A power monitoring system full life cycle network security detection and evaluation method

Abstract

The application provides a kind of power monitoring system full life cycle network security detection evaluation method, belongs to power monitoring system network security detection technical field, it can at least partially solve the problem that power monitoring system network security detection stage is fragmented in prior art, standard clause is difficult to execute, detection task is difficult to quantitatively constrain the influence on production operation.The application comprises: collecting the basic data of target power monitoring system and identifying the life cycle stage;Safety protection requirements are converted into executable detection units by constrained generative artificial intelligence model and verified by deterministic rules;Build power production control domain knowledge graph;Use graph neural network model and time series anomaly detection model to obtain asset-level graph risk embedding and operation anomaly vector;Select detection mode under production impact constraints;Fusion output risk score, risk drift index, evidence chain and suggestion.The application realizes the full life cycle network security detection evaluation that can be explained and traced.

Description

Technical Field

[0001] This invention relates to the field of network security testing technology for power monitoring systems, and specifically to a method for network security testing and evaluation throughout the entire lifecycle of a power monitoring system. Background Technology

[0002] Power monitoring systems directly support the monitoring, control, dispatching, protection, and operation management of power plants, substations, and related production control operations. Their network security status directly impacts the safe and stable operation of the power system. With the development of new energy power plants, distributed power sources, remote centralized control, and intelligent operation and maintenance, the asset types, communication paths, business dependencies, and security boundaries of power monitoring systems are becoming increasingly complex.

[0003] Existing network security testing and assessment methods for power monitoring systems mostly rely on manual checklist verification, single-project testing, or single-type equipment scanning. These testing methods are independent of each other and cannot cover the entire lifecycle, including planning and design, implementation, operation, and maintenance. Area segmentation defects in the design phase, deployment deviations in the implementation phase, state drift in the operation phase, and residual risks from changes in the maintenance phase cannot be continuously identified within a unified framework. This results in a lag between assessment conclusions and the actual risk status of the production control network, making it impossible to track and quantify the lifecycle evolution of security risks.

[0004] Meanwhile, power monitoring systems have stringent requirements for real-time performance, high reliability, and continuous production. The network traffic and computational resource overhead generated by ordinary network scanning, active probing, or vulnerability verification can cause unacceptable interference to the production control network. Existing detection technologies typically lack quantitative constraints on the production impact of detection tasks, and cannot dynamically schedule detection modes based on indicators such as allowable detection time windows, detection rates, network load increments, and equipment resource utilization, making it difficult to conduct detection while ensuring real-time stable operation.

[0005] In addition, generative artificial intelligence can help understand standard clauses, analyze evidence, and generate reports, but if it lacks structured output constraints, deterministic rule verification, and evidence verification, it is easy to produce conclusions that cannot be verified by evidence or rectification suggestions that are not suitable for production control scenarios.

[0006] Therefore, how to establish a network security testing and evaluation method for power monitoring systems that can cover the entire lifecycle, make security protection requirements executable, graph the knowledge of production control domain relationships, orchestrate detection modes under production impact budget constraints, and make artificial intelligence output trustworthy is a core problem that has not yet been solved in the field of power monitoring system network security. Summary of the Invention

[0007] The present invention aims to solve at least one of the technical problems existing in the prior art, and to provide a method for network security detection and evaluation of the entire life cycle of a power monitoring system.

[0008] To achieve the above objectives, this invention provides a method for network security detection and evaluation throughout the entire lifecycle of a power monitoring system, comprising: Step S1: Collect basic data of the target power monitoring system, identify the life cycle stage of the target power monitoring system based on the basic data, and load the corresponding detection and evaluation template for the life cycle stage; Step S2: The network security protection requirements applicable to the target power monitoring system are converted into executable detection units through a constrained generative artificial intelligence model. The executable detection unit includes at least a decision predicate and production impact constraints. Deterministic rule verification is performed on the executable detection unit. Executable detection units that fail the verification are rejected or returned to the constrained generative artificial intelligence model for regeneration. Step S3: Construct a knowledge graph of the power production control domain based on the aforementioned basic data; Step S4: Use a graph neural network model to perform risk propagation calculation on the knowledge graph of the power production control domain to obtain asset-level graph risk embedding, and use a time-series anomaly detection model to perform anomaly detection on the time-series sequence of the operation data in the basic data to obtain the operation anomaly vector; Step S5: Select a detection mode based on the production impact constraints in the executable detection unit, and generate a detection task sequence; Step S6: Integrate the asset-level graph risk embedding, the operational anomaly vector, and the judgment results of the executable detection unit to generate the network security risk score, risk drift index, evidence chain, and rectification suggestions for the target power monitoring system.

[0009] Further, in step S1, the basic data includes at least planning and design documents, network topology, asset list, business system and device information, dedicated security equipment information, general security equipment information, communication links, network security policies, device configuration, log events, traffic metadata, vulnerability information, device operating status, and maintenance and change records; the lifecycle stages include the planning and design stage, the implementation and launch stage, the operation stage, and the maintenance stage. When the basic data is mainly based on design schemes, regional division schemes, and equipment selection schemes, it is identified as the planning and design stage; when the basic data includes installation and debugging records, launch applications, and configuration baselines, it is identified as the implementation and launch stage; when the basic data continuously includes traffic metadata, log events, and intrusion detection alarms, it is identified as the operation stage; and when the basic data includes maintenance plans, change orders, and shutdown / reinstatement records, it is identified as the maintenance stage.

[0010] Furthermore, in step S2, the executable detection unit further includes a clause identifier, applicable lifecycle stage, applicable object type, graph matching mode, required evidence type, and risk weight. The executable detection unit is represented by the following structure:

[0011] ; in, Indicates the identifier of the aforementioned terms, This indicates the applicable lifecycle stage. Indicates the applicable object type, This indicates the map matching pattern. Indicates the type of evidence required. Indicates the detection mode. This represents the determination predicate. Indicates the risk weight, This represents the production impact budget corresponding to the production impact constraint.

