Power monitoring disposal method and system based on finite time domain approximate survivability screening

Abstract

The application discloses a power monitoring treatment method and system based on limited time domain approximate survivability screening and belongs to the technical field of power system network security. In view of the fact that in the existing network security treatment method of the power monitoring system, specific treatment actions are not included in a unified random state evolution model, and security deviation is easily offset by lower business cost, the application establishes a controlled jump diffusion prediction model and a conditional event intensity model, selects an approximate survival strategy under the condition that a conservative upper estimation value of a cumulative deviation is not greater than a preset threshold, forms an allowable control strategy set after key variable constraint and device interlocking check, and executes the best strategy from the allowable control strategy set and rolls over cycle by cycle. When there is no allowable control strategy or the action execution is abnormal, abnormal treatment is triggered, and when a new allowable control strategy cannot be obtained, a standby treatment strategy is executed. The application realizes layered treatment with security screening preceding performance optimization, and guarantees the continuous operation capability of the power grid under random attacks and business constraints.

Description

Technical Field

[0001] This invention relates to the field of power system network security technology, and in particular to a power monitoring and handling method and system based on finite time-domain approximate survivability screening. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the deep integration of power monitoring systems and information networks, power grid operation is highly dependent on a collaborative sensing and control system composed of Supervisory Control and Data Acquisition (SCADA) or Energy Management System (EMS) master stations, vertical encryption authentication, horizontal isolation, and network intrusion detection equipment.

[0004] In actual operation, the cybersecurity threats faced by power monitoring systems are becoming increasingly complex: on the one hand, cyberattacks are characterized by randomness, suddenness, and multi-stage evolution. For example, attackers may first probe the penetration boundary through protocol anomalies and then trigger malicious remote control commands; on the other hand, security response actions are subject to operational constraints such as equipment interlocking, business continuity, and operation tickets.

[0005] However, existing network security response methods have the following technical limitations. First, specific actions such as firewall policy switching, link isolation, or host freezing are often not considered in a unified stochastic state evolution model. This makes it difficult to simultaneously quantify the combined impact of continuous background disturbances, state abrupt changes caused by identifiable attack events, and different response actions on the subsequent risk distribution, leading to a discrepancy between prediction and execution. Second, existing coordinated defense strategies often set security risks, service interruptions, and response costs as a weighted soft objective. When response actions may trigger communication interruptions or remote control / disabling, security deviations are easily offset by lower service operating costs, potentially resulting in conservative but insufficiently secure policies being issued even under high-risk conditions. Third, the discretization error between the continuous-time stochastic model and the digital response controller, the unpredictability of candidate policies, and equipment failures or abnormal feedback after action execution lack rolling verification and engineering degradation mechanisms, failing to meet the power system's engineering requirements for predictable, verifiable, and auditable security collaborative response risks.

[0006] Therefore, how to achieve secure and predictable generation, rigorous screening, and rolling execution of response strategies under the coexistence of random network attacks and business continuity constraints, and how to ensure backup capabilities when action execution fails, are the technical problems that need to be solved. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention provides a power monitoring and handling method and system based on finite-time-domain approximate survivability screening. By using controlled jump-diffusion model prediction and approximate survivability threshold screening, it achieves coordinated handling where safety screening is superior to business optimization, thus ensuring the continuous operation of the power grid.

[0008] To achieve the above objectives, the present invention is implemented through the following technical solution: In a first aspect, the present invention provides a power monitoring and handling method based on finite-time-domain approximate survivability screening, comprising: Acquire data from the power monitoring system; Construct a network security situational vector and extract labeled attack event sequences; Based on the state vector and the attack event sequence, a discretized controlled jump diffusion prediction model and a conditional event intensity model are established. In each processing cycle, a set of candidate control strategies is generated, and a set of safety state constraints and constraint check conditions are constructed. Random scenarios are generated for each candidate control strategy using a prediction model and an intensity model. The cumulative deviation of the predicted state from the set of safety state constraints is conservatively estimated. Approximate survival strategies are selected based on the condition that the conservatively estimated value is not greater than a preset threshold. After constraint check, an allowable control strategy set is formed. Select a policy from the allowable control policy set, execute the first handling action, and roll it over in the next handling cycle; trigger exception handling when there is no allowable control policy or the action is executed abnormally, and execute the backup handling policy when no new allowable control policy can be obtained.

[0009] Furthermore, based on power monitoring system data, raw status indicators are calculated, including authentication anomalies, abnormal messages, remote control and adjustment records, link quality, database access, and host behavior. After performing exponential smoothing or asymmetric exponential smoothing on the original state indicators, a dimensionless network security situation state vector is constructed. Original alarms with the same or related event source, affected target, and event type, and whose adjacent time is no greater than a preset aggregation threshold, are aggregated into a labeled attack event sequence that includes event type, affected target, severity, and context information.

[0010] Furthermore, the controlled jump diffusion prediction model is obtained by discretizing the continuous-time network security situation state model; the continuous-time network security situation state model consists of a drift term, a diffusion term, and an attack event jump term.

[0011] Furthermore, the conditional event intensity model adopts a multi-type labeled exponential decaying kernel linear self-excitation point process, the intensity of which is composed of the sum of the basic intensity and the decaying kernel excitation effect of historical events.

[0012] Furthermore, based on the current augmented decision state, action template, action hold and cooldown time, and subsequent action rules based on currently available information, a finite number of candidate control strategies are generated. Simultaneously, safe state boundaries are constructed using box-type constraints and coupled linear constraints, and key variable constraints and equipment-level safety interlocks are set as constraint check conditions.

[0013] Furthermore, the random scenarios include ordinary random prediction scenarios and stress scenarios; The ordinary random prediction scenario is used to calculate the statistical estimate of the cumulative deviation; the stress scenario is used to check the alternative capability under key variable constraints and equipment failure, and the stress scenario includes at least one or more combinations of high attack intensity, action execution delay, loss of key data source or failure of disposal equipment.

[0014] Furthermore, the cumulative deviation is conservatively estimated as the sum of the cumulative deviation statistical estimate and the finite scenario sampling error margin, model error margin, and discretization error margin.

[0015] A second aspect of the present invention provides a power monitoring and handling system based on finite-time-domain approximate survivability screening, comprising: Data acquisition module: used to acquire data from the power monitoring system; Situation Construction Module: Used to construct network security situation state vectors and extract labeled attack event sequences; Model building module: used to build a discretized controlled jump diffusion prediction model and a conditional event intensity model based on the state vector and the attack event sequence; Strategy generation and screening module: In each handling cycle, it generates a set of candidate control strategies and constructs a set of safety state constraints and constraint check conditions; it generates random scenarios for each candidate control strategy using a prediction model and an intensity model, calculates a conservative estimate of the cumulative deviation of the predicted state from the set of safety state constraints, and screens approximate survival strategies based on the condition that the conservative estimate is not greater than a preset threshold. After constraint check, an allowable control strategy set is formed. The strategy execution and rolling module is used to select a strategy from the set of permissible control strategies, execute the first action, and then execute it on a rolling basis in the next action cycle. Exception handling module: used to trigger exception handling when there is no allowable control policy or when the action is executed abnormally, and to execute the backup handling policy when a new allowable control policy cannot be obtained.

[0016] In a third aspect, the present invention also provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of the method as described in the first aspect.

[0017] In a fourth aspect, the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method as described in the first aspect.

[0018] Compared with the prior art, the beneficial effects of the present invention are: Compared with existing collaborative defense methods that uniformly weight and optimize security risks, business interruptions, and handling costs, this invention adopts a layered architecture where security screening precedes performance optimization. It generates random prediction scenarios under each candidate control strategy through a controlled jump diffusion model and a conditional event strength model, calculates a conservative estimate of the cumulative deviation, and selects finite-time-domain approximate survival strategies based on this estimate not exceeding a preset approximate survival threshold. After key variable constraints and device-level security interlock checks, an acceptable control strategy set is formed, ensuring that candidate strategies first meet security acceptability before performance optimization within the safe feasible domain. This avoids the risk of security deviations being offset by lower business operating costs. Simultaneously, this invention incorporates network security handling actions as control inputs into a unified state prediction framework. It uses a conditional event strength model to drive the generation of random attack scenarios and ensures that the system retains degraded operation capabilities even in cases of data loss, model failure, or abnormal actions through cycle-by-cycle rolling execution, action execution receipt verification, recalculation after failure, and backup strategies. This achieves collaborative handling where security screening is superior to business optimization, ensuring continuous operation of the power grid. Attached Figure Description

[0019] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0020] Figure 1 This is a flowchart of the method according to Embodiment 1 of the present invention; Figure 2 This is a flowchart of the allowable control strategy screening process of the present invention; Figure 3 This is a flowchart of the abnormal handling process of the present invention. Detailed Implementation

[0021] The following detailed description is exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0022] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0023] In this embodiment of the invention, the data collection and processing strictly adhere to the requirements of relevant laws and regulations, obtaining informed consent or separate consent from the data subject, and conducting subsequent data use and processing within the scope of laws, regulations, and the data subject's authorization. All data acquisition in this embodiment is based on compliance with laws and regulations and user consent, representing the lawful application of the data.

