A power system boundary access trust evaluation and risk control system and method

Abstract

The application belongs to the technical field of power system boundary security, and discloses a power system boundary access trust evaluation and risk control system and method, wherein a principal and object identification engine assigns a globally unique identity to the principal and the object and implements tag management, a risk control rule engine performs rule matching comparison between the fluidized principal and object interaction event and a rule library to obtain the rule matching degree of each event, the fluidized principal and object interaction event is analyzed in parallel through a multi-model to output a risk assessment score, a decision engine generates a differentiated control strategy set according to the matching result of a strategy matrix, and a strategy issuing module issues the control strategy to an execution node in batches in a gray manner according to the hierarchical logic of the device label to the region by means of a message bus. After the multi-model analysis is introduced, the comprehensive hit rate is improved by about 15%-20% compared with the pure rule mode, the false alarm rate is reduced by about 10%, and the overall risk identification is more accurate.

Description

Technical Field

[0001] This invention belongs to the field of power system boundary security technology, and relates to a power system boundary access trust evaluation and risk control system and method. Background Technology

[0002] To meet the needs of intelligent dispatching, remote operation and maintenance, and market transactions, the power grid core network has been deeply integrated with enterprise office networks, public cloud platforms, and third-party service platforms. While this "barrier-breaking" has greatly improved the efficiency of data sharing and business collaboration, it has also led to the continuous erosion of the traditional "internal network" security boundary. Attackers can initiate penetration from the internet entry point, using vulnerabilities or phishing techniques to gradually infiltrate the control system; if the security protection levels of partners or third-party service providers are uneven, they can also become "stepping stones" for attacks. At the same time, multiple entities, including regulatory authorities, operation and maintenance service providers, equipment manufacturers, and security vendors, access the same network with different identities and permissions. Existing permission management is mostly limited to a two-level division of "internal / external" and "administrator / user," lacking fine-grained control over device type, business scenario, access time, and risk level. Slight negligence can lead to problems such as "unauthorized access," "abuse," or "configuration mismatch."

[0003] Currently available security devices such as firewalls, intrusion detection systems (IDS), and unified threat management (UTM) primarily rely on pre-configured access control lists (ACLs) and static rule bases. Execution results are often presented in a binary "allow" or "block" manner. Faced with the frequent switching of communication partners and dynamically adjusted business models in modern power systems, these methods are inadequate for both risk classification and ensuring business continuity. Security information and event management (SIEM) platforms mainly rely on offline log analysis, often requiring hours or even days to complete situational assessments, clearly failing to meet the requirements for "second-level" or "sub-second-level" risk discovery and response. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a power system boundary access trust evaluation and risk control system and method, which improves response speed and identification accuracy.

[0005] This invention is achieved through the following technical solution: A power system boundary access trust assessment and risk control system, comprising: The subject-object identification engine assigns globally unique identifiers to subjects and objects and implements tag-based management of objects; The stream computing center integrates a risk control rule engine, which receives and streams the interaction events between the subject and object. The risk control rule engine then compares the streamed interaction events with the rule base to obtain the rule matching degree of each event and sends it to the decision engine. The trust evaluation engine uses multiple models to perform parallel analysis on the subject-object interaction events after the streaming process, obtains the risk assessment scores output by each model, and then obtains the trust evaluation score after standardization, which is then sent to the decision engine. The decision engine has a strategy matrix that includes four levels of risk control: observation, rate limiting, reinforcement, and isolation. The received rule matching degree and trust assessment score are input into the strategy matrix, and the strategy matrix outputs the matching results. Based on the matching results of the strategy matrix, the decision engine generates a set of differentiated control strategies, performs compliance verification and conflict detection on the control strategy set, and then encapsulates the compliant control strategies in a unified format. The policy distribution module, with the help of the message bus, distributes the encapsulated control policies to the execution nodes in batches according to the hierarchical logic from device tag to region.

