the percentage of equipment operating without abnormalities, and the normal operation rate of industrial control protocol interactions during the attack / failure phase are extracted. After quantification, these indicators are normalized to the [0,1] interval to obtain the final system robustness parameter values.

[0054] System recovery efficiency refers to the efficiency with which a power system can restore normal business operations, repair system damage, and restore data and permission integrity after an attack / fault. Based on multi-source data acquisition and standardized preprocessing, time-series operational indicators such as core business recovery time, damage dimension repair completion rate, and data / permission recovery timeliness are extracted from the power system during the attack / fault recovery phase using effective feature vectors. These indicators are then quantified and normalized to the [0,1] interval to obtain the system recovery efficiency parameter value.

[0055] System adaptability refers to the power system's ability to adaptively adjust business processes, equipment operation strategies, and defense strategies to adapt to the damaged state and maintain core functions after being attacked or experiencing a failure. Based on preprocessed effective feature vectors, time-series operational indicators such as the success rate of fault-tolerant path switching, the retention rate of core functions during load reduction operation, and the effectiveness of adaptive adjustment of defense strategies are extracted during the attack / failure process. After quantitative calculation, the results are normalized to the [0,1] interval to obtain the system adaptability parameter values.

[0056] System robustness refers to the ability of a power system to maintain continuous operation of core services and avoid cascading failures even when some components / functions are damaged. Under the premise of standardized preprocessing of multi-source data, time-series operational indicators such as the cascading failure rate of damaged components, continuous operation time of core services, and anti-fault propagation protection effectiveness are extracted based on effective feature vectors after an attack / failure. These indicators are quantified and normalized to the [0,1] interval to obtain system robustness parameter values.

[0057] The overall system resilience value is the arithmetic mean of the first four single-dimensional resilience indicators, used to quantify the overall resilience level of the power system. No additional data collection and quantification is required; the pre-normalized data is directly applied. , , , The four single-dimensional parameter values ​​are substituted into the arithmetic mean formula for calculation, and the result is the comprehensive resilience value, which also takes the value in the range of [0,1].

[0058] Furthermore, the power target attack damage calculation method also includes step S5. Step S5 involves constructing a visualization interface based on the attack link graph and the multi-dimensional damage quantification assessment model, and constructing a dynamic deduction function based on the attack link graph and damage propagation rules.

[0059] Step S5 specifically includes: S51. Use a time-series evolution diagram to mark the attack stage, penetration nodes, and propagation probability, and use different colors to distinguish the attack type; use a heat map to present the equipment damage situation, with node size reflecting business importance, and set different colors to correspond to the degree of damage; use a radar chart to show the proportion of four-dimensional damage values; and draw a resilience recovery curve.

[0060] Attack paths are visualized by annotating attack stages, penetration nodes, and propagation probabilities using a time-series evolution chart. APT attacks are highlighted in red, AI-assisted attacks in purple, and supply chain attacks in orange. Heatmaps present equipment damage levels, with color gradients transitioning from green (no damage) to yellow (minor damage), orange (moderate damage), and red (severe damage). Node size is positively correlated with business importance; for example, the main transformer node is 1.5 times the size of a typical power distribution unit. Radar charts simultaneously display the percentage of damage across four dimensions: business, data, system, and permissions. The radar chart area visually reflects the overall damage level. Resilience recovery curves are plotted, with the expression for the recovery curve being: .in, To initialize the curve, To illustrate the recovery rate, a resilience recovery curve is plotted to demonstrate the effects of redundant resource startup and fault-tolerant path switching.

[0061] S52. Based on the attack link graph and damage propagation rules, construct the inference function.

[0062] A deduction function module is constructed based on the attack link graph and damage propagation rules. The deduction function is as follows: in, This represents the cumulative quantitative value of the damage caused by a cyberattack on the power system at time t. It can also be understood as the quantitative value of the attack damage propagation status of the system at time t. It is a core quantitative indicator describing the overall degree of propagation and cumulative scale of attack damage within the power system at a specific point in time. For the propagation probability matrix, This represents the probability of the defense taking effect. This derivation function allows for the dynamic simulation of the damage propagation process at different time steps Δt (e.g., 5 minutes / step).

[0063] Furthermore, the simulation model supports custom simulation parameter configuration, allowing users to customize the attack initiation node, defense strategy strength, and business operation status (normal / reduced load / emergency response). The simulation model dynamically exits the simulation results based on the configured simulation parameters.

[0064] Step S6: Collect feedback data from the training exercise at the target range, and calculate and update the model weight coefficients and threshold parameters based on the feedback data.

[0065] Step S6 specifically includes: S61. Collect feedback data during the training exercise and construct a feedback dataset based on the feedback data.

[0066] Collect attack attribution results, damage assessment feedback, and verification data on the accuracy of simulations during range training exercises to construct a feedback dataset: ,in, For the true result of attack damage propagation, This represents the true damage value. This represents the true toughness value. The predicted results of attack damage propagation. To predict damage values, To predict toughness values.