[0024] Terminology Explanation: The network security situation state vector is a multi-dimensional state vector constructed from preprocessed network security, network operation, and business operation technical indicators according to a preset state definition. This vector is the basic state variable for model identification, state prediction, and security screening in this invention. When there is missing data or significant measurement noise, the data preprocessing step can use interpolation, filtering, or state estimation methods to recover the corresponding state components, but the recovery method does not change the definition of the network security situation state vector itself.

[0025] Tagged attack events: Attack events with a clear time of occurrence and information including event type, affected targets, event severity, and context.

[0026] Handling actions: Specifically, these include actions such as rate limiting, enhanced authentication, switching access control policies, link isolation, account freezing, isolation of abnormal hosts, disabling remote control and adjustment, read-only mode, switching trusted data sources, switching primary and backup paths, switching primary and backup stations, or stopping control.

[0027] Actual effective action: The action that the target device has accepted and actually executed. The controlled jump diffusion model uses the actual effective action as the control input.

[0028] Ordinary stochastic prediction scenario: A complete stochastic evolution scenario generated according to the target prediction distribution determined by the current online effective model, used to estimate the expected cumulative deviation corresponding to the candidate control strategy.

[0029] Stress scenarios: For fully stochastic evolution scenarios artificially constructed with high attack intensity, high event severity, action execution delay, loss of critical data sources, failure of handling equipment, or combinations thereof, it is used for key variable constraint checks, alternative strategy checks under equipment failure, and conservatism checks.

[0030] For the same candidate control strategy, predicted state trajectories are calculated in both the ordinary random prediction scenario set and the stress scenario set. Each candidate control strategy is evaluated in both scenarios using the same subsequent causal action rule. The first command action of the candidate control strategy is the same in all scenarios, and subsequent command actions are only allowed to be determined by the same causal action rule based on the information already obtained at the corresponding time. The ordinary random prediction scenario is used to calculate the cumulative deviation statistical estimate according to the target prediction distribution. The stress scenario, because its occurrence frequency is usually not set according to the target prediction distribution, is not equally weighted with the ordinary random prediction scenario to calculate the expected cumulative deviation; when the probability of the stress event can be reliably determined, it can be included in the cumulative deviation statistical estimate according to the corresponding probability weight or importance sampling weight.

[0031] Anomaly Handling: This refers to the process of identifying the anomaly type when an action execution anomaly, lack of allowable control policy, data quality anomaly, model validity anomaly, policy calculation timeout, or other situations that prevent the normal rolling handling process from continuing under the original conditions. Based on the updated equipment status, actual effective actions, system operating mode, data quality, model validity, and remaining handling time limit, the process determines whether to execute online alternative policy recalculation, enter conservative mode for online recalculation, or enter the standby handling process.

[0032] Conservative Mode: This refers to a degraded online operation mode adopted when there is still an effective model available for online prediction, and the current state that meets the minimum confidence requirements can be used as the initial prediction value. However, when model uncertainty, data quality risk, or other operational uncertainty exceeds normal levels, this mode is used. In conservative mode, the system still performs candidate control strategy generation, random scenario prediction, finite-time-domain approximate survivability screening, and constraint checks, but adopts a more conservative error margin, candidate strategy range, or constraint check parameters, and allows for the acquisition of permissible control strategies by relaxing safety screening conditions. When the model, data, or remaining processing time no longer meets the minimum requirements for online prediction and screening, the system enters the standby processing procedure.

[0033] Backup handling process: This refers to the downgrade handling process when the current conditions are insufficient to reliably execute online policy prediction and screening, or when no permissible control policy is found after recalculating online alternative policies. Instead of relying on the current online optimization results, the process matches backup handling policies from an offline-verified backup handling policy library based on attack event information, asset level, business level, system operating mode, and device availability. Alternatively, when the attack event type cannot be reliably determined, a preset default security policy is selected. This process is then executed after verification of permissions, parameter ranges, and device-level security interlocks.

[0034] The terms mentioned above are commonly used technical terms in this field, but they have specific meanings in the context of this invention. Those skilled in the art should understand these terms in conjunction with the overall technical solution of this invention. The following embodiments will provide a detailed description of the technical solution of this invention to facilitate its implementation by those skilled in the art.

[0035] Example 1 Existing cybersecurity measures for power monitoring systems typically use security risks, service interruptions, and handling costs as a weighted soft objective for unified optimization. Furthermore, specific handling actions are not incorporated into a unified stochastic state evolution model, leading to two potential engineering risks under high-risk conditions: First, taking the example of an attacker maliciously remotely controlling the SCADA / EMS master station after probing the penetration boundary through protocol anomalies, if handling actions (such as link isolation or disabling remote control) might cause partial service interruption, traditional weighted optimization might sacrifice security margins due to the low service interruption cost coefficient, resulting in a strategy that deviates from the acceptable threshold but whose actual risk is already uncontrollable. Second, traditional methods lack the ability to jointly predict random continuous disturbances, sudden attack events, and the results of handling actions within a unified framework. They also cannot form an engineering closed loop through action execution receipt verification, recalculation after failure, and backup strategies, often leading to discrepancies between prediction and execution.

[0036] To address the aforementioned shortcomings, this invention utilizes the drift term in the controlled jump-diffusion model to describe the inertial evolution of the state, the diffusion term to characterize background random fluctuations, and the jump term to depict the instantaneous impact of attack events on the state. It also incorporates actual effective handling actions as control inputs into a unified state prediction framework, enabling the coordinated quantification of random disturbances, attack events, and handling actions within the same stochastic evolution model. Furthermore, this invention uses a conservative estimate of the cumulative deviation not exceeding a preset approximate survival threshold as a safety screening condition. Only strategies that pass the safety screening can proceed to subsequent performance optimization stages, ensuring that safety constraints strictly take precedence over business performance optimization. In addition, this invention achieves a complete process from strategy generation, safety screening, action execution, to anomaly degradation through cycle-by-cycle rolling execution, action execution receipt verification, recalculation after failure, and backup strategies, ensuring the continuous operation capability of the power monitoring system under network attack conditions.

[0037] In a typical embodiment of the present invention, such as Figure 1 As shown, a power monitoring and handling method based on finite-time-domain approximate survivability screening is disclosed, and the specific steps include: S1: Collect network security data, network operation data, and business operation and management log data from the power monitoring system, and complete time synchronization, quality marking, and preprocessing; construct the current network security situation vector; and extract the labeled attack event sequence from the collected data.

[0038] S2: Based on historical network security situation vectors, historical response actions, system operation modes, response action execution results, and labeled attack event sequences, establish a controlled jump diffusion model and a conditional event strength model, identify and verify model parameters; discretize the verified continuous-time model to form a discrete-time stochastic prediction model for online scenario prediction.

[0039] S3: In each handling cycle, update the current augmented decision state, construct a set of safety state constraints, key variable constraints and device-level safety interlock conditions, and generate a finite set of candidate control strategies containing subsequent action sequences or subsequent causal action rules.

[0040] S4: Generate ordinary random prediction scenarios for each candidate control strategy, calculate the predicted state trajectory and the cumulative deviation of each predicted state trajectory from the set of safe state constraints within the rolling prediction time domain. Calculate the statistical estimate of the cumulative deviation based on the ordinary random prediction scenario, and add the finite scenario sampling error margin, model error margin, and discretization error margin to obtain a conservative estimate of the cumulative deviation after error margin correction. Construct stress scenarios for high attack intensity, action execution delay, loss of critical data sources, or failure of handling equipment. Under stress scenarios, check the constraints of key variables, equipment failure replacement capabilities, and conservatism requirements. Filter the finite-time domain approximate survival strategies based on a preset approximate survival threshold, and then intersect them with the strategies that pass the checks of key variable constraints and equipment-level security interlocks to form an acceptable control strategy set.

[0041] S5: Select a control strategy only from the permissible control strategy set based on at least one of the following: state deviation, command action cost, actual effective action cost, service interruption cost, action switching cost, and action execution anomaly cost. Execute the first handling action of the selected control strategy and re-predict, filter, and select in the next handling cycle.

[0042] S6: Trigger exception handling when there is no permissible control policy or the action is executed abnormally. If the online alternative policy recalculation conditions are met, regenerate and filter candidate control policies based on the updated current augmented decision state. If the online alternative policy recalculation conditions are not met or there is still no permissible control policy after recalculation, execute the backup handling policy.

