Wind power industrial control equipment safety evaluation method and system, storage medium and electronic equipment

Abstract

The application provides a kind of wind power industrial control equipment safety evaluation method, system, storage medium and electronic equipment, belong to wind power generation technical field.The method comprises: real-time acquisition of original data, the original data includes the operating parameter of industrial control equipment, operator activity log, system event log, firmware hash value and configuration snapshot;Based on the original data, the safety feature vector of the industrial control equipment is generated;Based on the safety feature vector of the industrial control equipment, the safety evaluation index of the industrial control equipment is determined according to the preset safety evaluation model.Can automatically, efficiently, real-time safety evaluation is carried out to industrial control equipment, not dependent on artificial, improve the evaluation efficiency, can meet the demand of large-scale asset safety management, so as to can improve the accuracy, real-time performance and intelligent level of wind power industrial control asset safety evaluation.

Description

Technical Field

[0001] This invention relates to the field of wind power generation technology, specifically to a method for safety assessment of wind power industrial control equipment, a system for safety assessment of wind power industrial control equipment, a machine-readable storage medium, and an electronic device. Background Technology

[0002] As an important clean energy source, wind energy has seen its installed capacity grow rapidly and continuously. The safe and stable operation of wind farms is crucial to national energy security and grid reliability. The industrial control system of a wind farm is its core nervous system, containing a large number of key industrial control devices such as programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA) systems, human-machine interfaces (HMIs), and network equipment. These industrial control devices often operate in harsh environments with complex network structures and diverse protocols.

[0003] In recent years, cyberattacks targeting critical infrastructure, particularly industrial control systems in the energy sector, have become increasingly frequent, including ransomware attacks and targeted attacks. The wind power sector, due to its strategic value and the severity of its physical consequences, has become a key target. Therefore, security assessments of wind power industrial control equipment are essential.

[0004] Traditional safety assessments of wind power industrial control equipment rely mainly on manual operation, which is inefficient and cannot meet the needs of large-scale asset safety management. Summary of the Invention

[0005] The purpose of this invention is to provide a method for safety assessment of wind power industrial control equipment, a system for safety assessment of wind power industrial control equipment, a machine-readable storage medium, and an electronic device. This method does not rely on manual labor, improves assessment efficiency, and can meet the needs of large-scale asset safety management, thereby enhancing the accuracy, real-time performance, and intelligence level of wind power industrial control asset safety assessment.

[0006] To achieve the above objectives, the first aspect of this application provides a method for safety assessment of wind power industrial control equipment, comprising: Real-time acquisition of raw data, including operating parameters of industrial control equipment, operator activity logs, system event logs, firmware hash values, and configuration snapshots; Based on the original data, a safety feature vector of the industrial control equipment is generated; Based on the safety feature vector of the industrial control equipment, the safety assessment index of the industrial control equipment is determined according to the preset safety assessment model.

[0007] In this embodiment of the application, generating the security feature vector of the industrial control equipment based on the original data includes: Extract field information from the original data; Based on the WindSec format, the field information is encapsulated to obtain the security feature vector of the industrial control equipment.

[0008] In this embodiment of the application, the real-time acquisition of raw data includes: Real-time acquisition of sampling parameter fluctuation information within a preset time window; Based on the fluctuation information of the sampling parameters, the sampling interval is adjusted to obtain a new sampling interval; Raw data is acquired in real time from the industrial control environment of the wind farm according to the new sampling interval.

[0009] In this embodiment of the application, the step of determining the security assessment index of the industrial control equipment based on the security feature vector of the industrial control equipment according to a preset security assessment model includes: Based on the security feature vector of the industrial control equipment, the service level of the industrial control equipment is determined according to a preset equipment classification strategy; Based on the service level of the industrial control equipment, a corresponding priority queue is obtained; The industrial control device is added to the corresponding priority queue, and when the corresponding priority queue reaches the industrial control device, the security assessment index of the industrial control device is determined according to the preset security assessment model based on the security feature vector of the industrial control device.

[0010] In this embodiment of the application, the step of determining the security assessment index of the industrial control equipment based on the security feature vector of the industrial control equipment according to a preset security assessment model includes: Based on the security feature vector of the industrial control equipment, vulnerability score, behavior score and configuration score are determined. The security assessment index of the industrial control equipment is obtained by weighted summation of the vulnerability score, the behavior score, and the configuration score.

[0011] In this embodiment of the application, the vulnerability score is determined based on the security feature vector of the industrial control equipment, including: Extract the firmware hash value from the security feature vector of the industrial control equipment; Based on the firmware hash value, CVE records are matched in the NVD database; The vulnerability score is determined based on the CVSS score corresponding to the CVE record.

[0012] In this embodiment of the application, the behavior score is determined based on the security feature vector of the industrial control equipment, including: Time-series data and instruction sequence data are extracted from the safety feature vector of the industrial control equipment; Anomaly analysis is performed using a first anomaly analysis model and / or a second anomaly analysis model to identify anomalous data. The first anomaly analysis model is used to calculate the reconstruction error of the time series data and determine the anomalous behavior based on the reconstruction error. The second anomaly analysis model is used to classify the instruction sequence data to obtain anomalous events. Based on the abnormal data, a behavior score is determined.

[0013] In this embodiment of the application, the configuration score is determined based on the security feature vector of the industrial control equipment, including: Extract the configuration snapshot from the security feature vector of the industrial control equipment; The compliance check pass rate is obtained by comparing the configuration snapshot with the IEC 62443 standard baseline. The configuration score is obtained based on the compliance check pass rate.

[0014] In this embodiment of the application, the step of weighted summing of the vulnerability score, the behavior score, and the configuration score to obtain the security assessment index of the industrial control equipment includes: Based on the operational years of the industrial control equipment, the vulnerability weights were determined; Based on the frequency of attacks on the industrial control equipment, the behavior weights are determined; Obtain configuration weights; Based on the vulnerability weight, the behavior weight, and the configuration weight, the vulnerability score, the behavior score, and the configuration score are weighted and summed to obtain the security assessment index of the industrial control equipment.

[0015] In this embodiment of the application, it also includes: Obtain safety assessment indicators for adjacent industrial control equipment; Based on the safety assessment indicators of the industrial control equipment and the safety assessment indicators of the adjacent industrial control equipment, the associated risk indicators of the industrial control equipment are determined.

[0016] The second aspect of this application provides a safety assessment system for wind power industrial control equipment, including an edge agent and a server; The edge agent is used to acquire raw data in real time, including the operating parameters of the industrial control equipment, operator activity logs, system event logs, firmware hash values, and configuration snapshots; based on the raw data, a security feature vector of the industrial control equipment is generated, and the security feature vector of the industrial control equipment is sent to the server. The server is used to determine the security assessment index of the industrial control equipment based on the security feature vector of the industrial control equipment and according to a preset security assessment model.

[0017] A third aspect of this application provides an electronic device, the electronic device comprising: At least one processor; A memory connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the above-mentioned wind power industrial control equipment safety assessment method by executing the instructions stored in the memory.

[0018] A fourth aspect of this application provides a machine-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the aforementioned wind power industrial control equipment safety assessment method.

