A power grid network attack damage quantification and alarm generation method based on service semantic translation

Abstract

This invention discloses a method for quantifying damage and generating alarms from power grid attacks based on business semantic translation. Relating to the field of network attack damage quantification, the method acquires multi-source power grid data at the time of a network attack, combines this data with a pre-defined semantic recognition mechanism to generate attack semantics and business semantics, calculates the semantic correlation between the attack and business semantics, establishes a data semantic association link between them, performs multi-dimensional damage quantification of the current network attack based on the semantic association data, calculates a comprehensive damage quantification value for damage level classification, allocates alarm priorities and maintenance plans based on the damage level, generates alarm information, and sends the alarm information to maintenance personnel for processing according to the alarm priority order. This achieves accurate damage quantification and business-oriented alarms, supporting the power grid's security requirements of "proactive defense, accurate detection, rapid response, and dynamic assessment."

Description

Technical Field

[0001] This invention relates to the technical field of network attack damage quantification, and in particular to a method for power grid network attack damage quantification and alarm generation based on business semantic translation. Background Technology

[0002] Currently, as the power system evolves towards an integrated architecture such as "smart grid + ubiquitous power Internet of Things" and "new energy + energy storage + power grid," core businesses such as dispatch automation, substation control, and remote operation and maintenance are deeply integrated with information networks. The dependence of power grid operation on the continuity of business logic and the accuracy of data interaction has significantly increased. Attacks on the power grid are now highly organized, covert, and targeted. Attack methods have evolved from traditional scanning and brute-force attacks to complex forms such as APT attacks, supply chain attacks, and AI-assisted attacks. Attack paths extend along the path of "boundary breaching—privilege penetration—business interference," seriously threatening the safe operation of the power grid.

[0003] Existing power grid network security analysis technologies focus only on technical aspects such as traffic characteristics and vulnerability exploitation, lacking an understanding of the semantics of power grid business. They cannot correlate attack behavior with business logic such as scheduling processes, equipment control, and compliance rules. As a result, they can only assess the consequences of attacks at the system level, such as equipment downtime and abnormal traffic, and it is difficult to quantify the precise damage caused by attacks to power grid business, such as abnormal load transfer due to tampering of scheduling instructions or the risk of relay protection malfunction. Moreover, the generated alarm information is mostly at the level of scattered technical indicators, such as port scan triggers and protocol anomalies, and fails to be transformed into risk warnings at the business level. Operation and maintenance personnel still need to analyze technical indicator parameters to locate the actual impact of attacks on business, which often leads to delayed response and inaccurate handling. Summary of the Invention

[0004] To address the problems of existing power grid network analysis remaining at the level of technical indicators, making it difficult to accurately quantify attack damage and requiring manual location of the actual impact of attacks on services, resulting in delayed response and inaccurate handling, this application provides a power grid network attack damage quantification and alarm generation method based on business semantic translation. This method can convert attack behavior and system status into semantic information that power grid services can understand, thereby achieving accurate damage quantification and business-oriented alarms, supporting the power grid's security requirements of "proactive defense, accurate detection, rapid response, and dynamic assessment".

[0005] Firstly, the above-mentioned inventive objective of this application is achieved through the following technical solution: A method for power grid network attack damage quantification and alarm generation based on business semantic translation, the method comprising: The system acquires multi-source data of the power grid at the time of a network attack, and performs semantic recognition on the multi-source data of the power grid through a preset semantic recognition mechanism to obtain the attack semantics and business semantics of the power grid network attack. Calculate the semantic correlation degree between the attack semantics and the business semantics, establish a correlation link between the attack semantics and the business semantics based on the semantic correlation degree, and perform data semantic correlation to obtain semantic correlation data; Based on semantic association data, multi-dimensional damage quantification is performed on the current network attack behavior, and a comprehensive damage quantification value is calculated based on the attack damage quantification results to classify the damage level. Alarm priorities and maintenance plans are allocated based on damage levels, and alarm information is generated. The alarm information is then sent to maintenance personnel for alarm processing according to the alarm priority order.

[0006] In a preferred embodiment, this application can be further configured as follows: after allocating alarm priorities and maintenance plans based on damage levels and generating alarm information, and sending the alarm information to the maintenance personnel for alarm processing according to alarm priority order, it further includes: The alarm information is executed to obtain damage quantification feedback data, and the semantic correlation degree and the comprehensive damage quantification value are respectively subjected to parameter iterative optimization processing based on the damage quantification feedback data. The expression for the damage quantification feedback data is as follows: (1) in, This represents the damage quantification feedback data. , These represent business semantics, semantic relevance, damage quantification value, and alarm information, respectively. These represent semantic translation accuracy, relevance matching rate, damage quantification deviation, and alarm handling effectiveness, respectively. Obtain the actual troubleshooting plan for the actual network attack, and iteratively optimize the alarm information generation and push rules. The parameter iteration update expression is as follows: (2) in, , They represent the first sequence The parameter values ​​for the next iteration. Indicates the learning rate. The parameter optimization coefficients are expressed as follows: (3) in, Represents the parameter optimization coefficients. , These represent the semantically based comprehensive damage quantization value and the actual damage quantization value from the damage quantization feedback data, respectively. These represent the correlation matching rate of damage quantification feedback data and the semantic-based correlation matching rate, respectively. These represent the effectiveness of alarm handling based on damage quantification feedback data and the effectiveness of alarm handling based on semantics, respectively.

