A water conservancy network safety monitoring method and system based on big data

Abstract

The application provides a water conservancy network security monitoring method and system based on big data, relates to the technical field of water conservancy network security, and solves the technical problems that in the existing water conservancy network security monitoring, a static baseline is difficult to adapt to working condition changes, business impact evaluation lacks asset and business correlation analysis, and the monitoring result is inaccurate. The method comprises the following steps: acquiring multi-source security data in a water conservancy network, and constructing a water conservancy business dynamic knowledge graph; performing spatio-temporal correlation analysis based on the knowledge graph to generate behavior sequence features; determining a dynamic behavior baseline and determining an abnormal confidence according to the deviation of real-time behavior data from the baseline; acquiring asset vulnerability parameters and business criticality parameters, and determining a business impact evaluation value in combination with the abnormal confidence; and generating a security monitoring result according to the business impact evaluation value. The application is used in the process of water conservancy engineering network security monitoring and situation awareness.

Description

Technical Field

[0001] This application relates to the field of water conservancy network security, and in particular to a water conservancy network security monitoring method and system based on big data. Background Technology

[0002] With the deepening of water conservancy informatization and intelligentization, the scale of water conservancy networks is constantly expanding, and the number of monitoring devices, control devices, and business systems connected is increasing, leading to a continuous expansion of the network security threat surface. Currently, water conservancy network security monitoring mainly adopts anomaly detection methods based on rule matching and static thresholds. This involves deploying firewalls, intrusion detection systems, and other devices at the network boundary to collect and analyze network traffic and operation logs. However, existing technologies have the following shortcomings: First, the operating status of water conservancy networks changes dynamically with hydrological conditions (such as flood season and drought season), and the behavior patterns of devices differ significantly under different operating conditions. Using a fixed baseline for anomaly judgment results in a high false alarm rate. Second, existing methods lack systematic modeling of the relationship between asset nodes and business function nodes, making it difficult to accurately assess the impact of a single asset anomaly on the overall business function. Third, the spatiotemporal correlation analysis of multi-source security data is insufficient, making it difficult to effectively identify covert attack behaviors from a time-series perspective.

[0003] Therefore, there is an urgent need for a water conservancy network safety monitoring method that can adapt to dynamic changes in water conservancy conditions and integrate asset and business correlation analysis. Summary of the Invention

[0004] This application provides a water conservancy network security monitoring method and system based on big data, which solves the technical problems of existing water conservancy network security monitoring that use static baselines, which are difficult to adapt to changes in operating conditions and lack asset and business correlation analysis, resulting in inaccurate monitoring results.

[0005] To achieve the above objectives, this application adopts the following technical solution: Firstly, a big data-based method for monitoring the safety of water conservancy networks is provided, including: Acquire multi-source security data from multiple monitoring nodes in the water conservancy network, and construct a dynamic knowledge graph of water conservancy business. The entities in the dynamic knowledge graph of water conservancy business include asset nodes and business function nodes, and the relationships include data flow edges. Based on the dynamic knowledge graph of water conservancy business, spatiotemporal correlation analysis is performed on the multi-source security data to generate behavioral sequence features of each asset node in the time dimension. The dynamic behavior baseline of each asset node is determined based on the behavioral sequence characteristics, and the anomaly confidence level of each asset node is determined based on the degree of deviation between the real-time behavior data of each asset node and the corresponding dynamic behavior baseline. Obtain the asset vulnerability parameters of each asset node and the business criticality parameters of each business function node, and determine the business impact assessment value of each business function node in combination with the anomaly confidence level. The water conservancy network safety monitoring results are generated based on the business impact assessment values ​​of each business function node.

[0006] Based on the above technical solutions, this application provides a big data-based water conservancy network security monitoring method. By constructing a dynamic knowledge graph of water conservancy business, the method structurally models the relationships between asset nodes, business function nodes, and data flows, enabling deep integration of multi-source security data with water conservancy business logic. This effectively solves the problem of security monitoring being detached from the business context in existing technologies. Spatiotemporal correlation analysis based on the knowledge graph generates behavioral sequence features of each asset node, and dynamic behavioral baselines are established in conjunction with water conservancy operating conditions (including flood season, drought season, normal operation, and transitional operation). Weighted interpolation processing under transitional conditions smooths baseline switching, enabling anomaly detection to adapt to changes in operating conditions and significantly reducing the false alarm rate caused by traditional static baselines. Furthermore, the method integrates the anomaly confidence of asset nodes with vulnerability parameters and the criticality parameters of business function nodes, and introduces the credibility of data flow side transmission to participate in the quantitative calculation of business impact assessment values. This achieves a complete assessment link from asset anomalies to business impact, and the assessment results are more consistent with the actual operational risks of the water conservancy network. Finally, security monitoring results are generated based on the business impact assessment values, providing operation and maintenance personnel with a basis for risk ranking and handling, thus improving the proactive defense capability and situational awareness level of water conservancy project network security.

[0007] In conjunction with the first aspect above, in one possible implementation, the steps for constructing the dynamic knowledge graph of water conservancy operations include: Determine each asset node and the physical connection relationship between each asset node based on the topology of the water conservancy network; Based on the division of water conservancy business functions, business function nodes are determined, and each business function node is associated with the asset nodes involved in performing that business function. The data flow edges are determined based on the transmission path of the data flow between each asset node and the business function node, and each data flow edge is assigned a data transmission direction attribute and a data interaction frequency attribute. The data interaction frequency attribute of the data flow edge is dynamically updated based on changes in water conservancy conditions.

[0008] In conjunction with the first aspect above, in one possible implementation, the step of the dynamic knowledge graph of water conservancy operations performing correlation analysis on the multi-source security data includes: Using the data flow edge as an index, the multi-source security data are grouped and merged according to their respective data flow edges; For each group of merged security data, extract the sequence of behavioral events of each asset node within a preset time window according to the time series. Based on the time intervals between adjacent behavioral events and the event type transition relationships in the behavioral event sequence, a time-series behavioral transition matrix is ​​constructed for each asset node.

[0009] In conjunction with the first aspect above, in one possible implementation, the duration of the preset time window is dynamically determined based on the business function type corresponding to each asset node. Specifically, the preset time window for asset nodes involving gate control functions is shorter than the preset time window for asset nodes involving hydrological data acquisition functions.