[0019] The above technical solution acquires raw data in real time, including the operating parameters of industrial control equipment, operator activity logs, system event logs, firmware hash values, and configuration snapshots. Based on this raw data, a security feature vector for the industrial control equipment is generated. Based on this security feature vector, a security assessment index for the industrial control equipment is determined according to a preset security assessment model. By uniformly transforming raw data from different protocols into structured security feature vectors containing rich contextual information, and then utilizing the security assessment model, security assessments of industrial control equipment can be performed automatically, efficiently, and in real time, without relying on manual intervention. This improves assessment efficiency and meets the needs of large-scale asset security management, thereby enhancing the accuracy, real-time performance, and intelligence level of wind power industrial control asset security assessment.

[0020] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0021] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings: Figure 1 The illustration shows a flowchart of a safety assessment method for wind power control equipment according to an embodiment of this application; Figure 2 An overall protocol workflow diagram according to an embodiment of this application is illustrated schematically; Figure 3 A schematic diagram illustrating the core workflow according to an embodiment of this application is provided. Detailed Implementation

[0022] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0023] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application all comply with relevant laws and regulations. In the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0024] It should be noted that if the embodiments of this application involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of each component in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0025] Furthermore, if the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, features defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, the technical solutions of various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0026] Definitions: MCP: Model Context Protocol. An open standard designed to provide a standardized and universal way for AI applications (especially large language models) to connect with external data sources and tools.

[0027] MCP-WindSec: Based on the design concept of MCP unified encapsulation of heterogeneous data sources, it is a data encapsulation format extended and defined for wind power industrial control security scenarios.

[0028] Modbus TCP: An industrial communication protocol based on TCP / IP, commonly used for data transmission between PLCs and host computers.

[0029] OPC-UA: OPC Unified Architecture. A service-oriented industrial communication protocol that supports cross-platform data exchange.

[0030] DNP3: Distributed Network Protocol 3. An industrial communication protocol widely used in power systems.

[0031] Syslog: A standard log transmission protocol used to transmit log messages between network devices.

[0032] SNMP: Simple Network Management Protocol. Used for managing and monitoring network devices.

[0033] SSH: Secure Shell. An encrypted network protocol used for remote login and secure file transfer.

[0034] CVE: Common Vulnerabilities and Exposures. Each CVE number uniquely identifies a publicly disclosed cybersecurity vulnerability.

[0035] CVSS: Common Vulnerability Scoring System. An international open standard maintained by FIRST.Org, it is used to quantitatively assess the severity of software vulnerabilities, with scores ranging from 0 to 10. This method uses the CVSSv3.1 Base Score.

[0036] NVD: National Vulnerability Database, maintained by NIST. Each CVE vulnerability record includes a CVSS score.

[0037] IEC 62443: International standard for safety of industrial automation and control systems.

[0038] LSTM: Long Short-Term Memory, a deep learning model suitable for processing time-series data.

[0039] SVM: Support Vector Machine, a type of supervised learning classification model.

[0040] HSM: Hardware Security Module, a dedicated cryptographic hardware device used to securely store keys and perform cryptographic operations.

[0041] TLS: Transport Layer Security, is a protocol used to provide encryption and data integrity protection in network communications.

[0042] ECDSA: Elliptic Curve Digital Signature Algorithm, an efficient digital signature algorithm based on elliptic curve cryptography.

[0043] AEAD: Authenticated Encryption with Associated Data, a cryptographic mechanism that provides encryption, integrity, and authentication simultaneously.

[0044] LPWAN: Low Power Wide Area Network, a type of wireless communication technology characterized by low power consumption and long coverage, such as LoRa and NB-IoT.

[0045] LoRa: Long Range, a low-power, long-range wireless communication technology.

[0046] QoS: Quality of Service.

[0047] SOC: Security Operations Center, a centralized operations and maintenance platform for security monitoring and incident response.

[0048] OMC: Operations and Maintenance Center, a platform for centralized equipment operation and maintenance management.

[0049] HMAC: Hash-based Message Authentication Code.

[0050] Please refer to Figure 1 , Figure 1 This illustration schematically shows a flowchart of a safety assessment method for wind power control equipment according to an embodiment of this application. This embodiment provides a safety assessment method for wind power control equipment, including the following steps: Step 110: Acquire raw data in real time, including the operating parameters of industrial control equipment, operator activity logs, system event logs, firmware hash values, and configuration snapshots; In this embodiment, the aforementioned raw data may refer to raw data obtained from the wind farm's industrial control environment. The wind farm's industrial control environment includes various heterogeneous protocols (such as Modbus TCP, OPC-UA, DNP3, Syslog, etc.), therefore, the raw data includes data from different sources and in different formats. The aforementioned raw data includes data from the wind turbine control logic, data from the SCADA system, and data from the industrial control equipment itself.

[0051] Among them, the data for the wind turbine control logic can be collected by polling the values ​​of key control registers at preset intervals (such as every 50ms) using the Modbus TCP protocol. The values ​​of the key control registers can cover 128 core operating parameters such as speed, pitch angle, generator temperature, gearbox oil temperature, and hydraulic pressure. These operating parameters can directly reflect the physical state and control logic of the industrial control equipment.

[0052] For SCADA system data, operator activity logs and system event logs can be obtained in real time or near real time via the Syslog protocol or a dedicated API. These logs include 20 types of operation records such as user login / logout records, execution of key commands (starting / stopping units, modifying parameters), alarm event triggering and clearing, and system error messages.

[0053] For data from industrial control equipment itself, firmware hashes and configuration snapshots of critical devices can be obtained daily or on demand via vendor tools, SNMP, or SSH protocols. The firmware hash is the digital fingerprint of the firmware file, and the configuration snapshot is a complete copy of all configurable parameters of the industrial control equipment at a specific point in time, recording its operational status at that moment. Firmware hashes can be used for vulnerability matching, and configuration snapshots can be used for compliance checks.

[0054] In some embodiments, to improve efficiency and focus on key changes, not all data is collected at the highest frequency; the collection interval can be dynamically adjusted. That is, the real-time acquisition of raw data includes: First, acquire the fluctuation information of the sampling parameters within the preset time window in real time; In this embodiment, the aforementioned preset time window can be pre-set according to actual conditions, and the aforementioned sampling parameters can be determined according to actual conditions, such as wind speed. The sampling parameter fluctuation information includes the sampling parameter volatility, which can refer to the standard deviation or absolute rate of change of the sampling parameter. For example, the standard deviation or absolute rate of change of a parameter (such as wind speed) within the most recent 10-second time window can be continuously calculated as the volatility.

[0055] It should be noted that the time window mentioned above can also be dynamically adjusted. For example, the time window can be fixed at 10 seconds. When the sampling interval is 10ms, the time window contains 1000 samples; when the sampling interval is 1s, the time window contains 10 samples. When the number of samples is less than 10 (such as at startup or when the sampling interval is too large), the volatility calculation window (i.e., the time window) can be automatically extended until it contains at least 10 samples to avoid insufficient samples.

[0056] Then, based on the fluctuation information of the sampling parameters, the sampling interval is adjusted to obtain a new sampling interval; In this embodiment, the sampling interval refers to the frequency at which the industrial control equipment initiates data acquisition. This sampling interval can be a pre-set baseline sampling interval (for example, for a wind turbine PLC, the sampling interval can be set to 200ms). The sampling parameter fluctuation information can be compared with a pre-set fluctuation threshold, and the sampling interval can be adjusted based on the comparison result.