[0007] In a preferred embodiment, this application can be further configured as follows: The acquisition of multi-source power grid data at the time of a network attack, followed by semantic recognition of the multi-source power grid data using a preset semantic recognition mechanism to obtain the attack semantics and business semantics of the power grid network attack, specifically includes: Data on network attack behavior, business operation, equipment status, and network traffic at the time of the attack are acquired and aggregated to obtain multi-source power grid data. The multi-source data of the power grid is semantically mapped using a preset data mapping table. Based on the semantic mapping results, the attack semantics and business semantics of power grid network attacks are obtained. The semantic mapping results are shown below: (4) in, Represents the business semantic feature vector. , These represent attack behavior identifiers and attack semantic tags, respectively. , These respectively represent business traffic identifiers and business stage semantics. , These represent the device identifier and the device status semantics, respectively. Indicates the protocol's business semantics. Indicates the timestamp of the occurrence.

[0008] In a preferred embodiment, this application can be further configured as follows: calculating the semantic correlation degree between the attack semantics and the business semantics, establishing a correlation link between the attack semantics and the business semantics based on the semantic correlation degree, and performing data semantic correlation to obtain semantic correlation data, specifically includes: A business semantic ontology model is constructed based on semantic mapping relationships. The semantic association between attack semantics and business semantics is analyzed based on the business semantic ontology model. The business semantic ontology model is shown below: (5) in, Represents a business semantic vector. Representing semantic elements, Indicates semantic association. Indicates associated attributes; The semantic correlation degree between attack semantics and business semantics that have a semantic relationship is calculated, and the expression for calculating the semantic correlation degree is as follows: (6) in, Indicates attack semantics and business semantics semantic relevance, , These represent the weighting coefficients, The cosine similarity between attack semantics and business semantics is represented. This indicates the degree of matching between business semantics and device semantics. This indicates a conflict between attack semantics and compliance semantics; When the semantic correlation degree exceeds the preset semantic correlation threshold, a correlation link is established between attack semantics and business semantics to obtain semantic correlation data. The conditions for establishing the associated link are as follows: (7) in, This represents the semantic association threshold.

[0009] In a preferred embodiment, this application can be further configured as follows: The step of performing multi-dimensional damage quantification processing on the current network attack behavior based on semantic association data, and calculating a comprehensive damage quantification value based on the attack damage quantification results to classify the damage level, specifically includes: The semantically related data is comprehensively assessed for damage using a predefined multidimensional damage assessment system. Based on the comprehensive damage assessment results, the current network attack behavior is subjected to multidimensional damage quantification to obtain the attack damage quantification results. Based on the attack damage quantification results, a comprehensive damage quantification value is calculated, and combined with the damage level preset range, the current network attack damage of the service is classified into damage levels according to the comprehensive damage quantification value. The expression for calculating the comprehensive damage quantification value is as follows: (8) in, This represents the quantified value of attack damage. - These represent the quantitative weighting coefficients for each damage assessment indicator. , These represent the quantitative value of business function impairment and the corresponding importance weight, respectively. , These represent the quantitative value of data asset damage and its corresponding importance weight, respectively. , These represent the quantitative values ​​of equipment operational damage and their corresponding importance weights, respectively. , These represent the quantitative value of system toughness damage and the corresponding importance weight, respectively.

[0010] In a preferred embodiment, this application can be further configured as follows: The step of performing a comprehensive damage assessment on the semantically related data using a predefined multi-dimensional damage assessment system, and then performing multi-dimensional damage quantification on the current network attack behavior based on the comprehensive damage assessment results to obtain attack damage quantification results, specifically including: A multi-dimensional attack impact analysis was conducted on power grid network attacks, and a multi-dimensional damage assessment system was constructed that includes business functions, data assets, equipment operation, and system resilience. The expression for calculating the quantitative value of business function impairment is as follows: (9) in, Indicates the duration of service interruption. Indicates the duration of normal business operation; The expression for calculating the quantitative value of data asset damage is as follows: (10) in, This indicates the amount of data leaked due to a cyberattack. This represents the total amount of sensitive data related to cyberattacks; The formula for calculating the quantitative value of equipment operation damage is as follows: (11) in, This indicates that the equipment parameters have exceeded the limit. Indicates the parameter safety threshold; The expression for calculating the system toughness damage quantification value is shown below: (12) in, This indicates the actual recovery time of the system after being attacked. This indicates the system's preset recovery time threshold.

[0011] In a preferred embodiment, this application can be further configured as follows: The process of allocating alarm priorities and maintenance plans based on damage levels and generating alarm information, and sending the alarm information to maintenance personnel for alarm processing according to alarm priority, specifically includes: Based on the preset priority mapping relationship between damage level and alarm priority, alarm priority mapping and repair plan matching are performed according to the damage level of the current network attack to generate alarm information, as shown below: (13) in, Indicates alarm priority. This represents an attack semantic description. This indicates a business impact analysis. This indicates the maintenance plan. Indicates the attack trigger time. Indicates the location where the attack was triggered; The alarm information is pushed to the corresponding maintenance personnel in descending order of alarm priority for alarm processing.

[0012] Secondly, the above-mentioned inventive objective of this application is achieved through the following technical solutions: A system for quantifying damage and generating alarms from power grid attacks based on business semantic translation, the system comprising: The data acquisition and translation module is used to acquire multi-source power grid data when a network attack occurs, and to perform semantic recognition on the multi-source power grid data through a preset semantic recognition mechanism to obtain the attack semantics and business semantics of the power grid network attack. The business semantic association module is used to calculate the semantic association degree between the attack semantics and the business semantics, establish an association link between the attack semantics and the business semantics based on the semantic association degree, and perform data semantic association to obtain semantic association data. The attack damage quantification module is used to perform multi-dimensional damage quantification on the current network attack behavior based on semantic association data, and to calculate a comprehensive damage quantification value based on the attack damage quantification results to classify the damage level. The alarm generation and push module is used to allocate alarm priorities and maintenance plans based on damage level and generate alarm information, and send the alarm information to the operation and maintenance personnel for alarm processing in order of alarm priority.