[0012] Further, in step S2, the constrained generative artificial intelligence model adopts a retrieval-enhanced generation method to retrieve relevant fragments from the security protection requirement library, enterprise detection rule library, historical assessment case library, and object type library, and generates the executable detection unit according to a preset structured template; the deterministic rule verification includes: verifying whether the fields of the executable detection unit are complete, whether the applicable object type exists in the power production control domain knowledge graph, whether the judgment predicate can be verified by the evidence of the required evidence type, and whether the production impact constraint meets the preset production impact budget.

[0013] Furthermore, in step S3, the nodes of the power production control domain knowledge graph include at least business system nodes, monitoring device nodes, network device nodes, dedicated security device nodes, general security device nodes, regional nodes, account nodes, policy nodes, vulnerability nodes, log event nodes, equipment status nodes, and maintenance change nodes; the edges of the power production control domain knowledge graph include at least ownership relationships, communication relationships, protection relationships, isolation relationships, authentication relationships, dependency relationships, change relationships, and violation relationships.

[0014] Further, in step S4, the graph neural network model propagates risk features among nodes in the knowledge graph of the power production control domain based on a neighbor aggregation mechanism. The input features of the graph neural network model include at least asset importance, regional exposure, vulnerability severity, policy compliance, equipment health, alarm density, and change frequency. The update formula for node risk embedding is: ; in, For nodes In the Risk embedding of layers, For nodes The set of neighboring nodes, For aggregate functions, and For model parameters, For bias terms, This is the activation function.

[0015] Further, in step S4, the time-series sequence of the running data includes the time-series sequence of log events, the time-series sequence of traffic metadata, and the time-series sequence of device operating status. The time-series anomaly detection model adopts a self-supervised training method to perform at least one of mask event prediction, next event prediction, or state drift prediction on the time-series sequence of the running data to obtain the running anomaly vector.

[0016] Furthermore, in step S5, the detection modes include document review mode, passive detection mode, digital twin verification mode, and restricted online detection mode; the production impact constraints include at least the allowed detection time window, maximum detection rate, prohibited control command types, maximum network load increment, maximum device resource utilization, rollback conditions, and approval conditions; when the expected impact of a certain detection task in the detection task sequence exceeds the preset production impact budget, the execution of the detection task is prohibited or the detection task is switched to the digital twin verification mode.

[0017] Furthermore, in step S6, the fusion also includes evidence credibility and the stage weight corresponding to the lifecycle stage, and the output of step S6 also includes a compliance score; the risk drift index is calculated by comparing the node differences, edge differences, strategy differences, abnormal event differences, and equipment status differences between the current power production control domain knowledge graph and the historical baseline knowledge graph; the rectification suggestions are generated by the constrained generative artificial intelligence model and verified by the evidence verifier. When the rectification suggestions fail to be associated with at least one executable detection unit, at least one entity in the power production control domain knowledge graph, and at least one evidence identifier, the rectification suggestions are marked as unconfirmed suggestions and are not included in the formal evaluation conclusion.

[0018] Furthermore, the digital twin verification mode includes: A digital twin environment is generated based on the network topology, asset configuration, communication links, policy configuration, and historical traffic of the target power monitoring system. Access path verification, policy conflict verification, configuration deviation verification, and change impact verification are performed in the digital twin environment. The verification results of the digital twin environment are used as a prerequisite for whether the detection task in the restricted online detection mode is allowed to be executed.

[0019] The beneficial effects of this invention are as follows: This invention incorporates the four stages of planning and design, implementation and launch, operation and maintenance into a unified testing and evaluation process. By identifying the life cycle stages and loading the corresponding testing and evaluation templates, it overcomes the shortcomings of traditional testing methods, such as each stage being independent, risk omission, and evaluation lag.

[0020] This invention transforms network security protection requirements into executable, verifiable, and traceable detection units through a constrained generative artificial intelligence model and a deterministic rule validator. This avoids the problems of ambiguity in the interpretation of standard clauses and low efficiency in the manual decomposition of clauses. At the same time, rule validation ensures that the detection unit fields output by the generative artificial intelligence are complete and logically executable.

[0021] This invention constructs a knowledge graph of the power production control domain and uses a graph neural network model to propagate risk characteristics between knowledge graph nodes, identify risk propagation paths between assets, links, regions, safety equipment and policies, and continuously detects deviations in safety status during operation and maintenance phases by combining a time-series anomaly detection model, thus realizing risk correlation analysis and dynamic assessment capabilities.

[0022] This invention, through production impact budget constraints and detection mode arrangement, dynamically selects the execution mode among document review, passive detection, digital twin verification, and restricted online detection, thus avoiding the impact of high-intensity active detection on the real-time stable operation of the power monitoring system.

[0023] This invention performs correlation verification on rectification suggestions through evidence verification and structured constraints, and marks rectification suggestions that fail the verification as unconfirmed suggestions, thereby improving the interpretability and auditability of the assessment conclusions. Attached Figure Description

[0024] Figure 1 This is an overall flowchart of the power monitoring system full lifecycle network security detection and evaluation method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the full lifecycle state machine according to an embodiment of the present invention; Figure 3 This is a flowchart illustrating the generation and verification process of the detection unit in an embodiment of the present invention. Figure 4 This is a flowchart illustrating the knowledge graph and intelligent risk assessment process according to an embodiment of the present invention. Figure 5 This is a flowchart of the production impact constraint detection and arrangement process according to an embodiment of the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and beneficial effects of this application clearer, the following detailed description, in conjunction with the accompanying drawings and specific embodiments, further clarifies this application. It should be understood that the specific embodiments described in this specification are merely for explaining this application and are not intended to limit it.

[0026] The overall technical solution of the power monitoring system full life cycle network security detection and evaluation method of the present invention will be described below.

[0027] See Figure 1 The power monitoring system full life cycle network security detection and evaluation method of the present invention includes steps S1 to S6, and each step is described in detail below.

