Network security situation awareness method based on time sequence correlation modeling of multi-source heterogeneous data

Abstract

The application relates to the technical field of network security, and discloses a network security situation awareness method based on time sequence correlation modeling of multi-source heterogeneous data, which selects multi-source heterogeneous situation factors and time sequence representation; calculates the running average with the normal running state as a reference, measures the deviation degree, and divides the state categories; calculates the state information entropy based on the state category distribution in the time sequence window, calculates the dynamic weight coefficient according to the certainty contribution; generates the reference situation value and the multi-level security situation demarcation value; obtains the comprehensive security situation value through weighted fusion and carries out grade discrimination; compares the trend state and the change discrimination threshold value through the adjacent cycle situation change amplitude, and outputs the early warning code. The application realizes trend prediction based on the change amplitude through the information entropy reverse driving weight self-adaptive distribution, solves the problems that the key abnormality is smoothed under the fixed weight and the fixed threshold early warning is delayed, and improves the situation awareness accuracy and stability.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a network security situation awareness method based on time-series correlation modeling of multi-source heterogeneous data. Background Technology

[0002] As a core infrastructure for the power industry's production and operation, the power monitoring system is crucial for ensuring the safe, stable, and reliable operation of the power grid. With the acceleration of the energy internet and industrial digitalization, the network boundaries of power monitoring systems are becoming increasingly blurred, significantly increasing the cybersecurity risks they face. In recent years, cyberattacks targeting power monitoring systems have evolved, exhibiting characteristics of multi-stage penetration, long-term latency, and concealment. Traditional boundary defense methods are no longer sufficient to meet the needs of detecting deep-seated and persistent threats.

[0003] Network security situation awareness, as a crucial means of identifying and warning of potential risks in power monitoring systems, has received widespread attention. The security indicators involved in power monitoring systems are diverse in origin and type, including industrial control protocol messages, host audit logs, and network communication link status. Existing situation awareness methods mostly employ fixed-weight models based on expert experience or the analytic hierarchy process (AHP). However, in complex dynamic attack scenarios, the contribution of indicators from different dimensions to the overall risk varies significantly at different attack stages. Fixed weights cannot automatically adjust the focus based on the real-time evolution characteristics of each indicator, leading to perception results often being smoothed by redundant or low-value indicators, making it difficult to effectively highlight abnormal states in key dimensions. Therefore, there is an urgent need to provide a network security situation awareness method based on time-series correlation modeling of multi-source heterogeneous data to address these issues. Summary of the Invention

[0004] To address the aforementioned technical issues, this invention provides a network security situation awareness method based on time-series correlation modeling of multi-source heterogeneous data. This method can dynamically allocate weights based on the uncertainties of multi-source heterogeneous data within a time-series window and combine this with the magnitude of situational changes to achieve accurate early warning, thereby enhancing the power monitoring system's ability to perceive network security situation.

[0005] To achieve the above objectives, the technical solution of the present invention is as follows:

[0006] A network security situation awareness method based on multi-source heterogeneous data temporal correlation modeling includes:

[0007] Multiple situation factors are selected from the multi-source heterogeneous security data of the power monitoring system and represented in a time-series manner according to a preset sampling period;

[0008] Using multiple consecutive sampling periods of the system's normal operating state as reference stages, the operating mean of each situation factor is calculated, and the deviation of each situation factor is calculated based on the operating mean, thereby classifying the state categories.

[0009] The state information entropy is calculated based on the state category distribution of each situation factor within the time window, and the dynamic weight coefficient of each situation factor is calculated based on the deterministic contribution of the state information entropy to the maximum information entropy. The smaller the state information entropy, the larger the corresponding dynamic weight coefficient.

[0010] Based on the situation assessment results of the reference phase, a reference situation value and a multi-level security situation boundary value are generated.

[0011] The comprehensive security situation value is calculated based on the dynamic weight coefficients of each situation factor and its current state category, and the situation level is determined based on the security situation boundary value.

[0012] Calculate the magnitude of situational change between adjacent sampling periods, determine the change discrimination threshold based on the security situation boundary value, and determine the security situation trend state by comparing the magnitude of situational change with the change discrimination threshold and output an early warning code.