[0067] S62. Calculate the assessment error based on the feedback dataset, damage assessment value, and toughness assessment value. The formula for calculating the assessment error is: The evaluation error calculation formula is used to calculate the sum of the absolute errors between the system's overall damage value and overall toughness value predicted by the comprehensive calculation model and the actual overall damage value and actual overall toughness value obtained from the range training. It can comprehensively reflect the overall prediction deviation of the model in the two core aspects of damage quantification assessment and system toughness assessment.

[0068] S63. Optimize the evaluation error and calculate and update the weight coefficients based on the evaluation error. With threshold parameter .

[0069] Among them, the weight coefficient is a numerical coefficient representing the proportion of importance of different evaluation dimensions and feature indicators assigned in the multi-dimensional quantitative evaluation of the model. It covers various fusion weights such as damage assessment, and the sum of the coefficients in the same group is 1. It can reflect the actual difference in importance of different dimensions / indicators, realize the quantitative fusion of multi-dimensional indicators, and dynamically adapt to the evaluation needs of different attack scenarios.

[0070] Threshold parameters are the critical values ​​that define "normal / abnormal" in the model system state and behavior feature judgment process. They include explicit thresholds such as behavior similarity of 0.7 and implicit thresholds such as damage level classification. They provide the model with an objective and unified judgment benchmark, balance the accuracy and fault tolerance of model recognition, and can also adapt to the operating characteristics of different power systems.

[0071] Both are core control parameters in the entire process of the power target attack damage calculation model, and are iteratively updated based on the feedback data from the test range training using the gradient descent method. Their core function is to dynamically iteratively optimize the attack damage calculation model based on real feedback data from power range training, ensuring that the model's various assessments, judgments, and deductions continuously align with the actual operation of the power system and attack scenarios, fundamentally improving the model's quantitative accuracy, judgment accuracy, and practical applicability.

[0072] In this example, the gradient descent method is used to minimize the evaluation error. The update formulas for the weight coefficients and threshold parameters are as follows: in, For learning rate, Let be the evaluation error at time t. Let be the weighting coefficient at time t. Let be the threshold parameter at time t.

[0073] By optimizing the evaluation error and dynamically adjusting the weighting coefficients and threshold parameters, the deviation between the model's evaluation results and the actual feedback data is gradually reduced. For example, when the actual damage value of a certain type of attack is discovered during multiple training exercises... consistently higher than model predictions At the same time, the system will automatically increase the weight coefficient of the corresponding damage dimension through the gradient descent algorithm, and may lower the behavior similarity judgment threshold to enhance the sensitivity of anomaly detection. Through iterative optimization of multiple rounds of range training data, the damage quantification accuracy and attack inference accuracy of the model will continue to improve, ensuring its reliability and applicability in actual power system attack damage assessment scenarios.

[0074] Example 2 Assuming the target scenario is a 220kV substation SCADA system suffering an APT attack, this system will be used for training and evaluation: Data Acquisition and Standardization: Attack sequences are collected: {port scanning (t1) → vulnerability exploitation (t2) → obtaining operational privileges (t3) → tampering with relay protection parameters (t4) → lateral movement to the dispatch terminal (t5)}. The collected attack sequences are standardized, and the standardized feature vector is: Construct the current behavior feature vector based on the standardized feature vector, and calculate the behavior similarity based on the baseline feature vector and the current behavior feature vector. .

[0075] This indicates abnormal behavior. An attack chain graph is constructed, with the propagation path marked as "external terminal → maintenance server → relay protection device → SCADA server → dispatch terminal".

[0076] The values ​​of each damage dimension were calculated based on the damage assessment system, resulting in: , , , Calculate the overall damage value based on the values ​​of each damage dimension: Since 0.3 < <0.7, the system is judged to have moderate damage. The system toughness assessment value is calculated, and the results are obtained. .

[0077] Heatmaps were used to identify SCADA servers and dispatch terminals as high-risk nodes. Dynamic simulations showed that without defensive measures, the damage would escalate to a significant level within 10 minutes. (Severe damage); Output recovery recommendations: "Activate backup dispatch channel + reset relay protection parameters + block lateral movement path".

[0078] Feedback data from range training exercises was collected, and the assessment error was calculated and optimized based on this data. Then, the weighting coefficients and threshold parameters were calculated and updated based on the assessment error. The updated damage assessment error decreased from 7.8% to 3.2%, and the prediction accuracy improved to 95.6%.

[0079] Example 3 Please refer to Figure 2 , Figure 2 This is a block diagram of a power target attack damage calculation system. This embodiment provides a power target attack damage calculation system, which includes: The multi-source data collaborative acquisition and standardization module is used to acquire multi-source data from the power system and perform standardized preprocessing on the multi-source data. The business behavior profiling and attack chain modeling module is used to calculate behavior similarity based on static baseline models and dynamic behavior models, and to determine the system behavior status based on behavior similarity; and to construct an attack link graph based on multi-source data using attack chain models and dynamic behavior models.