[0010] In conjunction with the first aspect above, in one possible implementation, the step of determining the dynamic behavior baseline of each asset node includes: The temporal behavior transition matrix of each asset node is classified according to the water conservancy working condition, and a baseline behavior transition matrix corresponding to each water conservancy working condition is generated. Using the current water conservancy working condition as an index, the corresponding baseline behavior transition matrix is ​​selected as the dynamic behavior baseline of the asset node under the current working condition; The water conservancy operating conditions include at least the flood season condition, the drought season condition, and the normal operation condition.

[0011] In conjunction with the first aspect above, in one possible implementation, the step of determining the anomaly confidence level of each asset node includes: Construct a real-time behavior transfer matrix for each asset node based on real-time behavior data; The differences between the real-time behavior transition matrix of each asset node and the corresponding elements in the benchmark behavior transition matrix are weighted and accumulated. The weights are determined based on the business importance of the data flow edge associated with the corresponding position. The accumulated result is normalized and used as the anomaly confidence of each asset node.

[0012] In conjunction with the first aspect above, in one possible implementation, obtaining the asset vulnerability parameters of each asset node and the business criticality parameters of each business function node includes: The asset vulnerability parameter is determined based on the device type, solid-state version information, known vulnerability information, and historical attack records of the asset node; the business criticality parameter is determined based on the importance of the water conservancy business corresponding to the business function node in the safe operation of the water conservancy project.

[0013] In conjunction with the first aspect above, in one possible implementation, the step of determining the business impact assessment value of each business function node includes: The set of asset nodes on which each business function node depends is determined based on the aforementioned dynamic knowledge graph of water conservancy business. The abnormal confidence level of each asset node in the asset node set is fused with the corresponding asset vulnerability parameter to determine the risk transmission intensity of each asset node; The business impact assessment value of each business function node is determined based on the risk transmission intensity of each asset node and the business criticality parameters of the corresponding business function nodes. Among them, the business impact value of each business function node It is calculated using the following formula: ; Where b is the sequence number of the business function node. For business function node b, this is the business importance parameter. Let c be the set of asset nodes that business function node b depends on, and c be the sequence number of the asset node. This is the normalization coefficient for the historical attack frequency of asset node c, obtained by normalizing the historical attack event frequencies of this asset node. The degree of anomaly of asset node c. For the vulnerability parameter of asset node c; The reliability of the data flow edge from asset node c to business function node b is determined based on the historical data transmission success rate.

[0014] In conjunction with the first aspect above, in one possible implementation, the water conservancy operating condition state further includes: a transitional operating state. When the water conservancy project switches from one operating condition state to another, the transitional benchmark behavior transfer matrix corresponding to the transitional operating state is used as the dynamic behavior baseline. The transitional benchmark behavior transfer matrix is ​​obtained by weighted interpolation of the benchmark behavior transfer matrix corresponding to the operating condition state before the switch and the benchmark behavior transfer matrix corresponding to the operating condition state after the switch. The weighting coefficient is determined according to the switching progress.

[0015] Secondly, this application provides a water conservancy network security monitoring system based on big data, including: a data acquisition module, a knowledge graph construction module, and a security analysis module; wherein, the data acquisition module is used to acquire multi-source security data from multiple monitoring nodes in the water conservancy network; the knowledge graph construction module is used to construct a dynamic knowledge graph of water conservancy business based on the multi-source security data; the security analysis module is used to perform spatiotemporal correlation analysis on the multi-source security data based on the dynamic knowledge graph of water conservancy business, determine the dynamic behavior baseline and anomaly confidence level of each asset node, and determine the business impact assessment value of each business function node in combination with asset vulnerability parameters and business criticality parameters, thereby generating water conservancy network security monitoring results.

[0016] This application provides a big data-based method and system for water conservancy network security monitoring, which achieves the following beneficial effects: First, by constructing a dynamic knowledge graph of water conservancy business, asset nodes and business function nodes and their relationships are structurally modeled, providing a data foundation that integrates business semantics for security monitoring and overcoming the shortcomings of traditional methods that separate security data from business logic. Second, by generating behavioral sequence features through spatiotemporal correlation analysis based on the knowledge graph and establishing a dynamic behavioral baseline corresponding to the water conservancy operating conditions, anomaly detection can adapt to changes in behavioral patterns under different operating conditions such as flood season, drought season, and normal operation, effectively reducing the false alarm rate caused by operating condition switching. Third, by integrating and calculating the anomaly confidence level and asset vulnerability parameters of asset nodes with the business criticality parameters of business function nodes, a quantitative assessment of the impact from asset anomalies to business is achieved, providing monitoring results with greater decision-making reference value for security operation and maintenance personnel. Fourth, by using the transmission credibility of data flow edges in the calculation of business impact assessment values, the actual quality of data transmission links is reflected in the impact of risk transmission, and the assessment results are more consistent with the actual operating conditions of the water conservancy network.

[0017] It should be understood that the descriptions of technical features, technical solutions, beneficial effects, or similar language in this application do not imply that all features and advantages can be achieved in any single embodiment. Rather, it is understood that the description of a feature or beneficial effect means that a specific technical feature, technical solution, or beneficial effect is included in at least one embodiment. Therefore, the descriptions of technical features, technical solutions, or beneficial effects in this specification do not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions, and beneficial effects described in this embodiment can be combined in any suitable manner. Those skilled in the art will understand that embodiments can be implemented without one or more specific technical features, technical solutions, or beneficial effects of a particular embodiment. In other embodiments, additional technical features and beneficial effects may be identified in specific embodiments that do not embody all embodiments. Attached Figure Description

[0018] Figure 1 A system architecture diagram of a water conservancy network safety monitoring system based on big data is provided for embodiments of this application; Figure 2 A flowchart illustrating a water conservancy network safety monitoring method based on big data, provided for an embodiment of this application; Figure 3 A flowchart illustrating a knowledge graph construction and association analysis method provided in this application embodiment; Figure 4 This application provides a schematic diagram of a process for dynamically determining a preset time window in an embodiment of the present application. Figure 5This is a schematic diagram of a transitional operating state baseline interpolation process provided in an embodiment of this application. Detailed Implementation

[0019] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] The water conservancy network safety monitoring method based on big data provided in this application embodiment can be applied to a water conservancy network safety monitoring system based on big data, such as... Figure 1 As shown, the system includes: a data acquisition module, a knowledge graph construction module, and a security analysis module.

[0021] The data acquisition module is used to acquire multi-source security data from multiple monitoring nodes in the water conservancy network. The multi-source security data includes, but is not limited to, network traffic data, equipment operation logs, operation audit records, and security alarm event data.