[0028] Step S1 involves collecting basic data from the target power monitoring system, identifying the lifecycle stage of the target power monitoring system based on this basic data, and loading corresponding detection and evaluation templates for each lifecycle stage. The basic data refers to a dataset collected from the target power monitoring system and its associated business environment, covering various information from the design phase to the operation and maintenance phase. This dataset provides the input data foundation for subsequent detection unit generation, knowledge graph construction, and risk assessment. The basic data may include, but is not limited to, the following types: planning and design documents, network topology, asset list, business system and device information, dedicated security equipment information, general security equipment information, communication links, network security policies, device configurations, log events, traffic metadata, vulnerability information, device operating status, and maintenance change records. The commonality among different types of basic data is that they all reflect the network security status information of the target power monitoring system at different lifecycle stages and all serve as input for subsequent steps.

[0029] The lifecycle stages include four phases: planning and design, implementation and launch, operation, and maintenance. The identification of each lifecycle stage is automatically determined based on the input data type, time characteristics, work order status, and operational status. In a preferred embodiment, when the basic data primarily consists of design schemes, regional division schemes, network security protection schemes, and equipment selection schemes, it is identified as the planning and design phase; when the basic data includes installation and commissioning records, launch applications, configuration baselines, and on-site commissioning records, it is identified as the implementation and launch phase; when the basic data continuously includes traffic metadata, log events, intrusion detection alarms, equipment status, and policy operation records, it is identified as the operation phase; and when the basic data includes maintenance plans, change work orders, shutdown and reinstatement records, policy adjustment records, and retesting records, it is identified as the maintenance phase. In alternative embodiments, lifecycle stage identification can also be achieved through rule engines, decision tree classifiers, or classification models based on historical labels. The choice of identification method does not affect the logic of subsequent detection unit generation and knowledge graph construction.

[0030] The testing and evaluation templates specify the scope of testing objects, types of testing evidence, risk weight allocation, optional testing modes, and production impact constraint baselines for each stage. The templates for the planning and design stage focus on reviewing protection schemes, ensuring the rationality of regional divisions, and guaranteeing the completeness of safety equipment selection; the templates for the implementation and go-live stage focus on deployment consistency, configuration baseline compliance, and pre-go-live risks; the templates for the operation stage focus on routine monitoring, state drift, and anomaly identification; and the templates for the maintenance stage focus on change impact assessment and post-maintenance review.

[0031] Step S2 involves converting the network security protection requirements applicable to the target power monitoring system into executable detection units using a constrained generative artificial intelligence model, and then validating them through deterministic rules. The constrained generative artificial intelligence model refers to a generative artificial intelligence model operating under structured output constraints. Its input is the standard clause text of the network security protection requirements, and its output is executable detection units formatted according to a preset structured template. Its core processing mechanism involves retrieving relevant content fragments from a multi-source knowledge base and generating detection units according to a fixed template. "Constrained" means that the model's output format, field range, and content boundaries are all limited by the preset structured template, disallowing the free generation of content that does not conform to the template format.

[0032] The constrained generative artificial intelligence model can be implemented in, but is not limited to, the following ways: a large language model pipeline based on retrieval-enhanced generation, a conditional text generation model based on template filling, and a structured output generation model guided by a knowledge graph. The commonalities among these different implementations are: all accept standard clause text as input, all retrieve auxiliary information from a knowledge base, all output structured executable detection units according to a fixed template, and none directly generate unverified formal evaluation conclusions.

[0033] In a preferred embodiment, the constrained generative AI model employs a retrieval-enhanced generation method. The retrieval enhancement module searches for semantically relevant fragments from a security protection requirement database, an enterprise detection rule database, a historical assessment case database, and an object type database. The retrieved fragments are then concatenated with the input clause and fed into the generative AI model, which outputs an executable detection unit according to a preset structured template. The output of the constrained generative AI model cannot be directly used as a formal assessment conclusion; it must be verified by a rule validator and an evidence validator.

[0034] The executable detection unit includes at least a decision predicate and a production impact constraint. The decision predicate is used to generate a decision result in subsequent step S6, and the production impact constraint is used as the basis for selecting the detection mode in subsequent step S5. In a further embodiment, the executable detection unit also includes a clause identifier, applicable lifecycle stage, applicable object type, graph matching mode, required evidence type, detection mode, and risk weight, which can be represented by the following nine-tuple structure:

[0035] ; in, For the purpose of identifying terms and conditions, To be applicable to the lifecycle stage, For applicable object types, For knowledge graph matching patterns, For the required type of evidence, For detection mode, To determine the predicate, Risk weighting To impact the production budget.

[0036] The deterministic rule verification is performed by a rule verifier. For each executable detection unit, the rule verifier sequentially checks the following: whether the field is complete, whether the applicable object type exists in the power production control domain knowledge graph, whether the graph matching pattern is executable, whether the judgment predicate can be verified by the required evidence type, whether the detection pattern meets the production impact budget, and whether the risk weight is within a preset range. If any check fails, the detection unit is rejected or returned to the constrained generative artificial intelligence model for regeneration. Only detection units that pass all checks are allowed to enter the subsequent detection task sequence.

[0037] Step S3 involves constructing a knowledge graph for the power production control domain based on the aforementioned basic data. This knowledge graph is a knowledge representation method that models entities, relationships, and attributes in the target power monitoring system using a graph structure. It means that among them For a set of nodes, Let be the set of edges. The node feature matrix, Let be the edge feature matrix.

[0038] The nodes in the power production control domain knowledge graph may include, but are not limited to, the following types: business system nodes, monitoring device nodes, network device nodes, dedicated security device nodes, general security device nodes, area nodes, account nodes, policy nodes, vulnerability nodes, log event nodes, equipment status nodes, and maintenance change nodes. The edges may include, but are not limited to, the following types: ownership relationships, communication relationships, protection relationships, isolation relationships, authentication relationships, dependency relationships, change relationships, and violation relationships. The commonality among different types of nodes and edges is that they all reflect business relationships, security constraints, or state change relationships between entities in the power production control domain, and can all be used as input to the graph neural network model in step S4 for risk propagation calculation.