[0013] As a preferred embodiment of the present invention, the plurality of situation factors include: frequency of abnormal messages in industrial control protocols, frequency of unauthorized port access, frequency of new network connections, frequency of intrusion detection alarms, frequency of firewall blocking events, frequency of failed logins to critical hosts, frequency of abnormal permission operation events, and frequency of interruption of critical communication links.

[0014] The aforementioned eight status factors cover the overall security status of the power monitoring system's dispatch master station, plant and substation terminals, station control layer networks, key hosts, security protection equipment, and remote communication links from eight dimensions: industrial control protocol compliance, network access control, abnormal session behavior, intrusion detection response, boundary protection effectiveness, host authentication security, permission operation and maintenance management, and communication link availability. By uniformly statistically analyzing protocol messages, connection behavior, audit logs, and link status, multi-source heterogeneous raw data is transformed into comparable time-series quantitative indicators, providing a structured data representation foundation for subsequent deviation measurement, information entropy calculation, and dynamic weighted fusion.

[0015] As a preferred embodiment of the present invention, the frequency of abnormal industrial control protocol messages is defined as the number of abnormal IEC 60870-5-104 or Modbus protocol messages detected within the sampling period; the frequency of unauthorized port access is defined as the number of connection attempts with a destination port belonging to a non-whitelisted port set within the sampling period; the frequency of new network connections is defined as the number of new network sessions or connection establishments within the sampling period; the frequency of intrusion detection alarm triggers is defined as the number of alarm events generated by the intrusion detection system within the sampling period; the frequency of firewall blocking events is defined as the number of times the firewall executes a security policy of denial or drop actions within the sampling period; the frequency of critical host login failures is defined as the number of login failure events generated by critical servers or station control hosts within the sampling period; the frequency of abnormal permission operation events is defined as the number of permission escalation, account permission change, or sensitive operation events recorded in the host audit log within the sampling period; and the frequency of critical communication link interruptions is defined as the number of times the communication link between the station control layer and the scheduling master station is interrupted within the sampling period.

[0016] Power monitoring systems involve heterogeneous data from multiple sources, including industrial control protocols, network traffic, host auditing, and communication links. The original data formats, acquisition frequencies, and units vary significantly. By uniformly converting various security events into frequency statistics within the sampling period, heterogeneous behaviors such as IEC 60870-5-104 or Modbus industrial control protocol anomalies, port scanning detection, sudden increase in sessions, intrusion alarms, firewall blocking, login failures, permission changes, and link interruptions are given the same time-series quantification caliber. This frequency normalization process eliminates data type differences, ensuring that subsequent deviation measurement and weighted fusion are performed under a unified unit, avoiding unit conflicts and numerical distortions caused by direct fusion of heterogeneous data.

[0017] As a preferred embodiment of the present invention, the state categories include normal state, general risk state and abnormal risk state; the deviation degree is no more than 1 corresponding to normal state, more than 1 but no more than 2 corresponding to general risk state, and more than 2 corresponding to abnormal risk state.

[0018] The continuous deviation is discretized into three levels: normal, general risk, and abnormal risk. This preserves the distinguishability of risk levels while constraining the state space to a finite number of categories. Since the number of state categories is fixed at three, the information entropy calculation has a definite theoretical maximum value of ln3. This closed boundary makes the entropy values ​​of different situation factors and different sampling periods comparable. At the same time, the three-level division corresponds to the subsequent comprehensive situation value interval [0,2], so that the state category can be directly used as the numerical input for weighted fusion, realizing a smooth mapping from discrete risk levels to continuous situation values.

[0019] As a preferred embodiment of the present invention, the degree of deviation is obtained by comparing the portion of the current observation value that exceeds the normal operating average with the normal operating average; when the current observation value does not exceed the normal operating average, the degree of deviation is zero.

[0020] Under normal operating conditions, each situation factor in a power monitoring system exhibits inherent baseline fluctuations. By retaining only the positive deviation of the observed value relative to the normal operating mean, negative deviations below the baseline in normal operating noise can be effectively filtered out, ensuring that the risk deviation measurement focuses on abnormally high behaviors. When the observed value does not exceed the normal operating mean, the deviation is zero, avoiding misjudging normal fluctuations as risks. At the same time, a very small positive number is introduced to correct the denominator, preventing calculation failure when the normal operating mean is zero, and ensuring the numerical stability of the deviation measurement under extreme operating conditions.

