A power monitoring system alarm correlation quantitative evaluation method and system

Abstract

A kind of power monitoring system alarm correlation quantitative evaluation method and system.In alarm time axis, alarm is divided into multiple security events according to alarm intensive distribution;In single security event, the network session behavior of all network devices is collected, and the business correlation is calculated based on the total frequency of device session, and the alarm text is vectorized to obtain semantic similarity;The correlation risk of any two alarms is calculated by combining risk level, semantic similarity and business correlation, and the correlation risk value of single alarm and the overall risk of security event are further obtained;Finally, the risks of different security events are correlated and analyzed, and the comprehensive security risk assessment results of the whole network are formed.The present application aims to improve the accuracy of alarm correlation analysis and the whole network security risk identification ability.

Description

Technical Field

[0001] This invention belongs to the field of power system network security technology, specifically relating to a method and system for quantitative evaluation of alarm correlation in power monitoring systems. Background Technology

[0002] With the rapid expansion of power monitoring system network scale, the continuous expansion of network business functions, and the extensive application of network security technologies, the number of network security alarms continues to increase, and the alarm analysis work of network security operation and maintenance personnel has become significantly more difficult.

[0003] Existing alarm correlation analysis techniques primarily employ expert systems and rule-based correlation analysis. For example, some research proposes using raw alarm logs collected by power network situational awareness platforms, employing a dynamic sliding time window algorithm to generate alarm transaction sets, mining power network alarm correlation rules, and using a time-series-based alarm rule filtering algorithm to eliminate invalid rules, thereby extracting key alarm rules from the power network. Another example is the effective control of network alarms in communication network maintenance and management, extending alarm logic and correlation logic from within network devices to between network devices.

[0004] However, existing methods rely heavily on rule mining to achieve alarm compression and qualitative analysis of network security risks. They can only analyze alarms based on known rules and lack quantitative evaluation indicators for the correlation of massive alarms. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a method and system for quantitative assessment of alarm correlation in power monitoring systems. It achieves security event segmentation through density analysis of alarm time series; integrates device session behavior within events to construct business relevance; and calculates alarm correlation risk and event risk by combining alarm semantic similarity and risk level. Furthermore, it performs correlation analysis on different event risks to obtain a comprehensive network-wide security risk assessment result, realizing alarm correlation and risk quantification driven by multi-source information.

[0006] The first aspect of this application discloses a method for quantitative evaluation of alarm correlation in a power monitoring system, which adopts the following technical solution: Sampling points are defined on the alarm time axis with equal intervals. Within the two sampling intervals before and after the sampling point, the alarm density at the sampling point is calculated based on the alarm time. An alarm density curve is constructed by the point pairs of all sampling points and alarm density in time sequence. The sampling points corresponding to all minimum points in the curve are extracted as time division points. Alarms between adjacent time division points are classified as a security event. Within the time frame of a security incident, network session behavior of all network devices is collected, and a session frequency matrix is ​​constructed based on the number of sessions between each pair of devices. Based on the session frequency matrix, the service correlation between each pair of devices is calculated using the total session frequency of each device. The natural language description of the alarm content is vectorized, and the semantic similarity between any two alarms is calculated. In a security incident alarm grouping, the associated risk between any two alarms is calculated based on risk level, semantic similarity, and business relevance; for each alarm, the associated risk value of a single alarm is calculated by its associated risk to all alarms in the group except itself; the total risk of the current security incident is obtained by aggregating all associated risk values ​​in the group; and the comprehensive security risk of the entire network is calculated by associating the risks between different security incidents.

[0007] Furthermore, the calculation process for the alarm density includes: At the sampling point Two sampling intervals Inside, with sampling points With each alarm time The difference between them is used to calculate the alarm density of the current sampling point by calling the kernel density estimation function; In the kernel density estimation function, the bandwidth is calculated based on an empirical adjustment factor and the standard deviation of all alarm times.

[0008] Furthermore, the calculation process for the business relevance includes: In the session frequency matrix, each element represents the session frequency between two devices; based on the total session frequency of any two devices, the service correlation between the devices is calculated through covariance. The total session frequency for each device is represented by the sum of the session frequencies in the row where that device is located in the session frequency matrix.