[0013] Thirdly, the above-mentioned objectives of this application are achieved through the following technical solutions: A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-described method for quantifying damage and generating alarms from power grid attacks based on business semantic translation.

[0014] Fourthly, the above-mentioned objectives of this application are achieved through the following technical solutions: A computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for quantifying damage and generating alarms from power grid attacks based on business semantic translation.

[0015] In summary, this application includes at least one of the following beneficial technical effects: 1. By using a pre-set semantic recognition mechanism, attack behaviors and system states are transformed into semantic information that the power grid business can understand, breaking down the barrier between "technical analysis and business understanding" and solving the problem of the disconnect between traditional attack analysis and power grid business logic. The accuracy of semantic translation is improved by more than 90%. Based on the calculation of semantic correlation and the correlation link between attack semantics and business semantics, data semantics are correlated at the data semantic level. Damage assessment and quantification are carried out from multiple dimensions, achieving accurate quantification of damage and business-oriented alarms. Alarm information is transformed from a collection of technical indicators into business-oriented content of "attack semantics - business impact - handling suggestions". The response efficiency of operation and maintenance personnel is improved by 60%, and the handling accuracy is improved by 70%, supporting the power grid's security requirements of "proactive defense, accurate detection, rapid response, and dynamic assessment". 2. By constructing a full-process mechanism of "business semantic data collection and translation - business semantic association modeling - semantic-driven damage quantification - business-oriented alarm generation - model iterative optimization", we can achieve deep binding between attack behavior and power grid business, and achieve the goals of damage that is "quantifiable, understandable and manageable" and alarms that are "precise, business-oriented and visualized". 3. Adaptive Optimization: Based on range training and real-world feedback, the model parameters related to semantic correlation calculation and comprehensive damage quantification are dynamically optimized to adapt to new attack methods such as AI-assisted attacks and supply chain attacks, improving model adaptability by 85%. 4. Emphasis on practical application: It aligns with the integrated "cloud-edge-device" architecture of the power grid and the characteristics of industrial control protocols, supporting the "perceptible, knowable, assessable, and measurable" consequences of attacks, and providing quantitative basis for the construction of a proactive defense system for the power grid. Attached Figure Description

[0016] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0017] Figure 1 This is a flowchart illustrating the implementation of the power grid network attack damage quantification and alarm generation method in this embodiment.

[0018] Figure 2 This is a flowchart of the data acquisition and processing of the power grid network attack damage quantification and alarm generation method in this embodiment.

[0019] Figure 3 This is a flowchart illustrating the implementation of semantic recognition in the power grid network attack damage quantification and alarm generation method of this embodiment.

[0020] Figure 4 This is a flowchart illustrating the implementation of semantic association in the power grid network attack damage quantification and alarm generation method of this embodiment.

[0021] Figure 5 This is a flowchart illustrating the implementation of damage quantification in the power grid network attack damage quantification and alarm generation method of this embodiment.

[0022] Figure 6 This is a flowchart illustrating the alarm implementation process of the power grid network attack damage quantification and alarm generation method in this embodiment.

[0023] Figure 7 This is a flowchart illustrating the implementation of feedback optimization for the power grid network attack damage quantification and alarm generation method in this embodiment.

[0024] Figure 8 This is a structural block diagram of the power grid network attack damage quantification and alarm generation system in this embodiment.

[0025] Figure 9 This is a schematic diagram of the internal structure of a computer device used to implement a method for quantifying damage from power grid network attacks and generating alarms. Detailed Implementation

[0026] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] It should be understood that, when used in this specification, the terms “comprising” and “including” indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0028] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification, unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “the” are intended to include the plural forms.

[0029] It should also be further understood that the term "and / or" as used in this specification refers to any combination of one or more of the associated listed items, as well as all possible combinations, and includes such combinations.

[0030] In one embodiment, such as Figure 1 and Figure 2 As shown, this application discloses a method for power grid network attack damage quantification and alarm generation based on business semantic translation, which specifically includes the following steps: S1: Obtain multi-source data of the power grid when the network attack occurs, and perform semantic recognition on the multi-source data of the power grid through a preset semantic recognition mechanism to obtain the attack semantics and business semantics of the power grid network attack.

[0031] Specifically, such as Figure 3 As shown, step S1 includes: S11: Obtain attack behavior data, business operation data, equipment status data, and network traffic data when a network attack occurs, and summarize them to obtain multi-source power grid data.

[0032] Specifically, attack behavior data, business operation data, equipment status data, and network traffic data are acquired when network attacks occur, and then aggregated to obtain multi-source power grid data.

[0033] Attack behavior data includes data on attack phases such as reconnaissance, intrusion, privilege escalation, lateral movement, and sabotage, as well as data on attack methods such as vulnerability exploitation types, malicious command content, and protocol abuse methods, and data on attack trigger points such as target IPs or ports and business systems.

[0034] Business operation data includes dispatch instruction data such as content, execution stage and approval status; equipment operation data such as relay protection parameter adjustment, SCADA remote signaling and telemetry data interaction; and business process node data such as issuing orders, repeating, executing and reporting.

[0035] Equipment status data includes operating status data of OT equipment such as PLC, RTU, and SCADA, including normal, maintenance, and fault status, as well as parameter threshold data such as voltage or current safety range and redundancy mechanism configuration data.

[0036] Network traffic data includes industrial control protocol traffic data, such as IEC 60870-5-104 / Modbus TCP / DNP3, traffic timing characteristics such as session duration and interaction frequency, and anomaly marker data such as replay and man-in-the-middle attack characteristics.