[0057] For example, the sampling parameter fluctuation information is the wind speed fluctuation rate, with fluctuation thresholds of 15% and 5%. When the wind speed fluctuation rate is greater than 15% (such as sudden wind speed changes or drastic changes in operating conditions), the sampling interval is set to max(10ms, the baseline sampling interval). 0.5); When the wind speed fluctuation rate is less than 5% (stable operating conditions), the sampling interval = min(1000ms, reference sampling interval) 2.0).

[0058] Finally, raw data is acquired in real time from the industrial control environment of the wind farm according to the new sampling interval.

[0059] In this embodiment, after determining the new sampling interval, the original data is acquired according to the new sampling interval. This enables adaptive dynamic data acquisition, making the acquired original data more reliable and improving the efficiency of data acquisition.

[0060] Step 120: Based on the original data, generate the security feature vector of the industrial control equipment; In this embodiment, since the original data contains data from different protocols, the original data can be converted to obtain the security feature vector of the industrial control equipment.

[0061] In some embodiments, generating the security feature vector of the industrial control equipment based on the original data includes: First, extract field information from the raw data; In this embodiment, after real-time monitoring of the raw data streams of each protocol interface (operating parameters of industrial control equipment, operator activity logs, system event logs, firmware hash values ​​and configuration snapshots), the fields (such as Modbus register addresses and values, Syslog priority, timestamps, hostnames, message bodies) are parsed and decoded to obtain the field information.

[0062] Then, based on the WindSec format, the field information is encapsulated to obtain the security feature vector of the industrial control equipment.

[0063] In this embodiment, field information can be combined with the metadata (device fingerprint) and environmental data (environmental factors) of the industrial control equipment, and then encapsulated in a structured manner based on the WindSec format to obtain the security feature vector of the industrial control equipment. Specifically, field information, the metadata (device fingerprint) of the industrial control equipment, and environmental data (environmental factors) can be filled into the corresponding fields, and then encapsulated into a security feature vector in a unified format.

[0064] Specifically, a new format can be obtained by extending the field definitions on the standard WindSec format. For example, the new format could be named MCP-WindSec format. The field definitions included in the MCP-WindSec format are shown in Tables 1 and 2 below. Table 1 shows the field definitions of the MCP-WindSec security feature vector, and Table 2 shows the original payload fields and protocol type. The security tag, security_tag, can be generated by HMAC-SHA256(device_id+timestamp+payload+key), where key is the security key.

[0065] Table 1: Definition of MCP-WindSec Security Feature Vector Fields

[0066] Table 2: Raw Payload Fields and Protocol Types

[0067] The security feature vector generated above is not a one-dimensional mathematical vector, but a structured multi-field record.

[0068] By extracting field information from the raw data and encapsulating the field information based on the WindSec format, the security feature vector of the industrial control equipment can be obtained. This allows the raw data of traditional industrial protocols to be uniformly transformed into a structured security feature vector containing rich contextual information through predefined rules and feature extraction.

[0069] Step 130: Based on the safety feature vector of the industrial control equipment, determine the safety assessment index of the industrial control equipment according to the preset safety assessment model.

[0070] In this embodiment, security assessment can be performed based on the security feature vector of the industrial control equipment. A security assessment model can be pre-set, which can be one or more machine learning models or mathematical models, etc., and the security assessment indicators of the industrial control equipment can be calculated through the security assessment model.

[0071] In some embodiments, determining the security assessment index of the industrial control equipment based on its security feature vector according to a preset security assessment model includes: First, based on the security feature vector of the industrial control equipment, the service level of the industrial control equipment is determined according to a preset equipment classification strategy; In this embodiment, the device type can be identified based on the device_id in the security feature vector of the industrial control equipment, and then the service level can be matched according to a preset device classification strategy. Specifically, a device classification strategy table can be pre-set. After determining the device type, the corresponding service level can be matched in the device classification strategy table. For example, the device classification strategy table is shown in Table 3 below. Table 3 is the device classification strategy table. The device type can be determined based on the device_id, and then the corresponding service level (i.e., QoS level) can be matched. The above service level can be determined based on the update frequency. The lower the update frequency, the higher the service level, and vice versa.

[0072] Table 3: Equipment Classification Strategy Table

[0073] Then, based on the service level of the industrial control equipment, the corresponding priority queue is obtained; In this embodiment, multiple priority queues can be pre-maintained, each with a different processing priority level. Different service levels correspond to different priority queues. For example, in the above example, queue P0 is used to process devices at level P0, queue P1 is used to process devices at level P1, queue P2 is used to process devices at level P2, and queue P3 is used to process devices at level P3. Queue P0 has absolute priority. Once the service level is determined, the corresponding priority queue can be identified.

[0074] For different priority queues, resource allocation can monitor the egress bandwidth, prioritizing data transmission for queue P0. When bandwidth is tight, data transmission for queues P2 / P3 is rate-limited and delayed. In computing resources, queue P0 triggers real-time analysis and immediately preempts execution, queue P1 processes data in batches according to time windows (e.g., every minute), and queues P2 / P3 execute when idle.

[0075] Finally, the industrial control device is added to the corresponding priority queue, and when the corresponding priority queue reaches the industrial control device, the security assessment index of the industrial control device is determined according to the preset security assessment model based on the security feature vector of the industrial control device.

[0076] In this embodiment, industrial control devices can be added to the corresponding priority queue, and tasks can be executed in the order of the priority queue. When the task is executed on an industrial control device, the security assessment index of the industrial control device is determined based on the security feature vector of the industrial control device and according to the preset security assessment model.

[0077] By using the security feature vector of the industrial control equipment (ICS) to determine its service level according to a preset equipment classification strategy, and obtaining a corresponding priority queue based on the ICS's service level, the ICS is added to the corresponding priority queue. When the ICS is executed in the corresponding priority queue, the security assessment index of the ICS is determined based on its security feature vector according to a preset security assessment model. This enables dynamic task scheduling, classifies equipment and assigns different service levels, and intelligently allocates network bandwidth and computing resources, which helps to determine the security assessment index of the ICS in a timely manner.

[0078] It should be noted that the priority queues corresponding to the aforementioned industrial control devices can be dynamically adjusted. For example, if the security score of an industrial control device in a P1 queue suddenly drops to the danger zone (S<60), the device can be temporarily upgraded to a P0 queue, increasing its data acquisition frequency and analysis priority. It can also monitor server CPU, memory, and network load. When the load is too high, the acquisition or analysis frequency of some industrial control devices in the P1 queue can be temporarily reduced (while still ensuring the P0 queue), preventing system overload and crashes. Furthermore, upon receiving a vulnerability alert regarding a specific device model or protocol, the monitoring level of all related devices can be proactively upgraded (e.g., from the P1 queue to the P0 queue).

[0079] For example, please see Figure 2 , Figure 2This diagram illustrates the overall protocol workflow according to an embodiment of this application. Upon receiving encrypted data, the server verifies and decrypts it. Based on the decrypted data packet, it identifies the device type: if it's a P0 device, it's placed in the P0 queue and immediately allocated resources; if it's a P1 device, it's placed in the P1 queue and awaits batch processing; if it's a P2 or P3 device, it's placed in the P2 queue and processed when idle. During processing, it continuously checks whether dynamic queue adjustments are needed. For example, if the security score is less than 60, the industrial control device's priority is upgraded and moved to a higher priority queue; if the system is overloaded, industrial control devices in the P0 queue can be downgraded to the P1 / P2 queue; if a 0-day warning occurs, the relevant industrial control device can be upgraded to the P0 queue; if none of the above applies, no adjustments are made, and normal processing continues. Finally, the results are output.

