Power distribution network security risk assessment method and system based on artificial intelligence dynamic optimization, and electronic device

Abstract

The application discloses a power distribution network network security risk assessment method and system based on artificial intelligence dynamic optimization and electronic equipment, wherein the method comprises the following specific steps: (1) obtaining data required for power distribution network network security risk assessment, and obtaining standardized security assessment input data after preprocessing; (2) constructing a network security risk assessment structure based on the data obtained in step one; (3) inputting the standardized security assessment input data into the assessment structure constructed in step two, performing threat detection and risk assessment, and obtaining a network security risk assessment result; and (4) outputting the risk assessment result according to the risk assessment result obtained in step three. The application is suitable for the fields of intelligent power distribution network, power distribution automation system, intelligent electric meter system, SCADA monitoring system and power distribution network security operation monitoring platform.

Description

Technical Field

[0001] This invention belongs to the field of distribution network network security risk assessment technology, specifically involving a distribution network network security risk assessment method, system and electronic equipment based on artificial intelligence dynamic optimization, applicable to fields such as smart distribution networks, distribution automation systems, smart meter systems, SCADA monitoring systems and distribution network safety operation monitoring platforms. Background Technology

[0002] With the advancement of smart distribution network construction, the operation of distribution networks increasingly relies on sensors, communication interfaces, smart meters, smart grid control centers, edge computing, and cloud computing for data collection, processing, and decision-making. Environmental sensors, phasor measurement units (PMUs), IoT devices, smart meters, power line sensors, SCADA monitoring systems, and communication interfaces can collect or transmit raw power load data, environmental data, equipment operating status, generation-side data, supply-side information, network status, and network security risk factors. This data provides the foundation for real-time operation analysis of the distribution network and network security risk assessment, and it is also the reason why network security risk assessment needs to simultaneously consider factors such as data processing, threat detection, risk judgment, and response decision-making.

[0003] In distribution network operation scenarios, cybersecurity risks are no longer simply a matter of judging a single alarm or a single security incident. Data manipulation behaviors such as the injection of false data can affect the secure operation of smart grid infrastructure, thereby impacting demand-side response, control signal generation, and the smart grid control center's assessment of operational status. Therefore, there is an urgent need in this field for a method that can dynamically assess distribution network cybersecurity risks based on real-time data analysis, threat detection, and risk assessment mechanisms, in order to improve the data security, operational resilience, and timeliness of risk response in distribution networks.

[0004] On the other hand, network security risk assessment for power distribution networks also faces new challenges from attacks involving artificial intelligence. Cybercriminals may use AI to launch ransomware and extortion attacks against critical infrastructure, and malicious attackers may also target AI systems, manipulating them and producing unreliable results. Insufficient understanding of predictive maintenance and network security requirements will further exacerbate these problems; therefore, it is necessary to expand cybersecurity knowledge and implement stringent security measures. Recent research indicates that a comprehensive network security and predictive maintenance framework for power distribution networks (PDNs) is of great significance for risk management and operational efficiency.

[0005] Existing methods typically rely on traditional static models or manual assessments. While these methods can handle some known risks, they often suffer from insufficient real-time performance, weak data analysis capabilities, and inadequate utilization of multi-source data when facing constantly evolving network threats. This is especially true in smart distribution networks, where security and operational data come from complex sources, vary in format, and change frequently. Relying solely on manual judgment or fixed rules makes it difficult to continuously complete real-time risk assessments.

[0006] In summary, the shortcomings of existing technologies are as follows:

[0007] (1) Insufficient real-time performance of security risk assessment. Existing methods rely heavily on periodic scanning and manual review, which are slow to respond to changes in network threats, abnormal data states, and network status anomalies that occur during operation, making it difficult to reflect the dynamic changes in network security risks of the distribution network in a timely manner.

[0008] (2) Insufficient multi-source data joint processing. The network security risks of the distribution network are related to environmental sensor data, smart meter data, power line sensor data, SCADA monitoring data, network status data, and network security risk factors. Existing methods usually only use single-type security records or single-type alarms, lacking a unified data cleaning, sorting, standardization, and feature organization process, resulting in incomplete risk assessment basis.

[0009] (3) Insufficient correlation between threat detection and distribution network operation scenarios. Without combining the distribution network operation status, power supply side information, control signals and data flow relationships, standalone threat detection results are difficult to reflect the impact of network threats on actual operation safety and power grid performance.

[0010] (4) Risk assessment results are difficult to support decision control. Some existing solutions only provide detection alarms and lack mechanisms to transmit risk assessment results to decision support, safety alarm response and risk mitigation links, making it difficult to directly use risk assessment results for operational control.

[0011] (5) Insufficient adaptability to dynamic security threats. Threats to power distribution networks are characterized by continuous changes and strong concealment. Traditional static models are difficult to adapt to changes in network threats, abnormal data patterns and risk factors, which can easily lead to a decline in detection and assessment effectiveness.

[0012] (6) Insufficient integration of cybersecurity assessment and real-time grid optimization information. In the original method, real-time grid optimization is used to optimize load distribution, grid stability and operating efficiency based on real-time data. However, existing security assessment methods usually do not combine operating indicators such as power usage, voltage fluctuation, equipment performance and grid performance feedback with cybersecurity risk assessment, making it difficult to simultaneously take into account security and operating efficiency in risk management. Summary of the Invention

[0013] Based on the above-mentioned status quo of the existing technology, the present invention discloses a method, system and electronic equipment for assessing network security risks of distribution networks based on dynamic optimization of artificial intelligence.