[0037] S12: Semantic mapping is performed on multi-source data of the power grid through a preset data mapping table. Based on the semantic mapping results, the attack semantics and business semantics of power grid network attacks are obtained. The semantic mapping results are shown below: (4) in, Represents the business semantic feature vector. , These represent attack behavior identifiers and attack semantic tags, respectively. , These respectively represent business traffic identifiers and business stage semantics. , These represent the device identifier and the device status semantics, respectively. Indicates the protocol's business semantics. Indicates the timestamp of the occurrence.

[0038] Specifically, the data mapping table includes an attack method-business threat semantic mapping table, which is obtained by establishing a mapping relationship between common attack methods and power grid business threat semantics. For example, "Modbus TCP function code 0x06 abuse" is translated as "relay protection setting tampering attempt". It also includes an equipment parameter-business semantic mapping table, which is obtained by establishing a mapping relationship between changes in equipment parameters during attacks using common attack methods and corresponding business semantics. For example, equipment operating parameters are converted into business status semantics, such as "voltage value exceeds 5% threshold" is translated as "#1 main transformer voltage exceeds limit". Business instruction semantics are extracted by parsing industrial control protocol fields, such as "IEC 60870-5-104 message type 100" is translated as "dispatch remote control instruction issuance".

[0039] S2: Calculate the semantic correlation between attack semantics and business semantics, establish the correlation link between attack semantics and business semantics based on the semantic correlation, and obtain semantically correlated data.

[0040] Specifically, such as Figure 4 As shown, step S2 includes: S21: Construct a business semantic ontology model based on semantic mapping relationships, and analyze the semantic association between attack semantics and business semantics based on the business semantic ontology model. The business semantic ontology model is shown below: (5) in, Represents a business semantic vector. The semantic elements include attack semantics, business semantics, device semantics, and compliance semantics. Indicates semantic association. This indicates the associated attributes, including the weight of the attack's impact on the business. In this embodiment, the value is set to 1 for core business and 0.5 for general business. It also includes a service recovery time threshold. and equipment redundancy protection level .

[0041] Attack semantics include semantics for stages such as reconnaissance, intrusion, and destruction; business semantics include business types such as scheduling, operation and maintenance, and protection; equipment semantics include semantics for core, ordinary, and edge devices; and compliance semantics include rule semantics extracted from power safety work specifications.

[0042] Establish the influence relationship between attack semantics and business semantics, and the dependency relationship between business semantics and equipment semantics. Construct semantic association relationships with business semantics as the center. For example, the influence relationship between attack semantics and business semantics is "set value tampering" → "relay protection business anomaly"; the dependency relationship between business semantics and equipment semantics is "dispatch command" → "main transformer control equipment".

[0043] S22: Calculate the semantic correlation between attack semantics and business semantics that have a semantic relationship. The expression for calculating the semantic correlation is as follows: (6) in, Indicates attack semantics and business semantics semantic relevance, , These represent the weighting coefficients, The cosine similarity between attack semantics and business semantics is represented. This indicates the degree of matching between business semantics and device semantics. This indicates a conflict between attack semantics and compliance semantics; In this embodiment, a weighted summation method is used to calculate the correlation between attack semantics and business semantics. and business semantics The expression for calculating the cosine similarity between them is as follows: (14) in, Indicates the first Feature vectors of attack semantics Indicates the first Each attack semantic feature vector.

[0044] In this embodiment, when there is a semantic association between business semantics and device semantics, the matching degree is 1; otherwise, it is 0. When there is a conflict between attack semantics and compliance semantics, the impact degree is 1; otherwise, it is 0. The initial values ​​were set to 0.5, 0.3, and 0.2 respectively.

[0045] S23: When the semantic relevance exceeds the preset semantic relevance threshold, establish a link between the attack semantics and the business semantics to obtain semantic relevance data.

[0046] The conditions for establishing the associated link are as follows: (7) in, This represents the semantic association threshold. In this embodiment, the semantic association threshold is set to 0.7.

[0047] S3: Based on semantic association data, perform multi-dimensional damage quantification on the current network attack behavior, and calculate the comprehensive damage quantification value based on the attack damage quantification results to classify the damage level.

[0048] Specifically, such as Figure 5 As shown, step S3 includes: S31: A comprehensive damage assessment of semantically related data is performed using a predefined multidimensional damage assessment system. Based on the comprehensive damage assessment results, multidimensional damage quantification is performed on the current network attack behavior to obtain the attack damage quantification results.

[0049] Specifically, a multi-dimensional attack impact analysis is conducted on power grid network attacks, and a multi-dimensional damage assessment system is constructed that includes business functions, data assets, equipment operation, and system resilience. The damage of the current network attack behavior is comprehensively assessed through each indicator of the multi-dimensional damage assessment system.

[0050] Among them, the business function evaluation indicators include the duration of business process interruption caused by attacks and the instruction deviation rate; the data asset evaluation indicators include the amount of sensitive data leakage and the degree of instruction or parameter tampering; the equipment operation evaluation indicators include the duration of abnormal equipment operation and the extent of parameter exceeding limits; and the system resilience evaluation indicators include the system recovery time and the probability of redundancy mechanism effectiveness.

[0051] The expression for calculating the quantitative value of business function impairment is as follows: (9) in, Indicates the duration of service interruption. This indicates the duration of normal business operation.

[0052] The expression for calculating the quantitative value of data asset damage is as follows: (10) in, This indicates the amount of data leaked due to a cyberattack. This represents the total amount of sensitive data related to cyberattacks.

[0053] The formula for calculating the quantitative value of equipment operation damage is as follows: (11) in, This indicates that the equipment parameters have exceeded the limit. This indicates the safety threshold for the parameter.