[0080] Preferably, the power target attack damage calculation system further includes a visualization mapping and dynamic inference module and an adaptive optimization and module integration module. The visualization mapping and dynamic inference module is used to construct a visualization interface based on the attack link map and the multi-dimensional damage quantification assessment model, and to construct a dynamic inference function based on the attack link map and damage propagation rules. The adaptive optimization and integration module is used to collect feedback data in the target range training and to calculate and update the model weight coefficients and threshold parameters based on the feedback data.

[0081] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A method for calculating damage from an attack on a power target, characterized in that, Includes the following steps: Collect multi-source data from the power system and perform standardized preprocessing on the multi-source data; Calculate behavioral similarity based on static baseline model and dynamic behavioral model, and determine the system behavioral state based on behavioral similarity; Based on the attack chain model and dynamic behavior model, construct an attack link graph using multi-source data; A multi-dimensional damage quantification assessment model is constructed based on the damage assessment system. The damage assessment system is used to accurately quantify the damage to the system after it has been attacked or failed. A system resilience assessment model is constructed based on the resilience assessment system.

2. The method for calculating damage from an attack on a power target according to claim 1, characterized in that, Also includes: A visualization interface is constructed based on the attack link graph and the multi-dimensional damage quantification assessment model, and a dynamic inference function is constructed based on the attack link graph and damage propagation rules.

3. The method for calculating damage from an attack on a power target according to claim 1, characterized in that, Also includes: Collect feedback data from the training exercise at the target range, and calculate and update the model weight coefficients and threshold parameters based on the feedback data.

4. The method for calculating damage from an attack on a power target according to claim 1, characterized in that, The standardization preprocessing of the multi-source data collected from power sources includes: Collect four types of core data provided by the power system; Numerical data is standardized and mapped to the [0,1] interval, textual data is converted into a 256-dimensional feature vector, and protocol data is standardized after parsing key fields. Integrate features from multiple data sources and construct feature vectors based on these features; Dimensionality reduction of the feature vectors yields effective feature vectors.

5. The method for calculating damage from an attack on a power target according to claim 1, characterized in that, The step of calculating behavioral similarity based on the static baseline model and the dynamic behavioral model, and determining the system behavioral state based on behavioral similarity, includes: Construct a multidimensional static benchmark model and a dynamic behavior model; A baseline feature vector is generated based on a multidimensional static benchmark model, and a current behavior feature vector is generated based on real-time multi-source data. Behavior similarity is calculated based on the baseline feature vector and the current behavior feature vector, and the system behavior state is determined based on behavior similarity. Construct attack chain feature vectors, build attack link graphs based on the attack chain features, and complete the attack links based on Bayesian inference to generate a directed graph.

6. The method for calculating damage from an attack on a power target according to claim 5, characterized in that, Constructing an attack chain graph based on attack chain feature vectors includes: Construct feature vectors for the attack phase; Attack chain graphs are generated based on dynamic behavior models; The attack path weights are labeled on the attack link graph.

7. The method for calculating damage from an attack on a power target according to claim 1, characterized in that, The construction of a multi-dimensional damage quantification assessment model based on a damage assessment system, wherein the damage assessment system is used to accurately quantify the damage to the system after an attack or failure, and the construction of the system resilience assessment model includes: Construct a damage assessment dimension system; The comprehensive damage value is calculated based on the damage assessment dimension system; Construct a system resilience assessment model.

8. The method for calculating damage from an attack on a power target according to claim 4, characterized in that, The construction of a visualization interface based on the attack link graph and multi-dimensional damage quantification assessment model, and the construction of a dynamic inference function based on the attack link graph and damage propagation rules, include: The attack stages, penetration nodes, and propagation probabilities are marked with a time-series evolution chart, and different colors are used to distinguish attack types; Heatmaps are used to display the extent of equipment damage; radar charts are used to show the percentage of damage values ​​across multiple dimensions; and resilience recovery curves are plotted. A deductive model is constructed based on the attack link graph and damage propagation rules.

9. The method for calculating damage from an attack on a power target according to claim 3, characterized in that, The process of collecting feedback data during range training and calculating and updating model weight coefficients and threshold parameters based on the feedback data includes: Collect feedback data during range training and construct a feedback dataset based on the feedback data; The assessment error is calculated based on the feedback dataset, damage assessment value, and toughness assessment value. Optimize the evaluation error by calculating and updating the weight coefficients and threshold parameters based on the optimized evaluation error.

10. A power target attack damage calculation system, characterized in that, include: The multi-source data collaborative acquisition and standardization module is used to acquire multi-source data from the power system and perform standardized preprocessing on the multi-source data. The business behavior profiling and attack chain modeling module is used to calculate behavior similarity based on static baseline models and dynamic behavior models, and to determine the system behavior status based on behavior similarity. Based on the attack chain model and dynamic behavior model, construct an attack link graph using multi-source data; The multi-dimensional damage quantification assessment module is used to construct a multi-dimensional damage quantification assessment model based on the damage assessment system. The damage assessment system is used to accurately quantify the damage to the system after it has been attacked or failed. The system resilience assessment model is constructed based on the resilience assessment system.

Images