[0080] In some embodiments, determining the security assessment index of the industrial control equipment based on its security feature vector and according to a preset security assessment model includes: First, based on the security feature vector of the industrial control equipment, vulnerability score, behavior score and configuration score are determined; In this embodiment, the vulnerability score is used to evaluate vulnerability status, the behavior score is used to evaluate operational behavior, and the configuration score is used to evaluate configuration compliance. The vulnerability score can be determined based on the firmware hash value in the security feature vector, the behavior score can be determined based on the operating parameters of the industrial control equipment, operator activity logs, and system event logs in the security feature vector, and the configuration score can be determined based on the configuration snapshot in the security feature vector.

[0081] In some embodiments, determining the vulnerability score based on the security feature vector of the industrial control equipment includes: First, the firmware hash value is extracted from the security feature vector of the industrial control equipment; In this embodiment, the firmware hash value can be extracted from the corresponding field in the security feature vector. For example, in the example above, the value in the firmware_hash field can be extracted to obtain the firmware hash value.

[0082] Then, based on the firmware hash value, CVE records are matched in the NVD database; In this embodiment, by matching the firmware hash value with the NVD database, all CVE records affected by this firmware version can be found.

[0083] Finally, the vulnerability score is determined based on the CVSS score corresponding to the CVE record.

[0084] In this embodiment, each CVE record comes with a built-in CVSS v3.1 Base Score (0-10), which can be summed across all hit CVEs to obtain the vulnerability risk value. Specifically, the vulnerability risk value V_cve = Σ(CVSS × Exploitability Factor), where the exploitability factor is a coefficient ranging from 0.0 to 1.0, which can be dynamically adjusted based on factors such as whether the vulnerability is publicly exploited, whether there are readily available attack tools, and the degree of network exposure of the device. The exploitability factor for patched CVEs is set to 0; partial patching is discounted by the cause factor (e.g., from 0.8 to 0.4). CVSS in the formula represents the CVSS score corresponding to the CVE record. After calculating the vulnerability risk value, it can be further normalized to obtain the vulnerability score. Specifically, this can be obtained by logarithmically compressing and normalizing V_cve. The normalization formula is: Vulnerability Score = 100 × exp(-V_cve / constant). The constant is determined based on statistical analysis of vulnerability data for typical industrial control equipment in NVD. A single device typically has 3-8 CVE hits, with an average CVSS score of approximately 7.0 and an average exploitability factor of approximately 0.7, corresponding to a typical V_cve range of 14-40. Using a constant of 30, when V_cve = 30, the normalized vulnerability score is approximately 37 (close to the High-level CVE threshold of 40). When V_cve = 0, the normalized vulnerability score is 100. When V_cve = 60, the normalized vulnerability score is approximately 13. This constant can be fine-tuned during deployment based on the specific device type.

[0085] CVE records can be matched in the NVD database using firmware hash values. The accurate vulnerability score can be obtained by summing the CVSS scores corresponding to the CVE records.

[0086] In some embodiments, determining a behavior score based on the safety feature vector of the industrial control equipment includes: First, time-series data and instruction sequence data are extracted from the safety feature vector of the industrial control equipment; In this embodiment, the aforementioned time-series data includes sensor values, operation sequences, etc. The sensor values ​​can be taken from the operating parameters of the industrial control equipment, such as the Modbus TCP acquisition stream (50ms level) of the PLC, corresponding to the Modbus TCP of the original load field in the safety feature vector. The operation sequence can be taken from the Syslog acquisition stream of SCADA, that is, it can be extracted from the system event log, corresponding to the Syslog of the original load field in the safety feature vector. The aforementioned instruction sequence can be taken from the instruction sequence in the SCADA operation log, that is, it can be extracted from the operator activity log, corresponding to the Syslog of the original load field in the safety feature vector.

[0087] Then, the first anomaly analysis model and / or the second anomaly analysis model are used to determine the abnormal data. The first anomaly analysis model is used to calculate the reconstruction error of the time series data and determine the abnormal behavior based on the reconstruction error. The second anomaly analysis model is used to classify the instruction sequence data to obtain the abnormal events. In this embodiment, if time-series data exists, the first anomaly analysis model is used for abnormal behavior analysis; if instruction sequence data exists, the second anomaly analysis model is used for abnormal event analysis; if both time-series data and instruction sequence data exist, the first anomaly analysis model is used for abnormal behavior analysis and the second anomaly analysis model is used for abnormal event analysis.

[0088] The aforementioned first anomaly analysis model can be an LSTM autoencoder, including an encoder LSTM layer and a decoder LSTM layer. During training, historical time-series data under normal operating conditions of industrial control equipment can be used, with the goal of minimizing the MSE between the input sequence and the reconstructed sequence. Specifically, during training, time-series data collected in the initial deployment phase of the industrial control equipment (generally 30 days) can be used, with manually labeled or statistically selected normal operating condition segments for pre-training. An adaptive fine-tuning mechanism can be enabled during operation, incrementally fine-tuning the model every 7 days using the most recent steady-state data to adapt to normal behavioral drift caused by the aging of the industrial control equipment. Data deemed anomalous is excluded from training to avoid contaminating the model.

[0089] When using the first anomaly analysis model, time-series data is input into the model, using a time-series window of length N, x=(x_1,...,x_N), such as N=100 sampling points (50ms sampling corresponds to a 5-second window); the model outputs a reconstructed sequence of equal length, x'=(x'_1,...,x'_N). The reconstruction error is then calculated: err=(1 / N)×Σ(x_i-x'_i)². The reconstruction error sequence for a preset time period (e.g., the most recent hour) is maintained, and the moving average μ and standard deviation σ are calculated. If err>μ+3σ, the behavior at that moment is considered abnormal and recorded as one anomaly event.

[0090] The second anomaly analysis model mentioned above can be an SVM classifier. When analyzing anomaly events, the instruction sequence data can be converted into feature vectors. These feature vectors include: instruction type, execution time, target device, parameter modification range, frequency, etc. The feature vectors are then input into the SVM classifier to obtain the anomaly events. The SVM classifier is used to classify instruction sequences by comparing them with known normal / attack patterns. Events classified as "malicious / misoperation" are recorded as one anomaly event.

[0091] Finally, based on the abnormal data, a behavior score is determined.

[0092] In this embodiment, the aforementioned abnormal data includes the number of abnormal events. The percentage of abnormal events can be determined based on this number. The percentage of abnormal events refers to the proportion of events identified as abnormal by the first and / or second anomaly analysis models within a statistical window (defaulting to the most recent 24 hours) to the total number of events for the industrial control equipment. That is, percentage of abnormal events = number of abnormal events / total number of events. The total number of events can be the count of all observable events detected within the window for the industrial control equipment (for PLC, this is the number of register limit violations + the number of control instruction anomalies; for SCADA, it is the total number of Syslog events). After obtaining the percentage of abnormal events, a behavior score can be calculated: behavior score = 100 × (1 - percentage of abnormal events).

[0093] By employing a first anomaly analysis model and / or a second anomaly analysis model, abnormal data is identified. The first anomaly analysis model is used to calculate the reconstruction error of the time series data and determine the abnormal behavior based on the reconstruction error. The second anomaly analysis model is used to classify the instruction sequence data to obtain abnormal events. Based on the abnormal data, the behavior score can be determined quickly and accurately.