[0014] The present invention adopts the following technical solution:

[0015] A method for assessing network security risks in distribution networks based on dynamic optimization using artificial intelligence, the specific steps of which are as follows:

[0016] (1) Obtain the data required for the network security risk assessment of the power distribution network, and after preprocessing, obtain standardized security assessment input data;

[0017] (2) Based on the data obtained in step one, construct a network security risk assessment structure;

[0018] (3) Input the standardized security assessment input data into the assessment structure constructed in step two, perform threat detection and risk assessment, and obtain the network security risk assessment results;

[0019] (4) Output the risk assessment results based on the risk assessment results obtained in step three.

[0020] Preferably, step one, data acquisition and preprocessing, is as follows:

[0021] The process involves acquiring data required for power distribution network cybersecurity risk assessment. This data includes environmental sensor data, smart meter data, power line sensor data, SCADA monitoring data, raw power load, environmental data, equipment operating status, generator-side data, power supply-side information, component temperature, network status, and cybersecurity risk factors. The collected data undergoes preprocessing such as aggregation, sorting, cleaning, standardization, and feature extraction to obtain standardized security assessment input data, providing a unified data foundation for subsequent risk assessment structure construction and model operation.

[0022] Preferably, step two, the construction of the cybersecurity risk assessment structure, is as follows:

[0023] Based on the standardized security assessment input data obtained in Step 1, a cybersecurity risk assessment structure corresponding to the hierarchical architecture of the original literature is constructed. The main workflow of this structure includes a data acquisition layer, a data processing layer, an AI model analysis and maintenance plan layer, a cybersecurity risk assessment layer, a decision-making and control layer, and a user interface layer. Edge computing, cloud computing, intrusion detection systems, threat modeling, security alerts and response systems, maintenance and risk dashboards, and automatic control serve as supporting relationships and are not considered as separate main workflow layers. Simultaneously, the structure retains operational monitoring and real-time grid optimization results to represent the supporting role of information such as load distribution, grid stability, power usage, voltage fluctuations, and equipment performance in the security risk assessment.

[0024] Preferably, step three, threat detection and risk assessment, is as follows:

[0025] Based on the network security risk assessment structure constructed in step two, standardized security assessment input data is sent to the intrusion detection module and threat modeling module to identify abnormal network behavior, abnormal data status, and potential threat scenarios. At the same time, based on security risk constraints, risk factor uncertainty, and risk correction models, the network security risk assessment results are obtained.

[0026] Preferably, step four, risk result output and application, is as follows:

[0027] Based on the cybersecurity risk assessment results obtained in step three, the system outputs risk assessment rate, risk factor uncertainty, threat detection results, and risk correction results, forming alert information, risk mitigation strategies, or control signals. Response feedback and subsequent monitoring data are returned to the risk assessment process to correct thresholds, update parameters, and improve subsequent assessment results.

[0028] This invention also discloses a power distribution network network security risk assessment system based on artificial intelligence dynamic optimization, used to execute the above method, which includes the following modules:

[0029] Data acquisition and preprocessing module: Acquires the data required for the network security risk assessment of the power distribution network, and after preprocessing, obtains standardized security assessment input data;

[0030] Cybersecurity risk assessment structure construction module: Based on the obtained standardized security assessment input data, construct the cybersecurity risk assessment structure;

[0031] Threat Detection and Risk Assessment Module: Inputs standardized security assessment input data into the cybersecurity risk assessment structure to perform threat detection and risk assessment, and obtains cybersecurity risk assessment results;

[0032] Risk Result Output Module: Based on the obtained cybersecurity risk assessment results, output the risk assessment results.

[0033] The present invention also discloses an electronic device, including a processor and a memory, the memory storing a plurality of instructions; the processor loads instructions from the memory to execute the method or system described above.

[0034] Compared with the prior art, the present invention has the following significant technical advantages:

[0035] (1) This invention proposes a multi-source security-related data processing mechanism for network security risk assessment of power distribution networks. This mechanism collects data from environmental sensors, smart meters, power line sensors, SCADA monitoring systems, network status and network security risk factors, and performs cleaning, sorting, standardization and feature extraction on the data, so that the dispersed data can form a unified risk assessment input.

[0036] (2) This invention proposes a dynamic risk assessment method based on the uncertainty of network security risk factors and security thresholds. This method takes the uncertainty of network security risk factors as the content of risk characterization and determines whether the risk has reached the conditions for further analysis or disposal by judging the risk threshold, thereby improving the interpretability and real-time performance of risk assessment.

[0037] (3) This invention proposes a security risk identification process that combines intrusion detection and threat modeling. This process identifies abnormal behavior through an intrusion detection system and analyzes threat scenarios and risk relationships through threat modeling, thus avoiding the problem that a single detection method is difficult to cover complex security scenarios.

[0038] (4) This invention proposes a distribution network network security risk assessment architecture supported by edge computing and cloud computing. Edge computing and cloud computing are not used as the main process level, but provide computing support for real-time data analysis, continuous decision making and control processes.

[0039] (5) This invention proposes a decision output mechanism that links risk assessment results with safety alarm response. This mechanism outputs risk assessment results to the decision support system and safety alarm response module to generate risk mitigation strategies, alarm information or control signals, so that safety assessment can serve the safe operation of actual power distribution network.