[0039] In a preferred embodiment, the node set is further refined as follows: business system nodes include DCS monitoring systems and SIS security instrumented systems; monitoring device nodes include monitoring hosts, engineer workstations, and operator workstations; network device nodes include communication gateways and switches; dedicated security device nodes include lateral isolation devices, vertical authentication devices, log auditing devices, and intrusion detection devices; and general security device nodes include firewalls and security monitoring platforms. Node characteristics include asset importance, area exposure, vulnerability severity, configuration deviation, alarm density, log completeness, device health, and change frequency. Edge characteristics include communication protocol, access direction, access frequency, policy hit rate, isolation strength, authentication status, and historical anomaly count.

[0040] Step S4 involves obtaining the asset-level graph risk embedding using a graph neural network model and obtaining the operational anomaly vector using a time-series anomaly detection model. The graph neural network model refers to a deep learning model that performs risk propagation calculations on the knowledge graph of the power production control domain. Its input consists of the node features and edge features of the knowledge graph constructed in step S3. Its core processing mechanism is to fuse the node's own features with the features of neighboring nodes through multi-layer neighbor aggregation and propagate risk information. Its output is the asset-level graph risk embedding vector for each node.

[0041] The graph neural network model can be implemented in, but is not limited to, the following ways: graph convolutional networks, graph attention networks, and graph sampling aggregation networks. The commonalities among these different implementations are: they all use the node features and edge structure of the knowledge graph as input, all propagate information between nodes through a neighbor aggregation mechanism, and all output node-level risk embedding vectors. In a preferred embodiment, the graph neural network model propagates risk features between nodes in the power production control domain knowledge graph based on the neighbor aggregation mechanism. The input features of the graph neural network model include at least asset importance, regional exposure, vulnerability severity, policy compliance, equipment health, alarm density, and change frequency. The update formula for node risk embedding is: ; in, For nodes In the Risk embedding of layers, For nodes The set of neighboring nodes, For aggregate functions, and For model parameters, For bias terms, This is the activation function.

[0042] The aforementioned time-series anomaly detection model refers to a deep learning model that performs anomaly identification on the time-series sequence of operational data. Its input is the time-series sequence of operational data in the basic data, including log event sequences, traffic metadata sequences, and device operating status sequences. Its core processing mechanism is to learn the time-series feature representation of normal operating modes through self-supervised pre-training, and its output is an operational anomaly vector.

[0043] The temporal anomaly detection model can be implemented, but is not limited to, the following methods: a self-supervised sequence model based on a Transformer encoder, a Long Short-Term Memory network, and a temporal convolutional network. The commonalities among these different implementations are: they all use temporal sequences as input, all learn normal pattern representations through self-supervision, and all output vectors representing the degree of sequence anomaly. In a preferred embodiment, the temporal anomaly detection model employs self-supervised training to perform masked event prediction on log event sequences, next event prediction on traffic metadata sequences, and state drift prediction on device operating state sequences.

[0044] The asset-level graph risk embedding and the operational anomaly vector output in step S4 serve as the core inputs for the fusion score calculation in step S6.

[0045] Step S5 involves selecting a detection mode and generating a detection task sequence based on the production impact constraints in the executable detection unit. The production impact constraints refer to the quantitative constraints set for the potential impact of the detection task execution on the production and operation of the power monitoring system. These constraints may include, but are not limited to, the following indicators: allowed detection time window, maximum detection rate, prohibited control command types, maximum network load increment, maximum equipment resource utilization, rollback conditions, and approval conditions.

[0046] The production impact constraint orchestrator calculates the expected impact of each validated executable detection unit generated in step S2 based on its production impact constraint field. When the expected impact meets the preset production impact budget, restricted online detection is allowed; when the expected impact exceeds the preset production impact budget but can be executed in the digital twin environment, the system switches to digital twin verification mode; when the detection task exceeds the preset production impact budget and cannot be executed in digital twin verification mode, only passive detection mode or document review mode is retained.

[0047] The document review mode only parses and judges design documents, policy documents, configuration baselines, and policy documents. The passive detection mode only collects traffic metadata, log events, device status, and alarm information, without sending probe messages to the target power monitoring system. The digital twin verification mode generates a digital twin environment based on the network topology, asset configuration, communication links, policy configuration, and historical traffic of the target power monitoring system. Access path verification, policy conflict verification, configuration deviation verification, risk propagation verification, and change impact verification are performed within this digital twin environment, and the verification results serve as a prerequisite for whether the restricted online detection task can be executed. The restricted online detection mode executes read-only, low-speed, and rollback-enabled detection tasks under the conditions of approval, permitted time window, and budget compliance.

[0048] Step S6 involves fusing the asset-level graph risk embedding, the operational anomaly vector, and the judgment results of the executable detection unit to generate a cybersecurity risk score, risk drift index, evidence chain, and rectification recommendations for the target power monitoring system. In a further implementation, the fusion input also includes evidence credibility and the stage weights corresponding to the lifecycle stages, and the fusion output includes a compliance score.

[0049] The comprehensive risk score can be expressed as: ; in, For nodes In time The risk value, The graph risk embedding for this node is output from step S4. This is the runtime anomaly vector for this time window output in step S4. The degree of non-compliance of the executable detection unit associated with this node. This is the inverse value of the credibility of the evidence associated with this node. , , , These are the weighting parameters. The overall system risk score is... ,in For nodes The weight of business importance.

[0050] The risk drift index is calculated by comparing the node differences, edge differences, policy differences, anomaly event differences, and equipment status differences between the current power production control domain knowledge graph and the historical baseline knowledge graph. The risk drift index characterizes the degree of deviation of the network security status from the baseline status during the operation or maintenance phase.

[0051] The rectification suggestions are generated by the constrained generative AI model and verified by the evidence verifier. The evidence verifier checks each rectification suggestion for: whether it corresponds to at least one executable detection unit, whether a corresponding entity and relationship exist in the knowledge graph, and whether there are supporting evidence identifiers in the evidence chain. When the conditions are not met, the rectification suggestion is marked as an unconfirmed suggestion and is not included in the formal evaluation conclusion.