[0021] As a preferred embodiment of the present invention, the state category distribution is obtained by counting the cumulative number of times each situation factor is in each state category up to the current sampling period and calculating the state category probability;

[0022] The state information entropy is calculated based on the negative logarithmic expectation of the probabilities of each state category;

[0023] The weighting coefficients are determined based on the proportion of the difference between the state information entropy and the maximum information entropy of each situation factor to the total deterministic contribution of all situation factors.

[0024] By statistically analyzing the cumulative frequency of each situation factor in each state category up to the current sampling period, a probability distribution reflecting the historical evolution of the factor is constructed. Information entropy serves as a quantitative indicator of the dispersion of this distribution; the smaller the entropy value, the more concentrated the state distribution and the more frequently the factor is in a certain state category. When the certain state category corresponds to a general risk state or an abnormal risk state, it indicates that its risk characteristics are more significant. The difference between the state information entropy and the maximum information entropy is used as the deterministic contribution, and weights are allocated according to the proportion of deterministic contributions. This achieves adaptive adjustment where the more certain the state, the clearer the risk direction, and the higher the weight, the more the dimension that truly dominates the risk during the dynamic attack process automatically gains greater decision-making influence.

[0025] As a preferred embodiment of the present invention, the comprehensive security situation value is obtained by weighted summation of the weight coefficients of each situation factor and their corresponding state categories.

[0026] The state categories of each situation factor are discrete integers, which are weighted and summed through dynamic weight coefficients to integrate multi-source heterogeneous indicators into a single continuous variable. Since the sum of the weights is 1 and the maximum value of the state category is 2, the comprehensive situation value is constrained within a fixed interval [0,2]. This normalized interval makes the situation results of different sampling times and different systems horizontally comparable. At the same time, the magnitude of the comprehensive situation value directly maps the overall risk level. The closer it is to 0, the lower the overall risk of the system. The closer it is to 2, the higher the overall risk. This achieves a unified quantitative representation of multi-dimensional security status.

[0027] As a preferred embodiment of the present invention, the reference situation value is the average of the comprehensive security situation values ​​of each sampling period under normal operating conditions; the multi-level security situation boundary value includes a first-level security situation boundary value and a second-level security situation boundary value, which are obtained by dividing the interval between the reference situation value and the maximum situation value according to a preset ratio.

[0028] By utilizing the system's own historical data of normal operation, a reference situation value is calculated to establish a personalized judgment standard that fits the actual business characteristics and operating baseline of the power monitoring system, replacing the traditional manual experience setting or globally unified threshold. Based on the interval between this personalized baseline and the theoretical maximum risk value, the first-level and second-level safety situation boundary values ​​are adaptively divided according to a preset ratio, so that the boundary values ​​are dynamically adjusted with the fluctuation characteristics of the system's normal operating status. This adaptive mechanism overcomes the problem of insufficient adaptability of fixed thresholds to individual differences and reduces false alarms and missed alarms caused by baseline drift.

[0029] As a preferred embodiment of the present invention, the magnitude of the situation change is the difference between the comprehensive security situation value of the current sampling period and the comprehensive security situation value of the previous sampling period;

[0030] The situation change discrimination threshold is determined based on the difference between the first-level security situation boundary value and the second-level security situation boundary value according to a preset sensitivity coefficient; by comparing the situation change amplitude with the situation change discrimination threshold and its multiple, the current security situation is determined to be in a state of risk mitigation, stable operation, risk enhancement or risk surge, and the default value of the change sensitivity adjustment coefficient is 0.5.

[0031] The difference in situation between adjacent sampling periods directly reflects the rate of evolution of the security situation. Predicting the situation value at the next moment by numerical extrapolation is susceptible to random noise interference and is computationally complex. However, trend state discrimination is based on the comparison between the difference and the change discrimination threshold, which transforms the continuous change amplitude into four qualitative states: risk mitigation, stable operation, risk enhancement, and risk surge. This discrimination mechanism does not require the prediction of future situation values; it can identify the risk escalation trend in advance based solely on the current deterioration acceleration, allowing for decision-making lead time for emergency response. At the same time, the threshold is defined by the interval of the boundary value and a sensitivity coefficient is introduced to ensure that the trend discrimination standard and the system risk level classification are inherently consistent.