[0040] (6) This invention proposes a decision support mechanism that coordinates real-time grid optimization results with network security risk assessment. This mechanism uses load distribution, grid stability, power usage, voltage fluctuation, equipment performance and grid performance feedback as operational status support information for security assessment, so that the system can take into account grid performance, operational efficiency and operational resilience when detecting and dealing with network risks. Attached Figure Description

[0041] Figure 1 This is a flowchart of a preferred embodiment of the present invention for a power distribution network network security risk assessment method based on dynamic optimization using artificial intelligence.

[0042] Figure 2 This is a flowchart of demand-side network security and risk mitigation in a preferred embodiment of the present invention.

[0043] Figure 3 This is a network security layered architecture diagram of a preferred embodiment of the present invention.

[0044] Figure 4 This is a block diagram of a power distribution network network security risk assessment system based on artificial intelligence dynamic optimization, according to a preferred embodiment of the present invention. Detailed Implementation

[0045] The preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0046] Scope and prerequisites for the preferred embodiments of the present invention:

[0047] The method described in this embodiment is applicable to scenarios such as distribution network security risk assessment, smart distribution network security monitoring, distribution automation system risk assessment, smart meter system abnormal behavior identification, and power line sensor data security analysis. The system needs to have security-related data acquisition interfaces, a data preprocessing module, edge computing nodes or local analysis nodes, a cloud analysis platform, an intrusion detection module, a threat modeling module, a risk assessment module, and a security alarm response interface.

[0048] Before implementing this method, it is necessary to acquire safety-related data during the operation of the distribution network and to uniformly identify different data sources. If deployed in a real distribution network, data from sensors, smart meters, line sensors, SCADA systems, and network security monitoring equipment should be integrated into the same data processing flow. The simulation verification below uses a synthetic simulation dataset of a four-node star distribution network and maps it according to the characteristics required for safety risk assessment.

[0049] This embodiment presents a power distribution network network security risk assessment method based on artificial intelligence dynamic optimization, which is generally divided into four steps: (1) data acquisition and preprocessing; (2) constructing a network security risk assessment structure based on the preprocessed data in step one; (3) performing threat detection and risk assessment in the assessment structure constructed in step two; and (4) outputting and applying the risk assessment results obtained in step three. The above four steps are connected step by step according to the logic of "data input - data processing - intelligent decision analysis - operation monitoring and optimization results - real-time network security risk assessment - decision support system - output", such as Figure 1 As shown in the figure. In this embodiment, the dynamic optimization of artificial intelligence is mainly reflected in: using intrusion detection to identify abnormal network behavior, using threat modeling to analyze threat scenarios and risk relationships, using uncertainty measurement of risk factors and security threshold judgment to form risk assessment results, and combining edge computing, cloud computing, proactive maintenance scheduling, power grid performance feedback and real-time grid optimization results, so that the risk assessment results can be dynamically updated with changes in real-time operating data and network status.

[0050] Specifically, Figure 1The data input corresponds to the data collection objects such as environmental sensors, phasor measurement units, smart meters, and power line sensors; data processing corresponds to data cleaning, real-time data streaming, data aggregation, and normalization; intelligent decision analysis provides a comprehensive judgment on the processed data; operation monitoring and optimization results correspond to the operating status from sensor data, load / load, grid constraints, and real-time power flow; real-time network security risk assessment corresponds to threat detection results and risk status response strategies; network security risk mitigation strategies, proactive maintenance scheduling, and grid performance feedback are input into the decision support system as supporting information; and finally, the system outputs security control results, risk location suggestions, and operation feedback.

[0051] The steps involved in this embodiment will be described in more detail below.

[0052] Step 1: Data Acquisition and Preprocessing.

[0053] Step one establishes a unified data foundation for subsequent risk assessments. Data sources include environmental sensors, phasor measurement units (PMUs), IoT devices, smart meters, power line sensors, SCADA monitoring systems, communication interfaces, network status monitoring equipment, intrusion detection systems, and security alarm response systems. Collected or received data includes raw power load, environmental data, equipment operating status, generator-side data, power supply-side information, component temperature, network status, abnormal data records, intrusion detection results, and network security risk factor data. Notably, the network security risk factor data is not directly generated by a single hardware component but is collectively formed from communication interface logs, SCADA monitoring records, network status monitoring records, intrusion detection results, threat modeling results, and security alarm response records. This data characterizes potential abnormal network behavior, malicious data patterns, false data injection risks, and network status anomalies that may occur during distribution network operation. All of the above data falls under the category of technical data related to distribution network operation and network security risk assessment.

[0054] Before the data enters the risk assessment structure, the following processes are performed sequentially: First, data from different sources is aggregated and sorted; second, missing data and abnormal noise are cleaned; third, data of different dimensions are standardized; fourth, features that can characterize the network security status are extracted from the cleaned data to form standardized security assessment input data. The output of this step serves as the input for step two (constructing the risk assessment structure) and step three (running the risk assessment calculation relationship). Figure 2 The input data, demand-side data processing, cybersecurity and risk mitigation strategies, detection results, control signals or pricing, and outputs in this step correspond to the multi-source data acquisition, data denoising, diagnosis, normalization, feature extraction, security risk analysis, detection result generation, control output, and final output processes, respectively.

[0055] The following is a more detailed description of the content involved in step one of this embodiment.

[0056] 1.1 Data Sources and Definitions

[0057] The data sources and data types in this embodiment are shown in Table 1.