[0043] The finite-time approximate survivability described in this invention is a model-based security screening concept defined given a current augmented decision state, a current online effective model, a finite set of candidate control strategies, and a rolling prediction time domain. For a candidate control strategy, if the expected cumulative deviation from its corresponding network security situation state to the set of security state constraints is not greater than a preset approximate survivability threshold, the candidate control strategy is said to have finite-time approximate survivability in the current rolling prediction time domain. In the online implementation, the conservatively estimated value of the cumulative deviation is not greater than the threshold as the screening condition.

[0044] The power monitoring and handling method based on finite time domain approximate survivability screening will be described in detail below with reference to specific implementation methods.

[0045] In one implementation, a data acquisition agent is deployed at a data acquisition location that meets the security zoning requirements of the power monitoring system, acquiring data through bypass mirroring, device native audit interfaces, log agents, or controlled data upload interfaces; state construction and attack event extraction are deployed on the situational awareness host; candidate control strategy generation, scenario prediction, screening, and performance optimization are deployed on the online response controller; and model parameter identification, model verification, and backup response strategy library maintenance are deployed on the controlled training node. The controlled training node cannot bypass the online response controller to directly issue commands to the production equipment.

[0046] S1: Through data acquisition agents deployed at data acquisition locations that meet the security zoning requirements of the power monitoring system, operational and security data such as authentication and security tunnels, network packets, remote control and adjustment, critical communication links, database access, and host behavior are collected via bypass mirroring, device native audit interfaces, log agents, or controlled data upload interfaces. After time synchronization, quality marking, and preprocessing, various basic anomaly indicators are constructed within the statistical window. Six types of dimensionless raw state indicators are formed through normalization and weighted fusion of normal operation baselines. Then, state components are formed by exponential smoothing or asymmetric exponential smoothing for states with rapid risk escalation and slow recovery, and a dimensionless network security situational vector is constructed. At the same time, raw alarms with the same or related event sources, affected targets, and adjacent times not exceeding a preset aggregation threshold are aggregated into a labeled attack event sequence containing event type, affected target, severity, and context information. Since a network attack in a power monitoring system usually generates multiple related alarms on multiple security devices, such as scanning alarms, authentication anomaly alarms, and abnormal access alarms. Treating each alarm as an independent attack event would lead to repeated calculations of attack counts and intensity, affecting the prediction accuracy of subsequent conditional event intensity models and random jump models. Therefore, this invention sets an aggregation threshold to aggregate multiple alarms belonging to the same attack activity into a single attack event based on the temporal proximity of the alarms and the correlation between the event source, target object, and event type. This improves the accuracy of attack event extraction and avoids duplicate jumps in the random jump model.

[0047] S101: Data acquisition and quality labeling.

[0048] The collected data includes at least one of the following: authentication failures, certificate anomalies, tunnel status, and session records of vertical encryption authentication devices; policy hits, transmission direction anomalies, policy versions, and policy change records of horizontal isolation devices; protocol anomalies, scans, vulnerability exploits, malicious payloads, and abnormal control messages of network intrusion detection devices; abnormal processes, file integrity, account logins, and privilege escalation records of host intrusion detection devices; remote control and adjustment records, operation ticket matching results, command sources, target devices, control parameters, database access, and primary / backup status of the monitoring and data acquisition system or energy management system master station; and the number of transmitted and received messages, interface traffic, latency, packet loss, link status, processor utilization, and memory utilization of dedicated power monitoring network equipment.

[0049] All data sources use a unified clock, or record the deviation of the data source clock relative to the unified clock. Data is aligned according to device identifier, service identifier, link identifier, and statistical window. The data quality identifier for each statistical window is denoted as follows: The data quality identifiers include data integrity rate, time synchronization reliability, sampling delay, and outlier ratio. Based on these identifiers, data quality requirements are set to determine whether the current data can support online state construction, model prediction, and security screening. These requirements include normal data quality requirements and minimum data quality requirements. Normal data quality requirements refer to the data quality conditions that the current data should meet to be directly used for state construction, online prediction, and security screening. Minimum data quality requirements refer to the minimum data quality conditions that must be met to support state construction, online prediction, and security screening in a conservative mode, provided that necessary data supplementation, filtering, or state estimation results meet the minimum reliability requirements for online prediction.

[0050] The critical data completeness rate is determined by the ratio of the number of critical data points actually obtained within the statistical window and passing the validity check to the number of critical data points that should be obtained according to preset sampling or event logging rules. The preset threshold for the critical data completeness rate is preferably... More preferably, it should be 99%; for essential key data directly related to the current automatic handling, including command source, target device, command parameters, command integrity verification results, handling device availability status, and action execution receipts, the corresponding essential fields must be complete. The upper limit of time synchronization error is set according to the data type. For key time-series data that requires determining the order of events, such as attack events, remote control events, action effect receipts, and changes in system operating modes, the upper limit of time synchronization error is preferably... More preferably, it is 100 ms; for general status statistics such as interface traffic, resource utilization, and aggregated indicators within the statistical window, the upper limit of time synchronization error is preferably 100 ms. More preferably, it should be 1 second. For critical time-series data, when the order of related events cannot be reliably determined after considering time synchronization errors, prediction scenarios should be constructed according to different event sequences, or an order that is less favorable for safety screening should be adopted. The corresponding requirements for sampling delay and outlier ratio are predetermined based on data type, sampling period, handling period, and historical operation verification results.

[0051] In one implementation, normal data quality requirements include at least a critical data integrity rate of not less than 99%, the completeness of the required critical fields, and time synchronization errors meeting the aforementioned upper limits. Minimum data quality requirements include at least a critical data integrity rate of not less than 98%, the completeness of the required critical fields, and key time-series data meeting the aforementioned time synchronization requirements, or, after considering time synchronization errors, the order of events related to the current handling can still be reliably determined. If the current data meets the normal data quality requirements, online state construction, prediction, and security screening are performed according to the normal mode. If the current data does not meet the normal data quality requirements but still meets the minimum data quality requirements, and the state components that need to be supplemented, filtered, or estimated meet the minimum confidence requirements for online prediction, a conservative mode is entered. If the current data does not meet the minimum data quality requirements, the state constructed from the corresponding data is no longer directly used for online strategy screening, and the process enters the standby handling procedure.

[0052] The minimum reliability requirement for online prediction means that the state recovery method has been verified on historical data, test data, or simulation data that match the current data source, missing data method, and system operation mode, and the recovery error can be determined and does not exceed a preset error upper limit. In one embodiment, the statistical coverage level of the recovery error is preferably not less than 95%, more preferably not less than 99%; under the corresponding coverage level, the normalized recovery error upper limit is preferably not more than 10%, more preferably not more than 5%. For discrete key information that directly affects the legality of the action or the actual effective state, such as command source, target device, command parameters, available status of the disposal device, action execution result, system operation mode, and device-level safety interlock status, general interpolation or state estimation results are not used to replace reliable confirmation; if reliable confirmation cannot be obtained, it is considered that the minimum reliability requirement for online prediction is not met.

[0053] S102: Definition of network security situational state vector.

[0054] At sampling time The network security situation vector is uniformly denoted as: ,in, The sampling time number is used. The number of state components. For the first Each network security situational component, symbol This represents the vector transpose. Each state component is a dimensionless state variable; the larger the value, the greater the corresponding risk, anomaly, or operational degradation. To preserve the extent of exceeding the reference threshold, the state components are not subject to upper limit saturation truncation.

[0055] In a six-dimensional implementation, the network security situation vector is defined as: ,in, This is an authentication anomaly status, used to represent situations such as authentication failure, certificate anomaly, tunnel anomaly, and abnormal login. This is an abnormal message status, used to characterize situations such as protocol anomalies, traffic anomalies, scanning, and malicious payloads; This indicates an abnormal remote control / teleading status, used to characterize situations such as mismatched operation tickets, unauthorized sources, out-of-bounds parameters, and failure of command integrity. This represents the quality degradation state of critical communication links, used to characterize packet loss, latency, latency variations, and link interruptions. This represents the database abnormal access status, used to characterize situations such as abnormal queries, unauthorized access, and abnormal data modification; This represents the abnormal behavior status of the host, used to characterize situations such as abnormal processes, abnormal file integrity, privilege escalation, and abnormal resource consumption.

[0056] The number and meaning of state components can be adjusted according to the target power monitoring system, but the same version of the state definition must be used in model identification, online prediction, safety state constraint set, and audit log. When the state definition changes, the state version number should be updated and the model and safety thresholds should be revalidated.

[0057] S103: Calculation of the original state index.

[0058] 1) Authentication anomaly status is used to describe the security risks caused by abnormal identity authentication process, trusted communication process and login behavior in the power monitoring system.