[0006] This invention also provides a method for power system boundary access trust evaluation and risk control, comprising the following operations: 1) The subject-object identification engine assigns globally unique identifiers to subjects and objects, and implements tag-based management for objects; When an object initiates an access to a subject, it will be sent for streaming processing; 2) The stream computing center, which integrates a risk control rule engine, receives and streams subject-object interaction events; the risk control rule engine compares the streamed subject-object interaction events with the rule base to obtain the rule matching degree of each event and sends it to the decision engine. The stream computing center sends the streamed subject-object interaction events to the trust evaluation engine. 3) The trust evaluation engine uses multiple models to perform parallel analysis on the subject-object interaction events after the streaming process, obtains the risk assessment scores output by each model, and obtains the trust evaluation score after standardization, which is then sent to the decision engine. 4) The decision engine has a strategy matrix that includes four levels of risk control: observation, rate limiting, reinforcement, and isolation. The received rule matching degree and trust assessment score are input into the strategy matrix, and the strategy matrix outputs the matching results. 5) Based on the matching results of the strategy matrix, the decision engine generates a differentiated control strategy set, performs compliance verification and conflict detection on the control strategy set, and then encapsulates the compliant control strategies in a unified format; 6) The policy distribution module uses the message bus to distribute control policies to execution nodes in batches according to the hierarchical logic from device tag to region.

[0007] Furthermore, the rule base is the core component that solidifies security policies from human experience into executable logic, and it includes static rules, dynamic rules, and composite rules; The static rules focus on basic access control at the network and session layers, modeling conventional security boundary policies as static rules; each static rule can specify a whitelist or blacklist for a specific subnet or device; The dynamic rules characterize and identify risk features of real-time behavior patterns, and adjust the threshold of the dynamic rules based on historical traffic statistics and real-time trend analysis. The composite rule combines and encapsulates static and dynamic rules according to business scenarios and risk levels, and allows for preset priorities and execution actions for static / dynamic rules.

[0008] Furthermore, the stream computing center streams the interaction events between the subject and object; After each event arrives, the rule engine completes the matching with a delay of milliseconds, performs precise matching on static rules, performs threshold and pattern detection on dynamic rules, and outputs the rule matching degree; The rule matching degree includes: Match count: The number of times a rule is matched within a given time window; Matching type: Whether it matches static rules or dynamic rules; Anomaly metrics include the percentage of times the threshold was exceeded and the percentage of abnormal protocol messages. The rule matching score is pushed to the trust evaluation engine in real time via the message bus.

[0009] Furthermore, the multi-model includes a statistical feature model, a machine learning model, and a deep learning model; The statistical model is based on lightweight features, including the access frequency of the sliding window, the peak-to-valley ratio, and the latency distribution, to quickly capture short-term anomalies. The machine learning model uses algorithms including random forest and XGBoost to classify and regress the labeled features and identify risk patterns of moderate complexity. The deep learning model, by deploying a learning network including LSTM time-series prediction and autoencoder anomaly detection, mines long-term dependencies and high-dimensional behavioral anomalies, enabling accurate perception of complex threat chains.

[0010] Furthermore, the trust assessment score includes: After normalization, the risk scores output by each model are summed in a weighted manner to form a trust assessment score, and the trust score is mapped to four gray-scale risk levels: low, medium, high, and very high. The low-risk level is characterized by behavior that closely matches historical patterns and a control strategy that requires no intervention. The medium-risk level is described as: slight deviation in behavior; the control strategy is to enter mirror observation. The high-risk level is defined as: significant behavioral deviation; control strategies include speed limits or secondary identity verification. The extremely high risk level refers to a highly risky behavior; the control strategy is to interrupt the connection or isolate the situation.

[0011] Furthermore, the policy matrix stores the trust evaluation score threshold range corresponding to each policy level, as well as the corresponding control actions, in matrix form; During runtime, the decision engine generates a set of differentiated control policies based on the matrix matching results; these control policies include bandwidth limiting, multi-factor authentication, traffic mirroring, and connection interruption. Before issuing the instructions, compliance and conflict checks are performed to eliminate or adjust any instructions that conflict with the compliance database.

[0012] Furthermore, the control strategy is encapsulated in a unified JSON / XML message format, with a version number and effective time indicated.

[0013] Furthermore, the execution nodes need to report the execution results of the control strategy and traffic indicators in real time, and the decision engine compares and analyzes them against the expected results. If the control strategy fails to execute or the business is interrupted, multi-channel alarms are triggered immediately, and manual or control strategy compensation is issued according to the contingency plan.

[0014] Compared with the prior art, the present invention has the following beneficial technical effects: Traditional systems often rely on fixed rules for matching and interception, resulting in slow response times and an inability to adapt to complex and ever-changing threat scenarios. The decision engine of this invention adopts a rule engine and a multi-model reasoning collaborative mechanism, which can complete comprehensive judgment on real-time streaming data and achieve dynamic risk decisions at the second or even millisecond level, significantly improving response speed and recognition accuracy.