[0032] This invention also provides a network security situation awareness system based on multi-source heterogeneous data temporal correlation modeling, comprising:

[0033] The data acquisition module is used to select multiple situation factors from the multi-source heterogeneous security data of the power monitoring system and perform time-series representation according to a preset sampling period.

[0034] The risk offset measurement module is used to take multiple consecutive sampling periods of the normal operating state of the system as reference stages, calculate the operating average of each situation factor, and calculate the degree of deviation of each situation factor based on the operating average, thereby classifying the state categories.

[0035] The weight calculation module is used to calculate the state information entropy based on the state category distribution of each situation factor within the time window, and to calculate the dynamic weight coefficient of each situation factor based on the deterministic contribution of the state information entropy to the maximum information entropy. The smaller the state information entropy, the larger the corresponding dynamic weight coefficient.

[0036] The boundary value generation module is used to generate reference situation values ​​and multi-level security situation boundary values ​​based on the situation assessment results of the reference stage.

[0037] The situation quantification module is used to calculate the comprehensive security situation value based on the dynamic weight coefficients of each situation factor and its current state category, and to determine the situation level based on the security situation boundary value.

[0038] The trend prediction module is used to calculate the magnitude of situational change between adjacent sampling periods, determine the change discrimination threshold based on the security situation boundary value, and determine the security situation trend state by comparing the magnitude of situational change with the change discrimination threshold and output an early warning code.

[0039] The beneficial technical effects of this invention are:

[0040] This invention quantifies the uncertainty of the state distribution of each situation factor within a time window by using state information entropy, and uses the deterministic contribution of information entropy relative to the maximum information entropy to drive weight allocation in reverse. This allows factors with more concentrated state distribution and clearer risk orientation to automatically receive higher weights, effectively avoiding the problem of key anomalies being smoothed by redundant or low-value indicators under a fixed-weight model. At the same time, information entropy itself, as a quantitative measure of uncertainty, is embedded in the fusion decision-making process, making the situation awareness results adaptively robust to acquisition noise and attack interference.

[0041] This invention adaptively generates multi-level safety situation boundary values ​​based on historical data of normal operation, replacing the traditional manual setting or globally fixed threshold. Furthermore, based on the comparison results of the situation change amplitude of adjacent sampling periods with the change discrimination threshold, it directly distinguishes four trend states: risk mitigation, stable operation, risk enhancement, or risk surge. It can perceive the acceleration of situation deterioration before the risk reaches the critical state without the need to extrapolate the situation value of the next moment, significantly reducing the lag of fixed threshold early warning and reserving sufficient lead time for emergency response.

[0042] This invention unifies multi-source heterogeneous security data, such as industrial control protocol messages, network access behavior, host audit events, and communication link status, into time-series situational factors. It achieves correlation modeling through deviation measurement, state category classification, and information entropy calculation, thereby improving the unified representation and fusion capability of multi-source heterogeneous data. Through the synergistic effect of the aforementioned dynamic weights, trend perception, uncertainty handling, and adaptive boundary values, it comprehensively enhances the accuracy and stability of network security situational awareness, risk assessment, and early warning response in power monitoring systems. Attached Figure Description

[0043] Figure 1 This is a schematic diagram of the method flow of the present invention. Detailed Implementation

[0044] In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, the specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0045] Combination Figure 1 The present invention provides the following embodiments:

[0046] Example 1:

[0047] A network security situation awareness method based on temporal correlation modeling of multi-source heterogeneous data includes the following steps:

[0048] Step 1: Construction of situation factors and temporal representation of situation factors

[0049] To reflect the network security status of the power monitoring system across the dispatch master station, substation terminals, station control layer network, critical hosts, security protection equipment, and remote communication links, eight status factors were first selected. It serves as a computational indicator for network security situational awareness in power monitoring systems.