[0059] In the Within each statistics window, the authentication failure rate is defined as: in, This indicates the number of authentication failures, including username or password verification failures, digital certificate authentication failures, device identity authentication failures, and other identity trust verification failure events. This represents the total number of authentication requests. For the basic anomaly index constructed subsequently in this embodiment using the ratio of the number of abnormal events to the corresponding valid events, detections, or observations, when the total number may be zero, it is uniformly adopted. As the denominator, among which, This represents the total number of valid events, detections, or observations within the corresponding statistics window. This processing is only used to avoid division by zero when the total number is zero, and in... The actual value of the corresponding abnormality ratio remains unchanged. Furthermore, if the data quality identifier confirms that the corresponding data collection or detection function is normal, and it is confirmed that there are no corresponding valid events or detection objects within the statistical window, the corresponding basic abnormal indicators will be treated as zero; when When the problem is caused by a missing data source, failed data collection, unavailable detection functions, or other data quality anomalies, it will not be caused by... The obtained zero value is directly regarded as a valid normal observation, and is supplemented and marked according to the data quality anomaly handling rules; when the data quality still meets the minimum data quality requirements for online prediction but does not meet the normal operation requirements after processing, it enters the conservative mode; when the current prediction state cannot be reliably constructed, it enters the standby handling process.

[0060] Define the certificate anomaly rate as: in, This indicates the number of times certificate anomalies were detected. These anomalies include certificate expiration, certificate revocation, certificate chain verification failure, certificate signature verification failure, certificate identity mismatch with device identity, and certificate usage not conforming to security policies. This indicates the total number of certificate validity checks performed.

[0061] The anomaly rate of a safe tunnel is defined as: in, This indicates the number of times the secure tunnel has been in an abnormal state, including tunnel negotiation failure, authentication failure, abnormal disconnection, abnormal password change, and communication interruption. This indicates the total number of times the tunnel's safety status was observed.

[0062] Define the abnormal login rate as: in, This indicates the number of abnormal login attempts, including logins from non-whitelisted terminals, logins at unplanned times, logins from abnormal accounts, and login events that deviate from normal login behavior patterns. This indicates the total number of login events.

[0063] Baseline reference values ​​for the above indicators were obtained based on normal operation data. The authentication exception state component is then defined as follows: ,in, and The weights are non-negative and satisfy the following conditions: , , , and These are the normalized positive lower bounds for authentication failure rate, certificate anomaly rate, secure tunnel anomaly rate, and abnormal login rate, respectively.

[0064] 2) Abnormal message status is used to describe the security risks caused by abnormal message traffic, abnormal protocol behavior, and malicious payload activities during the network communication process of the power monitoring system.

[0065] In the Within each statistics window, the abnormal message rate is defined as: ,in, This indicates the number of messages that are judged to be abnormal, including the number of messages corresponding to abnormal communication frequency, abnormal source, abnormal target, and abnormal access mode; This indicates the total number of network packets.

[0066] Define the protocol anomaly rate as: ,in, This indicates the number of messages that exhibit protocol field anomalies, state machine anomalies, illegal opcodes, or abnormal protocol interaction processes. This indicates the number of messages involved in the protocol parsing.

[0067] The malicious payload anomaly rate is defined as: ,in, This indicates the number of packets that were detected to have malicious characteristics, abnormal content patterns, or attack payloads. This indicates the number of messages for which payload detection was performed.

[0068] Baseline reference values ​​for the above indicators were obtained based on normal operation data. The original status index of the abnormal message is defined as follows: ,in, , and The weights are non-negative and satisfy the following conditions: , , and These correspond to the normalized positive lower bounds of the abnormal message rate, protocol abnormal rate, and malicious payload abnormal rate, respectively.

[0069] 3) Abnormal remote control and adjustment status is used to describe abnormal behaviors, control risks, and status changes that may affect the safe operation of power equipment during the generation, transmission, and execution of control commands in the power monitoring system.

[0070] In the Within each statistics window, the exception control instruction rate is defined as: ,in, Indicates the number of exception control instructions, including unauthorized instructions, exception source instructions, and parameter out-of-bounds instructions; Indicates the total number of control commands.

[0071] Define the control transmission error rate as: ,in, This indicates the number of times that the control command transmission process has been tampered with, failed to verify, retransmitted, or experienced communication abnormalities. This indicates the total number of control command transmissions.

[0072] Define the control execution exception rate as: ,in, This indicates the number of times control execution failed, the execution result was inconsistent with the instruction, and the device status changed abnormally. This indicates the total number of times the control is executed.

[0073] Baseline reference values ​​for the above indicators were obtained based on normal operation data. The original state index for abnormal remote control and teleading is defined as follows: ,in, , and The weights are non-negative and satisfy the following conditions: , , and These correspond to the normalized positive lower bounds of the abnormal control instruction rate, control transmission abnormal rate, and control execution abnormal rate, respectively.

[0074] 4) The critical communication link quality degradation status is used to describe the security risks caused by the decline in data transmission reliability, abnormal network performance, and the impact on communication continuity in the communication links of the power monitoring system.

[0075] In the Within each statistics window, the packet loss anomaly rate is defined as: ,in, Indicates the number of lost packets; This indicates the total number of messages sent.

[0076] The latency anomaly rate is defined as: ,in, This indicates the number of data transmissions that exceeded the normal latency range; Indicates the number of delay detections.

[0077] Let the first A total of [number] data were collected within the statistical window. Transmission delay data for each communication message: ,in, Indicates the first Within the first statistical window The transmission delay corresponding to each communication message; Indicates the first The number of valid delay measurement samples within a statistical window. The average transmission delay within this statistical window is defined as: The degree of time delay fluctuation is defined as: Further define the time-delay volatility as: ,in, This is a preset positive lower limit for the average transmission delay, used to avoid the average delay being zero or too small due to measurement resolution, sampling anomalies, or other reasons, which could lead to division by zero or abnormal amplification in the delay fluctuation calculation.

[0078] Baseline reference values ​​for the above indicators were obtained based on normal operation data. The original state index of critical communication link quality degradation is defined as follows: ,in, , and The weights are non-negative and satisfy the following conditions: , , and These correspond to the normalized positive lower bounds of packet loss anomaly rate, latency anomaly rate, and latency volatility, respectively.

[0079] 5) Abnormal database access status is used to describe the security risks caused by database access behavior deviating from the normal business model.

[0080] No. Within each statistics window, the abnormal query rate is defined as: ,in, This indicates the number of abnormal queries, including queries at unplanned times, access to unexpected data objects, abnormal query frequency, and abnormal query data size. This indicates the total number of database queries.

[0081] Define unauthorized access rate as: ,in, This indicates the number of times data access was outside the authorized scope; This indicates the total number of database access requests.

[0082] Define the abnormal data modification rate as: ,in, This indicates the number of unauthorized data writes, updates, deletions, structural modifications, or configuration modifications. This represents the total number of database write operations.

[0083] Baseline reference values ​​for the above indicators were obtained based on normal operation data. The database abnormal access state component is then defined as follows: ,in, , and The weights are non-negative and satisfy the following conditions: , , and These are the normalized positive lower bounds for the abnormal query rate, unauthorized access rate, and abnormal data modification rate, respectively.

[0084] 6) Abnormal host behavior status is used to describe the security risks caused by abnormal operation of servers, workstations and control hosts.

[0085] No. Within each statistics window, the abnormal process rate is defined as: in, This indicates the number of abnormal process events, including unauthorized processes, non-whitelisted processes, abnormal parent-child process relationships, abnormal execution paths, and abnormal network connection processes. This indicates the total number of process checks.

[0086] Define the file integrity exception rate as: in, This indicates the number of times critical file hashes have changed, files have been illegally replaced, files have been deleted, digital signatures have been corrupted, or permission attributes have changed abnormally. Indicates the number of file integrity checks performed.

[0087] Define the privilege escalation exception rate as: in, This indicates the number of unauthorized privilege escalation, administrator privilege acquisition, or abnormal privilege usage events. This indicates the total number of events involving permission changes and privileged usage.

[0088] Define the abnormal resource utilization rate as: in This indicates the number of times CPU, memory, disk, or network resources are abnormally used. This indicates the total number of resource status observations.

[0089] Baseline reference values ​​for the above indicators were obtained based on normal operation data. The host abnormal behavior state component is then defined as follows: ,in, , , and The weights are non-negative and satisfy the following conditions: , , , and These are the normalized positive lower bounds for the abnormal process rate, file integrity abnormal rate, privilege escalation abnormal rate, and resource abnormal occupancy rate, respectively.

[0090] For continuously changing the first The original state indices are used to form state components using exponential smoothing: ;in, For the first The sampling time of the first sampling moment One original state index, The first sampling time Each state component The sampling time interval, For the first The engineering response time constant of each state component, This is the smoothing coefficient. It is initialized based on the average value of the normal state indicators within the initialization window. ,in, This indicates the initial length of the history window.