[0058] Table 1. Data Sources and Definitions for Distribution Network Network Security Risk Assessment

[0059] Monitoring data Environmental sensor data It reflects changes in the external environment and helps determine whether network status anomalies are related to environmental disturbances. Monitoring data Phasor Measurement Unit (PMU) data It reflects changes in node phasors, timing measurements, and electrical states, and is used to help determine the relationship between abnormal data and the impact of network attacks. Monitoring data IoT device data It reflects the status of edge sensing devices, communication devices, and smart terminals, and is used to supplement communication links and terminal anomaly characteristics. Monitoring data Smart meter data It reflects the energy consumption and distribution status on the user side, and is used to identify risks related to abnormal data flow or abnormal load. Monitoring data Power line sensor data It reflects the operating status of the line and is used to identify abnormal changes related to the line status. System data SCADA monitoring data It reflects the historical and real-time measurement status during the smart grid monitoring process. Running data Raw power load, power supply side information, power generation side data Used to determine the correlation between cybersecurity risks and the operating status and control signals of the power distribution network. Status data Equipment operating status, component temperature Used to help identify the correlation between abnormal states and security risks. Security Data Network status and network security risk factors Used for intrusion detection, threat modeling, and risk assessment. Simulation data Synthetic data of a four-node star distribution network Used for model validation, it contains an initial 10,000 observations, expanded to 60,000 observations, and includes 12 core features and 2 dependent variables. Environmental data Environmental sensor data, temperature, humidity, weather and other environmental condition data Derived from environmental sensors and operational monitoring records, it reflects the external environmental status and provides operational context for demand-side analysis, operational status assessment, and cybersecurity risk assessment.

[0060] 1.2 Data Description

[0061] The preprocessed data should form a unified data structure. Each data record should include at least the following fields: timestamp, data source, operational status characteristics, security status characteristics, and risk assessment results. The goal of data preprocessing is not to change the meaning of the data, but to eliminate format differences, missing values, and anomalous noise between different acquisition systems, making it usable for subsequent intrusion detection, threat modeling, and risk assessment processes.

[0062] Table 2 Description of Distribution Network Network Security Risk Assessment Data

[0063] Time stamp Time series This indicates the data collection time, used for real-time risk analysis. Data Objects integer or string This refers to the object being measured by a sensor, smart meter, or circuit. Data source Enumeration type This indicates that the data comes from sensors, smart meters, line sensors, SCADA, or network status monitoring. Operating status characteristics Numerical It indicates operational characteristics such as load, environment, power supply side information, and equipment status. Safety status characteristics Numeric or categorical It represents network status, abnormal data patterns, security risk factors, and threat modeling results. Risk assessment results Numeric or vector This indicates the risk assessment rate, the uncertainty of risk factors, the results of threat detection, or risk mitigation strategies.

[0064] 1.3 Data Preprocessing Methods

[0065] Data preprocessing includes data aggregation, data sorting, data cleaning, standardization, and feature extraction. Data aggregation and sorting are used to organize multi-source real-time data into a continuous data stream; data cleaning is used to reduce the impact of abnormal noise and invalid records; standardization is used to eliminate the influence of different units on risk assessment; and feature extraction is used to extract key variables that reflect security risks from operational and network states. After preprocessing, a standardized security assessment input dataset is obtained, providing a unified data foundation for steps two and three, and the processing relationship is shown in Figure 2.

[0066] Step 2: Construction of the cybersecurity risk assessment structure.

[0067] This step organizes the data obtained in Step 1 into an executable risk assessment structure. Based on... Figure 3The network security layered architecture shown includes the following main processes in sequence: data acquisition layer, data processing layer, intelligent decision analysis layer, operation monitoring and optimization results layer, real-time network security risk assessment layer, decision support system, and output layer. Supporting relationships include edge computing, cloud computing, intrusion detection system, threat modeling, security alarm response system, maintenance and risk dashboard, and automated control. These supporting relationships are not individual steps in the main process but rather support data processing, risk assessment, decision output, and monitoring and control, respectively.

[0068] The data acquisition layer receives data from sensors and communication interfaces; the data processing layer systematically organizes the data for subsequent analysis; the AI ​​model analysis and maintenance planning layer utilizes machine learning for status monitoring, maintenance requirement prediction, and maintenance planning; this part serves as the operational analysis background before security risk assessment and is not elaborated as the main predictive maintenance process; the network security risk assessment layer continuously detects and assesses network threats; the decision-making and control layer supports real-time, continuous decision-making and control; and the user interface layer provides a supervision and management interface for operators and management. Edge computing and cloud computing provide computational support for real-time decision-making, intrusion detection systems and threat modeling assist in security protection, and security alert and response systems, maintenance and risk dashboards, and automatic controls provide support for alerts, monitoring, and resilience. The output of this step is a workable network security risk assessment structure, which serves as the basis for the model operation in step three. The layered architecture is shown in Figure 3.

[0069] This embodiment sets up a network security risk assessment layer, and combines an intrusion detection system, threat modeling, and a security alert and response system to detect, assess, and respond to changing network threats.

[0070] 2.1 Introduction to Layered Structure

[0071] The cybersecurity risk assessment structure includes the following main process hierarchy and supporting modules:

[0072] (1) Data acquisition layer: Acquire data related to power distribution network operation and network security from sources such as sensors, communication interfaces, smart meters, power line sensors, SCADA monitoring systems, phasor measurement units (PMUs), and IoT devices.

[0073] (2) Data processing layer: The collected data is systematically organized, including data aggregation, cleaning, sorting, standardization and feature extraction, to facilitate subsequent analysis.