[0009] Furthermore, the calculation process for the associated risk between any two alarms includes: Extract the risk level attribute carried in the alarm content and map it to the risk level assessment value; For any two alarms within a group, multiply the sum of the business relevance between the devices to which they belong, the semantic similarity of the alarms, and the risk level assessment value of the alarms to obtain the associated risk between the two alarms. Similarly, calculate the correlation risk between all pairs of alarms within the group.

[0010] Furthermore, the process of obtaining the associated risk value of a single alarm includes: The correlation risk between all alarms in a group constitutes the alarm correlation assessment matrix; for a single alarm, its correlation risk value is the sum of all correlation risks in the row where it is located in the alarm correlation assessment matrix.

[0011] Furthermore, the calculation process for the overall network security risk includes: Within an alarm group for a security incident, the associated risk values ​​of all alarms are summed to obtain the total risk of the current security incident. For each security event on the alarm timeline, the impact weight of each security event on the overall network security risk is calculated based on its correlation with other security events besides itself. The total risk of all security incidents across the entire network is weighted by its impact weight, and then normalized using the total number of security incidents across the entire network to obtain the comprehensive security risk of the entire network.

[0012] Furthermore, the process of obtaining the correlation of the security events includes: For alarm groups of two security events, calculate the ratio of the number of alarms of the same type in the two groups to the number of all alarms, which is used to represent the correlation between the two security events; The same type of alarm means that the two alarms have the same alarm device and alarm description.

[0013] The second aspect of this application discloses a power monitoring system alarm correlation quantitative evaluation system, which implements the evaluation method described in the first aspect of this application. The system includes: The time clustering module is used to define sampling points with equal intervals on the alarm time axis, calculate the alarm density at the sampling point in the two sampling intervals before and after the sampling point based on the alarm time, construct an alarm density curve by pairing all sampling points with alarm density in time sequence, extract the sampling points corresponding to all minimum points in the curve as time segmentation points, and classify alarms between adjacent time segmentation points as a single security event. The device association module is used to collect network session behavior of all devices in the network within a security event time interval, construct a session frequency matrix based on the number of sessions between each pair of devices, calculate the service correlation between each pair of devices based on the session frequency matrix and the total session frequency of each device, vectorize the natural language description of the alarm content, and calculate the semantic similarity between any two alarms. The risk quantification module is used to calculate the associated risk between any two alarms in a security incident alarm group based on risk level, semantic similarity, and business relevance; for each alarm, it calculates the associated risk value of a single alarm by considering its associated risks with all alarms in the group except itself; it aggregates all associated risk values ​​in the group to obtain the total risk of the current security incident; and it correlates the risks between different security incidents to calculate the overall network security risk.

[0014] The beneficial effects of this invention are that, compared with the prior art, 1. By constructing a time segmentation mechanism based on kernel density estimation, integrating business relevance and semantic similarity into a correlation risk calculation model, and further forming an alarm correlation matrix and a hierarchical aggregation risk scoring system, a unified quantitative evaluation index system from alarms to events and then to the entire network level has been achieved, which is different from the evaluation methods that rely on rule-driven and qualitative judgment in existing methods.

[0015] 2. By introducing alarm density curves to classify security events and combining device session covariance relationships with alarm semantic vector similarity, automatic grouping and cross-device correlation modeling of massive alarms can be achieved. This enables efficient characterization of the multidimensional correlation strength between alarms in large-scale alarm scenarios, improving the ability to identify risks and assess the overall network security situation in complex network environments. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the alarm correlation quantitative evaluation method provided in the embodiment. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this invention. The embodiments described in this application are merely some embodiments of this invention, and not all embodiments. Based on the spirit of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of this invention.

[0018] Example 1 To improve the ability to quantitatively assess the risks of massive alarms, enhance the efficiency of network security operations and maintenance, and provide quantitative support for the correlation of risks in other alarm analysis technologies, this embodiment discloses a specific implementation method for quantitative assessment of alarm correlation in power monitoring systems, referring to... Figure 1 This invention quantifies the risk of network security alarms by conducting correlation analysis on alarms across time and network service dimensions. The alarm attributes processed in this invention include alarm time, risk level, alarm device, and alarm content. Furthermore, this invention also collects service network traffic during the alarm period to mine device correlations.