[0054] The expression for calculating the system toughness damage quantification value is shown below: (12) in, This indicates the actual recovery time of the system after being attacked. This indicates the system's preset recovery time threshold.

[0055] S32: Calculate the comprehensive damage quantification value based on the attack damage quantification result, and classify the current network attack damage of the service according to the damage level according to the damage level preset range and the comprehensive damage quantification value.

[0056] The expression for calculating the comprehensive damage quantification value is as follows: (8) in, This represents the quantified value of attack damage. - Each of the following represents a quantitative weighting coefficient for a damage assessment index that satisfies the following conditions: In this embodiment, the values ​​are determined to be 0.4, 0.25, 0.2, and 0.15 using the analytic hierarchy process. , These represent the quantitative value of business function impairment and the corresponding importance weight, respectively. , These represent the quantitative value of data asset damage and its corresponding importance weight, respectively. , These represent the quantitative values ​​of equipment operational damage and their corresponding importance weights, respectively. , These represent the quantitative value of system toughness damage and the corresponding importance weight, respectively.

[0057] In this embodiment, the damage range for mild damage is set as follows: This indicates no significant business interruption, no data leakage, and minor deviations in equipment parameters; the damage range for moderate damage level is... This indicates partial business interruption, minor sensitive data leakage, and abnormal equipment operation; the damage period for a severe damage level is... This indicates a complete business interruption, a large amount of sensitive data leakage, equipment failure / system resilience failure.

[0058] Based on the comparison between the comprehensive damage quantification value and the preset damage period of the damage level, the current network attack damage to the service is classified into the corresponding damage level.

[0059] S4: Based on the damage level, alarm priorities and maintenance plans are allocated, and alarm information is generated. The alarm information is sent to the operation and maintenance personnel for alarm processing according to the alarm priority order.

[0060] Specifically, such as Figure 6As shown, step S4 includes: S41: Based on the preset priority mapping relationship between damage level and alarm priority, perform alarm priority mapping and repair plan matching according to the damage level of the current network attack, and generate alarm information, as shown below: (13) in, Indicates the alarm priority (including level 1 / level 2 / level 3). This indicates an attack semantic description (e.g., "The hacker tampered with the relay protection settings of the #1 main transformer via the Modbus TCP protocol"). This indicates an impact analysis on operations (e.g., "It leads to deviations in the execution of main transformer control operations, increasing the risk of abnormal load transfer by 80%"). This indicates the maintenance plan. Indicates the attack trigger time. Indicates the location where the attack was triggered (e.g., device ID / business system node). Specifically, a mapping relationship between damage levels and alarm priorities is established in advance. For example, minor damage is mapped to a Level 3 alert alarm, moderate damage to a Level 2 warning alarm, and severe damage to a Level 1 emergency alarm. Alarm priorities are mapped according to the damage level of the current network attack, and corresponding maintenance plans are matched synchronously, such as "immediately suspend remote operation of the main transformer, verify relay protection parameters, and investigate the intrusion path." Alarm content is compiled according to a preset alarm template, including "attack semantic description - business impact analysis - maintenance plan suggestions." .

[0061] S42: Push alarm information to the corresponding maintenance personnel in descending order of alarm priority for alarm processing.

[0062] Specifically, alarm information is pushed to the corresponding operations and maintenance personnel in order of priority, such as level 1 / level 2 / level 3, from emergency to alert, and is displayed visually using attack path graphs and damage quantification curves.

[0063] In this embodiment, as Figure 7 As shown, after step S4, the following steps are also included: S5: Obtain damage quantification feedback data from alarm information, and perform parameter iterative optimization processing on semantic correlation degree and comprehensive damage quantification value based on damage quantification feedback data.

[0064] The expression for the damage quantification feedback data is shown below: (1) in, This represents the damage quantification feedback data. , These represent business semantics, semantic relevance, damage quantification value, and alarm information, respectively. These represent semantic translation accuracy, relevance matching rate, damage quantification deviation, and alarm handling effectiveness, respectively.

[0065] In this embodiment, damage quantification feedback data is collected from range training or live-fire exercises. A gradient descent approach is used to adjust the weighting coefficients of semantic relevance and comprehensive damage quantification value. and semantic association threshold Perform iterative optimization.

[0066] S6: Obtain actual troubleshooting solutions for real network attacks, and iteratively optimize the alarm information generation and push rules.

[0067] The parameter iteration update expression is as follows: (2) in, , They represent the first sequence The parameter values ​​for the next iteration. Indicates the learning rate. , The parameter optimization coefficients are expressed as follows: (3) in, Represents the parameter optimization coefficients. , These represent the semantically based comprehensive damage quantization value and the actual damage quantization value from the damage quantization feedback data, respectively. These represent the correlation matching rate of damage quantification feedback data and the semantic-based correlation matching rate, respectively. These represent the effectiveness of alarm handling based on damage quantification feedback data and the effectiveness of alarm handling based on semantics, respectively.

[0068] In one simulation example, the target scenario is assumed to be "a hacker using the IEC 60870-5-104 protocol to tamper with dispatching and remote control commands, causing abnormal load regulation operations at substation #2": Semantic translation: Translate "IEC 60870-5-104 Message Type 100 Field Tampering" into "Attempt to tamper with dispatch remote control command", generating a semantic feature vector: Dispatch remote control command tampering, Bus005, load adjustment execution stage, Dev012, abnormal, remote control command issued, 2025-10-20 14:30:25 (issue time).

[0069] Semantic association modeling: computation: Establish related links; Damage quantification: (Service interruption for 30 minutes, normal operation time for 50 minutes). (No data breach) (Equipment parameters exceed the 70% threshold). (Recovery time exceeds threshold by 30%).