[0022] The knowledge graph construction module is used to construct a dynamic knowledge graph of water conservancy business based on the topology, business function division and data flow transmission path of the water conservancy network, and to dynamically update the knowledge graph.

[0023] The security analysis module is used to perform spatiotemporal correlation analysis on multi-source security data based on the dynamic knowledge graph of water conservancy business, determine the dynamic behavior baseline and anomaly confidence of each asset node, and determine the business impact assessment value of each business function node by combining asset vulnerability parameters and business criticality parameters, and generate water conservancy network security monitoring results.

[0024] To address the technical problems in existing water conservancy network security monitoring technologies, such as the inability to adapt to changes in operating conditions due to static baselines and the lack of asset-business correlation analysis, leading to inaccurate monitoring results, this application provides a big data-based water conservancy network security monitoring method. This method includes: acquiring multi-source security data from multiple monitoring nodes in the water conservancy network and constructing a dynamic knowledge graph of water conservancy business; performing spatiotemporal correlation analysis on the multi-source security data based on the dynamic knowledge graph of water conservancy business to generate behavioral sequence characteristics of each asset node in the time-series dimension; determining the dynamic behavioral baseline of each asset node based on the behavioral sequence characteristics, and determining the anomaly confidence level of each asset node based on the deviation between the real-time behavioral data of each asset node and the corresponding dynamic behavioral baseline; acquiring asset vulnerability parameters of each asset node and business criticality parameters of each business function node, and determining the business impact assessment value of each business function node based on the anomaly confidence level; and generating water conservancy network security monitoring results based on the business impact assessment values ​​of each business function node. Based on this, a comprehensive perception of the water conservancy network security status and a quantitative assessment of business impact are achieved.

[0025] like Figure 2 As shown in the figure, an embodiment of this application provides a water conservancy network safety monitoring method based on big data, including: S201. Obtain multi-source security data from multiple monitoring nodes in the water conservancy network and construct a dynamic knowledge graph for water conservancy operations.

[0026] The water conservancy network includes monitoring nodes deployed at various locations within water conservancy projects, such as gate control system nodes, hydrological data acquisition nodes, and video surveillance nodes. Multi-source security data includes various types of data such as network traffic data, equipment operating status data, operation audit logs, and security alarm events. The water conservancy business dynamic knowledge graph models entities and their relationships within the water conservancy network using a graph structure. Entities include asset nodes and business function nodes, and relationships include data flow edges.

[0027] It should be noted that asset nodes refer to various physical or logical devices in the water conservancy network, such as PLC controllers, data acquisition terminals, communication equipment, servers, etc.; business function nodes refer to various business functions in water conservancy projects, such as gate control, hydrological monitoring, flood warning, water resource scheduling, etc. Data flow edges are used to characterize the data transmission relationships between asset nodes and business function nodes, as well as between different asset nodes.

[0028] S202. Based on the dynamic knowledge graph of water conservancy business, perform spatiotemporal correlation analysis on multi-source security data to generate behavioral sequence features of each asset node in the time dimension.

[0029] Specifically, using the data flow edges in the knowledge graph as indexes, the scattered multi-source security data is merged and organized according to the data flow to which it belongs. Based on this, the behavioral event sequences of each asset node within a preset time window are extracted according to the time series, forming behavioral sequence features that can reflect the operational rules and behavioral patterns of the asset nodes.

[0030] It should be noted that behavioral sequence features are a structured description of the operational behavior of asset nodes in the time dimension, including information such as event type, occurrence time, and transfer relationship between events.

[0031] S203. Determine the dynamic behavior baseline of each asset node based on the behavioral sequence characteristics, and determine the anomaly confidence level of each asset node based on the degree of deviation between the real-time behavior data of each asset node and the corresponding dynamic behavior baseline.

[0032] The dynamic behavior baseline is a benchmark pattern extracted from the behavioral sequence characteristics of asset nodes under historical normal operating conditions. This baseline is dynamically adjusted according to changes in the hydraulic engineering conditions. The real-time collected asset node behavior data is compared with the corresponding dynamic behavior baseline under the current operating conditions, the degree of deviation between the two is calculated, and the abnormal confidence level of the asset node is obtained after normalization.

[0033] It should be noted that the anomaly confidence level is used to quantify the degree to which the current behavior of an asset node deviates from its normal operating mode. The higher the anomaly confidence level, the greater the possibility that the asset node has a security anomaly.

[0034] S204. Obtain the asset vulnerability parameters of each asset node and the business criticality parameters of each business function node, and determine the business impact assessment value of each business function node in combination with the anomaly confidence level.

[0035] Among them, the asset vulnerability parameter is used to characterize the security weaknesses of the asset node itself, including factors such as device type, firmware version information, known vulnerability information, and historical attack records. The business criticality parameter is used to characterize the importance of each business function node in the safe operation of the water conservancy project. By integrating the anomaly confidence level of the asset node with the asset vulnerability parameter, the risk transmission strength to related business functions after the asset node anomaly is determined. Then, combined with the business criticality parameter of the business function node, the business impact assessment value of each business function node is comprehensively calculated.

[0036] It should be noted that the business impact assessment value is used to quantitatively characterize the degree of impact on a certain business function node due to the anomaly of the asset node it depends on. The higher the value, the greater the security risk faced by the business function.

[0037] S205. Generate water conservancy network safety monitoring results based on the business impact assessment values ​​of each business function node.

[0038] Based on the business impact assessment value of each business function node, the business function nodes can be sorted and classified according to the degree of business impact, high-risk business functions and their corresponding key asset nodes can be identified, and security monitoring results including risk level, scope of impact, and disposal suggestions can be generated for security operation and maintenance personnel to refer to for decision-making.

[0039] Based on the above technical solutions, the big data-based water conservancy network security monitoring method provided in this application structurally associates asset nodes with business function nodes through a dynamic knowledge graph of water conservancy business, so that security data is no longer isolated at the network level, but deeply integrated with the water conservancy business logic. The spatiotemporal correlation analysis based on this fully explores the correlation patterns of multi-source security data in both time and space dimensions, and the generated behavioral sequence features accurately reflect the operational behavior patterns of each asset node under different operating conditions. The dynamic behavioral baseline is constructed according to the classification of water conservancy operating conditions, enabling anomaly detection to adapt to the differences in behavioral patterns under different operating conditions such as flood season, drought season, and normal operation. The calculation of anomaly confidence is based on the degree of deviation between real-time behavioral data and the dynamic behavioral baseline, which can sensitively capture abnormal behavior of asset nodes. Furthermore, by introducing asset vulnerability parameters and business criticality parameters, anomalies at the asset level are transformed into impact assessments at the business level, elevating the security monitoring results from simply "whether the equipment is abnormal" to "how much will the business be affected," providing a more valuable quantitative basis for decision-making in the network operation and maintenance of water conservancy networks.