[0094] In some embodiments, determining the configuration score based on the security feature vector of the industrial control equipment includes: First, a configuration snapshot is extracted from the security feature vector of the industrial control equipment; In this embodiment, a configuration snapshot can be extracted from the SNMP / SSH of the original payload field in the security feature vector.

[0095] Then, the configuration snapshot is compared with the IEC 62443 standard baseline to obtain the compliance check pass rate; In this embodiment, the IEC 62443 standard baseline (213 inspection rules) can be loaded, and the configuration snapshot of the industrial control equipment can be automatically compared with these rules to detect and record all configuration deviations. Each rule is defined as a four-tuple of {inspection object, inspection field, expected value, comparison method}, and the corresponding field is automatically compared from the configuration snapshot of the industrial control equipment. The compliance inspection pass rate = number of passed rules / total number of rules × 100%.

[0096] Finally, a configuration score is obtained based on the compliance check pass rate.

[0097] In this embodiment, the configuration score is equal to the compliance check pass rate, and the configuration score ranges from 0 to 100.

[0098] By comparing the configuration snapshot with the IEC 62443 standard baseline, the compliance check pass rate is obtained. Based on the compliance check pass rate, the configuration score can be obtained quickly and accurately.

[0099] Second, the vulnerability score, the behavior score, and the configuration score are weighted and summed to obtain the security assessment index of the industrial control equipment.

[0100] In this embodiment, the vulnerability score, behavior score, and configuration score can be weighted and summed to obtain the security assessment index. When performing the weighted summation, the weights of each item can be preset based on experience or set according to the specific situation of the industrial control equipment.

[0101] It should be noted that the three sub-scores (vulnerability score, behavior score, and configuration score) are updated at different frequencies (for example, vulnerability score and configuration score are updated daily; behavior score is updated every second / minute). The security assessment metrics are recalculated and synthesized each time a sub-score is updated; sub-scores that have not been updated use the results from the previous iteration.

[0102] Each industrial control device independently generates a comprehensive safety score S (0-100). The final output can show a list of scores for all equipment in the entire wind farm, supporting horizontal comparisons. Score update frequency: P0 near real-time, P1 minute-level, P2 / P3 during idle periods.

[0103] In some embodiments, the step of weighted summing of the vulnerability score, the behavior score, and the configuration score to obtain the security assessment index of the industrial control equipment includes: First, based on the operational years of the industrial control equipment, the vulnerability weights are determined; In this embodiment, the vulnerability weight α can be determined by the operating years of the industrial control equipment. For example, α = clip(0.6 - 0.05 × operating years, 0.1, 0.6), so that α dynamically takes a value between 0.1 and 0.6 when the operating years change, in order to reasonably adjust the vulnerability weight of older equipment. The above 0.6 and 0.1 represent the clamping of the upper and lower limits, respectively, and can be determined according to the actual situation.

[0104] Then, based on the frequency of attacks on the industrial control equipment, the behavior weights are determined; In this embodiment, the behavior weight β can be determined by the number of attacks in the past 24 hours, i.e., the attack frequency is the number of attacks in the past 24 hours. Specifically, β = clip(0.25 + 0.1 × number of attacks in the past 24 hours, 0.25, 0.7), so that the behavior weight in a high-threat environment is increased accordingly. The above 0.7 and 0.25 represent the upper and lower limits of the clamping, which can be determined according to the actual situation.

[0105] Then, obtain the configuration weights; In this embodiment, the value of the configuration weight γ can be set according to the actual situation, for example, it can be set to 0.15.

[0106] Finally, based on the vulnerability weight, the behavior weight, and the configuration weight, the vulnerability score, the behavior score, and the configuration score are weighted and summed to obtain the security evaluation index of the industrial control equipment.

[0107] In this embodiment, the sum of the baseline values ​​of α, β, and γ is not necessarily equal to 1. In actual calculations, they are normalized proportionally, i.e., α' = α / (α + β + γ), and β' and γ' are calculated similarly. This ensures that the normalized weights satisfy α' + β' + γ' = 1. The clamping of upper and lower limits avoids weight imbalances caused by extreme situations. For example, if the operating period is 12 years, without clamping, α = 0, causing the vulnerability dimension's weight to completely disappear. After clamping, α retains a lower limit of 0.1. If the number of attacks in the last 24 hours is 10, without clamping, β = 1.25. After clamping, β is limited to 0.7, preventing β from becoming too large and compressing γ to near 0, thus rendering the configuration compliance dimension meaningless. The baseline value of γ is 0.15. After normalization, the actual configuration compliance weight γ' will fluctuate between 0.08 and 0.60 depending on the changes in α and β, but always maintains a non-zero weight, thereby ensuring that the configuration compliance dimension always participates in the scoring. The final security assessment metric S = α'·vulnerability score + β'·behavioral score + γ'·configuration score.

[0108] For example, a new PLC device (low α) may still have a few unpatched medium-risk vulnerabilities if its current operation is completely normal and its configuration is compliant, and its security assessment metric S may still be within the safe range. Conversely, an old PLC device (high α) may have few vulnerabilities, but if its behavior becomes abnormal, its security assessment metric S will drop rapidly and trigger an alarm.

[0109] By determining vulnerability weights based on the operational lifespan of industrial control equipment and behavioral weights based on the frequency of attacks on the equipment, it is possible to ensure that security assessment indicators dynamically reflect the most pressing threats faced by the equipment, making the security assessment indicators more reliable.

[0110] By using the security feature vector of the industrial control equipment, vulnerability score, behavior score, and configuration score are determined. Then, the vulnerability score, behavior score, and configuration score are weighted and summed to conduct security assessment in three dimensions: vulnerability risk, abnormal behavior, and configuration compliance. This makes the security assessment indicators more accurate in quantifying the security of the industrial control equipment.

[0111] After obtaining the security assessment indicators, these indicators can be transformed into automated response actions based on service levels, and the execution results can be fed back to the upstream of the system to form a closed-loop control for security management.

[0112] It can also automatically respond based on safety assessment indicators. For example, based on the range in which the safety assessment indicator S falls, the risk level of industrial control equipment can be divided into three levels: safe, concerning / low risk, and high risk, and differentiated response actions and notification methods can be implemented for each level.

[0113] For example, when S≥80, it is judged as a safe level. At this time, only detailed security logs are recorded, including the comprehensive score, scores of each dimension, weights and analysis indicators, and no alarms are generated. When 60≤S<80, it is judged as a concern / low-risk level. A yellow alarm is automatically sent while logging. The alarm information includes the industrial control device ID, security assessment indicator S, main risk dimensions and recommended inspection items. No blocking operation is performed under this level, but manual verification is required. The notification method can be pushed to the SOC / OMC and the relevant person in charge through the work order system, email or APP. When S<60, it is judged as a high-risk level. A red alarm is triggered while logging, and the network port of the industrial control device is immediately isolated, blocking all communication except the management channel. If the sudden drop in score is related to the most recent firmware update, a firmware rollback operation is further triggered, and a red alarm notification will be sent to all operation and maintenance and security personnel.

[0114] When the isolation operation is successful, maintain the upgraded service quality level for the device, such as maintaining the P0 level, and continuously monitor subsequent changes in its security assessment indicators. If the security assessment indicators rise back to above 60, the isolation is lifted and the service quality level is restored to the original level. When the isolation operation fails, further escalate the alarm level and notify manual intervention. At the same time, attempt to disconnect the external network connection of the network segment where the device is located as a fallback blocking measure.