[0015] The real-time decision-making performance of this invention is significantly improved: under the same hardware conditions, the decision engine reduces the average response time for a single event from seconds to less than 100ms through a streaming processing architecture, and still maintains a stable response in high-concurrency (>10kTPS) scenarios.

[0016] The risk identification accuracy of this invention is significantly improved: after introducing multi-model analysis, the overall hit rate is increased by about 15%–20% compared with the pure rule method, the false alarm rate is reduced by about 10%, and the overall risk identification is more accurate. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the process of the present invention.

[0018] Figure 2 This demonstrates the results of the present invention's monitoring of local communication anomalies in a power system. Detailed implementation methods are described below. The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings and examples.

[0019] This invention provides a power system boundary access trust assessment and risk control system, comprising: The subject-object identification engine assigns globally unique identifiers to subjects and objects and implements tag-based management of objects; The stream computing center integrates a risk control rule engine, which receives and streams the interaction events between the subject and object. The risk control rule engine then compares the streamed interaction events with the rule base to obtain the rule matching degree of each event and sends it to the decision engine. The trust evaluation engine uses multiple models to perform parallel analysis on the subject-object interaction events after the streaming process, obtains the risk assessment scores output by each model, and then obtains the trust evaluation score after standardization, which is then sent to the decision engine. The decision engine has a strategy matrix that includes four levels of risk control: observation, rate limiting, reinforcement, and isolation. The received rule matching degree and trust assessment score are input into the strategy matrix, and the strategy matrix outputs the matching results. Based on the matching results of the strategy matrix, the decision engine generates a set of differentiated control strategies, performs compliance verification and conflict detection on the control strategy set, and then encapsulates the compliant control strategies in a unified format. The policy distribution module, with the help of the message bus, distributes the encapsulated control policies to the execution nodes in batches according to the hierarchical logic from device tag to region.

[0020] The following provides a detailed explanation of each engine / module and its operation method.

[0021] 1. Tag-based management The subject-object identification engine assigns globally unique identifiers (UUIDs) to the subject (access target) and the object (access initiator) and implements tag-based management; Preferably, the globally unique identifier (UUID) is not only associated with static attributes such as device MAC, serial number, and software version, but also bound to dynamic tags such as geographical coordinates, network domain, and the operation and maintenance team to which it belongs; It also allows for the dynamic addition, deletion, or modification of tags based on security events or human intervention: if a device is deemed high-risk in multiple consecutive assessments, the system can automatically add a "key monitoring" tag to it, triggering stricter access restrictions; conversely, when the device exits the maintenance or fault window, it can be restored to its normal tag status.

[0022] The aforementioned tagging management establishes a tagging system for subjects and objects (access initiators). The tagging system is a hierarchical management system based on dimensions such as "business attributes (e.g., substations, distribution networks, energy storage units)," "security levels (e.g., critical nodes, ordinary nodes)," and "geographical divisions (e.g., east zone, west zone)," which facilitates the precise distribution of control strategies.

[0023] 2. Stream processing and rule matching Integrate rule engines, including Drools, into stream computing platforms (such as Apache Flink and Spark Streaming) to stream the interaction events between the subject and object. After each event arrives, the rule engine completes the matching with a millisecond delay, performs precise matching on static rules, performs threshold and pattern detection on dynamic rules, and outputs the rule matching degree.

[0024] The rule matching degree depends on the rule base, which is the core component that solidifies security policies from human experience into executable logic. The rule base is divided into three categories: static rules, dynamic rules, and composite rules.

[0025] The static rules primarily focus on basic access control at the network and session layers, including IP / port / protocol blacklists and whitelists, network area boundary delineation, and access time restrictions. For example, through research on the existing network architecture and business time characteristics of power grid operators, conventional security boundary policies are modeled as static rules. Each static rule can specify whitelists and blacklists for specific subnets or devices, ensuring that critical sessions of the power grid dispatching, monitoring, and control systems are prioritized during peak business periods.

[0026] The dynamic rules characterize and identify risk features based on real-time behavioral patterns, covering aspects such as session duration thresholds, access frequency limits, and identification of unauthorized protocols or abnormal message formats. The thresholds of the dynamic rules are adjusted based on historical traffic statistics and real-time trend analysis. For example, if a session between an RTU and the SCADA system is detected to exceed the normal duration or a sudden increase in access frequency, dynamic rule matching can be triggered, and the matching event will be reported to the trust evaluation engine.