[0074] (3) AI Model Analysis and Maintenance Planning Layer: This layer utilizes machine learning for status monitoring, maintenance requirement prediction, and maintenance planning. It retains the operational background of predictive maintenance from the original literature, but the predictive maintenance algorithm process will not be elaborated in this safety classification.

[0075] (4) Network security risk assessment layer: Continuously detect and assess network threats, and determine whether the risk has reached the triggering conditions by combining the uncertainty of risk factors, security constraints and threat status.

[0076] (5) Decision and control layer: Based on risk assessment results, control signals and operational status information, support real-time and continuous decision making and control.

[0077] (6) User interface layer: Provides a supervision and management interface for operators and management personnel to facilitate the viewing of maintenance and risk-related information.

[0078] In addition to the main process hierarchy mentioned above, edge computing and cloud computing provide computing support; intrusion detection systems, threat modeling, and security alarm response systems provide network security protection support; maintenance and risk dashboards and automatic control provide monitoring and resilience support; and load distribution, grid stability, power usage, voltage fluctuations, equipment performance, and grid performance feedback provide operational status support related to real-time grid optimization. The above data transmission and support relationships are shown in Figure 3.

[0079] 2.2 Risk Assessment Input Structure

[0080] The input data processed in step one can be represented as follows:

[0081] Where X(n) represents the security assessment input data at time n, L(n) represents load and power supply related data, E(n) represents environmental data, S(n) represents equipment operating status and component temperature, N(n) represents network status data, and Z(n) represents network security risk factor data. This input structure is used to connect the data preprocessing results with the subsequent risk assessment model.

[0082] Step 3: Threat Detection and Risk Assessment.

[0083] This step generates specific risk judgment results within the risk assessment structure constructed in step two. First, standardized security assessment input data is fed into the intrusion detection step to identify changing network threats, abnormal data changes, and abnormal network states. Second, the threat modeling step analyzes threat scenarios and risk relationships. Then, network security risk constraints, uncertainty calculation relationships of risk factors, and risk correction calculation relationships are used to determine whether the risk has reached the triggering conditions. Finally, the risk assessment results are output to step four.

[0084] The focus of this step is not on issuing a single alert, but rather on combining real-time data, intrusion detection results, threat modeling results, and risk constraint assessments to form an interpretable cybersecurity risk assessment. The threat types primarily include deceptive data injection, ransomware attacks, manipulation attacks targeting AI systems, abnormal data flows, malicious data patterns, random mixed network attacks, and abnormal network states. These threats correspond to descriptions of cybersecurity risk assessment, attacks on AI systems, ransomware attacks on critical infrastructure, and deceptive data injection attacks in relevant literature.

[0085] The following is a more detailed description of the content involved in step three.

[0086] 3.1 Design Concept

[0087] This embodiment focuses on network security risk factors for risk assessment. For each distribution network monitoring or control node, security status characteristics are first extracted from multi-source data. Then, an intrusion detection step identifies abnormal network behavior, abnormal data changes, and abnormal network status. Next, a threat modeling step analyzes threat scenarios, risk sources, and risk relationships. Following this, a risk assessment step, combining security risk constraints, risk factor uncertainty, and risk correction calculation relationships, determines whether the current risk meets the triggering conditions. Finally, the risk assessment results are output to the decision support system. In a demand-side scenario, network security and risk mitigation strategies are used to protect demand response activities, and their relationship is as follows: Figure 2 As shown; in real-time grid optimization scenarios, network security risk assessment, load distribution, grid stability, and grid performance feedback are all incorporated into the decision support process, and their relationship is as follows: Figure 1 and Figure 3 As shown.

[0088] The specific processing steps of the intrusion detection step are as follows: It receives standardized security assessment input data, focuses on reading network status data, abnormal data changes, communication link status, and security risk factor records, identifies abnormal network behavior, abnormal data flows, malicious data patterns, and network status anomalies, and generates threat detection results. This result serves as input for subsequent threat modeling and risk assessment. The specific processing steps of the threat modeling step are as follows: Based on the threat detection results, it establishes a correlation between "threat source—affected data object—potentially affected control signals—corresponding risk factors," analyzing risk propagation paths in scenarios such as fake data injection, ransomware attacks, and manipulation of the AI ​​analysis process. The specific processing steps of the risk assessment step are as follows: Combining the risk assessment rate R(x), risk factor uncertainty H(z), risk correction calculation relationship, and security threshold, it determines whether the current risk has reached the triggering condition, and outputs the risk assessment rate, risk factor uncertainty, threat detection results, and risk correction results to the decision support system. The above intrusion detection, threat modeling, and risk assessment processes are... Figure 3 This is reflected in the supporting function of the network security risk assessment layer.

[0089] 3.2 Mathematical Model

[0090] The security risk assessment constraints in this embodiment take the following form:

[0091]

[0092] Where R(x) represents the cybersecurity risk assessment rate as a function of time x. This represents the minimum risk threshold set by the system. When R(x) is below the threshold, it indicates that the current network security risk assessment capability is insufficient, and it is necessary to increase the data sampling frequency, adjust the detection strategy, or trigger further analysis.

[0093] The uncertainty of cybersecurity risk factors can be expressed in the following form:

[0094] Where H(z) represents the uncertainty or entropy of network security risk factors, and H(e, w) represents the uncertainty of network state and system state. This indicates the model performance at the previous time step. This indicates that the risk assessment meets the minimum valid judgment criteria. In the method of this embodiment, H(z) is mainly used to measure network security risk factors.