[0115] When a firmware rollback operation is performed successfully, the safety assessment indicators of the industrial control equipment should rise accordingly, and the normal scheduling strategy should be restored. When a firmware rollback operation is performed but fails, or the industrial control equipment does not support firmware rollback, the scheduler maintains the current isolation state and triggers a red alarm, requiring manual replacement of the equipment or offline maintenance.

[0116] The results of all response actions, including success or failure status, execution time, and scope of impact, are recorded in the audit log for post-event traceability and model optimization.

[0117] In the above implementation process, raw data is acquired in real time, including the operating parameters of the industrial control equipment, operator activity logs, system event logs, firmware hash values, and configuration snapshots. Based on the raw data, a security feature vector of the industrial control equipment is generated. Based on the security feature vector of the industrial control equipment, a security assessment index of the industrial control equipment is determined according to a preset security assessment model. By uniformly transforming raw data from different protocols into structured security feature vectors containing rich contextual information, and then using the security assessment model, the security assessment of industrial control equipment can be performed automatically, efficiently, and in real time, without relying on manual intervention. This improves assessment efficiency and meets the needs of large-scale asset security management, thereby enhancing the accuracy, real-time performance, and intelligence level of wind power industrial control asset security assessment.

[0118] The above method is applicable to industrial control equipment in onshore / offshore wind farms, especially suitable for high wind speed areas and older turbines. In practice, an edge agent can be deployed to the wind farm's safety zone 3, configured with protocol conversion rules and dynamic sampling parameters, and connected to the MCP server for real-time evaluation.

[0119] For example, real-time data acquisition and safety scoring of PLC devices based on the Modbus TCP protocol includes the following steps: 1. Use the Modbus TCP protocol to poll the core registers (such as speed, pitch angle, temperature, etc.) of the wind turbine PLC at 50ms intervals. The data proxy layer is configured with a protocol conversion module to parse the raw register values ​​into MCP-WindSec format, adding security tags and environmental factors. The dynamic sampling algorithm adjusts the sampling interval based on the pitch angle volatility: volatility > 15%, sampling interval 10ms; volatility < 5%, sampling interval 1s.

[0120] 2. By comparing firmware hashes with the NVD database, 3 CVEs were found. A normal operating sequence was trained based on an LSTM autoencoder, and reconstruction errors were detected in real time (threshold = μ + 3σ). The 213 rules of the IEC 62443 standard baseline were loaded, and PLC configuration snapshots were checked.

[0121] 3. Score generation: Vulnerability score: 3 unpatched CVEs were hit: CVE-2023-1234 (CVSS=9.0), CVE-2023-5678 (CVSS=8.0), and CVE-2024-0011 (CVSS=7.0), with an exploitability factor of 0.8 for each. V_cve = (9.0 + 8.0 + 7.0) × 0.8 = 19.2; Vulnerability score = 100 × exp(-19.2 / 30) ≈ 52.7; Behavioral score: 25% of abnormal events were detected, so the behavioral score is 100 × (1 - 0.25) = 75. Configuration score: 8 low-risk configuration deviations were found, pass rate = 205 / 213 ≈ 96.2%, configuration score ≈ 96.2; Operating life = 10 years, α = clip(0.6-0.5, 0.1, 0.6) = 0.1; attack frequency = 5 times / day, β = clip(0.25+0.5, 0.25, 0.7) = 0.7; γ baseline = 0.15; α+β+γ = 0.1+0.7+0.15 = 0.95, normalized: α' = 0.105, β' = 0.737, γ' = 0.158, S = 0.105×52.7+0.737×75+0.158×96.2≈5.53+55.28+15.20≈76.01.

[0122] S≈76.01, which falls within the 60≤S<80 concern range, triggering a yellow alarm. An alarm is sent to the SOC / OMC and the responsible person. No blocking is implemented; manual verification is required.

[0123] If the score further drops to S<60 (e.g., if the vulnerability is not patched in time and the behavior worsens abnormally), the switch API is invoked to isolate the PLC network port and trigger a firmware rollback to version v2.1.0. The execution result is fed back to the scheduler. If the isolation is successful, the QoS upgrade is maintained until the score recovers. If it fails, an alarm is upgraded and manual intervention is required.

[0124] In some embodiments, it also includes: First, obtain the safety assessment indicators of adjacent industrial control equipment; In this embodiment, the safety assessment indicators of the adjacent industrial control equipment can be obtained through the above steps, and will not be repeated here.

[0125] Then, based on the safety assessment indicators of the industrial control equipment and the safety assessment indicators of the adjacent industrial control equipment, the associated risk indicators of the industrial control equipment are determined.

[0126] In this embodiment, the associated risk index of industrial control equipment can be a network-level risk supplementary index. The calculation method is as follows: the associated risk value of industrial control equipment i is equal to the sum of the risk value of the equipment itself and the propagation risk from neighboring equipment, that is, the associated risk value of industrial control equipment i = the risk value of industrial control equipment i itself + the propagation coefficient × Σ(the risk value of neighboring equipment j / the number of network hops (or logical dependency distance)).

[0127] Wherein: the risk value of industrial control equipment i itself can be obtained by converting the safety assessment index S_i of industrial control equipment i, specifically, the risk value of industrial control equipment i itself R_i = 100 - S_i. The risk value of adjacent industrial control equipment j is converted in the same way, i.e., R_j = 100 - S_j.

[0128] Network hop count or logical dependency distance can be derived from the network topology configuration table. Network hop count is 1 hop for a direct physical connection and 2 hops for an indirect connection via a switch; logical dependency distance is calculated based on the distance in the dependency graph for strong business logic dependencies.

[0129] The propagation coefficient is a configurable parameter between 0 and 1, set based on the effectiveness of network isolation measures. For strong isolation measures such as industrial firewalls, the propagation coefficient can be configured to 0.1 to 0.3; for weak isolation measures such as VLAN segmentation, the propagation coefficient can be configured to 0.5 to 0.7; and for scenarios without isolation, the propagation coefficient can be configured to 0.8 to 1.0.

[0130] Based on the magnitude of the associated risk indicators of industrial control equipment, different risk levels can be classified and corresponding measures can be taken: when the associated risk indicator is less than 30, it is judged as low network propagation risk, and only log recording is performed; when the associated risk indicator is greater than or equal to 30 and less than 60, it is judged as medium propagation risk, and the data collection and processing priority of the industrial control equipment is temporarily increased, for example, the QoS level is increased from P1 to P0 to increase the data collection frequency and analysis priority; when the associated risk indicator is greater than or equal to 60, it is judged as high propagation risk, and the alarm level is upgraded from yellow to red in the response phase, and the operation and maintenance personnel are notified to check the security status of adjacent devices in the network topology. The above thresholds of 30 / 60 can be determined according to the typical network scale of the wind farm (a single device is usually associated with 5-15 adjacent devices) and the network isolation strength, and can be adjusted according to the actual network topology during deployment.

[0131] By determining the associated risk indicators of the industrial control equipment (ICS) based on its security assessment indicators and those of adjacent ICS, the network-level risks of the ICS can be further assessed. This overcomes the limitation of single-device assessment in reflecting network-level risks, achieving a two-layer risk assessment combining device-level assessment and network-level propagation.