[0027] The composite rule combines and encapsulates static and dynamic rules according to "business scenario + risk level," forming a template that can be applied with one click. Typical templates include "external maintenance read-only mode," "critical equipment interaction rate limit," and "nighttime high-risk monitoring mode." By pre-setting the priority and execution actions of static / dynamic rules in the composite rule, it can quickly respond to various scenario requirements while ensuring rule consistency.

[0028] To effectively pass the matching results to the decision engine, the rule engine will attach a rule matching degree label to the event attributes, which includes: Match count: The number of times a rule is matched within a given time window; Matching type: Whether it matches a static rule or a dynamic rule; or whether it matches a static rule or a dynamic rule. Anomaly metrics: such as the percentage of times exceeding the threshold, the percentage of abnormal protocol messages, etc.

[0029] This matching data is pushed to the decision engine in real time via a message bus, ensuring that control strategies are tailored to the latest behavioral risk profiles.

[0030] 3. Trust assessment The trust evaluation engine uses multiple models to perform parallel analysis of the subject-object interaction events after streaming. The parallel analysis of the data stream by the multiple models includes a comprehensive evaluation of the subject-object interaction behavior from multiple levels, from statistical features and machine learning to deep learning.

[0031] The statistical model is based on lightweight features such as the access frequency of the sliding window, the peak-to-valley ratio, and the latency distribution to quickly capture short-term anomalies. The machine learning model uses algorithms such as random forest and XGBoost to classify and regress labeled features (such as device labels, rule matching degree, and historical risk scores) to identify risk patterns of moderate complexity. The deep learning model, by deploying learning networks including LSTM time-series prediction and autoencoder anomaly detection, mines long-term dependencies and high-dimensional behavioral anomalies, enabling accurate perception of complex threat chains.

[0032] Specifically, obtaining the trust assessment score includes: The risk scores output by each model are normalized and then weighted to form the final trust score (0–100). The system maps the trust score to four gray-scale risk levels: "low—medium—high—very high"; when mapping the trust level to the four levels, interval division is used for quantification.

[0033] Specifically, the trust assessment score ranges from 0 to 100, and is divided into four levels based on the degree of trust: High Trust (Level A): 80-100 points, indicating that the entity's identity is trustworthy, its behavior is stable, and there are no obvious risk characteristics; High Trust (Level B): 60-79 points, indicating that the entity has a high degree of credibility and only exhibits minor fluctuations or low-risk behavior; General Trust (Level C): 40-59 points, indicating that the entity has certain risk characteristics and needs to be included in the key monitoring. Low Trust (Level D): 0-39 points, indicating that the entity has a high risk or abnormal behavior, and corresponding control measures should be taken.

[0034] Furthermore, the trust score is mapped to four gray-scale risk levels: low, medium, high, and extremely high. The low-risk level is characterized by behavior that closely matches historical patterns and a control strategy that requires no intervention. The medium-risk level is described as: slight deviation in behavior; the control strategy is to enter mirror observation. The high-risk level is defined as: significant behavioral deviation; control strategies include speed limits or secondary identity verification. The extremely high risk level refers to a highly risky behavior; the control strategy is to interrupt the connection or isolate the situation.

[0035] In practical applications, the score threshold can be dynamically adjusted based on business scenarios, historical sample distribution, and model output results; the decision engine optimizes the partition threshold and performs grayscale verification through the strategy configuration center to ensure that trust mapping and risk control effects remain consistent.

[0036] 4. Risk control strategy The decision engine is based on a predefined four-level risk control strategy matrix of "observation → speed limit → reinforcement → isolation" and constructs a risk decision system with trust score and rule matching degree as the core dimensions.

[0037] Specifically, based on multiple factors such as trust score, rule matching degree, device criticality, current network load, and service SLA requirements, a four-level risk control strategy matrix of "observation → rate limiting → reinforcement → isolation" is predefined. The strategy matrix stores the trust assessment score threshold range corresponding to each strategy level and the corresponding control action in matrix form.

[0038] Table 1 provides examples of control actions and threshold ranges for the four-level risk control strategy matrix.