[0040] Furthermore, in this embodiment, the construction of a dynamic knowledge graph for water conservancy operations is the foundation for all subsequent analysis steps. The quality of the knowledge graph directly affects the accuracy of behavioral sequence feature extraction, dynamic behavioral baseline determination, and business impact assessment. The data flow edges in the knowledge graph not only carry information about the direction and frequency of data transmission but also serve as an index for the merging and organization of multi-source security data, thus realizing the integration of security data and business logic.

[0041] In one possible implementation of the embodiments of this application, such as Figure 3 As shown, the steps of S201 (constructing a dynamic knowledge graph for water conservancy operations) can be implemented through the following steps S301-S304, which are explained in detail below: S301. Determine each asset node and the physical connection relationship between each asset node based on the topology of the water conservancy network.

[0042] The topology of the water conservancy network describes the deployment locations and connection methods of various devices in the network. By analyzing the physical and logical topology of the water conservancy network, all asset nodes in the network (such as PLC controllers, remote terminal units (RTUs), data acquisition and monitoring control system SCADA servers, communication gateways, etc.) are identified, and the physical connection relationships between each asset node (such as Ethernet connections, serial communication connections, wireless communication connections, etc.) are determined.

[0043] In some implementations, the topological structure information of the water conservancy network can be obtained by combining network scanning, configuration document parsing, and manual data entry.

[0044] It should be noted that the identification of asset nodes should cover all critical equipment in the water conservancy network, including but not limited to monitoring layer equipment, control layer equipment, and field layer equipment.

[0045] S302. Determine the business function nodes according to the division of water conservancy business functions, and associate each business function node with the asset nodes involved in performing the business function.

[0046] The water conservancy business function division is based on the actual business needs of water conservancy projects, decomposing the business activities of the water conservancy system into several relatively independent business function units, such as remote gate control, reservoir water level monitoring, flow data acquisition, flood early warning issuance, and water resource scheduling decision-making. Each business function node represents a specific business function. For each business function, the set of asset nodes it depends on during execution is determined. For example, the "remote gate control" function depends on asset nodes such as gate control PLC, communication gateway, and control server, establishing the association between business function nodes and asset nodes.

[0047] In some implementation methods, the division of business functions can be based on the operating procedures and system design documents of water conservancy projects.

[0048] It should be noted that an asset node can serve multiple business function nodes, and a business function node can also depend on multiple asset nodes, forming a many-to-many relationship.

[0049] S303. Determine the data flow edge based on the transmission path of the data flow between each asset node and the business function node, and assign data transmission direction attribute and data interaction frequency attribute to each data flow edge.

[0050] The data flow edge characterizes the data transmission relationship between asset nodes and business function nodes, as well as between different asset nodes. The data transmission direction attribute indicates whether data flows from the source node to the target node or bidirectionally, such as unidirectional transmission from the data acquisition terminal to the data aggregation server, or bidirectional interaction between the control server and the PLC. The data interaction frequency attribute records the number of data transmissions occurring on this data flow edge per unit time, reflecting the activity level of the data link.

[0051] In some implementations, data flow edges can be determined by analyzing network traffic data or parsing system communication logs.

[0052] It should be noted that the data transmission direction attribute and data interaction frequency attribute of the data flow edge are important parameters for subsequent spatiotemporal correlation analysis and determination of dynamic behavior baseline.

[0053] S304. Dynamically update the data interaction frequency attribute of the data flow edge according to changes in water conservancy conditions.

[0054] The water conservancy operating conditions include flood season status, drought season status, normal operation status, and transitional operation status. Under different water conservancy operating conditions, the frequency of data interaction in water conservancy operations changes significantly. For example, during the flood season, the frequency of hydrological monitoring data collection increases dramatically, and the frequency of gate control commands issued also increases significantly. Therefore, it is necessary to dynamically update the data interaction frequency attribute of the data flow edges according to the current water conservancy operating conditions, so that the knowledge graph can reflect the changes in the operating status of the water conservancy network in real time.

[0055] In some implementations, the current operating status information can be obtained by connecting to the water resources department's operating condition monitoring system, and the data interaction frequency attribute can be updated accordingly.

[0056] Based on the above technical solution, a dynamic knowledge graph for water conservancy operations was constructed, systematically and structurally modeling the asset nodes, business function nodes, and data flow relationships between them in the water conservancy network. Asset nodes in the knowledge graph provide analytical objects for subsequent behavioral sequence analysis, business function nodes provide assessment targets for business impact assessment, and data flow edges provide indexing for the merging and spatiotemporal correlation analysis of multi-source security data. By dynamically updating the data interaction frequency attribute of the data flow edges, the knowledge graph can evolve in real time with changes in water conservancy conditions, ensuring the timeliness and accuracy of subsequent dynamic behavioral baselines. This knowledge graph-based modeling approach unifies previously scattered and heterogeneous multi-source security data under a single semantic framework, laying the foundation for cross-asset and cross-business correlation analysis.

[0057] In one possible implementation of the embodiments of this application, such as Figure 3As shown, the above-mentioned S202 (the step of performing correlation analysis on multi-source security data based on the dynamic knowledge graph of water conservancy business) can be specifically implemented through the following S401-S403, which are explained in detail below: S401. Using the data flow edge as an index, group and merge the multi-source security data according to their respective data flow edges.

[0058] The multi-source security data originates from different monitoring nodes and data sources within the water conservancy network, including network traffic logs, equipment operation logs, and operation audit records. Using data flow edges in the knowledge graph as indexes, each piece of security data is mapped to its corresponding data flow edge, indicating on which data flow the security data was generated or transmitted. All security data belonging to the same data flow edge are grouped and merged to form a security dataset organized around data flow edges.

[0059] In some implementations, mapping and matching can be performed by parsing information such as source address, destination address, and protocol type in the security data and combining it with the endpoint information of the data flow edges in the knowledge graph.