[0095] Taking into account changes in risk factors and model output, the following risk correction method is adopted:

[0096] Where m(zp) represents the impact of changes in risk factors on the assessment results. This represents the modified model performance energy. This represents the normalization factor over a given time scale. This formula is used to indicate how risk assessment results adjust as real-time data changes.

[0097] The decision output can be represented as:

[0098] Where D(n) represents the safety decision output at the current moment, f(·) represents the decision function, and J(n-1) represents the initial model state at the previous moment. This indicates the impact of cybersecurity resilience and risk mitigation. This formula is used to convert real-time risk assessment results into alerts, mitigation strategies, or control signals.

[0099] 3.3 Risk Assessment Output

[0100] According to the model described above, the output of step three includes the risk assessment rate, risk factor uncertainty, threat detection results, risk correction results, and security decisions. If the risk assessment results meet the preset risk conditions, the process proceeds to step four for response output; if the risk does not meet the handling conditions, real-time monitoring continues and the system awaits data input for the next cycle.

[0101] Step 4: Risk Results Output and Application.

[0102] Step four transforms the risk assessment results from step three into practical application outputs. Based on the risk assessment results, it outputs the risk assessment rate, risk factor uncertainty, threat detection results, risk correction results, and control signals to the decision support system. The safety alarm response process generates alarm information or risk mitigation strategies based on these outputs. When the risk assessment results do not meet the triggering conditions, real-time monitoring continues; when the risk assessment results meet the alarm or risk mitigation conditions, a safety alarm and risk mitigation strategy are generated; when the risk assessment results affect control and operational efficiency, the risk assessment results, control signals, and grid performance feedback are sent to the decision support system. The safety alarm response results and subsequent monitoring data can serve as reference information for subsequent risk assessments and operational control decisions.

[0103] The specific processing steps of the security alarm response process are as follows: First, it receives the risk assessment rate, risk factor uncertainty, threat detection results, risk correction results, and control signals output by the decision support system; then, it determines whether the risk assessment results meet the preset trigger conditions; if the trigger conditions are met, it generates a security alarm, risk location results, risk mitigation strategies, or control signals; if the trigger conditions are not met, it continues to maintain real-time monitoring. This process is consistent with... Figure 1 The outputs of "safety control results, risk identification recommendations, and operational feedback" correspond to each other and are included in the system. Figure 3 It serves as the decision-making and control layer supporting the security alarm response system.

[0104] Validate the model:

[0105] In the simulation verification phase, a synthetic dataset of a four-node star distribution network was used to test the method. The initial dataset contained 10,000 observations, which were expanded to 60,000 observations after node arrangement, including 12 core features and 2 dependent variables. The testing process mainly verified the system's ability to detect cybersecurity threats, the stability of risk assessment results, and the effectiveness of risk mitigation strategy outputs. The verification indicators mainly included cybersecurity threat detection and analysis, real-time grid optimization analysis, scalability analysis, cost analysis, accuracy, precision, recall, and F1 score; for fault detection and threat detection, the reduction of false positives and false negatives was also considered.

[0106] Model application introduction:

[0107] In the engineering application phase, this model can be deployed on distribution network security monitoring platforms, smart grid control centers, edge computing nodes, or cloud analytics platforms. The platform continuously receives distribution network security-related data and real-time grid optimization-related operational data, performs joint analysis on abnormal network states, risk factors, load distribution, and grid performance feedback, and sends the results to the decision support system and security alarm response process. The decision support system receives risk assessment rates, risk factor uncertainties, threat detection results, risk correction results, control signals, and grid performance feedback, forming risk mitigation strategies, alarm information, or control signals. The security alarm response process outputs security control results, risk location suggestions, and operational feedback based on these results, thereby improving the efficiency of distribution network security risk assessment, dynamic protection capabilities, and operational resilience. The application process is as follows: Figure 1 As shown.

[0108] The following will provide further explanation with specific application examples.

[0109] Based on the performance analysis results, the literature uses synthetic simulation data from a four-node star-shaped reference network. The initial dataset contains 10,000 observations, which are expanded to 60,000 observations after node arrangement, including 12 core features and 2 dependent variables. Combining Table 3 and the results discussion in the literature, the following results examples can be summarized to illustrate the output format of this method in terms of network security threat detection, real-time grid optimization, accuracy, precision, recall, and F1 score.

[0110] Table 3. Examples of simulation performance analysis results from the literature.

[0111] Network security threat detection and analysis 94.8% Used to demonstrate the effectiveness of intrusion detection and threat modeling in identifying cybersecurity risks. Real-time mesh optimization analysis 96.5% Used to demonstrate the supporting effect of load distribution, grid stability, and operational feedback on risk decision-making. Scalability Analysis 95.1% This demonstrates the adaptability of the method in scenarios with multiple nodes and multiple data sources. Cost Analysis 19% Used to demonstrate the supporting role of safety risk assessment and operational optimization in cost control. Accuracy Analysis 98.9% Used to evaluate the overall correctness of risk assessment results. Accuracy 97.1% Used to evaluate the effective identification rate among samples deemed at risk. Recall rate 96.5% Used to evaluate the coverage of risk samples detected. F1 value 97.4% Used to comprehensively evaluate the balance between precision and recall.