[0019] Since alarms are correlated in both time and cyberspace aspects, this invention mainly conducts alarm correlation analysis in three steps. The first step is to group alarms based on their time information; the second step is to calculate device interaction correlation based on service traffic within the corresponding time intervals; and the third step is to calculate network security risk quantification indicators based on the risk levels of related alarms and the correlation within each time interval. Based on the above process, this invention proposes three stages: time clustering, device correlation, and risk quantification.

[0020] S1: In one implementation, alarms are grouped based on time clustering to achieve the correlation and grouping of massive alarms in the time dimension. At the same time, time segments are divided for alarm groups through kernel density estimation to determine the pruning time nodes for network traffic collection.

[0021] The main goal of the time clustering stage is to discover the time correlation between alarms. Based on the principle that an event will generate multiple alarms in a short period of time and related events occur at similar times, all alarms are clustered according to their alarm time attributes to generate multiple clusters, and each cluster is divided into corresponding time segments.

[0022] On the alarm timeline of risk assessment, sampling points are defined with equal intervals (i.e., uniform time intervals). To assess the temporal correlation of alarm events, alarm time is used as a key attribute, and kernel density estimation is employed to divide the time segments into different clusters. Kernel density estimation function. : ; in, Sampling points Two sampling intervals The total number of alarms within, For bandwidth, For kernel function, For the first The alarm time of each alarm; the calculated This indicates the sampling point. The density of nearby alarms will be measured at each sampling point. The kernel function used in the kernel density estimation function described above is a Gaussian kernel function.

[0023] Bandwidth in the kernel density estimation function above The value of will affect the kernel density function. The smaller the bandwidth, the sharper the Gaussian curve, and the more sensitive it is to local fluctuations. The specific value is affected by the actual alarm operations. An empirical value can be determined by the time distribution characteristics of the alarms, and the specific calculation formula is as follows: ; As an empirical moderating factor, The standard deviation of the time attribute in the alarm event sample: ; This is the average of all alarm times. The above steps allow you to obtain a time-related value from the alarm time attributes of multiple alarms. kernel density function , A larger value results in more concentrated alarms, while a smaller value results in more dispersed alarms.

[0024] To segment alarms along the time dimension, several time division points need to be determined. The selection of these time division points ensures that alarms at each time division point are relatively sparse, while alarms between time division points are relatively concentrated. By fine-grained sampling of the kernel density function, all minimum points of the function are extracted to form time division points. All alarms between adjacent time division points are grouped as time-related alarms, with each group representing a single security event. Specifically: All sampling points according to The temporal connection yields a curve; the curve contains peaks and troughs. Peaks are... A high value indicates a particularly high number and frequency of alarms during this period (this is the time period in which the event occurred); a trough indicates... A small value indicates that there are very few alarms during this period, which is very sparse (this is the gap between events).

[0025] The sampling point corresponding to the trough value is used as the time division point. Within the time period between two adjacent division points, alarms are concentrated, forming a group representing a single security event. This process divides all alarms into multiple alarm groups, i.e., multiple security events.

[0026] To further explore the correlation between different security events, considering the similarity of alarms in similar events, security events with high alarm overlap are considered similar events. Since there is a high degree of device overlap among such similar groups, the correlation between security events is further calculated. : ; in, express , The correlation between the two events and Representing events respectively , The alarm group set; The ratio of the number of alarms of the same type in two event groups to the total number of alarms is calculated. "Alarms of the same type" refers to two alarms that have the same alarm device and alarm description.

[0027] By performing time-based clustering operations, multiple alarms can be grouped according to time, each group can be divided into a corresponding time interval (one security event), and the correlation between the groups can be calculated.

[0028] S2: In one implementation, based on traffic analysis device association, network session behavior is collected within a certain time range, and the covariance of session statistical samples is used to calculate the network service correlation between network devices, providing a quantitative indicator for the service correlation between different alarm devices.

[0029] The device association phase involves generating a device association matrix by combining the session relationships of network service traffic within the corresponding time interval after time clustering, and mining the network service correlations between devices.

[0030] In power monitoring systems, network traffic can be collected through network security monitoring devices. All network session behaviors are collected within the time interval between two adjacent split points output by S1 (corresponding to a single security event).

[0031] Furthermore, within this time interval, the number of sessions between any two devices on the entire network is counted to construct a symmetrical session frequency matrix. .in, The total number of devices in the entire network, each element in the matrix Indicates device and equipment Frequency of conversations between them. The larger the size, the better the equipment. and equipment The more frequent the interaction during this period.