[0091] For state components characterized by "rapid deterioration of security risks after an attack, but requiring a long recovery time," such as malicious remote control and telemetry, core authentication interruption, host privilege escalation, and unauthorized database access, asymmetric exponential smoothing with rapid rise and slow fall is suitable.

[0092] For example, for a state component where the risk should rise rapidly and recover slowly, when Use rising smoothing coefficient ,when When using the falling smoothing coefficient and set For malicious remote control and adjustment, failure of critical control message integrity, core authentication interruption, or equipment interlocking trigger events, use event latch variables; latch variables are only released after manual verification, equipment reset, or continuous fulfillment of recovery conditions.

[0093] If a non-critical data source is missing within a single sampling period, the corresponding original state index can be supplemented using the previous valid value, nearby time interpolation, or verified filtering results, and the supplementation method should be recorded in the data quality identifier. If a critical data source is missing, but the corresponding state can be recovered using other reliable data sources or verified state estimation methods, and the recovery result meets the minimum confidence requirement for online prediction, the recovery result can be used to construct the current state, and the corresponding recovery uncertainty can be included in the model error margin or the uncertainty of the initial state prediction. Online prediction and safety screening can continue in conservative mode. If a critical data source is missing and a recovery result that meets the minimum confidence requirement for online prediction cannot be obtained, or the recovery error cannot be reliably verified, the recovery result will not be used as a reliable current state, and the process will enter the standby handling procedure.

[0094] S104: Extraction of marked attack events.

[0095] Events with the same or related source, affected target, and event type, and whose occurrence times are no greater than the aggregation threshold, are considered as examples. The original alerts were aggregated into a tagged attack event sequence: ,in, Number the attack event. For the first The earliest moment when an attack event meets the preset confirmation conditions. Mark the event, For event type, For the affected targets, As the severity of the incident, For the event context vector, This is the original alarm aggregation time threshold. The system also saves the first original alarm time, confirmation time, and end time corresponding to the aggregated event for offline identification and auditing.

[0096] The method for calculating event severity is as follows: ,in, The number of severity assessment indicators, For the first The first event The severity evaluation metrics include alarm level, asset importance, detection confidence, affected business level, command sensitivity, and event duration. For the corresponding weights, and satisfying ; This indicates that the calculation result is restricted to an interval. Inside.

[0097] For attacks exceeding a preset duration limit, they can be broken down into multiple consecutive sub-events according to the preset maximum duration, or an attack activity state can be set and its continuous impact described by a drift term to avoid representing long-duration attacks as a single instantaneous jump. The system separately stores attack attempt events, blocked events by protected devices, and events that have a significant impact on services. Preferably, the attack arrival strength is estimated using the attack attempt event stream at the front end of the handling action, and the reduction effect of the handling action on the attack consequences is identified using blocked events and events with significant impact. If the target system cannot obtain the attack attempt event stream at the front end of the handling action, the available event stream can be used, but the impact of the handling action on event visibility should be incorporated into the conditional event strength model and verified through independent data.

[0098] S2: The controlled jump diffusion prediction model is obtained by discretizing the continuous-time network security situation state model; the continuous-time network security situation state model consists of three terms: a drift term, a diffusion term, and an attack event jump term; the drift term describes the state inertial evolution when no attack event occurs, the diffusion term describes background random fluctuations, and the attack event jump term is described by a counted random measure driven by a sequence of labeled attack events; the conditional event intensity model adopts a multi-type labeled exponential decay kernel linear self-excitation point process, the intensity of which is composed of the sum of the basic intensity and the excitation effect of the decay kernel of historical events, and is used to determine the occurrence time, type, and labeling information of the attack event when generating the random scenario.

[0099] The controlled jump diffusion prediction model is obtained by discretizing the continuous-time network security situation state model. The continuous-time network security situation state model takes the network security situation state vector as the state variable and the actual effective handling action as the control input. It is composed of a drift term describing the inertial evolution of the state when no attack has occurred, a diffusion term describing the random fluctuation of the background, and a jump term describing the instantaneous impact of the attack event.

[0100] S201: Continuous-time network security situational awareness model.

[0101] The evolution of network security situation over a continuous period of time can be represented as: (1) in, For time, For a moment The state of cybersecurity This is the initial state; For a moment The established system operating mode A finite set of patterns; For a moment Actions that have already taken effect For the set of actions that can be disposed of; for Standard Brownian motion; Mark the space for attack events; A random measure for counting attack events defined in a time and event tagging space; Mark the event; This represents the left limit of the cybersecurity situation before an attack occurs.

[0102] In equation (1), the state variables of the drift coefficient and the diffusion coefficient are taken from the current state. The state variable of the attack event transition amplitude function takes the left limit of the state before the attack event occurs. Among them, the following were adopted. Calculate the transition amplitude of attack events to ensure that state transitions caused by the same attack event do not participate in the calculation of the transition amplitude of the event itself. System operating mode. and actual effective actions All are determined by time Previously and currently available information is determined, and its predictable version is taken in the sense of stochastic integration; the actual effective action adopts zero-order maintenance between adjacent control update times. Zero-order maintenance means that the actual effective action remains unchanged between adjacent action change times. Therefore, in the event of an attack, This indicates actions that were determined and took effect before the event occurred. When the action and the attack event have the same timestamp, they are processed according to the verifiable actual order. When the order cannot be determined, different order scenarios are constructed or an order that is less favorable to security screening is adopted.

[0103] Drift coefficient Describes the state inertia, natural recovery, continuous risk accumulation, and the impact of response actions on the average evolution trend when no new identifiable attack events occur; diffusion coefficient. Describe background communication fluctuations, continuous small perturbations that do not meet the attack event extraction criteria, and unmodeled random perturbations; attack event jump amplitude function. Describe the instantaneous state changes caused by a marked attack event.

[0104] The random measure of attack event counts can be defined by a labeled sequence of attack events: ;in, For a family of measurable sets in the event label space, Label a measurable subset of the event space. This is an indicator function. Therefore, Represents from the initial time to time 1 Event markers between belong to a set The number of attack events. This implementation uses an uncompensated counting random measure. Directly accumulate the physical transitions that can identify attack events; if another implementation uses a compensated randomness measure Then the corresponding compensation item will be The drift coefficient is incorporated to maintain consistency in the meaning of the state model.

[0105] The actions taken to mitigate the attack change the effective gain of random disturbances transmitted to the network security situation by altering the network exposure surface, authentication and access control strength, traffic propagation channels, trusted data source weights, business redundancy paths, or primary / backup relationships. Therefore, the diffusion coefficient can depend on the actions taken. Within the verified engineering state domain, the drift coefficient, diffusion coefficient, and attack event jump amplitude function satisfy the local Lipschitz condition and the linear growth condition with respect to the state variables. Within any finite prediction time domain, the attack event strength integral is finite, and the jump amplitude has a finite second moment. These conditions are used to ensure that the attack event process is not explosive and to ensure that equation (1) has a unique strong solution that can be used for scenario prediction.

[0106] S202: An implementable parameterization method for model coefficients.

[0107] In a locally linear implementation, the drift coefficient is expressed as: (2) in, System operating mode The underlying rate of change vector, The state coupling matrix is... This is the matrix showing the impact of actual effective actions on the average rate of change of the state. This is the current state. This refers to the actions that are currently in effect. When the state relationship is significantly nonlinear, a proven nonlinear drift function can be used instead of equation (2).

[0108] Define the controlled diffusion covariance rate matrix: (3) in, This represents the instantaneous covariance rate matrix of the continuously spreading portion, given the current time, network security situation, actual effective actions, and system operation mode; for sufficiently small time intervals... The conditional covariance of the continuous diffusion increment is approximately: To ensure that the matrix is ​​positive semi-definite, the following can be used: (4) in, The covariance rate of the underlying random disturbance that still exists under any permissible action. This represents the number of random disturbance propagation channels. For the first The covariance rate components of each propagation channel For handling actions Under the action of the first The perturbation propagation gain coefficients of each propagation channel. The diffusion matrix is ​​obtained by Cholesky decomposition or by taking the square root of the positive semi-definite matrix after eigenvalue truncation. .

[0109] The attack event jump amplitude adopts a general form: ,in, Event marking without considering the current action The fundamental instantaneous impact on the state. The change in the instantaneous impact of the actual effective action. Different state components are allowed to have different symbols to indicate that a handling action may reduce some security risks while increasing communication quality degradation or state deviation. The values ​​of each component are determined through historical data, test area data, and equipment operating limitations.

[0110] For state components with non-negative physical meaning, multiplicative diffusion, square root diffusion, logarithmic state transformation, or other non-negativity-preserving models with zero diffusion amplitude at the zero boundary are preferred. If a general diffusion model is used, the proportion and amplitude of non-physically negative states in the prediction are verified; when they exceed a preset threshold, the model parameters or integration step size are determined to have failed the validity check, and unexplained simple truncation is not used to replace model verification.