[0050] in, Indicates the frequency of abnormal messages in the industrial control protocol. Indicates the frequency of unauthorized port access. Indicates the frequency of new network connections. Indicates the frequency of intrusion detection alarms, Indicates the frequency of firewall blocking events, Indicates the frequency of login failures on critical hosts. Indicates the frequency of abnormal permission operation events, This indicates the frequency of critical communication link interruptions.

[0051] Let the total number of samplings for multi-source heterogeneous security data acquisition be . The sampling time interval is For the first Each sampling time , , define the first Each sampling period is , obtain the Individual situation factors In the Each sampling period The observed value is , , .

[0052] Specifically: Indicates the first Each sampling period The number of abnormal protocol messages detected in the IEC 60870-5-104 or Modbus communication protocol is used to characterize the intensity of abnormal behavior in industrial control communication. Indicates the first Each sampling period The number of connection attempts to an internal destination port that is not part of the whitelisted port set is used to characterize situations where unauthorized access or scanning probing occurs. Indicates the first Each sampling period The number of newly added network sessions or connection establishments is used to characterize abnormal session establishment, sudden increase in connections, or abnormal lateral communication behavior in the power monitoring system network. Indicates the first Each sampling period The number of alarm events generated by the internal intrusion detection system is used to characterize the alarm intensity of the intrusion detection system against network attacks on the power monitoring system; Indicates the first Each sampling period The number of times the internal firewall executes the security policy of denying or dropping actions is used to characterize the interception of unauthorized access, abnormal communication and unauthorized connections by the perimeter protection device. Indicates the first Each sampling period The number of login failure events generated by critical servers or site control hosts is used to characterize the risk of abnormal authentication attempts by critical hosts; Indicates the first Each sampling period The number of privilege escalation, account permission changes, or sensitive operation events recorded in the internal host audit log is used to characterize abnormal operation and maintenance behaviors such as privilege escalation, account changes, and sensitive operations in the host audit log; Indicates the first Each sampling period The number of interruptions in the communication link between the internal station control layer and the dispatch master station is used to characterize the interruption of communication links between the dispatch master station and the plant, between the station control layer and the bay layer, or other critical communication links and their impact on business continuity.

[0053] Step 2: Measurement of situational factor risk offset based on normal behavior boundary

[0054] The power monitoring system is in normal operating condition. One sampling period is used as a reference stage; the sampling period during normal operation is... Represented as:

[0055]

[0056] in, The first sign that the power monitoring system is in normal operating condition Each sampling period, . No. Individual situation factors During the continuous operation of the power monitoring system The running average of each sampling period Represented as:

[0057]

[0058] in, Indicates the first Individual situation factors During the period when the power monitoring system is in normal operation Observations for each sampling period.

[0059] Based on this, calculate the first... Individual situation factors In the Each sampling period Degree of deviation from normal operating conditions Defined as:

[0060]

[0061] in, It is a very small positive number, used to avoid When the denominator is zero; This means only retaining the portion of the current observation that is higher than the normal operating average. At that time, it was considered that the situation factor did not exceed the normal operating level. ;when hour, The larger the value, the higher the value. Individual situation factors In the Each sampling period The greater the deviation from the normal operating state, the greater the safety risk.

[0062] Furthermore, let the first... Individual situation factors In the Each sampling period Status categories Defined as:

[0063]

[0064] in, Indicates the first Individual situation factors In the Each sampling period The growth rate relative to the normal operating state does not exceed 1 time, which corresponds to the normal state; This indicates a growth rate exceeding 1 but not exceeding 2 times, corresponding to a general risk status. This indicates a growth rate exceeding 2 times, corresponding to an abnormal risk state. This allows for the measurement of risk deviation and state classification of each situation factor relative to the normal operating state.

[0065] Step 3: Calculation of situation factor weight coefficients based on state information entropy

[0066] After classifying the states, to further quantify the dispersion of each situation factor's state distribution within the time window, we first count the cumulative number of times each situation factor has been in each state category up to the current sampling period. Let... Indicates the first Individual situation factors From the sampling period Sampling period The cumulative number of times each state category is in the middle, where This is the status number, with values ​​of 0, 1, and 2, corresponding to normal status, general risk status, and abnormal risk status, respectively. The calculation formula is:

[0067]

[0068] in, This is an indicator function that executes when the condition within the parentheses is true. ,otherwise .