[0052] The above is a description of the overall technical solution of the present invention. The following detailed explanation of each step is provided through specific embodiments.

[0053] Example 1 This embodiment focuses on the power monitoring system of a power plant. This system comprises one DCS (Distributed Control System), one SIS (Safety Instrumented System), three operator stations, two engineer stations, two communication gateways, six switches, two lateral isolation devices, two vertical authentication devices, one log auditing device, and one intrusion detection device, totaling approximately 60 assets. This embodiment relates to the network security testing and evaluation process of the power monitoring system during its operational phase.

[0054] Step S1: Collect basic data of the target power monitoring system, identify the life cycle stage, and load the detection and evaluation template.

[0055] In this embodiment, the scope of basic data collection covers network topology files, asset lists, configuration files for each device, network security policy configuration tables, log events, traffic metadata, intrusion detection alarm records, operational status information for each device, and recent maintenance and change records. For design documents and topology diagrams that cannot be directly and automatically collected, structured data is generated through a combination of document parsing and manual verification.

[0056] Lifecycle phase identification: In this embodiment, the basic data continuously includes traffic metadata, log events, intrusion detection alarms and device operating status. Based on this, the system determines that the target power monitoring system is currently in the operating phase and loads the detection and evaluation template for the operating phase.

[0057] The operational phase testing and evaluation template specifies: the scope of testing covers all operational assets and their communication relationships; testing evidence types include log records, traffic records, alarm records, configuration snapshots, and status snapshots; in the risk weighting, assets directly connected to the critical business system DCS have a weight of 0.9, assets directly connected to the SIS have a weight of 1.0, and ordinary auxiliary equipment has a weight of 0.5; optional testing modes include passive testing, digital twin verification, and restricted online testing; the production impact constraint baseline is set as follows: the allowed testing time window is during off-peak hours, the maximum detection rate is 10 packets / second, the execution of any control commands is prohibited, the maximum network load increment does not exceed 5% of the rated bandwidth, and the maximum equipment resource utilization rate does not exceed 10%.

[0058] Step S2: The network security protection requirements are converted into executable detection units through a constrained generative artificial intelligence model and then validated by deterministic rules.

[0059] In this embodiment, the retrieval enhancement module retrieves clauses related to the operational phase from the safety protection requirements library, retrieves existing testing rules for the power plant from the enterprise testing rule library, and retrieves historical assessment records of similar power plants from the historical assessment case library. The constrained generative artificial intelligence model generates executable testing units line by line according to the nine-tuple structured template.

[0060] Taking log integrity detection as an example, the executable detection unit generated by the constrained generative artificial intelligence model is: =Log integrity clause number, =Running phase, =Dedicated safety equipment, =Query the dedicated security device nodes and the relationship edges that have not reported logs in the last 24 hours. =Log index and device status, =Passive detection, =If a dedicated security device node exists but has no log reports in the last 24 hours, it is considered non-compliant. =0.7, =Low impact.

[0061] The rule validator checks the detection unit sequentially: all nine fields are filled in completely. The specialized security devices in the knowledge graph have corresponding nodes. The described query patterns can be executed within the knowledge graph. The described decision logic can be derived from Log indexing and device status verification. For passive detection to meet For low-impact constraints, The value 0.7 is within the preset range of 0 to 1. All checks pass, and the detection unit proceeds to the next detection task sequence.

[0062] In this embodiment, the constrained generative artificial intelligence model generates a total of 42 executable detection units. After verification by the rule validator, 38 units pass the verification and enter the detection task sequence, while 4 units are returned for regeneration due to incomplete fields or the judgment predicate being unable to be verified by the specified evidence.

[0063] Step S3: Construct a knowledge graph of the power production control domain.

[0064] In this embodiment, the power production control domain knowledge graph constructed based on the aforementioned basic data contains a total of 187 nodes and 423 edges. The node types are distributed as follows: 2 business system nodes, 5 monitoring device nodes, 8 network device nodes, 6 dedicated security device nodes, 1 general security device node, 4 regional nodes, 28 account nodes, 56 policy nodes, 12 vulnerability nodes, 35 log event nodes, 18 device status nodes, and 12 maintenance and change nodes.

[0065] The edge types are distributed as follows: 62 belonging edges, 87 communication edges, 24 protection edges, 16 isolation edges, 14 authentication edges, 38 dependency edges, 12 change edges, and 3 violation edges.

[0066] Node feature assignment: Taking DCS business system nodes as an example, asset importance =1.0, regional exposure =0.3, vulnerability severity =0.4, strategy compliance =0.85, Equipment Health =0.95, alarm density =0.2, frequency of change =0.1.

[0067] Step S4: Use a graph neural network model to obtain asset-level graph risk embeddings and use a time-series anomaly detection model to obtain operational anomaly vectors.

[0068] Graph Neural Network Model: In this embodiment, the graph neural network model adopts a 3-layer graph convolutional network structure, with each layer containing 128-dimensional hidden features. The activation function is the ReLU function, and the aggregation function is... Mean aggregation is employed. The input feature dimension is 7-dimensional, and the output dimension is 64-dimensional asset-level graph risk embedding vector.

[0069] The node risk embedding is updated layer by layer according to the following formula: ; in, For nodes initial feature vector , For nodes The number of neighbors. After three layers of aggregation, each node obtains a 64-dimensional risk embedding vector that incorporates neighbor risk information. .

[0070] Temporal Anomaly Detection Model: In this embodiment, the temporal anomaly detection model adopts a self-supervised sequence model based on a Transformer encoder. The input consists of a log event sequence of the past 30 days (aggregated in 5-minute windows, totaling 8640 time steps), a traffic metadata sequence (aggregated in 5-minute windows for connection frequency and total bytes), and a device operating status sequence (sampled in 5-minute windows for CPU utilization and memory usage). The Transformer encoder contains 4 self-attention layers with 8 attention heads and 256 hidden dimensions.