[0032] Furthermore, the business correlation between devices is calculated using covariance. This is expressed as: ; For equipment and equipment The relevance of network services and Representing the equipment and equipment Total session frequency. The total session frequency of a device is represented by the sum of the session frequencies of that device and all other devices, that is, the sum of the session frequencies of the row containing that device in the session frequency matrix.

[0033] Conversation frequency matrix The correlation between each pair of devices is calculated to obtain the device correlation matrix. The meaning of inter-device business correlation is that if the communication modes of two devices rise and fall in tandem, the covariance will be positive, indicating that the businesses of the two devices are highly correlated.

[0034] In one implementation, semantic correlation is performed based on alarm content. According to the alarm content attributes, the correlation between alarm descriptions is calculated through an embedding model to generate quantitative indicators of alarm semantic correlation. Semantic correlation is represented by a correlation matrix.

[0035] Alarm content attributes are natural language descriptions of alarms, and their semantic features can be used to further explore the correlations between alarms. This invention introduces a trained embedding model for semantic association. The embedding model can vectorize the semantics within the alarm content, allowing for comparison of similarity between different alarms in the semantic space. Semantic-dimensional associations can be achieved by comparing the distance between semantic vectors.

[0036] In one possible implementation, the embedding model can employ a pre-trained language model such as Sentence-BERT or GTE, and undergo domain-adaptive fine-tuning training based on corpora such as historical alarm texts, equipment logs, and operating procedures in the power sector. This enables the model to perform word segmentation, semantic encoding, and vectorized representation of power system alarm content. This step is a conventional technique in the field of natural language processing, and those skilled in the art can implement it by referring to existing publicly available solutions (such as the HuggingFace model library or domain adaptation tutorials), which will not be elaborated upon here.

[0037] The steps to calculate the relationships between all alarms in an alarm group are as follows: Step 1: For each alarm, extract the natural language description of the alarm content and vectorize it using an embedding model. The embedding model performs word segmentation, vectorization, and pooling operations on the alarm content to obtain a semantic vector for that alarm content.

[0038] Step 2: Normalize the semantic vector obtained for each alarm content. To facilitate the calculation of correlation between semantic vectors, L2 normalization is performed on the semantic vectors of all alarms while ensuring that the vector direction remains unchanged, so that the magnitude of all vectors is 1; represented as... ; in, It is a semantic vector for an alert. It is its normalized vector. It is the L2 norm of the semantic vector, calculated as follows: ;in It is a vector The first in One element, It is the dimension of the semantic vector space.

[0039] Step 3: Calculate the semantic relevance among all alarms in the alarm group. Cosine similarity is used to measure the semantic relevance between alarm content; two vectors of the same dimension... and The cosine similarity calculation method is as follows: ; and It is a vector and Since the semantic vectors all have a magnitude of 1 after the second normalization operation, the similarity of the semantic vectors can be obtained by calculating the dot product of the vectors: ; in The first in the alarm group The and the first The semantic similarity of the alarm content between the alarms is calculated, with similarity values ​​ranging from [value range missing]. The higher the value, the higher the semantic similarity between the two alerts.

[0040] S3: In one implementation, alarm risk quantification is performed based on correlation analysis. According to the risk level attribute of the alarm, the correlation risk quantification index of the alarm is generated through time correlation and device correlation. The correlation risk quantification index includes the correlation risk vector and the correlation risk assessment value.

[0041] In this embodiment, each original alarm, in addition to containing a natural language description, also carries a risk level attribute, which is typically output by a Security Operations Platform (SOC / SIEM) or a power monitoring system. Further, the risk level attribute of the original alarm is defined as a quantitative assessment value of the alarm itself, used to describe the risk level of the alarm; the higher the assessment value, the higher the security threat posed by the alarm. In a possible implementation, the risk level can be quantified as follows: high risk is mapped to 3, medium risk to 2, low risk to 1, and no risk (information-related) to 0.

[0042] In the risk quantification stage, based on the alarm groups and device correlation matrices obtained in the time clustering and device association stages mentioned above, alarm correlation risk quantification indicators are formed by quantifying the alarm correlation risk within each alarm group, including risk quantification for the alarm itself and for all alarms.