[0069] definition Used to describe the Individual situation factors Up to the Each sampling period Time State Category The probability is calculated using the following formula:

[0070]

[0071] Based on the above state category probabilities, to describe the dispersion of normal, general risk, and abnormal risk states of each situation factor, the following definition is made: Individual situation factors Up to the Each sampling period The state information entropy at time is The calculation formula is:

[0072]

[0073] Among them, when At that time, it was agreed . Used to measure the dispersion of a probability distribution; the more concentrated the probability distribution, the more dispersed it is. The smaller the value, the better the situation factor. The higher the certainty, the more dispersed the probability distribution. The larger the value, the greater the potential of the situation factor. The higher the uncertainty of the state.

[0074] Since the states of each situation factor only include three categories: normal state, general risk state, and abnormal risk state, when the three states are evenly distributed... Take the maximum value Define 8 situation factors. The total deterministic contribution is :

[0075]

[0076] Furthermore, define the first Individual situation factors Up to the Each sampling period The weighting coefficient is The calculation formula is:

[0077]

[0078] when When this occurs, it indicates that the state distribution of each situation factor is in a state of maximum uncertainty. At this point, let the weight coefficients of each situation factor be... , This enables uncertainty-based reverse weighting based on state information entropy, where situation factors with higher state certainty receive larger dynamic weight coefficients.

[0079] Step 4: Generation of Security Status Level Boundaries

[0080] To establish a level boundary standard that adaptively matches the system's normal operating baseline, the sampling period of the normal operating state described in step one is used. The power monitoring system is in normal operating condition. Each sampling period , The sampling period Substituting the values ​​from steps two and three in sequence, we can calculate the result. Individual situation factors In normal operating condition, the first State category for each sampling period and the corresponding weighting coefficients The normal operating state category and weight coefficient are weighted according to the method described in step five to obtain the normal operating state number. Comprehensive security status value corresponding to each sampling period The calculation formula is:

[0081]

[0082] Define the reference status value of the power monitoring system under normal operating conditions. for:

[0083]

[0084] Considering that this invention classifies state categories into normal state, general risk state, and abnormal risk state, a first-level security situation threshold value is defined. and Level 2 security status threshold They are respectively:

[0085]

[0086]

[0087] This generates multi-level security posture boundary values ​​that are adaptive to the normal operating baseline of the system.

[0088] Step 5: Comprehensive Security Situation Quantitative Characterization and Situation Level Determination

[0089] After obtaining the dynamic weight coefficients and state categories of each situation factor in the current sampling period, combined with the first... Individual situation factors In the Each sampling period Status categories Define the power monitoring system in the first Each sampling period Comprehensive security situation value The calculation formula is:

[0090]

[0091] because ,and ,therefore satisfy . The closer it is to 0, the lower the overall risk level of the power monitoring system; The closer the value is to 2, the higher the overall risk level of the power monitoring system.

[0092] Furthermore, based on the multi-level security status boundary values ​​generated in step four, the power monitoring system is defined in the [missing information - likely a specific step or step]. Each sampling period The situation level determination result is The calculation formula is:

[0093]

[0094] in, Indicates the power monitoring system in the first Each sampling period At a normal level, This indicates that the situation is at an early warning level. This indicates an abnormal situation.

[0095] Step Six: Security Situation Prediction Based on the Magnitude of Situation Changes

[0096] To characterize the changing trend of the overall security status of the power monitoring system between adjacent sampling periods, we first define the power monitoring system's first... Each sampling period The magnitude of the situation change The calculation formula is:

[0097]

[0098] in, Indicates the first Each sampling period Comprehensive security situation value Compared to the first Each sampling period Comprehensive security situation value rise; Indicates a decrease; This indicates that nothing has changed.

[0099] This method no longer extrapolates the comprehensive security situation value for the next sampling period, but instead judges the system security situation trend based on the change range of the comprehensive security situation value in the current sampling period. This is based on the Level 1 security situation boundary value generated in step four. and Level 2 security status threshold To distinguish between normal and abnormal fluctuations, a threshold for judging situational changes is defined. for:

[0100]

[0101] in, The sensitivity adjustment coefficient is set according to the actual situation of the power monitoring system. The default value is set to... .