[0071] The self-supervised training method of the time series anomaly detection model is masked event prediction: 15% of time steps are randomly masked, and the model is trained to predict the event type and numerical characteristics of the masked time steps. After training, newly acquired time series data is input into the model, and the prediction reconstruction error for each time step is calculated. Time steps with reconstruction errors exceeding the mean plus three times the standard deviation are marked as anomalous time steps. The feature vectors of all anomalous time steps are aggregated into a 32-dimensional running anomaly vector. .

[0072] Step S5: Select the detection mode based on production impact constraints and generate a detection task sequence.

[0073] In this embodiment, the production impact constraint orchestrator calculates the expected impact for each of the 38 validated executable detection units. The calculation of the expected impact is based on the detection mode, detection frequency, number of target devices, and expected network traffic increment of the detection unit.

[0074] The arrangement results are as follows: 18 detection units were assigned to passive detection mode, 12 to document review mode, 5 to digital twin verification mode, and 3 to restricted online detection mode.

[0075] In this embodiment, the execution process of the digital twin verification mode is as follows: Based on the network topology file of the target power monitoring system, configuration snapshots of 60 assets, communication link information, security policy configuration, and historical traffic data for the past 30 days, a digital twin copy of the target system is constructed in an isolated simulation environment. Access path verification and policy conflict verification involving five detection units are performed in the digital twin copy. The results of the digital twin verification are fed back to the detection task sequence as a preliminary criterion for whether restricted online detection is allowed to be performed in the production network.

[0076] Step S6: Perform fusion calculations and generate evaluation results.

[0077] In this embodiment, the comprehensive risk score is calculated using the following formula: ; The weight parameter is set to , , , . The value ranges from 0 to 1, where 0 indicates that all detection units associated with the node comply, and 1 indicates that none of them comply. The value ranges from 0 to 1, where 0 indicates that the evidence is completely credible and 1 indicates that it is completely unreliable.

[0078] Overall system risk score ,in Assets are allocated according to their importance in the business context. In this embodiment, The calculated result is 0.32, corresponding to a low to medium risk level.

[0079] The compliance score was calculated based on the results of 38 executable test items: the pass rate was 82%.

[0080] The risk drift index is calculated based on a comparison between the current knowledge graph and the baseline knowledge graph from 90 days ago: 3 new nodes, 5 new edges, and 2 policy differences. The overall risk drift index is 0.18, indicating that the safety status deviates slightly from the baseline.

[0081] Evidence chain output: Each non-compliant detection unit is associated with the corresponding evidence source, collection time, and associated object.

[0082] Rectification suggestion output: The constrained generative AI model generates rectification suggestions for the 7 non-compliance items. The evidence validator performs correlation verification on each rectification suggestion. In this embodiment, 6 rectification suggestions pass the verification and enter the formal report, while 1 rectification suggestion is marked as an unconfirmed suggestion because it cannot be associated with the corresponding entity in the knowledge graph.

[0083] Example 2 This embodiment uses a power plant's power monitoring system in the planning and design phase as an example to verify the applicability of the present invention in the design phase. This power monitoring system is a new project, planned to include 1 DCS, 1 SIS, 4 operator stations, 2 engineer stations, 3 communication gateways, 8 switches, 2 sets of horizontal isolation devices, 2 sets of vertical authentication devices, 1 set of log auditing devices, and 1 set of intrusion detection devices.

[0084] Step S1: Collect basic data of the target power monitoring system, identify the life cycle stage, and load the detection and evaluation template.

[0085] In this embodiment, the basic data mainly consists of design schemes, network security protection schemes, regional division schemes, equipment selection lists, and service access matrices. Since the project is still in the planning and design phase, there is no operational data such as log events, traffic metadata, and intrusion detection alarms. Based on this, the system determines that the target power monitoring system is currently in the planning and design phase and loads the detection and evaluation template for the planning and design phase.

[0086] The testing and evaluation template for the planning and design phase stipulates that: the scope of testing covers all planning assets and their planning communication relationships in the design scheme; the types of testing evidence include design scheme documents, area division descriptions, safety equipment selection lists, and business access matrices; the optional testing mode is limited to document review mode; and the production impact constraint baseline is set to zero impact.

[0087] Step S2: The network security protection requirements are converted into executable detection units through a constrained generative artificial intelligence model and then validated by deterministic rules.

[0088] In this embodiment, the constrained generative artificial intelligence model focuses on security partition detection, cross-zone access path detection, boundary protection device selection detection, vertical authentication design detection, log audit design detection, and intrusion detection access design detection for the executable detection units generated during the planning and design phase.

[0089] Taking cross-region access path detection as an example, the generated executable detection unit is: =Regional boundary protection clause number, =Planning and design stage, =Regional nodes and communication edges, =Query all cross-region communication paths that are not associated with isolated or authenticated device nodes. =Topology file and region division description, =Document review, =If a cross-regional communication path exists but is not associated with isolated or authenticated devices, it is considered non-compliant. =0.9, =Zero impact.

[0090] In this embodiment, the constrained generative artificial intelligence model generates a total of 28 executable detection units, all of which pass the verification by the rule validator.

[0091] Step S3: Construct a knowledge graph of the power production control domain.

[0092] In this embodiment, since it is in the planning and design phase, the knowledge graph is constructed based on the planned assets and communication relationships described in the design document. The knowledge graph contains a total of 126 nodes and 285 edges. Among the node features, asset importance is assigned a value based on the degree of business association in the business access matrix, and regional exposure is assigned a value based on the regional security level in the regional division scheme. The remaining features are assigned a default baseline value of 0 during the planning and design phase because there is no actual operational data.

[0093] Step S4: Use a graph neural network model to obtain asset-level graph risk embeddings and use a time-series anomaly detection model to obtain operational anomaly vectors.