[0132] This embodiment provides a safety assessment system for wind power industrial control equipment, including an edge agent and a server. The edge agent is used to acquire raw data in real time; based on the raw data, it generates a security feature vector of the industrial control equipment and sends the security feature vector of the industrial control equipment to the server. The server is used to determine the security assessment index of the industrial control equipment based on the security feature vector of the industrial control equipment and according to a preset security assessment model.

[0133] In this embodiment, the edge proxy can be an edge server, and the server can be an MCP server. The transmission between the edge proxy and the server can employ redundant transmission. The primary transmission channel typically uses high-reliability industrial Ethernet, while the backup channel uses LoRa or other low-power wide-area network (LPWAN) technologies. Although these technologies have lower bandwidth and higher latency, they offer advantages such as longer coverage distance, stronger penetration, and lower power consumption, ensuring the transmission capability of critical security data and alarm information can be maintained even under the most severe network conditions (such as when the backbone fiber is severed), meeting basic security monitoring requirements. When a primary channel failure is detected (such as link interruption or excessively high latency) or continuous packet loss, the proxy layer automatically switches to the backup transmission channel.

[0134] To ensure high security (confidentiality, integrity, and authentication) of data transmission from the edge agent to the server, and to intelligently allocate resources (network bandwidth, computing resources) based on device criticality and system status to optimize overall efficiency and ensure the continuity of core business, encrypted transmission can be implemented. Specifically, an encrypted tunnel can be established using TLS 1.3 + AEAD_CHACHA20. When the edge agent starts up and establishes a connection with the server, a strengthened TLS 1.3 handshake protocol is first executed. The handshake process strictly verifies the server certificate (issued by a private or trusted CA) to ensure that the connection is to a legitimate server and prevent man-in-the-middle attacks. The high-performance and secure AEAD_CHACHA20_POLY1305 cipher suite is negotiated. While ensuring strong encryption, integrity, and authentication, this suite offers significant performance advantages over traditional AES-GCM on some hardware platforms (especially resource-constrained edge devices), making it more suitable for industrial environments. The security feature vector of the industrial control equipment is transmitted as a data packet, and the data packet is appended with an ECDSA-P256 digital signature (the private key can be stored in the HSM hardware module). Before each encapsulated data packet is sent, an ECDSA-based digital signature can be attached. This signature uses a private key stored in the HSM (Hardware Security Module) and bound to the agent's identity to sign the core content of the data packet (or the security tag portion of the entire packet).

[0135] Please refer to Figure 3 , Figure 3The diagram illustrates the core workflow according to an embodiment of this application. The core workflow of the entire system includes five levels: real-time acquisition of multi-source data, secure data transmission and scheduling, multi-dimensional security analysis, security score generation, and response and feedback. In the real-time acquisition of multi-source data, the system acquires data from the wind turbine PLC via the Modbus TCP protocol, obtains 20 frames of operation logs from the SCADA system via the Syslog protocol, and acquires firmware hash values ​​and configuration snapshots of industrial control equipment. The acquired data undergoes protocol conversion by the data proxy layer (edge ​​proxy), including MCP-WindSec encapsulation (device fingerprint, environmental factors, and security tags). The data proxy layer can also control dynamic sampling through an adaptive sliding window algorithm. The data proxy layer can also employ a redundant transmission strategy, using industrial Ethernet as the primary channel and LoRa wireless as the backup channel, to transmit the acquired data to the MCP server. Subsequently, during the secure data transmission and scheduling phase, the MCP server is configured for encrypted transmission (using TLS 1.3+AEAD_CHACHA20 and ECDSA-P256 digital signatures stored in HSM hardware). The MCP server schedules data according to a four-level dynamic scheduling policy. The four-level dynamic scheduling policy includes four levels: P0 corresponds to core controls such as PLCs, with an update frequency of seconds or real-time; P1 corresponds to HMIs and SCADA servers, with an update frequency of minutes; P2 corresponds to network devices and gateways, with an update frequency of 10 minutes; and P3 corresponds to other auxiliary devices, with an update frequency of hours. After entering the multi-dimensional security analysis phase, the system operates along three parallel routes: static analysis, which involves vulnerability matching via NVD database queries and rule base compliance testing based on the IEC 62443 standard baseline. Vulnerability matching can be performed by first calculating the vulnerability risk value V_cve using V_cve = Σ(CVSS × Exploitability Factor), and then calculating the vulnerability score using the vulnerability score normalization formula: 100 × exp(-V_cve / 30). Dynamic analysis includes behavioral baseline modeling and instruction chain analysis. Correlation analysis is responsible for risk propagation calculations. Based on this, the security score generation phase uses the formula S = α·Vulnerability Score + β·Behavioral Score + γ·Configuration Score to derive the system's total security score. The coefficient α is affected by the system's operational years: α = clip(0.6 - 0.05 × operational years, 0.1, 0.6); β is affected by the number of attacks: β = clip(0.25 + 0.1 × number of attacks in the last 24 hours, 0.25, 0.7); and γ is based on a baseline value of 0.15. Finally, during the response and feedback phase, an automatic response mechanism is activated based on the scoring results: when S≥80, it is determined to be at a safe level, and only detailed security logs are recorded; when 60≤S<80, it is determined to be at a concern / low-risk level, triggering a yellow alarm and notifying the SOC / OMC and the person in charge; when S<60, it is determined to be at a high-risk level, triggering a red alarm and performing emergency handling operations such as isolating the port and rolling back the firmware.

[0136] This invention provides a machine-readable storage medium storing a program that, when executed by a processor, implements the safety assessment method for wind power industrial control equipment.

[0137] This invention provides a processor for running a program, wherein the program executes the wind power industrial control equipment safety assessment method during runtime.

[0138] This application provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the at least one processor implements the aforementioned wind power industrial control equipment safety assessment method by executing the instructions stored in the memory. When the processor executes the instructions, it performs the following steps: Real-time acquisition of raw data, including operating parameters of industrial control equipment, operator activity logs, system event logs, firmware hash values, and configuration snapshots; Based on the original data, a safety feature vector of the industrial control equipment is generated; Based on the safety feature vector of the industrial control equipment, the safety assessment index of the industrial control equipment is determined according to the preset safety assessment model.

[0139] In one embodiment, generating the security feature vector of the industrial control equipment based on the original data includes: Extract field information from the original data; Based on the WindSec format, the field information is encapsulated to obtain the security feature vector of the industrial control equipment.

[0140] In one embodiment, the real-time acquisition of raw data includes: Real-time acquisition of sampling parameter fluctuation information within a preset time window; Based on the fluctuation information of the sampling parameters, the sampling interval is adjusted to obtain a new sampling interval; Raw data is acquired in real time from the industrial control environment of the wind farm according to the new sampling interval.

[0141] In one embodiment, determining the security assessment index of the industrial control equipment based on its security feature vector and according to a preset security assessment model includes: Based on the security feature vector of the industrial control equipment, the service level of the industrial control equipment is determined according to a preset equipment classification strategy; Based on the service level of the industrial control equipment, a corresponding priority queue is obtained; The industrial control device is added to the corresponding priority queue, and when the corresponding priority queue reaches the industrial control device, the security assessment index of the industrial control device is determined according to the preset security assessment model based on the security feature vector of the industrial control device.

[0142] In one embodiment, determining the security assessment index of the industrial control equipment based on its security feature vector and according to a preset security assessment model includes: Based on the security feature vector of the industrial control equipment, vulnerability score, behavior score and configuration score are determined. The security assessment index of the industrial control equipment is obtained by weighted summation of the vulnerability score, the behavior score, and the configuration score.