[0102] Define the power monitoring system in the first Each sampling period The security situation trend is as follows The calculation formula is as follows:

[0103]

[0104] in, This indicates a state of risk mitigation, meaning that the overall security situation value in the current sampling period has significantly decreased compared to the previous sampling period; This indicates a stable operating state, meaning that the variation range of the comprehensive safety situation value is within the normal fluctuation range; This indicates an increased risk level, meaning the overall security situation value has risen significantly. This indicates a sudden increase in risk, meaning a significant rise in the overall security situation value. By outputting the corresponding status code, trend warnings based on the magnitude of the situational change are achieved.

[0105] Through the above six steps, this invention first unifies multi-source heterogeneous security data such as industrial control protocol messages, network access behavior, host audit events, and communication link status in the power monitoring system into situation factors, and represents them in a time-series manner according to the sampling period; then, based on reference data under normal operating conditions, it measures the risk deviation of each situation factor and completes the state category classification; further, by statistically analyzing the state distribution within the time-series window and calculating the state information entropy, it obtains the dynamic weight coefficients of each situation factor, realizing the dynamic fusion of different security indicators in the comprehensive situation assessment; subsequently, it generates adaptive multi-level security situation boundary values ​​based on reference stage data; then, it calculates the comprehensive security situation value and performs level discrimination based on the dynamic weights and state categories; finally, based on the change range of the comprehensive security situation value, it discriminates and outputs early warnings for the current security situation and its changing trend of the power monitoring system.

[0106] Therefore, this invention can improve the unified representation capability of multi-source heterogeneous security data, enhance the adaptability of weight allocation to dynamic attack processes, and reduce the judgment lag problem caused by fixed threshold and fixed weight methods, thereby improving the accuracy and stability of network security situation awareness, risk assessment and early warning response of power monitoring systems.

[0107] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A network security situation awareness method based on multi-source heterogeneous data temporal correlation modeling, characterized in that, include: Multiple situation factors are selected from the multi-source heterogeneous security data of the power monitoring system and represented in a time-series manner according to a preset sampling period; Using multiple consecutive sampling periods of the system's normal operating state as reference stages, the operating mean of each situation factor is calculated, and the deviation of each situation factor is calculated based on the operating mean, thereby classifying the state categories. The state information entropy is calculated based on the state category distribution of each situation factor within the time window, and the dynamic weight coefficient of each situation factor is calculated based on the deterministic contribution of the state information entropy to the maximum information entropy. The smaller the state information entropy, the larger the corresponding dynamic weight coefficient. Based on the situation assessment results of the reference phase, a reference situation value and a multi-level security situation boundary value are generated. The comprehensive security situation value is calculated based on the dynamic weight coefficients of each situation factor and its current state category, and the situation level is determined based on the security situation boundary value. The magnitude of the situation change between adjacent sampling periods is calculated, and a situation change discrimination threshold is determined based on the security situation boundary value. The security situation trend state is determined by comparing the magnitude of the situation change with the situation change discrimination threshold, and an early warning code is output.

2. The network security situation awareness method based on multi-source heterogeneous data temporal correlation modeling according to claim 1, characterized in that, The aforementioned situational factors include: frequency of abnormal messages in industrial control protocols, frequency of unauthorized port access, frequency of new network connections, frequency of intrusion detection alarms, frequency of firewall blocking events, frequency of failed logins to critical hosts, frequency of abnormal permission operation events, and frequency of interruptions in critical communication links.

3. The network security situation awareness method based on multi-source heterogeneous data temporal correlation modeling according to claim 2, characterized in that, The frequency of abnormal industrial control protocol messages is defined as the number of IEC 60870-5-104 or Modbus abnormal protocol messages detected within the sampling period; the frequency of unauthorized port access is defined as the number of connection attempts with a destination port belonging to a non-whitelisted port set within the sampling period; the frequency of new network connections is defined as the number of new network sessions or connection establishments within the sampling period; the frequency of intrusion detection alarm triggers is defined as the number of alarm events generated by the intrusion detection system within the sampling period; the frequency of firewall blocking events is defined as the number of times the firewall executes a security policy of denial or drop actions within the sampling period; the frequency of critical host login failures is defined as the number of login failure events generated by critical servers or station control hosts within the sampling period; the frequency of abnormal permission operation events is defined as the number of permission escalation, account permission changes, or sensitive operation events recorded in the host audit log within the sampling period; and the frequency of critical communication link interruptions is defined as the number of times the communication link between the station control layer and the dispatch master station is interrupted within the sampling period.