[0094] In this embodiment, the architecture and parameters of the graph neural network model are the same as in Embodiment 1, and the input is the node features and edge structure of the knowledge graph in the planning and design phase. Since there is no time-series data on log events, traffic metadata, and device operating status in the planning and design phase, the time-series anomaly detection model is not executed; instead, the anomaly vector is run. Set as a zero vector. Risk assessment during the planning and design phase relies entirely on graph neural network models to identify structural risks based on asset allocation and communication relationships within the design scheme.

[0095] Step S5: Select the detection mode based on production impact constraints and generate a detection task sequence.

[0096] In this embodiment, since the production impact constraint during the planning and design phase has zero impact, all 28 executable detection units are assigned to document review mode. The detection task sequence is arranged in descending order of risk weight, with priority given to security partition detection and cross-regional access path detection, which have higher weights.

[0097] Step S6: Perform fusion calculations and generate evaluation results.

[0098] In this embodiment, since the abnormal operation vector is a zero vector, the comprehensive risk scoring formula... With zero items, the risk score is entirely determined by the graph risk embedding. and the judgment result of the detection unit Decide.

[0099] The evaluation results showed that the knowledge graph identified one cross-regional business access path that was not associated with a vertical authentication device in the design scheme. The system generated a design flaw issue and output corresponding evidence and rectification suggestions. The rectification suggestions passed the evidence validator and were included in the formal evaluation conclusion.

[0100] Example 3 This embodiment takes the power monitoring system of a power plant under maintenance as an example to verify the applicability of the present invention during the maintenance phase and the calculation logic of the risk drift index.

[0101] The execution logic of steps S1 to S3 is the same as in Embodiment 1, except that in this embodiment, the basic data includes maintenance plans, change orders, and shutdown / reinstatement records. Based on this, the system determines that it is currently in the maintenance phase and loads the maintenance phase's inspection and evaluation template. The maintenance phase template focuses on change impact assessment and post-maintenance review.

[0102] In step S2, the executable detection units generated by the constrained generative artificial intelligence model for the maintenance phase include: consistency detection of policies before and after changes, detection of the impact of changes on related devices, detection of whether temporary access policies are deleted after maintenance, detection of log recovery of dedicated security devices after changes, and detection of linkage relationship recovery.

[0103] In step S3, the knowledge graph, based on the baseline version before maintenance, updates the configuration attributes and associated strategy edges of relevant nodes according to the maintenance change records. One node and two edges are added to the changed nodes.

[0104] The execution logic of steps S4 to S5 is the same as that in Example 1.

[0105] In step S6, the risk drift index is calculated as follows: The system compares the differences between the current knowledge graph and the baseline knowledge graph before maintenance. Node differences include the attribute changes of one newly added or changed node and the nodes affected by the changes; edge differences include the attribute changes of two newly added or changed edges and the communication edges affected by the changes; policy differences include the security policy of the affected devices being updated from the old version to the new version; and device status differences include the firmware version change of the affected devices.

[0106] The overall risk drift index is 0.35, indicating a moderate deviation from the baseline in terms of safety status. The system highlights areas affected by changes with significant deviations, and recommends performing post-maintenance verification and testing.

[0107] Post-maintenance review revealed that the temporary access policy for debugging equipment affected by the changes during maintenance was not deleted after maintenance. The system confirmed this issue through passive detection and configuration comparison, generated rectification suggestions, and included them in the formal evaluation conclusion after verification by the evidence validator.

[0108] In summary, the embodiments disclosed herein have at least the following technical effects: This invention incorporates the four stages of planning and design, implementation and launch, operation and maintenance into a unified testing and evaluation framework through a full life cycle state machine and a corresponding testing and evaluation template loading mechanism. This overcomes the shortcomings of traditional testing methods, such as independent stages, risk omissions and delayed evaluations.

[0109] This invention achieves automated conversion of security protection requirements into executable detection units through a collaborative mechanism of constrained generative artificial intelligence models and deterministic rule verifiers. Each detection unit contains a clause identifier, evidence type, and judgment predicate, which can be traced back to the original clause source, thus improving the efficiency and accuracy of standard clause enforcement.

[0110] This invention constructs a knowledge graph of the power production control domain and utilizes a graph neural network model to propagate risk features between nodes. This enables the risk assessment of a single node to incorporate risk information from its neighboring nodes and associated paths, achieving multi-level risk correlation analysis at the asset, path, and regional levels. Furthermore, by combining the operational anomaly vectors of the time-series anomaly detection model, it achieves the fusion of static graph analysis and dynamic time-series monitoring.

[0111] This invention utilizes production impact budget constraints and the dynamic arrangement of four detection modes to conduct network security detection while ensuring the real-time stable operation of the power monitoring system, thus avoiding unacceptable interference to the production control network caused by traditional active scanning and detection.

[0112] This invention performs correlation verification on rectification suggestions through an evidence verifier, marking suggestions that fail to be associated with detection units, knowledge graph entities, and evidence identifiers as unconfirmed suggestions. This reduces the impact of generative AI illusions on formal evaluation conclusions and improves the interpretability and auditability of the evaluation conclusions.

[0113] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for network security detection and evaluation throughout the entire lifecycle of a power monitoring system, characterized in that, include: Step S1: Collect basic data of the target power monitoring system, identify the life cycle stage of the target power monitoring system based on the basic data, and load the corresponding detection and evaluation template for the life cycle stage; Step S2: The network security protection requirements applicable to the target power monitoring system are converted into executable detection units through a constrained generative artificial intelligence model. The executable detection unit includes at least a decision predicate and production impact constraints. Deterministic rule verification is performed on the executable detection unit. Executable detection units that fail the verification are rejected or returned to the constrained generative artificial intelligence model for regeneration. Step S3: Construct a knowledge graph of the power production control domain based on the aforementioned basic data; Step S4: Use a graph neural network model to perform risk propagation calculation on the knowledge graph of the power production control domain to obtain asset-level graph risk embedding, and use a time-series anomaly detection model to perform anomaly detection on the time-series sequence of the operation data in the basic data to obtain the operation anomaly vector; Step S5: Select a detection mode based on the production impact constraints in the executable detection unit, and generate a detection task sequence; Step S6: Integrate the asset-level graph risk embedding, the operational anomaly vector, and the judgment results of the executable detection unit to generate the network security risk score, risk drift index, evidence chain, and rectification suggestions for the target power monitoring system.