[0111] S203: Conditional event intensity model.

[0112] No. The conditional event strength of a type of attack event is defined as follows: (5) in, Number the attack event type. The number of attack event types. For a moment Previously obtained attack history, For a moment The length afterwards is within the time interval The number of new attack events of this type Indicates the first time after the given history. Attack-like events at any time The instantaneous occurrence rate of conditions.

[0113] When employing a multi-type labeled exponentially decaying kernel linear self-excitation point process, its intensity is composed of the sum of the fundamental intensity and the excitation effects of the decaying kernels from historical events. The conditional event intensity is expressed as: ,in, For the first The base strength of this type of attack event For the first Historical events of the first Triggering coefficient of class events This is the attenuation coefficient corresponding to the excitation effect. Label the influence function for the event. When using a stationary linear self-excited point process, define the integral excitation matrix. , its first The element represents a first element. Historical events, on average, directly trigger the first generation of impact over the entire duration of their subsequent influence. Number of events of a class. Matrix spectral radius Defined as the maximum absolute value of all its eigenvalues, the model satisfies This ensures that the event-induced effects decay generation by generation on average, and guarantees that the long-term average event intensity of the standard stationary linear model is finite. For other event intensity models that are non-stationary or used only for finite-domain prediction, non-explosiveness and intensity integrability verification conditions matching the corresponding models are employed.

[0114] The system does not presuppose that attack events necessarily have self-excitation characteristics. Instead, it verifies and compares Equation (5) with homogeneous Poisson processes, piecewise Poisson processes, or conditional event intensity models that include external threat levels, time periods, and asset exposure levels. When the self-excitation point process fails verification or the event sample size is insufficient, a simplified model that has passed verification is adopted. When generating prediction scenarios, the event occurrence time and event type are generated based on the conditional event intensity, and then the affected targets, event severity, and context information are generated based on the verified labeled conditional distribution. The conditional event intensity model and the labeled conditional distribution jointly determine the prediction distribution of the attack event count random measure in Equation (1).

[0115] S204: Command Action, Actual Effective Action, and System Operating Mode. Command actions issued by the online processing controller must be confirmed as successfully executed by the target device before they can be input into the controlled jump diffusion model as actual effective actions, and the system operating mode will be updated accordingly.

[0116] The command actions selected and issued by the online processing controller are denoted as The action execution receipt of the target device is recorded as The availability status of the disposal equipment is recorded as follows: The actual effective action is determined according to the following formula: (6) in, This maps command actions to actual actions that take effect. The corresponding action component is only set to effective when the target device accepts the command and confirms successful execution; actions that are in progress, have failed, have been rejected, or for which no valid response has been received are not assumed to be effective. The controlled hop diffusion model uses the actual effective actions. Instead of just using command actions .

[0117] The system operating mode is updated according to the following formula: (7) in, For the first The system operation mode of each processing cycle This is a preset mode transition function. For master / slave switching or communication path switching where the action execution result is random, a controlled finite state transition probability can be used instead of the deterministic mode transition function. Within the prediction time domain, for each candidate control strategy and each prediction scenario, the process of "command action generation—action execution result generation—actual effective action update—system operation mode update" is executed step-by-step, and the resulting... and Used for corresponding state prediction.

[0118] For actions with significant transient impact, such as primary / backup station switching, primary / backup path switching, link isolation, session clearing, or remote control / adjustment disabling, the following approach is adopted upon confirmation of action effectiveness: (8) in, and These represent the states before and after the action takes effect. and These represent the system operating modes before and after the action takes effect. To confirm the effectiveness of the action, This is a state reset mapping verified by data or testing. To avoid duplicate calculations, the instantaneous impact of the same action, already represented by a state reset, will not be simultaneously included in the drift increment at the corresponding moment. When an action takes effect, a pattern change, and an attack event have the same timestamp, they are processed according to the actual order determined by reliable timestamps; if the order cannot be determined, different order scenarios are constructed separately, or an order that is less favorable to security screening is adopted.

[0119] S205: Model Parameter Identification and Validation. Drift, diffusion, jumps, and event intensity parameters are identified using historical data and attack event sequences on an offline, slow timescale. Model effectiveness is validated using criteria such as prediction error and coverage. Only validated models can be used for online prediction.

[0120] Model parameter identification is performed on a slow timescale. First, the baseline drift parameter and controlled diffusion covariance rate parameter are identified using samples without obvious attack events. Second, attack event transition parameters are identified using samples dominated by a single attack event or short time windows before and after the event. Third, conditional event intensity parameters are identified using labeled attack event sequences. For high-impact actions with insufficient sample coverage, parameter ranges are determined using test areas, simulation benches, or digital twin data. High-impact actions are not randomly executed in the production system to supplement the identification samples.

[0121] When comparing model parameters corresponding to different handling actions, the parameters are layered, matched, or weighted according to the initial state range, attack event type, attack intensity, and system operation mode to reduce parameter mixing caused by high-risk states being more likely to trigger strong handling actions.

[0122] For discrete observation intervals After deducting drift and jumps in identified attack events, the time-normalized residuals are calculated as follows: ,in, For the first Standardized residuals for each observation interval and These are the network security situation vectors representing the start and end points of the interval, respectively. The observation time interval is defined. The controlled diffusion covariance rate parameter in equations (3) and (4) is identified based on the residual covariance under given state, actual effective actions, and system operating mode conditions. If multiple events exist within the interval, the pre-event state is recursively deduced according to the event time sequence, without replacing it with the interval endpoint state. .

[0123] Model validation includes at least one-step prediction error, multi-step prediction error, prediction interval coverage, controlled diffusion covariance rate calibration error, log-likelihood of the conditional event intensity validation set, residual correlation, non-physical state occurrence rate, and discrete step size consistency. A candidate model will not be published as an online valid model if it exhibits any of the following: critical state prediction error exceeding limits, numerical ill-conditioned diffusion covariance rate matrix, parameters exceeding engineering boundaries, event intensity model failing calibration, non-physical state occurrence rate exceeding limits, or discrete step size validation failing.

[0124] When a newly identified candidate model fails validation but the current online effective model still meets the validity criteria, the current online effective model continues to be used. When the current online effective model still meets the minimum validity requirements, but the model uncertainty increases and exceeds the normal operation threshold, the model enters conservative mode and continues to perform online prediction and safety screening according to preset conservative parameters. When the current online effective model fails and there is no previous effective model that can be used, the failed model will no longer be used to perform online strategy screening, and the model will enter the standby handling process.

[0125] S206: Discretization and Validation of Continuous-Time Models.

[0126] The online processing cycle is denoted as The step size of the internal rule integration of the model is denoted as ,and The rule integration time, predicted attack event time, system operation mode change time, and action effective time are merged into a segmented time sequence in chronological order. For the first The first processing cycle, the first The candidate control strategy and the first For each predicted scenario, the Euler-Maruyama method is used to calculate continuous evolution between adjacent time segments, and action state reset or attack event jump is performed at each time segment: (9) When an action takes effect, the operating mode changes, or an attack event occurs at the end of a segment, the discrete event is updated according to the following formula: When no discrete events exist, the discrete event update operator is an identity mapping. Therefore, the continuous evolution formula does not directly include an attack jump term; the attack jump is applied separately at the end of the segment as a discrete event update. This segmentation ensures that the jump magnitude is calculated based on the state before the attack event occurs, and avoids the problem of unclear state update order when multiple attack events, actions, and mode changes occur within the same integration interval.

[0127] In equation (9), , Predict the state at the starting point of the segment. This represents the predicted endpoint state of the segment before the discrete event is updated. and These represent the system operation mode and actual effective actions in the corresponding predicted scenarios. It is a standard normal random vector; Update the discrete event update operator for this segment time: when an action takes effect, it includes state reset of equation (8); when an attack event occurs, it includes jump update. When an action takes effect and an attack event occur simultaneously, the composite order of each update operator is determined according to the order described in S204.

[0128] When only the number of events aggregated within the integration interval is available, but the precise event timestamps are not, the starting state of the interval can be frozen, and a composite jump increment approximation can be used. The uncertainties of the event's position within the interval, the recursive state between multiple events, and the mode changes are included in the discretization error margin. The cumulative deviation integral of the scene is calculated on each continuous segment; the instantaneous jump itself does not occupy time length, the state before the jump serves as the end point of the previous continuous segment, and the state after the jump serves as the starting point of the next continuous segment.

[0129] For the same initial augmented decision state, the same candidate control policy, and the same set of basic random variables, use different rule step sizes. , And use when needed Predictions are made by comparing cumulative deviations, minimum margins of key variables, approximate survival strategy indicators, and the first command action. The discretization error margin is determined based on the validation upper quantile or an upper bound with confidence correction for the above differences. If the screening results change frequently after halving the step size, the internal integration step size is shortened or the current discrete prediction model is deemed unvalidated.