[0043] Specifically, the following steps are included: First, within each alarm group (i.e., within a single security incident), the correlation risk among all alarms is calculated cross-referenced. The calculation method is as follows: ; in, Alarms within a group and alarm The associated risks between them For warning Equipment and alarm Equipment The correlation of network services between them; It's an alarm. and alarm Semantic relevance between alarm content; and Alarms and alarm Its own risk level.

[0044] Obtain the alarm correlation evaluation matrix , This represents the number of alarms within the group. The correlation risk between alarms means that if two devices are closely related in terms of business operations and their respective alarms are relatively dangerous, then the risk of correlation between these two devices will be very high.

[0045] Furthermore, in the alarm correlation evaluation matrix In the middle, the first Row elements indicate warnings Assess the associated risks of all alarms within the current group. Therefore, for alarms... Define its associated risk value This is the sum of the associated risks of other alerts within the industry; expressed as: ; This indicates an alarm. The sum of the threats posed by all other alerts. If an alert triggers many high-risk associations, then its associated risk value will be very high.

[0046] Furthermore, the associated risk values ​​of all alarms are summed to obtain the current alarm group, which is the total risk quantification assessment value of the current event.

[0047] Furthermore, the risks associated with different security incidents are normalized to calculate the overall network risk. This is represented as: ; In the formula, This is a quantitative assessment value for the overall network security risk. To assess the total number of security incidents included in the scope, For security incidents The total risk quantification assessment value, for , The correlation between the two security events (see S1); This represents the weight of the impact of security event A on the overall network security risk.

[0048] In the quantitative results of alarms in this invention, the associated risk vector describes the degree of correlation between the alarm and other alarms within the group, which can be further used for alarm collaborative filtering to achieve alarm relevance recommendation. The associated risk assessment value is affected by factors such as the alarm's own risk level, the risk level of other highly correlated alarms, the correlation with other alarms, and the number of highly correlated risks. It can be used to assist network security operation and maintenance personnel in screening massive alarms and help improve the efficiency of analyzing complex network security events. The comprehensive security risk quantitative assessment value describes the comprehensive risk level of all security events covering the detection range, which can reflect the overall network security level and can be used to assess the overall security status of the power monitoring system.

[0049] Example 2 As an embodiment of this application, a power monitoring system alarm correlation quantitative evaluation system is disclosed, employing the specific implementation method described in Embodiment 1 above. The system includes: The time clustering module is used to define sampling points with equal intervals on the alarm time axis, calculate the alarm density at the sampling point in the two sampling intervals before and after the sampling point based on the alarm time, construct an alarm density curve by pairing all sampling points with alarm density in time sequence, extract the sampling points corresponding to all minimum points in the curve as time segmentation points, and classify alarms between adjacent time segmentation points as a single security event. The device association module is used to collect network session behavior of all devices in the network within a security event time interval, construct a session frequency matrix based on the number of sessions between each pair of devices, calculate the service correlation between each pair of devices based on the session frequency matrix and the total session frequency of each device, vectorize the natural language description of the alarm content, and calculate the semantic similarity between any two alarms. The risk quantification module is used to calculate the associated risk between any two alarms in a security incident alarm group based on risk level, semantic similarity, and business relevance; for each alarm, it calculates the associated risk value of a single alarm by considering its associated risks with all alarms in the group except itself; it aggregates all associated risk values ​​in the group to obtain the total risk of the current security incident; and it correlates the risks between different security incidents to calculate the overall network security risk.

[0050] As an embodiment of this application, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded onto the processor, it employs the specific implementation described in the evaluation method above.

[0051] As an embodiment of this application, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, employs the specific implementation described in the evaluation method above.

[0052] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0053] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0054] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination of the foregoing. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0055] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0056] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0057] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. A method for quantitative evaluation of alarm correlation in a power monitoring system, characterized in that, include: Sampling points are defined on the alarm time axis with equal intervals. Within the two sampling intervals before and after the sampling point, the alarm density at the sampling point is calculated based on the alarm time. An alarm density curve is constructed by combining all sampling points with alarm density points in time sequence. The sampling points corresponding to all minimum points in the curve are extracted as time segmentation points. Alarms between adjacent time segmentation points are classified as a single security event. Within the time frame of a security incident, network session behavior of all devices on the network is collected, and a session frequency matrix is ​​constructed based on the number of sessions between each pair of devices. Based on the session frequency matrix, the service correlation between each pair of devices is calculated using the total session frequency of each device. Vectorize the natural language description of the alarm content and calculate the semantic similarity between any two alarms; In a security incident alarm grouping, the associated risk between any two alarms is calculated based on risk level, semantic similarity, and business relevance; For each alarm, calculate the associated risk value of the individual alarm by considering its associated risks with all alarms in the group other than itself. The total risk of the current security event is obtained by aggregating all associated risk values ​​within the group. By correlating the risks between different security incidents, the overall security risk of the entire network can be calculated.