[0070] The injury was determined to be moderate. Alarm generation: Generate a level 2 alarm. [Level 2, hacker tampered with IEC 60870-5-104 dispatch and remote control commands for substation #2, load regulation execution deviation 60%, equipment parameters exceeding limits 70%, immediately suspend remote dispatching of substation #2, verify remote control command parameters, investigate protocol intrusion path, 2025-10-20 14:30:25, Dev012]; Model Optimization: Practical Feedback =0.05, updated using gradient descent. After optimization =0.452, which is closer to the actual damage.

[0071] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0072] In one embodiment, a power grid network attack damage quantification and alarm generation system based on business semantic translation is provided. This system corresponds one-to-one with the power grid network attack damage quantification and alarm generation method based on business semantic translation in the above embodiments. For example... Figure 8 As shown, the power grid network attack damage quantification and alarm generation system based on business semantic translation includes a data acquisition and translation module, a business semantic association module, an attack damage quantification module, and an alarm generation and push module. Detailed descriptions of each functional module are as follows: The data acquisition and translation module is used to acquire multi-source power grid data when a network attack occurs. It performs semantic recognition on the multi-source power grid data through a preset semantic recognition mechanism to obtain the attack semantics and business semantics of the power grid network attack.

[0073] The business semantic association module is used to calculate the semantic association degree between attack semantics and business semantics, establish the association link between attack semantics and business semantics based on the semantic association degree, and perform data semantic association to obtain semantic association data.

[0074] The attack damage quantification module is used to perform multi-dimensional damage quantification on the current network attack behavior based on semantic association data, and to calculate a comprehensive damage quantification value based on the attack damage quantification results to classify the damage level.

[0075] The alarm generation and push module is used to allocate alarm priorities and maintenance plans based on damage level and generate alarm information. The alarm information is then sent to the operation and maintenance personnel for alarm processing according to the alarm priority order.

[0076] Preferably, after the alarm generation and push module, it also includes: The parameter optimization module is used to obtain damage quantification feedback data from alarm information, and to perform iterative parameter optimization on semantic correlation degree and comprehensive damage quantification value based on the damage quantification feedback data.

[0077] The expression for the damage quantification feedback data is shown below: (1) in, This represents the damage quantification feedback data. , These represent business semantics, semantic relevance, damage quantification value, and alarm information, respectively. These represent semantic translation accuracy, relevance matching rate, damage quantification deviation, and alarm handling effectiveness, respectively.

[0078] The rule optimization module is used to obtain actual troubleshooting solutions for real network attacks and to iteratively optimize the rules for generating and pushing alarm information.

[0079] The parameter iteration update expression is as follows: (2) in, , They represent the first sequence The parameter values ​​for the next iteration. Indicates the learning rate. The parameter optimization coefficients are expressed as follows: (3) in, Represents the parameter optimization coefficients. These represent the semantically based comprehensive damage quantization value and the actual damage quantization value from the damage quantization feedback data, respectively. These represent the correlation matching rate of damage quantification feedback data and the semantic-based correlation matching rate, respectively. These represent the effectiveness of alarm handling based on damage quantification feedback data and the effectiveness of alarm handling based on semantics, respectively.

[0080] Preferably, the data acquisition and translation module specifically includes: The data acquisition submodule is used to acquire attack behavior data, business operation data, equipment status data and network traffic data when network attacks occur, and summarize them to obtain multi-source power grid data.

[0081] The semantic mapping submodule is used to perform semantic mapping on multi-source data of the power grid through a preset data mapping table. Based on the semantic mapping results, the attack semantics and business semantics of power grid network attacks are obtained. The semantic mapping results are shown below: (4) in, Represents the business semantic feature vector. , These represent attack behavior identifiers and attack semantic tags, respectively. , These respectively represent business traffic identifiers and business stage semantics. , These represent the device identifier and the device status semantics, respectively. Indicates the protocol's business semantics. Indicates the timestamp of the occurrence.

[0082] Preferably, the business semantic association module specifically includes: The semantic association analysis submodule is used to construct a business semantic ontology model based on semantic mapping relationships. It then analyzes the semantic associations between attack semantics and business semantics based on this model. The business semantic ontology model is shown below: (5) in, Represents a business semantic vector. Representing semantic elements, Indicates semantic association. Indicates associated attributes.

[0083] The semantic relevance calculation submodule is used to calculate the semantic relevance between attack semantics and business semantics that have a semantic relationship. The semantic relevance calculation expression is as follows: (6) in, Indicates attack semantics and business semantics semantic relevance, , These represent the weighting coefficients, The cosine similarity between attack semantics and business semantics is represented. This indicates the degree of matching between business semantics and device semantics. This indicates a conflict between attack semantics and compliance semantics.

[0084] The association link establishment submodule is used to establish an association link between attack semantics and business semantics when the semantic association degree exceeds the preset semantic association threshold, and obtain semantic association data.

[0085] The conditions for establishing the associated link are as follows: (7) in, This represents the semantic association threshold.

[0086] Preferably, the attack damage quantification module specifically includes: The damage assessment submodule is used to perform a comprehensive damage assessment on semantically related data through a predefined multidimensional damage assessment system. Based on the comprehensive damage assessment results, it performs multidimensional damage quantification on the current network attack behavior to obtain the attack damage quantification results.

[0087] The damage quantification submodule is used to calculate the comprehensive damage quantification value based on the attack damage quantification result, and, in conjunction with the damage level preset range, classify the current network attack damage of the service according to the comprehensive damage quantification value.