[0039] Table 1. Control Actions and Threshold Ranges of the Risk Control Strategy Matrix 5. Generate a set of control strategies During runtime, the decision engine generates a set of differentiated control policies based on the matrix matching results; these control policies include bandwidth limiting, multi-factor authentication, traffic mirroring, and connection interruption. Before issuing instructions, compliance and conflict checks are performed to eliminate or adjust instructions that conflict with the compliance database, preventing accidental damage to core business operations.

[0040] Below are some examples of specific control strategies: Low-risk nodes trigger the observation policy set, which only performs logging and continuous monitoring. Low- to medium-risk nodes trigger a set of rate limiting policies, implementing bandwidth limiting, QPS control, and connection number constraints. High- and medium-risk nodes trigger an enhanced protection strategy set, which includes multi-factor authentication, traffic mirroring, permission reduction, and rule review. High-risk nodes trigger a set of isolation and blocking policies, including disconnection, device isolation, interface circuit breaking, and traffic blocking.

[0041] Step 106: Control Strategy Issuance The generated control policies are encapsulated in a unified JSON / XML message format, labeled with version number and effective time, and distributed to execution nodes in batches according to "device tag → region" using the message bus.

[0042] The execution nodes are required to report the execution results of the control strategy and traffic indicators in real time. The decision engine compares and analyzes the results against the expected effects. If the control strategy fails to execute or the business is interrupted, multi-channel alarms are triggered immediately, and manual or control strategy compensation is issued according to the contingency plan.

[0043] This invention improves the overall hit rate by about 15%–20% compared to the pure rule-based approach, reduces the false alarm rate by about 10%, and makes the overall risk identification more accurate. Figure 2 The image shows the results of the present invention for monitoring communication anomalies in a local power system. The overall situation is as follows: from November 11th to November 19th, the communication pairs of the general dispatch in the situation awareness zones I and II were analyzed, and a total of 83 alarms were generated, averaging about 9 alarms per day; the false alarm rate was only 2.4%.

[0044] The embodiments given above are preferred examples for implementing the present invention, and the present invention is not limited to the above embodiments. Any non-essential additions or substitutions made by those skilled in the art based on the technical features of the present invention are within the protection scope of the present invention.

Claims

1. A power system boundary access trust evaluation and risk control system, characterized in that, include: The subject-object identification engine assigns globally unique identifiers to subjects and objects and implements tag-based management of objects; The stream computing center integrates a risk control rule engine, which receives and streams interaction events between the subject and object. The risk control rule engine compares the streamed subject-object interaction events with the rule base to obtain the rule matching degree of each event and sends it to the decision engine. The trust evaluation engine uses multiple models to perform parallel analysis on the subject-object interaction events after the streaming process, obtains the risk assessment scores output by each model, and then obtains the trust evaluation score after standardization, which is then sent to the decision engine. The decision engine has a strategy matrix that includes four levels of risk control: observation, rate limiting, reinforcement, and isolation. The received rule matching degree and trust assessment score are input into the strategy matrix, and the strategy matrix outputs the matching result. Based on the matching results of the strategy matrix, the decision engine generates a differentiated set of control strategies, performs compliance verification and conflict detection on the set of control strategies, and then encapsulates the compliant control strategies in a unified format. The policy distribution module, with the help of the message bus, distributes the encapsulated control policies to the execution nodes in batches according to the hierarchical logic from device tag to region.

2. A method for trust evaluation and risk control of power system boundary access, characterized in that, Includes the following operations: 1) The subject-object identification engine assigns globally unique identifiers to subjects and objects, and implements tag-based management for objects; When an object initiates an access to a subject, it will be sent for streaming processing; 2) A stream computing center with an integrated risk control rule engine receives and streams interaction events between the subject and object. The risk control rule engine compares the streamed subject-object interaction events with the rule base to obtain the rule matching degree of each event and sends it to the decision engine. The stream computing center sends the streamed subject-object interaction events to the trust evaluation engine. 3) The trust evaluation engine uses multiple models to perform parallel analysis on the subject-object interaction events after the streaming process, obtains the risk assessment scores output by each model, and obtains the trust evaluation score after standardization, which is then sent to the decision engine. 4) The decision engine has a strategy matrix that includes four levels of risk control: observation, rate limiting, reinforcement, and isolation. The received rule matching degree and trust assessment score are input into the strategy matrix, and the strategy matrix outputs the matching results. 5) Based on the matching results of the strategy matrix, the decision engine generates a differentiated control strategy set, performs compliance verification and conflict detection on the control strategy set, and then encapsulates the compliant control strategies in a unified format; 6) The policy distribution module uses the message bus to distribute control policies to execution nodes in batches according to the hierarchical logic from device tag to region.