[0112] Taking a four-node star-shaped power distribution network as an example, this network includes one power supply node and three user nodes. First, environmental sensor data, phasor measurement unit (PMU) data, IoT device data, smart meter data, power line sensor data, SCADA monitoring data, and network status data are collected. Then, the data is cleaned, sorted, standardized, and feature extracted, and combined with real-time grid optimization data such as power usage, voltage fluctuations, equipment performance, load distribution, and grid stability. Next, the intrusion detection module identifies abnormal behavior, and the threat modeling module determines possible threat scenarios and risk relationships. Finally, the risk assessment module determines whether R(x) meets the security threshold requirements and outputs the risk assessment result.

[0113] When a user node experiences abnormal data changes and simultaneously exhibits abnormal network conditions, the uncertainty H(≈) of the network security risk factors is calculated, and a determination is made based on security constraints as to whether an alarm should be triggered. If the risk assessment results meet the preset risk triggering conditions, the system outputs risk mitigation strategies to the decision support module, including generating security alerts, outputting risk mitigation strategies, or linking with the security response module.

[0114] In summary, the above embodiments demonstrate that this invention employs artificial intelligence methods to analyze real-time data streams and achieves continuous identification of dynamic security risks through data processing, intrusion detection, threat modeling, network security risk assessment, edge computing, and cloud computing collaboration. By collecting, cleaning, sorting, standardizing, and extracting features from sensor, smart meter, power line sensor, SCADA monitoring system, and network status data, an input dataset for distribution network security risk assessment can be formed. Furthermore, by utilizing risk factor uncertainty measurement, security risk threshold judgment, and security alarm response mechanisms, distribution network security risks can be assessed and response results can be output. Therefore, the distribution network security risk assessment method of this embodiment can integrate multi-source security-related data, support real-time threat detection, dynamic risk assessment, and security response linkage, and has practical application value.

[0115] In summary, this embodiment solves the following technical problems:

[0116] (1) This invention solves the problem of the difficulty in continuously and in real-time assessment of network security risks in power distribution networks. By collecting, preprocessing and analyzing multi-source security-related data in real time, this invention enables the system to continuously obtain the network security risk status in a dynamic operating environment.

[0117] (2) This invention solves the problem of the difficulty in using multi-source data for security risk assessment in a unified manner. By uniformly processing environmental sensors, smart meters, power line sensors, SCADA monitoring systems, network status, and network security risk factors, this invention forms standardized input data that can be used for threat detection and risk assessment.

[0118] (3) This invention addresses the problem of lacking risk interpretation and threshold judgment criteria for security alarms. By introducing uncertainty measurement of risk factors, security risk threshold judgment, intrusion detection, and threat modeling, this invention outputs assessment results that reflect the risk status, assisting operation and maintenance personnel in making risk mitigation and operational decisions.

[0119] (4) This invention solves the problem that risk assessment results are difficult to support decision control. By integrating risk assessment results into decision support and safety alarm response, this invention generates alarm information, risk mitigation strategies, or control signals, transforming safety assessment from simple detection into decision output.

[0120] (5) This invention addresses the problem of insufficient adaptability of the assessment structure under dynamic network threats. By leveraging edge computing and cloud computing, this invention supports real-time and continuous decision-making and control, thereby improving the system's adaptability to dynamic network threats and complex security scenarios.

[0121] (6) This invention solves the problem that real-time grid optimization results are difficult to use for security risk decision-making. The invention incorporates operating states such as load distribution, grid stability, power usage, voltage fluctuations, equipment performance, and grid performance feedback into the context of network security risk assessment, so that security risk handling can be consistent with real-time grid optimization and operating efficiency.

[0122] like Figure 4 As shown in the figure, this embodiment discloses a power distribution network network security risk assessment system based on artificial intelligence dynamic optimization, used to execute the above method, which includes the following modules:

[0123] Data acquisition and preprocessing module: Acquires the data required for the network security risk assessment of the power distribution network, and after preprocessing, obtains standardized security assessment input data;

[0124] Cybersecurity risk assessment structure construction module: Based on the obtained standardized security assessment input data, construct the cybersecurity risk assessment structure;

[0125] Threat Detection and Risk Assessment Module: Inputs standardized security assessment input data into the cybersecurity risk assessment structure to perform threat detection and risk assessment, and obtains cybersecurity risk assessment results;

[0126] Risk Result Output Module: Based on the obtained cybersecurity risk assessment results, output the risk assessment results.

[0127] Other aspects of this embodiment can be found in the above method embodiments.

[0128] The present invention also discloses an electronic device, including a processor and a memory, the memory storing a plurality of instructions; the processor loads instructions from the memory to execute the method or system described above.

[0129] In summary, the operational flow of this invention includes four stages: data acquisition and preprocessing, risk assessment structure construction, threat detection and risk assessment, and risk result output and application. Furthermore, this invention applies the real-time grid optimization concept from the original literature to a security classification scenario, using load distribution, grid stability, power usage, voltage fluctuations, equipment performance, and grid performance feedback as operational status support information for risk assessment, without delving into the main predictive maintenance process. The data acquisition and preprocessing stage acquires security-related data from environmental sensors, phasor measurement units (PMUs), IoT devices, smart meters, power line sensors, SCADA monitoring systems, and network status data, and performs cleaning, sorting, standardization, and feature extraction. The risk assessment structure construction stage inputs the processed data into the network security risk assessment layer, combining edge computing and cloud computing to form a low-latency and globally collaborative assessment structure. The threat detection and risk assessment stage identifies distribution network security risks through intrusion detection, threat modeling, risk factor uncertainty measurement, and security threshold judgment. The risk result output and application stage sends the risk results to the decision support system and security alarm response module, generating risk mitigation strategies, alarm information, or control signals.