[0060] It should be noted that grouping and merging based on data flow edges reorganizes the originally scattered multi-source security data according to data transmission relationships, providing a data foundation for subsequent extraction of behavior sequences by asset node.

[0061] S402. For each group of merged security data, extract the sequence of behavioral events of each asset node within a preset time window according to the time series.

[0062] Specifically, for each asset node, all behavioral events generated by that asset node within a preset time window are extracted from the merged security data corresponding to the data stream edges it participates in. Each behavioral event includes at least two elements: event type (such as "data acquisition", "control command issuance", "status query", "configuration modification", etc.) and event occurrence time. The extracted behavioral events are arranged in chronological order to form a sequence of behavioral events for that asset node within the preset time window.

[0063] It should be noted that the duration of the preset time window affects the temporal resolution and statistical reliability of behavioral sequence features. A window that is too short may result in incomplete behavioral patterns, while a window that is too long may mask short-term abnormal behaviors.

[0064] S403. Based on the time interval between adjacent behavioral events and the event type transition relationship in the behavioral event sequence, construct the temporal behavioral transition matrix for each asset node.

[0065] The temporal behavior transition matrix is ​​a state transition probability matrix used to describe the behavior patterns of asset nodes. The rows and columns of the matrix correspond to different behavior event types. The element in the i-th row and j-th column represents the statistical probability or frequency of transitioning from event type i to event type j among adjacent behavior events. Specifically, it is constructed by iterating through all adjacent event pairs in the behavior event sequence, counting the number of transitions from one event type to another, and then normalizing the results row by row to obtain the probability values ​​for each transition relationship.

[0066] In some implementations, in addition to the event type transition probability, the average time interval information between adjacent events can be added to the matrix elements to enrich the representation dimensions of behavioral patterns.

[0067] Based on the above technical solution, multi-source security data is organized and merged from scattered to ordered using data flow edges in the knowledge graph as indexes. The extracted sequence of behavioral events for each asset node accurately reflects the operational patterns of the asset nodes over time. Furthermore, the time-series behavioral transition matrix abstracts the behavioral sequence into a quantifiable and comparable mathematical structure, providing a directly computable feature representation for determining the dynamic behavioral baseline and calculating anomaly confidence. This knowledge graph-driven association analysis method fully utilizes the topological structure and data flow relationships of the water conservancy network, ensuring that security data analysis is no longer divorced from the context of network topology and business logic.

[0068] In one possible implementation of this application embodiment, the duration of the preset time window is dynamically determined according to the business function type corresponding to each asset node. The preset time window of the asset node involving gate control function is shorter than the preset time window of the asset node involving hydrological data acquisition function.

[0069] Specifically, such as Figure 4 As shown, the specific process for determining the duration of the preset time window includes: First, obtaining the asset node identifier and its associated business function type; then, determining the real-time requirement category of the asset node based on the business function type. If it involves gate control, it belongs to high real-time requirements, and the preset time window is set to 1-5 minutes; if it involves hydrological data acquisition, it belongs to periodic acquisition requirements, and the preset time window is set to 30-60 minutes; if it involves flood warning, it belongs to near real-time requirements, and the preset time window is set to 5-15 minutes; if it involves water resource scheduling decision-making, it belongs to long-cycle decision-making requirements, and the preset time window is set to 60-120 minutes. Finally, the behavior sequence extraction time window for the asset node is determined based on the judgment result, and the behavior event sequence is extracted within this time window.

[0070] In some implementations, corresponding preset time window parameters can be configured during system initialization based on the specific business operation type performed by each asset node, and maintenance personnel can adjust them according to the actual operating conditions.

[0071] It should be noted that the dynamic determination mechanism of the preset time window makes the extraction of behavioral sequence features more closely match the behavioral characteristics of different business functions, avoiding the problems of insufficient sensitivity to high real-time business or excessive statistical noise for periodic business caused by a uniform window size. The step of "determining the dynamic behavioral baseline of each asset node based on behavioral sequence features" in S203 above can be specifically implemented through the following S501-S502, which are explained in detail below: S501. Classify the time-series behavior transition matrix of each asset node according to the water conservancy working condition, and generate the baseline behavior transition matrix corresponding to each water conservancy working condition.

[0072] The water conservancy operating conditions include at least the flood season condition, the drought season condition, and the normal operation condition. In historical operational data, the water conservancy operating condition to which each behavioral sequence belongs is marked. Then, all time-series behavioral transition matrices belonging to the same operating condition are merged (e.g., by averaging or weighted averaging) to generate the baseline behavioral transition matrix for that operating condition. The baseline behavioral transition matrix represents the normal behavioral pattern of asset nodes under a specific operating condition.

[0073] In some implementations, clustering algorithms can be used to perform unsupervised classification of the historical behavior transition matrix, automatically identify different behavior pattern categories, and then verify them against manually labeled working conditions.

[0074] It should be noted that the baseline behavior transition matrix of the same asset node may differ significantly under different operating conditions. For example, the increased data collection frequency during the flood season leads to a significantly higher probability of occurrence and transition of "collection" events compared to the drought season.

[0075] S502. Using the current water conservancy working condition as an index, select the corresponding baseline behavior transition matrix as the dynamic behavior baseline of the asset node under the current working condition.

[0076] In the real-time monitoring process, the current water conservancy working condition status is first obtained (e.g., by accessing the working condition monitoring system or by manual setting). Then, using the working condition status as an index, the corresponding one is selected from the baseline behavior transition matrix of each working condition generated in S501, which serves as the dynamic behavior baseline of the asset node at the current moment.

[0077] It should be noted that the hydraulic engineering condition also includes the transitional operating state. For example... Figure 5As shown, when the system detects a switch in a water conservancy project from one operating condition to another, it executes the following transition processing steps: Identify the operating condition X before the switchover and the operating condition Y after the switchover, and obtain the baseline behavior transition matrix Mx for the asset node under operating condition X and the baseline behavior transition matrix My for operating condition Y respectively; The current switching progress p is obtained. This switching progress is determined by monitoring the actual operating parameters of the water conservancy project (such as the rate of change of water level, the magnitude of change of flow rate, etc.) and combining them with the preset switching duration. The value of p ranges from 0 to 1, where p=0 indicates that the switching has not yet started and p=1 indicates that the switching has been completely completed. Based on the switching progress p, Mx and My are weighted and interpolated to calculate the transition baseline behavior transition matrix Mt, which is calculated as follows: ; The transition baseline behavior transition matrix Mt is used as the dynamic behavior baseline of the asset node in the current transition operation state; As the switching progress p increases, the value of Mt is updated in real time until p reaches 1. At this point, the system is fully switched to the reference behavior transition matrix My corresponding to the operating condition Y as the dynamic behavior baseline, and the transition process ends.