[0088] The expression for calculating the comprehensive damage quantification value is as follows: (8) in, This represents the quantified value of attack damage. - These represent the quantitative weighting coefficients for each damage assessment indicator. , These represent the quantitative value of business function impairment and the corresponding importance weight, respectively. , These represent the quantitative value of data asset damage and its corresponding importance weight, respectively. , These represent the quantitative values ​​of equipment operational damage and their corresponding importance weights, respectively. , These represent the quantitative value of system toughness damage and the corresponding importance weight, respectively.

[0089] Preferably, the damage assessment submodule specifically includes: The assessment system construction unit is used to conduct multi-dimensional attack impact range analysis on power grid network attacks and to build a multi-dimensional damage assessment system that includes business functions, data assets, equipment operation and system resilience.

[0090] The expression for calculating the quantitative value of business function impairment is as follows: (9) in, Indicates the duration of service interruption. This indicates the duration of normal business operation.

[0091] The expression for calculating the quantitative value of data asset damage is as follows: (10) in, This indicates the amount of data leaked due to a cyberattack. This represents the total amount of sensitive data related to cyberattacks.

[0092] The formula for calculating the quantitative value of equipment operation damage is as follows: (11) in, This indicates that the equipment parameters have exceeded the limit. This indicates the safety threshold for the parameter.

[0093] The expression for calculating the system toughness damage quantification value is shown below: (12) in, This indicates the actual recovery time of the system after being attacked. This indicates the system's preset recovery time threshold.

[0094] Preferably, the alarm generation and push module specifically includes: The alarm information generation submodule is used to generate alarm information based on the preset priority mapping relationship between damage level and alarm priority, according to the damage level of the current network attack, to perform alarm priority mapping and repair plan matching. The alarm information is shown below: (13) in, Indicates alarm priority. This represents an attack semantic description. This indicates a business impact analysis. This indicates the maintenance plan. Indicates the attack trigger time. Indicates the location where the attack was triggered.

[0095] The alarm information push submodule is used to push alarm information to the corresponding operation and maintenance personnel for alarm processing in descending order of alarm priority.

[0096] Specific limitations regarding the power grid network attack damage quantification and alarm generation system based on business semantic translation can be found in the limitations of the power grid network attack damage quantification and alarm generation method based on business semantic translation mentioned above, and will not be repeated here. Each module in the aforementioned power grid network attack damage quantification and alarm generation system based on business semantic translation can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0097] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data related to power grid network attack damage quantification and alarm generation. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a method for power grid network attack damage quantification and alarm generation based on business semantic translation.

[0098] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements a method for quantifying damage from power grid attacks and generating alarms based on business semantic translation.

[0099] Those skilled in the art will recognize that the units of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application of the technical solution and the constraints involved. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.

[0100] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical functional division. In actual implementation, there may be other division methods, such as multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored.

[0101] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0102] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0103] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A method for quantifying damage and generating alarms from power grid attacks based on business semantic translation, characterized in that, The method includes: The system acquires multi-source data of the power grid at the time of a network attack, and performs semantic recognition on the multi-source data of the power grid through a preset semantic recognition mechanism to obtain the attack semantics and business semantics of the power grid network attack. Calculate the semantic correlation degree between the attack semantics and the business semantics, establish a correlation link between the attack semantics and the business semantics based on the semantic correlation degree, and perform data semantic correlation to obtain semantic correlation data; Based on semantic association data, multi-dimensional damage quantification is performed on the current network attack behavior, and a comprehensive damage quantification value is calculated based on the attack damage quantification results to classify the damage level. Alarm priorities and maintenance plans are allocated based on damage levels, and alarm information is generated. The alarm information is then sent to maintenance personnel for alarm processing according to the alarm priority order.

2. The method for power grid network attack damage quantification and alarm generation based on business semantic translation according to claim 1, characterized in that, After allocating alarm priorities and maintenance plans based on damage levels and generating alarm information, and sending the alarm information to maintenance personnel for alarm processing according to alarm priority, the process also includes: The alarm information is executed to obtain damage quantification feedback data, and the semantic correlation degree and the comprehensive damage quantification value are respectively subjected to parameter iterative optimization processing based on the damage quantification feedback data. The expression for the damage quantification feedback data is as follows: （1） in, This represents the damage quantification feedback data. , These represent business semantics, semantic relevance, damage quantification value, and alarm information, respectively. These represent semantic translation accuracy, relevance matching rate, damage quantification deviation, and alarm handling effectiveness, respectively. Obtain the actual troubleshooting plan for the actual network attack, and iteratively optimize the alarm information generation and push rules. The parameter iteration update expression is as follows: （2） in, , They represent the first sequence The parameter values ​​for the next iteration. Indicates the learning rate. The parameter optimization coefficients are expressed as follows: （3） in, Represents the parameter optimization coefficients. These represent the semantically based comprehensive damage quantization value and the actual damage quantization value from the damage quantization feedback data, respectively. These represent the correlation matching rate of damage quantification feedback data and the semantic-based correlation matching rate, respectively. These represent the effectiveness of alarm handling based on damage quantification feedback data and the effectiveness of alarm handling based on semantics, respectively.

3. The method for power grid network attack damage quantification and alarm generation based on business semantic translation according to claim 1, characterized in that, The process of acquiring multi-source power grid data at the time of a network attack involves performing semantic recognition on the multi-source power grid data using a preset semantic recognition mechanism to obtain the attack semantics and business semantics of the power grid network attack. Specifically, this includes: Data on network attack behavior, business operation, equipment status, and network traffic at the time of the attack are acquired and aggregated to obtain multi-source power grid data. The multi-source data of the power grid is semantically mapped using a preset data mapping table. Based on the semantic mapping results, the attack semantics and business semantics of power grid network attacks are obtained. The semantic mapping results are shown below: （4） in, Represents the business semantic feature vector. , These represent attack behavior identifiers and attack semantic tags, respectively. , These respectively represent business traffic identifiers and business stage semantics. , These represent the device identifier and the device status semantics, respectively. Indicates the protocol's business semantics. Indicates the timestamp of the occurrence.