[0130] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made by those skilled in the art to the technical solutions of the present invention without departing from the spirit of the present invention should fall within the protection scope of the present invention.

Claims

1. A method for assessing network security risks in distribution networks based on dynamic optimization using artificial intelligence, characterized in that, The specific steps are as follows: (1) Obtain the data required for the network security risk assessment of the power distribution network, and after preprocessing, obtain standardized security assessment input data; (2) Based on the data obtained in step one, construct a network security risk assessment structure; (3) Input the standardized security assessment input data into the assessment structure constructed in step two, perform threat detection and risk assessment, and obtain the network security risk assessment results; (4) Output the risk assessment results based on the risk assessment results obtained in step three.

2. The method for assessing network security risks in distribution networks based on dynamic optimization using artificial intelligence as described in claim 1, characterized in that, In step one, the data includes environmental sensor data, smart meter data, power line sensor data, SCADA monitoring data, raw power load, environmental data, equipment operating status, power generation side data, power supply side information, component temperature, network status, and network security risk factors.

3. The method for assessing network security risks in distribution networks based on dynamic optimization using artificial intelligence as described in claim 1 or 2, characterized in that... In step one, the preprocessing is as follows: the collected data is aggregated, sorted, cleaned, standardized, and feature extracted to obtain the standardized security assessment input data.

4. The method for assessing network security risks in distribution networks based on dynamic optimization using artificial intelligence as described in claim 1, characterized in that, In step two, a cybersecurity risk assessment structure corresponding to the layered architecture of the original literature is constructed. The main process structure of this structure includes a data acquisition layer, a data processing layer, an AI model analysis and maintenance plan layer, a cybersecurity risk assessment layer, a decision-making and control layer, and a user interface layer. Edge computing, cloud computing, intrusion detection systems, threat modeling, security alerts and response systems, maintenance and risk dashboards, and automatic control serve as supporting relationships. At the same time, this structure retains the results of operation monitoring and real-time grid optimization to represent the supporting role of load distribution, grid stability, power usage, voltage fluctuations, and equipment performance information in security risk assessment.

5. A method for assessing network security risks in distribution networks based on dynamic optimization using artificial intelligence, as described in claim 1 or 4, characterized in that... In step two, the input data obtained after processing in step one is represented as follows: Where n represents the current sampling time or time series number, X(n) represents the security assessment input data at time n, L(n) represents the load and power supply side related data, E(n) represents the environmental data, S(n) represents the equipment operating status and component temperature, N(n) represents the network status data, and Z(n) represents the network security risk factor data.

6. The method for assessing network security risks in distribution networks based on dynamic optimization using artificial intelligence as described in claim 1, characterized in that, In step three, standardized security assessment input data is input into the cybersecurity risk assessment structure constructed in step two to identify abnormal network behaviors, abnormal data states, and potential threat scenarios. At the same time, based on security risk constraints, uncertainty calculation relationships of risk factors, and risk correction calculation relationships, the cybersecurity risk assessment results are obtained.

7. A method for assessing network security risks in distribution networks based on dynamic optimization using artificial intelligence, as described in claim 1 or 6, characterized in that... In step three, the safety risk assessment constraints take the following form: Where R(x) represents the cybersecurity risk assessment rate as a function of time x. This represents the minimum risk threshold set by the system. The uncertainty of cybersecurity risk factors is expressed in the following form: Where H(z) represents the uncertainty or entropy of network security risk factors, and H(e, w) represents the uncertainty of network state and system state. This indicates the model performance at the previous time step. This indicates that the risk assessment meets the minimum valid judgment criteria; Taking into account changes in risk factors and output results, the following risk correction method is adopted: Where m(zp) represents the impact of changes in risk factors on the assessment results. This represents the corrected evaluation energy. The normalization factor represents the time scale. The decision output is represented as: Where D(n) represents the safety decision output at the current moment, and f(·) represents the decision function. This represents the initial model state at the previous time step. This indicates the impact of cybersecurity resilience and risk mitigation.

8. The method for assessing network security risks in distribution networks based on dynamic optimization using artificial intelligence as described in claim 1, characterized in that, In step four, based on the cybersecurity risk assessment results obtained in step three, the risk assessment rate, risk factor uncertainty, threat detection results, and risk correction results are output to form alarm information, risk mitigation strategies, or control signals.

9. A power distribution network network security risk assessment system based on artificial intelligence dynamic optimization, used to execute the method as described in any one of claims 1-8, characterized in that, Includes the following modules: Data acquisition and preprocessing module: Acquires the data required for the network security risk assessment of the power distribution network, and after preprocessing, obtains standardized security assessment input data; Cybersecurity risk assessment structure construction module: Based on the obtained standardized security assessment input data, construct the cybersecurity risk assessment structure; Threat Detection and Risk Assessment Module: Inputs standardized security assessment input data into the cybersecurity risk assessment structure to perform threat detection and risk assessment, and obtains cybersecurity risk assessment results; Risk Result Output Module: Based on the obtained cybersecurity risk assessment results, output the risk assessment results.

10. An electronic device, characterized in that, The system includes a processor and a memory, the memory storing multiple instructions; the processor loads instructions from the memory to execute the method as claimed in any one of claims 1-8 or the system as claimed in claim 9.

Images