[0078] For example, when a water conservancy project switches from normal operation to flood season operation, and the switching progress is 30% (i.e., p=0.3), the transition baseline behavior transition matrix Mt=0.7. Normal baseline matrix +0.3 The flood season baseline matrix; when the switchover progress is 70% (i.e., p=0.7), the transition baseline behavior is the transition matrix Mt=0.3. Normal baseline matrix +0.7 Flood season baseline matrix. This transition processing method avoids false alarms caused by sudden changes in the behavioral baseline during operating condition switching.

[0079] Based on the above technical solution, by establishing a dynamic behavior baseline mechanism, the normal behavior patterns of each asset node can adaptively adjust to changes in the hydraulic operating conditions. Compared to using a fixed behavior baseline, this condition-adaptive dynamic baseline significantly reduces the probability of normal deviations in behavior patterns caused by changes in operating conditions being misjudged as anomalies, thus improving the accuracy and reliability of anomaly detection. The handling of transitional operating states further smooths baseline changes during operating condition switching, avoiding false alarms caused by abrupt baseline changes.

[0080] In one possible implementation of this application embodiment, the step of "determining the abnormal confidence level of each asset node" in S203 above can be specifically implemented by the following S601-S602, which are described in detail below: S601. Construct a real-time behavior transfer matrix for each asset node based on real-time behavior data.

[0081] Real-time behavior data refers to the behavioral event data of each asset node collected in real time within the current time period. Following the same method as S402 and S403, the behavioral event sequence within the current time window is extracted from the real-time behavior data, and a real-time behavior transition matrix is ​​constructed. The structure of the real-time behavior transition matrix is ​​exactly the same as the baseline behavior transition matrix, with rows and columns corresponding to the same set of event types, facilitating subsequent element-by-element comparison.

[0082] S602. The differences between the real-time behavior transition matrix of each asset node and the corresponding elements in the benchmark behavior transition matrix are weighted and accumulated. The weights are determined according to the business importance of the data flow edge associated with the corresponding position. The accumulated result is normalized and used as the anomaly confidence of each asset node.

[0083] Wherein, let the real-time behavior transition matrix be... The baseline behavior transition matrix is Both have the same dimension n×n (where n is the number of event types). For each position (i,j) in the matrix, calculate the difference value. , that is, the absolute value of the difference between the real-time transition probability and the baseline transition probability; where, The element in the i-th row and j-th column of the real-time behavior transition matrix represents the real-time transition probability of asset node c from event type i to event type j within the current time window. This represents the corresponding baseline transition probability. Each position (i,j) corresponds to a transition relationship of an event type. This transition relationship occurs during the data interaction process carried by a certain data flow edge. Therefore, the importance of this position is related to the business importance of the corresponding data flow edge, and each position is assigned a weight. (The weight value is determined based on the business criticality of the business function served by the data stream edge; the higher the criticality, the greater the weight.) Calculate the weighted total difference value: ; The total difference This comprehensively reflects the overall deviation between real-time behavior patterns and baseline behavior patterns across all event transfer relationships. To facilitate comparison and threshold determination between different asset nodes, [the following is done / is done / etc.]. Normalization is performed to obtain the anomaly confidence level of asset node c. : ; in, and These are the statistics obtained by asset node c under its historical normal operating conditions (i.e., during periods without security events). Minimum and maximum values, after normalization, are guaranteed to be . The closer the value is to 1, the more serious the deviation of the real-time behavior of the asset node from its dynamic behavior baseline, and the higher the possibility of security anomalies.

[0084] In some implementations, the business importance of a data flow edge can be determined based on the business criticality parameter of the business function node served by that data flow edge. The higher the business criticality of a business function, the higher the business importance of the data flow edge involved.

[0085] Based on the above technical solution, the anomaly confidence calculation methods S601 to S602 elevate the anomaly detection of asset nodes from simple threshold comparison to a quantitative assessment based on overall differences in behavioral patterns. The weighted accumulation mechanism ensures that differences in the transfer relationships of different event types contribute differently to the anomaly confidence score. Behavioral pattern deviations occurring in critical business data flows are given higher weights, thus being more significantly reflected in the anomaly confidence score. This weighting method makes the anomaly detection results more closely reflect the importance of the business, avoiding excessive interference from minor fluctuations in non-critical links.

[0086] In one possible implementation of this application embodiment, in the step of "obtaining the asset vulnerability parameters of each asset node and the business criticality parameters of each business function node" in S204 above, the asset vulnerability parameters are determined based on the device type, firmware version information, known vulnerability information and historical attack records of the asset node; the business criticality parameters are determined based on the importance of the water conservancy business corresponding to the business function node in the safe operation of the water conservancy project.

[0087] Among them, the asset vulnerability parameter is a comprehensive indicator that quantifies the security weaknesses of an asset node. Device type reflects the category of equipment to which the asset belongs (e.g., PLC, RTU, server, network equipment, etc.), and different device types have different security characteristics and attack surfaces. Firmware version information is used to determine whether the device has known security vulnerabilities; older versions generally mean more unpatched vulnerabilities. Known vulnerability information includes the number and severity of vulnerabilities related to the asset in the Common Vulnerabilities and Exposures (CVE) database. Historical attack records reflect whether the asset has suffered successful or attempted cyberattacks in the past; a higher frequency of historical attacks indicates that the asset is more likely to be a target.

[0088] In some implementations, the asset vulnerability parameter can be obtained by weighted comprehensive scoring of the above factors, and the weight of each factor can be configured according to the actual situation of the water conservancy network and the security strategy.

[0089] Business criticality parameters are indicators that quantify the importance of each business function node in the safe operation of water conservancy projects. For example, the "gate control" function is directly related to the flood control safety and water resource allocation of water conservancy projects, and its business criticality is the highest; the "hydrological data acquisition" function is the data foundation for subsequent analysis and decision-making, and its business criticality is the next highest; while auxiliary functions such as "report generation" have relatively low business criticality.

[0090] In some implementation methods, the business criticality parameter can be determined with reference to the safety level classification standards and operating procedures of water conservancy projects, and evaluated and assigned values ​​by water conservancy business experts.