3. The power system boundary access trust evaluation and risk control method as described in claim 2, characterized in that, The globally unique identifier is a binding mechanism that associates and links the static attributes and dynamic tags of each device with it. The static attributes include MAC address, serial number, and software version; The dynamic tags include geographic coordinates, network domain, and the corresponding operations and maintenance team; The aforementioned tag-based management system establishes a hierarchical tag management system based on dimensions including business attributes, security levels, and geographical regions. Tags are dynamically added, deleted, or changed based on security incidents or human policy adjustments.

4. The power system boundary access trust evaluation and risk control method as described in claim 2, characterized in that, The rule base is the core component that solidifies security policies from human experience into executable logic, and it includes static rules, dynamic rules, and composite rules. The static rules focus on basic access control at the network and session layers, and model conventional security boundary policies as static rules. Each static rule can specify a whitelist or blacklist for a specific subnet or device; The dynamic rules characterize and identify risk features of real-time behavior patterns, and adjust the threshold of the dynamic rules based on historical traffic statistics and real-time trend analysis. The composite rule combines and encapsulates static and dynamic rules according to business scenarios and risk levels, and allows for preset priorities and execution actions for static / dynamic rules.

5. The power system boundary access trust evaluation and risk control method as described in claim 2, characterized in that, The stream computing center streams the interaction events between the subject and object. After each event arrives, the rule engine completes the matching with a delay of milliseconds, performs precise matching on static rules, performs threshold and pattern detection on dynamic rules, and outputs the rule matching degree. The rule matching degree includes: Match count: The number of times a rule is matched within a given time window; Matching type: Whether it matches static rules or dynamic rules; Anomaly metrics include the percentage of times the threshold was exceeded and the percentage of abnormal protocol messages. The rule matching score is pushed to the trust evaluation engine in real time via the message bus.

6. The power system boundary access trust evaluation and risk control method as described in claim 2, characterized in that, The multiple models include statistical feature models, machine learning models, and deep learning models. The statistical model is based on lightweight features, including the access frequency of the sliding window, the peak-to-valley ratio, and the latency distribution, to quickly capture short-term anomalies. The machine learning model uses algorithms including random forest and XGBoost to classify and regress the labeled features and identify risk patterns of moderate complexity. The deep learning model, by deploying a learning network including LSTM time-series prediction and autoencoder anomaly detection, mines long-term dependencies and high-dimensional behavioral anomalies, enabling accurate perception of complex threat chains.

7. The power system boundary access trust evaluation and risk control method as described in claim 2, characterized in that, The trust assessment score includes: After normalization, the risk scores output by each model are summed in a weighted manner to form a trust assessment score, and the trust score is mapped to four gray-scale risk levels: low, medium, high, and very high. The low-risk level is characterized by behavior that closely matches historical patterns and a control strategy that requires no intervention. The medium-risk level is described as: slight deviation in behavior; the control strategy is to enter mirror observation. The high-risk level is defined as: significant behavioral deviation; control strategies include speed limits or secondary identity verification. The extremely high risk level refers to a highly risky behavior; the control strategy is to interrupt the connection or isolate the situation.

8. The power system boundary access trust evaluation and risk control method as described in claim 2, characterized in that, The policy matrix stores the trust assessment score threshold range for each policy level and the corresponding control action in matrix form. During runtime, the decision engine generates a set of differentiated control policies based on the matrix matching results; these control policies include bandwidth limiting, multi-factor authentication, traffic mirroring, and connection interruption. Before issuing the instructions, compliance and conflict checks are performed to eliminate or adjust any instructions that conflict with the compliance database.

9. The power system boundary access trust evaluation and risk control method as described in claim 2, characterized in that, The control strategy is encapsulated in a unified JSON / XML message format, with the version number and effective time indicated.

10. The power system boundary access trust evaluation and risk control method as described in claim 2, characterized in that, The execution nodes are required to report the execution results of the control strategy and traffic indicators in real time. The decision engine compares and analyzes the results against the expected effects. If the control strategy fails to execute or the business is interrupted, multi-channel alarms are triggered immediately, and manual or control strategy compensation is issued according to the contingency plan.

Images