[0143] In one embodiment, determining the vulnerability score based on the security feature vector of the industrial control equipment includes: Extract the firmware hash value from the security feature vector of the industrial control equipment; Based on the firmware hash value, CVE records are matched in the NVD database; The vulnerability score is determined based on the CVSS score corresponding to the CVE record.

[0144] In one embodiment, determining a behavior score based on the safety feature vector of the industrial control equipment includes: Time-series data and instruction sequence data are extracted from the safety feature vector of the industrial control equipment; Anomaly analysis is performed using a first anomaly analysis model and / or a second anomaly analysis model to identify anomalous data. The first anomaly analysis model is used to calculate the reconstruction error of the time series data and determine the anomalous behavior based on the reconstruction error. The second anomaly analysis model is used to classify the instruction sequence data to obtain anomalous events. Based on the abnormal data, a behavior score is determined.

[0145] In one embodiment, determining the configuration score based on the security feature vector of the industrial control equipment includes: Extract the configuration snapshot from the security feature vector of the industrial control equipment; The compliance check pass rate is obtained by comparing the configuration snapshot with the IEC 62443 standard baseline. The configuration score is obtained based on the compliance check pass rate.

[0146] In one embodiment, the step of weighted summing of the vulnerability score, the behavior score, and the configuration score to obtain the security assessment index of the industrial control equipment includes: Based on the operational years of the industrial control equipment, the vulnerability weights were determined; Based on the frequency of attacks on the industrial control equipment, the behavior weights are determined; Obtain configuration weights; Based on the vulnerability weight, the behavior weight, and the configuration weight, the vulnerability score, the behavior score, and the configuration score are weighted and summed to obtain the security assessment index of the industrial control equipment.

[0147] In one embodiment, it also includes: Obtain safety assessment indicators for adjacent industrial control equipment; Based on the safety assessment indicators of the industrial control equipment and the safety assessment indicators of the adjacent industrial control equipment, the associated risk indicators of the industrial control equipment are determined.

[0148] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0149] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0150] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0151] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0152] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0153] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0154] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0155] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0156] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A safety assessment method for wind power industrial control equipment, characterized in that, include: Real-time acquisition of raw data, including operating parameters of industrial control equipment, operator activity logs, system event logs, firmware hash values, and configuration snapshots; Based on the original data, a safety feature vector of the industrial control equipment is generated; Based on the safety feature vector of the industrial control equipment, the safety assessment index of the industrial control equipment is determined according to the preset safety assessment model.

2. The safety assessment method for wind power industrial control equipment according to claim 1, characterized in that, The step of generating the security feature vector of the industrial control equipment based on the original data includes: Extract field information from the original data; Based on the WindSec format, the field information is encapsulated to obtain the security feature vector of the industrial control equipment.

3. The safety assessment method for wind power industrial control equipment according to claim 1, characterized in that, The real-time acquisition of raw data includes: Real-time acquisition of sampling parameter fluctuation information within a preset time window; Based on the fluctuation information of the sampling parameters, the sampling interval is adjusted to obtain a new sampling interval; Raw data is acquired in real time from the industrial control environment of the wind farm according to the new sampling interval.

4. The safety assessment method for wind power industrial control equipment according to claim 1, characterized in that, The process of determining the security assessment indicators of the industrial control equipment based on its security feature vector and according to a preset security assessment model includes: Based on the security feature vector of the industrial control equipment, the service level of the industrial control equipment is determined according to a preset equipment classification strategy; Based on the service level of the industrial control equipment, a corresponding priority queue is obtained; The industrial control device is added to the corresponding priority queue, and when the corresponding priority queue reaches the industrial control device, the security assessment index of the industrial control device is determined according to the preset security assessment model based on the security feature vector of the industrial control device.

5. The safety assessment method for wind power industrial control equipment according to claim 1, characterized in that, The process of determining the security assessment indicators of the industrial control equipment based on its security feature vector and according to a preset security assessment model includes: Based on the security feature vector of the industrial control equipment, vulnerability score, behavior score and configuration score are determined. The security assessment index of the industrial control equipment is obtained by weighted summation of the vulnerability score, the behavior score, and the configuration score.

6. The safety assessment method for wind power industrial control equipment according to claim 5, characterized in that, Based on the security feature vector of the industrial control equipment, vulnerability scores are determined, including: Extract the firmware hash value from the security feature vector of the industrial control equipment; Based on the firmware hash value, CVE records are matched in the NVD database; The vulnerability score is determined based on the CVSS score corresponding to the CVE record.

7. The safety assessment method for wind power industrial control equipment according to claim 5, characterized in that, Based on the safety feature vector of the industrial control equipment, a behavior score is determined, including: Time-series data and instruction sequence data are extracted from the safety feature vector of the industrial control equipment; Anomaly analysis is performed using a first anomaly analysis model and / or a second anomaly analysis model to identify anomalous data. The first anomaly analysis model is used to calculate the reconstruction error of the time series data and determine the anomalous behavior based on the reconstruction error. The second anomaly analysis model is used to classify the instruction sequence data to obtain anomalous events. Based on the abnormal data, a behavior score is determined.

8. The safety assessment method for wind power industrial control equipment according to claim 5, characterized in that, Based on the security feature vector of the industrial control equipment, a configuration score is determined, including: Extract the configuration snapshot from the security feature vector of the industrial control equipment; The compliance check pass rate is obtained by comparing the configuration snapshot with the IEC 62443 standard baseline. The configuration score is obtained based on the compliance check pass rate.

9. The safety assessment method for wind power industrial control equipment according to claim 5, characterized in that, The step of weighted summing of the vulnerability score, the behavior score, and the configuration score to obtain the security assessment index of the industrial control equipment includes: Based on the operational years of the industrial control equipment, the vulnerability weights were determined; Based on the frequency of attacks on the industrial control equipment, the behavior weights are determined; Obtain configuration weights; Based on the vulnerability weight, the behavior weight, and the configuration weight, the vulnerability score, the behavior score, and the configuration score are weighted and summed to obtain the security assessment index of the industrial control equipment.

10. The safety assessment method for wind power industrial control equipment according to claim 1, characterized in that, Also includes: Obtain safety assessment indicators for adjacent industrial control equipment; Based on the safety assessment indicators of the industrial control equipment and the safety assessment indicators of the adjacent industrial control equipment, the associated risk indicators of the industrial control equipment are determined.

11. A safety assessment system for wind power industrial control equipment, characterized in that, This includes both edge proxy and server-side components. The edge agent is used to acquire raw data in real time, including the operating parameters of the industrial control equipment, operator activity logs, system event logs, firmware hash values, and configuration snapshots; based on the raw data, a security feature vector of the industrial control equipment is generated, and the security feature vector of the industrial control equipment is sent to the server. The server is used to determine the security assessment index of the industrial control equipment based on the security feature vector of the industrial control equipment and according to a preset security assessment model.

12. An electronic device, characterized in that, The electronic device includes: At least one processor; A memory connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor implements the wind power industrial control equipment safety assessment method according to any one of claims 1 to 10 by executing the instructions stored in the memory.

13. A machine-readable storage medium storing instructions thereon, characterized in that, When executed by a processor, this instruction causes the processor to be configured to perform the wind power industrial control equipment safety assessment method according to any one of claims 1 to 10.

Images