[0130] S3: Safety Constraints and Candidate Control Strategies. Based on the current augmented decision state, action template, action hold and cooldown time, and subsequent action rules based on currently available information, a finite number of candidate control strategies are generated. Simultaneously, a safety state boundary is constructed using box constraints and coupled linear constraints, and key variable constraints and device-level safety interlocks are set as constraint check conditions.

[0131] S301: Current augmented decision state.

[0132] No. The current augmented decision state for each disposal cycle is represented as follows: ,in, This is a network security situational vector constructed based on the currently collected data. For the finite-dimensional memory state of the attack event history, when using the exponential decay kernel self-excitation point process, it can be composed of the current condition event intensity vector and the necessary decay memory variables; This is the current system operating mode; Actions taken before the current decision-making moment; For each treatment action or each treatment device, the corresponding holding time vector is used. To determine the availability of equipment; The execution status of the most recent command actions and incomplete command actions related to the current decision; This serves as a data quality identifier. The current augmented decision state is used to determine the initial conditions of the stochastic prediction model, the range of candidate control strategies, action hold and cooling constraints, device executability conditions, and error margin.

[0133] Each processing cycle is based on the actual state constructed from the newly collected data. As the initial prediction value, the model prediction state from the previous treatment cycle will not be directly replaced by the current actual state; this is already reflected in... The actual impact of attacks will no longer be repeatedly superimposed as future attack jumps.

[0134] S302: Safety state constraint set and distance.

[0135] The set of safety state constraints is set as a non-empty closed convex set: ,in, Let be the lower bound vector of the state components. Let the upper bound vector of the state components be denoted as . and Inequalities used to represent coupled security constraints between multiple state components are interpreted according to the components; they are omitted when no coupled security constraints exist. For risk or operational degradation state components with non-negative physical meaning, their corresponding lower bounds are set to zero.

[0136] state The weighted distance to the set of safe state constraints is defined as: ,in, For the set of safety state constraints The state in, It is a positive definite diagonal weight matrix. , The distance is the Euclidean norm. For a box-shaped safety state constraint set, the distance is directly calculated based on the upper and lower bounds of each state component; for a general closed convex polyhedron, it is calculated through convex quadratic programming.

[0137] To ensure that the cumulative deviation of a single scene is bounded, a normalized cutoff distance is defined: (10) in, This serves as the distance normalization scale. The system simultaneously stores the uncrunted distance and the maximum distance in a single scene to avoid losing severely biased information after truncation.

[0138] S303: Critical variable constraints and device-level safety interlocks.

[0139] Key variable constraints are used to limit matters where trade-offs cannot be made solely by deviations in duration and magnitude. These include at least one of the following: abnormal remote control / telecommunications status limits, critical control message integrity requirements, core authentication availability requirements, critical control link availability requirements, and successful primary / backup switchover status requirements. For raw indicators whose increased values ​​represent operational improvements, they are first converted into corresponding unavailability, failure rate, or degradation levels, and then used as components of the network security posture status to maintain consistency in the direction that "increased values ​​indicate increased risk or degradation" across all status components.

[0140] For the The candidate control strategy and the first For a given prediction scenario, the key variable scenario constraint can be expressed as: The checks are performed at the rule integration node, nodes before and after the attack event, nodes before and after the action takes effect, and prediction terminal nodes. Robust constraints are applied to key variables for which the bounded set of perturbations can be determined; for key variables for which the bounded set of perturbations cannot be reasonably determined, the constraints must be satisfied in both the specified ordinary random prediction scenario and the stress scenario, or checks must be performed according to a preset upper limit of the empirical violation rate and confidence level. Satisfying the key variable constraints under the scenario conditions does not imply an absolute guarantee of no out-of-bounds errors for all random paths.

[0141] Device-level security interlocks are used to directly prohibit unauthorized remote control commands, isolate all critical business links, release write permissions when backup master station synchronization is not confirmed, handle device parameters exceeding safe limits, and prevent simultaneous execution of mutually exclusive actions. Device-level security interlock checks are independent of finite-time-domain approximate survivability calculations.

[0142] S304: Limited candidate control strategy.

[0143] The finite set of candidate control strategies is represented as: ,in, The number of candidate control strategies. For the first There are several candidate control strategies. The generation of candidate control strategies is based on offline-verified action templates, the allowed engineering settings for each action template, the minimum hold time for the action, the action cooldown time, and subsequent action rules based on currently available information. Action templates and engineering settings limit the command actions that the action rules can output; the minimum hold time and action cooldown time limit the times when the action rules are allowed to switch; and subsequent action rules determine the command actions under different prediction information conditions.

[0144] Based on the above generation criteria and constraints, the first... The candidate control strategies are represented as follows: ,in, To predict the number of control steps in the rolling forecast time domain, For the first The candidate control strategy in the first Action rules for each control step Deadline Information already obtained includes status, attack events, system operating mode, device status, action execution receipts, and information on actions that have taken effect. The command action output by the action rule. The action rule only relies on current and past information and does not use future attack events or random perturbations that have not yet occurred, thus satisfying causality and unpredictability.

[0145] Candidate control strategies can be complete open-loop command action sequences, state-interval-based feedback rules, or scenario-tree strategies that satisfy unpredictable constraints. A single current command action can only be used for evaluating the cumulative deviation across the entire rolling prediction time domain if its subsequent hold, recovery, or switching rules are simultaneously specified. The finite set of candidate control strategies represents the range of online computation, not an exhaustive representation of all permissible control processes.

[0146] S4: Random Scenarios, Cumulative Deviation, and Approximate Survivability Screening. A controlled jump diffusion prediction model is used to generate ordinary random scenarios under each candidate strategy. Attack event sampling is driven by a conditional event strength model. The cumulative deviation of the predicted trajectory for each scenario relative to the safe state constraint set is calculated. After superimposing the sampling, model, and discretization error margins, a conservative estimate is obtained. Finite-time-domain approximate survival strategies are screened based on this value not exceeding a preset threshold. After key variable constraints and device-level security interlock checks, an acceptable control strategy set is formed.

[0147] S401: Ordinary random prediction scenario and stress scenario. The random scenario includes ordinary random prediction scenario and stress scenario; the ordinary random prediction scenario is used to calculate the statistical estimate of cumulative deviation; the stress scenario is used to check the alternative capability under key variable constraints and equipment failure, and the stress scenario includes at least one or more combinations of high attack intensity, action execution delay, loss of key data source or failure of handling equipment.

[0148] Ordinary stochastic prediction scenarios are generated based on the current augmented decision state and the current online effective model. Each ordinary stochastic prediction scenario includes at least the Brownian increment, the time of the attack event, the type of attack event, the affected target, the severity of the event, the success, failure, or delay status of the action execution, and the change in system operation mode caused by the result of the action execution.

[0149] For each candidate control strategy and each ordinary random prediction scenario, the command action, actual effective action, and system operation mode are calculated step by step according to equations (6) and (7), and the prediction state is calculated according to equation (9). The ordinary random prediction scenarios corresponding to different scenario numbers are independent of each other. In order to reduce the sampling fluctuation of the comparison results between different candidate control strategies, different candidate control strategies under the same scenario number preferably use the same set of basic random numbers; when different command actions have different success probabilities, the same basic uniform random variable is used to generate the action execution results through their respective conditional distributions, without forcing different strategies to have the same execution results.

[0150] Stress scenarios include single-factor stress scenarios and joint stress scenarios. Single-factor stress scenarios are used to evaluate the impact of high attack intensity, high event severity, action execution delay, or single device failure, respectively. Joint stress scenarios are used to evaluate the impact when at least two of the following factors occur simultaneously: high attack intensity, severe attack events, continuous random disturbances, abnormal action execution, device failure, and changes in system operating mode.

[0151] For the For each candidate control strategy and any given stress scenario, the same candidate control strategy, command action rules, action execution result recursive relationships, and state prediction models used in the evaluation of ordinary random prediction scenarios are employed to calculate the predicted trajectory for the stress scenario. The stress scenario only changes the external random input, action execution results, or equipment and operating mode conditions, without altering the evaluated candidate control strategy itself.

[0152] Only when the same candidate control strategy simultaneously meets the finite-time-domain approximate survivability screening conditions under ordinary random prediction scenarios, the key variable constraints under specified ordinary random prediction scenarios and stress scenarios, and passes the device-level safety interlock check, will it be added to the set of permissible control strategies.

[0153] S402: Cumulative deviation.

[0154] Candidate control strategies The rolling prediction time-domain cumulative deviation functional is defined as: ,in, For the current handling moment, For the current augmented decision-making state, To predict the length of the time domain for rolling forecasting, For candidate control strategies, It represents the mathematical expectation of the results of random continuous disturbances, attack events, pattern changes, and action execution under the current time, current augmented decision state, and candidate control strategies.