[0091] It should be noted that the asset vulnerability parameter and the business criticality parameter are two core input dimensions for business impact assessment. The former reflects the likelihood of problems with the asset itself, while the latter reflects the potential losses to the business if problems with the asset occur.

[0092] In one possible implementation of this application embodiment, the above-mentioned S204 (the step of determining the business impact assessment value of each business function node in combination with the anomaly confidence level) can be specifically implemented by the following S701-S703, which will be explained in detail below: S701. Determine the set of asset nodes that each business function node depends on based on the dynamic knowledge graph of water conservancy business.

[0093] Specifically, starting from the dynamic knowledge graph of water conservancy operations, and traversing backwards along the data flow edges, all asset nodes that have data flow associations with the business function node are identified, forming the set of asset nodes that the business function node depends on. For example, the "remote gate control" business function node depends on multiple asset nodes such as the gate control PLC, communication gateway, and control server.

[0094] S702. Integrate the abnormal confidence level of each asset node in the asset node set with the corresponding asset vulnerability parameters to determine the risk transmission intensity of each asset node.

[0095] Among them, risk transmission strength is used to quantify the strength of the impact of an asset node after an anomaly occurs, which is then transmitted to the business function nodes it serves. Risk transmission strength is positively correlated with the anomaly confidence level and asset vulnerability parameters of the asset node. That is, the higher the anomaly confidence level and the greater the asset vulnerability, the greater the transmission strength of the impact on business functions after a security incident occurs on that asset node.

[0096] S703. Determine the business impact assessment value of each business function node based on the risk transmission intensity of each asset node and the business criticality parameters of the corresponding business function nodes.

[0097] Among them, the business impact assessment value of each business function node It is calculated using the following formula: ; Where b is the sequence number of the business function node. For business function node b, this is the business importance parameter. Let c be the set of asset nodes that business function node b depends on, and c be the sequence number of the asset node. This is the normalization coefficient for the historical attack frequency of asset node c, obtained by normalizing the historical attack event frequencies of this asset node. The degree of anomaly of asset node c. For the vulnerability parameter of asset node c; The reliability of the data flow edge from asset node c to business function node b is determined based on the historical data transmission success rate.

[0098] The logical meaning of the above formula is as follows: For each asset node c that business function node b depends on, first calculate the probability of a valid security event occurring on that asset node, and then use... It means that, among them, The larger the product of the two factors, the higher the overall risk of a security incident occurring at that asset node, according to the exponential function. The smaller the value, the closer the valid event probability obtained by subtracting this value from 1 is to 1. This mathematical form reflects the saturation growth relationship between the probability of a security event and the risk factor. When the risk factor is small, the probability increases approximately linearly with the risk factor; when the risk factor is large, the probability growth slows down and approaches 1. Then, this valid event probability is multiplied by the transmission reliability of the data flow edge c to b. This means that only the impact that can be successfully transmitted to the business function node through the data transmission link will be included. The transmission impact of all dependent asset nodes is summed up and then multiplied by the business criticality parameter of the business function node itself. This yields the business impact assessment value for that business function node. . The higher the value, the greater the security risk faced by the business function node.

[0099] All parameters involved in the above formulas can be found directly in the solution as physical or information entities: The historical attack event records for asset node c, Corresponding to the anomaly confidence level calculated through S601-S602, The corresponding asset node c has vulnerability-related attributes such as device type, firmware version, and vulnerability information. The historical transmission logs of the corresponding data flow edge c to b The importance rating of the corresponding business function node b in the water conservancy project. All parameters have consistent dimensions, being dimensionless normalized values, ensuring the mathematical validity of the formula calculations.

[0100] Based on the above technical solution, and through S701 to S703 and the business impact assessment value calculation formula, a complete quantitative link from anomaly detection of asset nodes to risk impact assessment of business function nodes is realized. This assessment method fully considers multiple dimensions of factors, including asset vulnerability, anomaly confidence, historical attack frequency, data transmission reliability, and business criticality, enabling the business impact assessment value to comprehensively and accurately reflect the actual risk level faced by each business function node under the current security situation. Compared to traditional methods that only focus on anomalies at the asset level, this application elevates the perspective of security monitoring from the asset layer to the business layer, providing more instructive information for security operation and maintenance decisions. Operation and maintenance personnel can directly rely on the data from each business function node... Risks are prioritized based on their value, and those impacting highly critical business operations are addressed first.

[0101] In one possible implementation, after S205, the water conservancy network security monitoring method based on big data provided in this application embodiment further includes the following S801-S803: S801. Based on the business impact assessment value of each business function node, and according to the preset risk level classification threshold, classify each business function node into different risk levels.

[0102] The preset risk level classification thresholds can be set based on the actual safety requirements and operation and maintenance experience of water conservancy projects, such as the business impact assessment value. It is divided into four levels: "low risk," "medium risk," "high risk," and "extremely high risk," each corresponding to different risks. Range of values.

[0103] S802. For business function nodes whose risk level exceeds a preset threshold, generate early warning information including the business function node identifier, the list of risk asset nodes it depends on, the risk level, and recommended handling measures.

[0104] In addition to identifying risky business function nodes, the warning information should also list the main contributing asset nodes (i.e., asset nodes with strong risk transmission in S702) that cause the risk assessment value of the business function node to be too high, so that operation and maintenance personnel can quickly locate the root cause of the problem.

[0105] S803 pushes early warning information to the water conservancy network security operation and maintenance terminal, and highlights the risk business function nodes and their associated risk asset nodes in the form of a knowledge graph on the visual interface.

[0106] The visualization interface is based on a dynamic knowledge graph of water conservancy business. It uses color coding or icon marking to highlight high-risk business function nodes and their associated asset nodes, enabling operation and maintenance personnel to intuitively understand the distribution and transmission path of risks in the asset-business relationship network.

[0107] Based on the above technical solution, through subsequent processing steps S801 to S803, the business impact assessment value is further transformed into actionable security warning information. Risk level classification provides operations and maintenance personnel with a clear basis for risk priority judgment; the risk asset node list in the warning information helps operations and maintenance personnel quickly locate the specific equipment requiring action; and the knowledge graph visualization makes the distribution and transmission path of risks in the asset-business relationship network readily apparent. These subsequent processing steps transform the security monitoring results of this application from "assessment data" into "actionable operations and maintenance instructions," enhancing the practical application value of the solution.