2. The method for quantitative evaluation of alarm correlation in a power monitoring system according to claim 1, characterized in that, The calculation process for the alarm density includes: At the sampling point Two sampling intervals Inside, with sampling points With each alarm time The difference between them is used to calculate the alarm density of the current sampling point by calling the kernel density estimation function; In the kernel density estimation function, the bandwidth is calculated based on an empirical adjustment factor and the standard deviation of all alarm times.

3. The method for quantitative evaluation of alarm correlation in a power monitoring system according to claim 1, characterized in that, The calculation process for the business relevance includes: In the session frequency matrix, each element represents the session frequency between two devices; based on the total session frequency of any two devices, the service correlation between the devices is calculated through covariance. The total session frequency for each device is represented by the sum of the session frequencies in the row where that device is located in the session frequency matrix.

4. The method for quantitative evaluation of alarm correlation in a power monitoring system according to claim 1, characterized in that, The calculation process for the associated risk between any two alarms includes: Extract the risk level attribute carried in the alarm content and map it to the risk level assessment value; For any two alarms within a group, multiply the sum of the business relevance between the devices to which they belong, the semantic similarity of the alarms, and the risk level assessment value of the alarms to obtain the associated risk between the two alarms. Similarly, calculate the correlation risk between all pairs of alarms within the group.

5. The method for quantitative evaluation of alarm correlation in a power monitoring system according to claim 1, characterized in that, The process of obtaining the associated risk value of a single alarm includes: The correlation risk between all alarms in a group constitutes the alarm correlation assessment matrix; for a single alarm, its correlation risk value is the sum of all correlation risks in the row where it is located in the alarm correlation assessment matrix.

6. The method for quantitative evaluation of alarm correlation in a power monitoring system according to claim 1, characterized in that, The calculation process for the overall network security risk includes: Within an alarm group for a security incident, the associated risk values ​​of all alarms are summed to obtain the total risk of the current security incident. For each security event on the alarm timeline, the impact weight of each security event on the overall network security risk is calculated based on its correlation with other security events besides itself. The total risk of all security incidents across the entire network is weighted by its impact weight, and then normalized using the total number of security incidents across the entire network to obtain the comprehensive security risk of the entire network.

7. The method for quantitative evaluation of alarm correlation in a power monitoring system according to claim 6, characterized in that, The correlation of the security events is obtained through the following process: For alarm groups of two security events, calculate the ratio of the number of alarms of the same type in the two groups to the number of all alarms, which is used to represent the correlation between the two security events; The same type of alarm means that the two alarms have the same alarm device and alarm description.

8. A power monitoring system alarm correlation quantitative evaluation system, executing the evaluation method as described in any one of claims 1-7, characterized in that, The system includes: The time clustering module is used to define sampling points with equal intervals on the alarm time axis, calculate the alarm density at the sampling point in the two sampling intervals before and after the sampling point based on the alarm time, construct an alarm density curve by pairing all sampling points with alarm density in time sequence, extract the sampling points corresponding to all minimum points in the curve as time segmentation points, and classify alarms between adjacent time segmentation points as a single security event. The device association module is used to collect network session behavior of all devices in the network within a security event time interval, construct a session frequency matrix based on the number of sessions between each pair of devices, calculate the service correlation between each pair of devices based on the session frequency matrix and the total session frequency of each device, vectorize the natural language description of the alarm content, and calculate the semantic similarity between any two alarms. The risk quantification module is used to calculate the associated risk between any two alarms in a security incident alarm group based on risk level, semantic similarity, and business relevance; for each alarm, it calculates the associated risk value of a single alarm by considering its associated risks with all alarms in the group except itself; it aggregates all associated risk values ​​in the group to obtain the total risk of the current security incident; and it correlates the risks between different security incidents to calculate the overall network security risk.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the computer program is loaded into the processor, it implements the evaluation method according to any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the evaluation method according to any one of claims 1-7.

Images