2. The method for network security detection and evaluation of a power monitoring system throughout its entire lifecycle, as described in claim 1, is characterized in that... In step S1, the basic data includes at least planning and design documents, network topology, asset list, business system and device information, dedicated security equipment information, general security equipment information, communication links, network security policies, device configuration, log events, traffic metadata, vulnerability information, device operating status, and maintenance and change records. The lifecycle stages include the planning and design stage, implementation and launch stage, operation stage, and maintenance stage. When the basic data is mainly based on design schemes, regional division schemes, and equipment selection schemes, it is identified as the planning and design stage. When the basic data includes installation and debugging records, launch applications, and configuration baselines, it is identified as the implementation and launch stage. When the basic data continuously includes traffic metadata, log events, and intrusion detection alarms, it is identified as the operation stage. When the basic data includes maintenance plans, change orders, and shutdown / reinstatement records, it is identified as the maintenance stage.

3. The method for network security detection and evaluation of a power monitoring system throughout its entire lifecycle, as described in claim 1, is characterized in that... In step S2, the executable detection unit further includes a clause identifier, applicable lifecycle stage, applicable object type, graph matching mode, required evidence type, and risk weight. The executable detection unit is represented by the following structure: ； in, Indicates the identifier of the aforementioned terms, This indicates the applicable lifecycle stage. Indicates the applicable object type, This indicates the map matching pattern. Indicates the type of evidence required. Indicates the detection mode. This represents the determination predicate. Indicates the risk weight, This represents the production impact budget corresponding to the production impact constraint.

4. The method for network security detection and evaluation of a power monitoring system throughout its entire lifecycle, as described in claim 3, is characterized in that... In step S2, the constrained generative artificial intelligence model uses a retrieval-enhanced generation method to retrieve relevant fragments from the security protection requirements library, the enterprise detection rule library, the historical evaluation case library, and the object type library, and generates the executable detection unit according to a preset structured template. The deterministic rule verification includes: verifying whether the fields of the executable detection unit are complete, whether the applicable object type exists in the power production control domain knowledge graph, whether the judgment predicate can be verified by the evidence of the required evidence type, and whether the production impact constraint meets the preset production impact budget.

5. The method for network security detection and evaluation of a power monitoring system throughout its entire lifecycle, as described in claim 1, is characterized in that... In step S3, the nodes of the power production control domain knowledge graph include at least business system nodes, monitoring device nodes, network device nodes, dedicated security device nodes, general security device nodes, regional nodes, account nodes, policy nodes, vulnerability nodes, log event nodes, equipment status nodes, and maintenance change nodes; the edges of the power production control domain knowledge graph include at least ownership relationships, communication relationships, protection relationships, isolation relationships, authentication relationships, dependency relationships, change relationships, and violation relationships.

6. The method for network security detection and evaluation of a power monitoring system throughout its entire lifecycle, as described in claim 1, is characterized in that... In step S4, the graph neural network model propagates risk features among nodes in the knowledge graph of the power production control domain based on a neighbor aggregation mechanism. The input features of the graph neural network model include at least asset importance, regional exposure, vulnerability severity, policy compliance, equipment health, alarm density, and change frequency. The update formula for node risk embedding is: ； in, For nodes In the Risk embedding of layers, For nodes The set of neighboring nodes, It is an aggregate function. and For model parameters, For bias terms, This is the activation function.

7. The method for network security testing and evaluation of a power monitoring system throughout its entire lifecycle, as described in claim 1, is characterized in that... In step S4, the time-series sequence of the running data includes the time-series sequence of log events, the time-series sequence of traffic metadata, and the time-series sequence of device operating status. The time-series anomaly detection model adopts a self-supervised training method to perform at least one of mask event prediction, next event prediction, or state drift prediction on the time-series sequence of the running data to obtain the running anomaly vector.

8. The method for network security testing and evaluation of a power monitoring system throughout its entire lifecycle, as described in claim 1, is characterized in that... In step S5, the detection modes include document review mode, passive detection mode, digital twin verification mode, and restricted online detection mode; the production impact constraints include at least the allowed detection time window, maximum detection rate, prohibited control command types, maximum network load increment, maximum device resource utilization, rollback conditions, and approval conditions; when the expected impact of a certain detection task in the detection task sequence exceeds the preset production impact budget, the execution of the detection task is prohibited or the detection task is switched to the digital twin verification mode.

9. The method for network security detection and evaluation of a power monitoring system throughout its entire lifecycle, as described in claim 1, is characterized in that... In step S6, the fusion also includes evidence credibility and the stage weight corresponding to the life cycle stage. The output of step S6 also includes a compliance score. The risk drift index is calculated by comparing the node differences, edge differences, strategy differences, abnormal event differences, and equipment status differences between the current power production control domain knowledge graph and the historical baseline knowledge graph. The rectification suggestions are generated by the constrained generative artificial intelligence model and verified by the evidence verifier. When the rectification suggestions fail to be associated with at least one executable detection unit, at least one entity in the power production control domain knowledge graph, and at least one evidence identifier, the rectification suggestions are marked as unconfirmed suggestions and are not included in the formal evaluation conclusion.

10. The method for network security testing and evaluation of a power monitoring system throughout its entire lifecycle, as described in any one of claims 1 to 9, is characterized in that... The digital twin verification mode includes: A digital twin environment is generated based on the network topology, asset configuration, communication links, policy configuration, and historical traffic of the target power monitoring system. Access path verification, policy conflict verification, configuration deviation verification, and change impact verification are performed in the digital twin environment. The verification results of the digital twin environment are used as a prerequisite for whether the detection task in the restricted online detection mode is allowed to be executed.

Images