[0108] Some of the data in the above formula are calculated by removing dimensions and taking their numerical values. The formula is the closest to the real situation obtained by software simulation of a large amount of collected data. The preset parameters and preset thresholds in the formula are set by those skilled in the art according to the actual situation or obtained through simulation of a large amount of data.

Claims

1. A method for monitoring the safety of water conservancy networks based on big data, characterized in that, include: Acquire multi-source security data from multiple monitoring nodes in the water conservancy network, and construct a dynamic knowledge graph of water conservancy business. The entities in the dynamic knowledge graph of water conservancy business include asset nodes and business function nodes, and the relationships include data flow edges. Based on the dynamic knowledge graph of water conservancy business, spatiotemporal correlation analysis is performed on the multi-source security data to generate behavioral sequence features of each asset node in the time dimension. The dynamic behavior baseline of each asset node is determined based on the behavioral sequence characteristics, and the anomaly confidence level of each asset node is determined based on the degree of deviation between the real-time behavior data of each asset node and the corresponding dynamic behavior baseline. Obtain the asset vulnerability parameters of each asset node and the business criticality parameters of each business function node, and determine the business impact assessment value of each business function node in combination with the anomaly confidence level. The water conservancy network safety monitoring results are generated based on the business impact assessment values ​​of each business function node.

2. The water conservancy network safety monitoring method based on big data according to claim 1, characterized in that, The steps for constructing the dynamic knowledge graph of water conservancy operations include: Determine each asset node and the physical connection relationship between each asset node based on the topology of the water conservancy network; Based on the division of water conservancy business functions, business function nodes are determined, and each business function node is associated with the asset nodes involved in performing that business function. The data flow edges are determined based on the transmission path of the data flow between each asset node and the business function node, and each data flow edge is assigned a data transmission direction attribute and a data interaction frequency attribute. The data interaction frequency attribute of the data flow edge is dynamically updated based on changes in water conservancy conditions.

3. The water conservancy network safety monitoring method based on big data according to claim 2, characterized in that, The steps of using the dynamic knowledge graph of water conservancy operations to perform correlation analysis on the multi-source security data include: Using the data flow edge as an index, the multi-source security data are grouped and merged according to their respective data flow edges; For each group of merged security data, extract the sequence of behavioral events of each asset node within a preset time window according to the time series. Based on the time intervals between adjacent behavioral events and the event type transition relationships in the behavioral event sequence, a time-series behavioral transition matrix is ​​constructed for each asset node.

4. The water conservancy network safety monitoring method based on big data according to claim 3, characterized in that, The duration of the preset time window is dynamically determined based on the business function type corresponding to each asset node. The preset time window for asset nodes involving gate control functions is shorter than the preset time window for asset nodes involving hydrological data acquisition functions.

5. The water conservancy network safety monitoring method based on big data according to claim 3, characterized in that, The step of determining the dynamic behavior baseline of each asset node includes: The temporal behavior transition matrix of each asset node is classified according to the water conservancy working condition, and a baseline behavior transition matrix corresponding to each water conservancy working condition is generated. Using the current water conservancy working condition as an index, the corresponding baseline behavior transition matrix is ​​selected as the dynamic behavior baseline of the asset node under the current working condition; The water conservancy operating conditions include at least the flood season condition, the drought season condition, and the normal operation condition.

6. The water conservancy network safety monitoring method based on big data according to claim 5, characterized in that, The step of determining the abnormal confidence level of each asset node includes: Construct a real-time behavior transfer matrix for each asset node based on real-time behavior data; The differences between the real-time behavior transition matrix of each asset node and the corresponding elements in the benchmark behavior transition matrix are weighted and accumulated. The weights are determined based on the business importance of the data flow edge associated with the corresponding position. The accumulated result is normalized and used as the anomaly confidence of each asset node.

7. The water conservancy network safety monitoring method based on big data according to claim 1, characterized in that, The acquisition of asset vulnerability parameters for each asset node and business criticality parameters for each business function node includes: The asset vulnerability parameter is determined based on the device type, solid-state version information, known vulnerability information, and historical attack records of the asset node; the business criticality parameter is determined based on the importance of the water conservancy business corresponding to the business function node in the safe operation of the water conservancy project.

8. The water conservancy network safety monitoring method based on big data according to claim 1, characterized in that, The steps for determining the business impact assessment value of each business function node include: The set of asset nodes on which each business function node depends is determined based on the aforementioned dynamic knowledge graph of water conservancy business. The abnormal confidence level of each asset node in the asset node set is fused with the corresponding asset vulnerability parameter to determine the risk transmission intensity of each asset node; The business impact assessment value of each business function node is determined based on the risk transmission intensity of each asset node and the business criticality parameters of the corresponding business function nodes. Among them, the business impact value of each business function node It is calculated using the following formula: ； Where b is the sequence number of the business function node. For business function node b, this is the business importance parameter. Let c be the set of asset nodes that business function node b depends on, and c be the sequence number of the asset node. This is the normalization coefficient for the historical attack frequency of asset node c, obtained by normalizing the historical attack event frequencies of this asset node. The degree of anomaly of asset node c. For the vulnerability parameter of asset node c; The reliability of the data flow edge from asset node c to business function node b is determined based on the historical data transmission success rate.

9. The water conservancy network safety monitoring method based on big data according to claim 5, characterized in that, The water conservancy working condition also includes a transitional operating condition. When a water conservancy project switches from one working condition to another, the transitional benchmark behavior transfer matrix corresponding to the transitional operating condition is used as the dynamic behavior baseline. The transitional benchmark behavior transfer matrix is ​​obtained by weighted interpolation of the benchmark behavior transfer matrix corresponding to the working condition before the switch and the benchmark behavior transfer matrix corresponding to the working condition after the switch. The weighting coefficient is determined according to the switching progress.

10. A water conservancy network safety monitoring system based on big data, operating based on the water conservancy network safety monitoring method based on big data as described in any one of claims 1-9, characterized in that, It includes a data acquisition module, a knowledge graph construction module, and a security analysis module; The data acquisition module is used to acquire multi-source security data from multiple monitoring nodes in the water conservancy network; The knowledge graph construction module is used to construct a dynamic knowledge graph of water conservancy business based on multi-source security data; The security analysis module is used to perform spatiotemporal correlation analysis on multi-source security data based on the dynamic knowledge graph of water conservancy business, determine the dynamic behavior baseline and anomaly confidence of each asset node, and determine the business impact assessment value of each business function node by combining asset vulnerability parameters and business criticality parameters, and generate water conservancy network security monitoring results.

Images