4. The method for power grid network attack damage quantification and alarm generation based on business semantic translation according to claim 2, characterized in that, The step of calculating the semantic correlation degree between the attack semantics and the business semantics, establishing a correlation link between the attack semantics and the business semantics based on the semantic correlation degree, and obtaining semantically correlated data specifically includes: A business semantic ontology model is constructed based on semantic mapping relationships. The semantic association between attack semantics and business semantics is analyzed based on the business semantic ontology model. The business semantic ontology model is shown below: （5） in, Represents a business semantic vector. Representing semantic elements, Indicates semantic association. Indicates associated attributes; Calculate the semantic correlation degree between attack semantics and business semantics that have a semantic relationship. The expression for calculating the semantic correlation degree is as follows: （6） in, Indicates attack semantics and business semantics semantic relevance, , These represent the weighting coefficients, The cosine similarity between attack semantics and business semantics is represented. This indicates the degree of matching between business semantics and device semantics. This indicates a conflict between attack semantics and compliance semantics; When the semantic correlation degree exceeds a preset semantic correlation threshold, a correlation link is established between attack semantics and business semantics to obtain semantic correlation data. The conditions for establishing the associated link are as follows: （7） in, This represents the semantic association threshold.

5. The method for power grid network attack damage quantification and alarm generation based on business semantic translation according to claim 1, characterized in that, The process of performing multi-dimensional damage quantification on the current network attack behavior based on semantic association data, and calculating a comprehensive damage quantification value based on the attack damage quantification results to classify the damage level specifically includes: The semantically related data is comprehensively assessed for damage using a predefined multidimensional damage assessment system. Based on the comprehensive damage assessment results, the current network attack behavior is subjected to multidimensional damage quantification to obtain the attack damage quantification results. Based on the attack damage quantification results, a comprehensive damage quantification value is calculated, and combined with the damage level preset range, the current network attack damage of the service is classified into damage levels according to the comprehensive damage quantification value. The expression for calculating the comprehensive damage quantification value is as follows: （8） in, This represents the quantified value of attack damage. - These represent the quantitative weighting coefficients for each damage assessment indicator. , These represent the quantitative value of business function impairment and the corresponding importance weight, respectively. , These represent the quantitative value of data asset damage and its corresponding importance weight, respectively. , These represent the quantitative values ​​of equipment operational damage and their corresponding importance weights, respectively. , These represent the quantitative value of system toughness damage and the corresponding importance weight, respectively.

6. The method for power grid network attack damage quantification and alarm generation based on business semantic translation according to claim 5, characterized in that, The process involves performing a comprehensive damage assessment on the semantically related data using a predefined multidimensional damage assessment system, and then performing multidimensional damage quantification on the current network attack behavior based on the comprehensive damage assessment results to obtain the attack damage quantification results. Specifically, this includes: A multi-dimensional attack impact analysis was conducted on power grid network attacks, and a multi-dimensional damage assessment system was constructed that includes business functions, data assets, equipment operation, and system resilience. The expression for calculating the quantitative value of business function impairment is as follows: （9） in, Indicates the duration of service interruption. Indicates the duration of normal business operation; The expression for calculating the quantitative value of data asset damage is as follows: （10） in, This indicates the amount of data leaked due to a cyberattack. This represents the total amount of sensitive data related to cyberattacks; The formula for calculating the quantitative value of equipment operation damage is as follows: （11） in, This indicates that the equipment parameters have exceeded the limit. Indicates the parameter safety threshold; The expression for calculating the system toughness damage quantification value is shown below: （12） in, This indicates the actual recovery time of the system after being attacked. This indicates the system's preset recovery time threshold.

7. The method for power grid network attack damage quantification and alarm generation based on business semantic translation according to claim 1, characterized in that, The process of prioritizing alarms and allocating repair plans based on damage levels, generating alarm information, and sending the alarm information to maintenance personnel for alarm processing according to alarm priority order specifically includes: Based on the preset priority mapping relationship between damage level and alarm priority, alarm priority mapping and repair plan matching are performed according to the damage level of the current network attack to generate alarm information, as shown below: （13） in, Indicates alarm priority. This represents an attack semantic description. This indicates a business impact analysis. This indicates the maintenance plan. Indicates the attack trigger time. Indicates the location where the attack was triggered; The alarm information is pushed to the corresponding maintenance personnel in descending order of alarm priority for alarm processing.

8. A power grid network attack damage quantification and alarm generation system based on business semantic translation, characterized in that, The system includes: The data acquisition and translation module is used to acquire multi-source power grid data when a network attack occurs, and to perform semantic recognition on the multi-source power grid data through a preset semantic recognition mechanism to obtain the attack semantics and business semantics of the power grid network attack. The business semantic association module is used to calculate the semantic association degree between the attack semantics and the business semantics, establish an association link between the attack semantics and the business semantics based on the semantic association degree, and perform data semantic association to obtain semantic association data. The attack damage quantification module is used to perform multi-dimensional damage quantification on the current network attack behavior based on semantic association data, and to calculate a comprehensive damage quantification value based on the attack damage quantification results to classify the damage level. The alarm generation and push module is used to allocate alarm priorities and maintenance plans based on damage level and generate alarm information, and send the alarm information to the operation and maintenance personnel for alarm processing in order of alarm priority.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the power grid network attack damage quantification and alarm generation method based on business semantic translation as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the power grid network attack damage quantification and alarm generation method based on business semantic translation as described in any one of claims 1 to 7.

Images