4. The network security situation awareness method based on multi-source heterogeneous data temporal correlation modeling according to claim 1, characterized in that, The status categories include normal status, general risk status, and abnormal risk status; When the deviation is no more than 1, it corresponds to a normal state; when it exceeds 1 but does not exceed 2, it corresponds to a general risk state; and when it exceeds 2, it corresponds to an abnormal risk state.

5. The network security situation awareness method based on multi-source heterogeneous data temporal correlation modeling according to claim 1, characterized in that, The degree of deviation is obtained by comparing the portion of the current observation value that exceeds the normal operating average with the normal operating average; The degree of deviation is zero when the current observed value does not exceed the normal operating average.

6. The network security situation awareness method based on multi-source heterogeneous data temporal correlation modeling according to claim 1, characterized in that, The state category distribution is obtained by counting the cumulative number of times each situation factor is in each state category up to the current sampling period and calculating the state category probability; The state information entropy is calculated based on the negative logarithmic expectation of the probabilities of each state category; The dynamic weighting coefficients are determined based on the proportion of the difference between the state information entropy and the maximum information entropy of each situation factor to the total deterministic contribution of all situation factors.

7. The network security situation awareness method based on multi-source heterogeneous data temporal correlation modeling according to claim 1, characterized in that, The comprehensive security situation value is obtained by weighting and summing the dynamic weight coefficients of each situation factor with their corresponding state categories.

8. The network security situation awareness method based on multi-source heterogeneous data temporal correlation modeling according to claim 1, characterized in that, The reference situation value is the average of the comprehensive security situation values ​​for each sampling period under normal operating conditions; the multi-level security situation boundary value includes a first-level security situation boundary value and a second-level security situation boundary value, which are obtained by dividing the interval between the reference situation value and the maximum situation value according to a preset ratio.

9. The network security situation awareness method based on multi-source heterogeneous data temporal correlation modeling according to claim 1, characterized in that, The magnitude of the change in situation is the difference between the comprehensive security situation value in the current sampling period and the comprehensive security situation value in the previous sampling period; The situation change discrimination threshold is determined based on the difference between the first-level security situation boundary value and the second-level security situation boundary value according to a preset sensitivity coefficient; by comparing the situation change amplitude with the situation change discrimination threshold and its multiple, the current security situation is determined to be in a state of risk mitigation, stable operation, risk enhancement or risk surge.

10. A network security situation awareness system based on multi-source heterogeneous data temporal correlation modeling, characterized in that, include: The data acquisition module is used to select multiple situation factors from the multi-source heterogeneous security data of the power monitoring system and perform time-series representation according to a preset sampling period. The risk offset measurement module is used to take multiple consecutive sampling periods of the normal operating state of the system as reference stages, calculate the operating average of each situation factor, and calculate the degree of deviation of each situation factor based on the operating average, thereby classifying the state categories. The weight calculation module is used to calculate the state information entropy based on the state category distribution of each situation factor within the time window, and to calculate the dynamic weight coefficient of each situation factor based on the deterministic contribution of the state information entropy to the maximum information entropy. The smaller the state information entropy, the larger the corresponding dynamic weight coefficient. The boundary value generation module is used to generate reference situation values ​​and multi-level security situation boundary values ​​based on the situation assessment results of the reference stage. The situation quantification module is used to calculate the comprehensive security situation value based on the dynamic weight coefficients of each situation factor and its current state category, and to determine the situation level based on the security situation boundary value. The trend prediction module is used to calculate the magnitude of situational change between adjacent sampling periods, determine the change discrimination threshold based on the security situation boundary value, and determine the security situation trend state by comparing the magnitude of situational change with the change discrimination threshold and output an early warning code.

Images