[0155] For the The candidate control strategy and the first For a typical random prediction scenario, the cumulative deviation of the scenario is calculated using trapezoidal integrals on each continuous segment formed by equation (9): ,in, For the first The candidate control strategy in the first Cumulative deviation in a typical random prediction scenario This represents the number of consecutive segments in the rolling prediction time domain for this scenario. Attack event transitions and action state resets do not directly consume integration time; the subsequent state serves as the starting point for the next consecutive segment. The system also stores the predicted terminal distance and the maximum untruncated distance in the prediction time domain, which can be used as additional filtering conditions.

[0156] S403: Conservative estimate of cumulative deviation. The conservative estimate of cumulative deviation is the sum of the statistical estimate of cumulative deviation and the finite scenario sampling error margin, model error margin, and discretization error margin.

[0157] No. The cumulative deviation statistical estimate of the candidate control strategies is: ,in, This represents the number of ordinary random prediction scenarios. For the first The average cumulative deviation of each candidate control strategy.

[0158] The conservative estimate of cumulative deviation refers to the statistical upper limit of the predicted state's deviation from the safety constraint range. This is obtained by adding multiple margins, such as sampling error, model error, and discretization error, to the sample mean.

[0159] In this embodiment, the conservative estimate of the cumulative deviation after error margin correction is defined as: (11) in, For finite scenario sampling error margin, For the first The model error margin corresponding to each candidate control strategy For the first Discrete error margins corresponding to each candidate control strategy. Each error margin has the same time dimension as the cumulative deviation and avoids double-counting the same error source.

[0160] Since equation (10) satisfies ,so When the candidate control strategy set is fixed before the ordinary random prediction scenario is generated, and the ordinary random prediction scenarios corresponding to different scenario numbers are independent of each other, the following approach can be adopted: As a simultaneous evaluation The one-sided joint finite-scenario sampling error margin of each candidate control strategy, where, For joint confidence level, This represents the upper bound of the joint failure probability. If the candidate control strategy is adaptively generated based on the same batch of scenarios, different scenario numbers are correlated, or importance sampling is used, this formula is not used directly. Instead, the independent verification scenario, resampling method, or statistical bound corresponding to the sampling method used is used.

[0161] The model error margin is determined based on the upper quantile of the prediction error of the cumulative deviation on the independent validation data, the worst cumulative deviation increment within the parameter confidence set, or the upper quantile of the resampling. The discretization error margin is determined based on the validation upper quantile of the difference in cumulative deviation under different integration step sizes. Equation (11) is used as the statistical upper bound at the corresponding confidence level only when each error term satisfies the explicit probability guarantee and completes the joint failure probability allocation; otherwise, it is expressed as a validated and calibrated engineering conservative estimate, not as a deterministic upper bound of the true error.

[0162] S404: Finite-time-domain approximate survival strategy and permissible control strategy set. The finite-time-domain approximate survival strategy refers to a candidate control strategy that, within the rolling prediction time domain, ensures that the cumulative deviation of its predicted state from the set of safe state constraints conservatively does not exceed a preset threshold (this preset threshold is the approximate survival threshold, the decision boundary value for selecting approximate survival strategies), thus possessing approximate safe survival capability within the finite-time domain. The permissible control strategy set is a set of strategies that, after further checks on key variable constraints and equipment-level safety interlocks, are formed from the aforementioned approximate survival strategies and can be used for performance optimization and action issuance.

[0163] Given an approximate survival threshold , No. The candidate control strategies satisfy: When this formula is satisfied, it is determined as the finite-time-domain approximate survival strategy within the current rolling prediction time domain.

[0164] The finite-time approximate survival strategy set is as follows: The set of feasible constraint strategies, determined through key variable constraints and equipment-level safety interlock checks, is as follows: .

[0165] The final set of permissible control policies is: ,in, Determined solely by the cumulative deviation and its error margin. Determined by key variable constraints and device-level safety interlocks, only strategies falling within the intersection of these two sets are allowed to enter the performance optimization and action issuance phase. An empty set of permissible control strategies only indicates that no strategy passes the screening within the current limited candidate strategy range, and does not mean that all permissible control processes are infeasible; candidate strategies are screened through the current rolling prediction time domain, but do not constitute a guarantee of infinite time domain survivability or recursive feasibility of subsequent processing cycles.

[0166] S5: Allow performance optimization and rolling execution within the policy set. Within the allowable control policy set, the policy with the lowest cost is selected based on performance indicators such as state deviation, action cost, and service interruption. Only its first action is executed, and the next action cycle is re-predicted, filtered, and selected based on the actual updated state, thus achieving finite-time-domain rolling optimization.

[0167] The search domain for performance optimization strategies is strictly limited to . No. The performance objective of an allowable control strategy can be expressed as: The single-step performance cost is defined as: (12) In equation (12), For the first The candidate control strategy in the first A typical random prediction scenario and the first The single-step performance cost of each control step; For the first The duration of each control step To correspond to the predicted state, To assess the desired cybersecurity posture, This is the state deviation weight matrix; The cost of command generation, approval, or manual confirmation. The cost per unit time for the actual effective handling actions. The cost of failure, rejection, or delay in action execution. For the first The degree of service interruption, service unavailability, or amount of service interruption per unit time is determined by the actual effective actions and system operating mode within each control step. This represents the business interruption cost coefficient. Switch the weight matrix for the actual action. .when hour, Take actions that took effect before the start of the current processing cycle. .

[0168] choose: ,in, The control strategy selected for the current handling cycle. The online handling controller executes only the first command action of the selected control strategy. Instead of issuing the entire sequence of actions for the prediction time domain at once, the next processing cycle regenerates and filters candidate control strategies based on the current state constructed from newly acquired data, the event history memory state, the system operating mode, the equipment availability status, and the action execution receipts.

[0169] Before an action is issued, it performs permission verification, command format verification, parameter range verification, operation ticket verification, action mutual exclusion verification, and device-level security interlock verification. After the action is issued, it records the command number, target device, action parameters, validity period, model version, candidate control strategy version, and rollback command, and receives receipts such as accepted, executing, executed successfully, executed failed, or rejected.

[0170] S6: Abnormal handling, backup handling and auditing.

[0171] When anomalies occur, such as abnormal action execution, lack of permissible control policies, abnormal data quality, abnormal model validity, or computation timeout, exception handling is triggered. If the conditions for online alternative policy recalculation are met, a normal recalculation or conservative recalculation mode is determined based on the current model and data reliability. The current augmented decision state is reconstructed, and candidate control policies are regenerated and screened. If the conditions for online alternative policy recalculation are not met, or if no permissible control policy is found after recalculation, the backup handling process is initiated, and a backup handling policy or default security policy that has been verified offline and validated for integrity is invoked.

[0172] For different anomaly types, update the status or validity flags related to subsequent handling. When a control command is rejected, action execution fails, or action execution delay exceeds a preset threshold, update the availability status of the handling equipment, the actual effective action, and the system operating mode based on the action execution receipt and the cause of the anomaly. When no valid execution receipt is received, mark the corresponding action execution status as unconfirmed, and do not assume that the issued new action has taken effect until reliable confirmation is obtained. For data quality anomalies, model validity anomalies, or calculation timeouts, update the data quality flag, model validity status, and remaining handling time limit or calculation status, respectively. For no permissible control policy, record the corresponding screening results.

[0173] When there is a usable online effective model, the current augmented decision state can be reliably constructed, the remaining disposal time limit meets the online calculation requirements, and there are updated device states, actual effective actions, system operating modes, or alternative candidate strategy templates as recalculation evidence, the conditions for online alternative strategy recalculation are considered met. Normal recalculation is used when the current model and data meet the requirements for normal online prediction; when the current online effective model still meets the minimum effectiveness requirements, and the data, although not meeting the normal data quality requirements, still meets the minimum data quality requirements, and the necessary state recovery results meet the minimum reliability requirements for online prediction, the conservative mode's preset parameters are used for recalculation. The conservative mode must not obtain permissible control strategies by relaxing approximate survival thresholds, key variable constraints, or device-level safety interlock conditions.

[0174] During online recalculation, the current augmented decision state is reconstructed based on the updated information, candidate control policies are regenerated, and the permissible control policy set is recalculated. If a permissible control policy exists after recalculation, the process returns to S5, where performance optimization and action execution are performed within the permissible control policy set. If the conditions for online alternative policy recalculation are not met, or if no permissible control policy exists after recalculation, the process enters the standby handling procedure. Insufficient remaining handling time, key data quality not meeting the minimum requirements for online prediction and policy recalculation, policy calculation exceeding the handling time limit, or the current online effective model becoming invalid and the absence of a usable previous effective model all constitute situations where online recalculation cannot be reliably executed. An empty permissible control policy set only indicates that no candidate policy that passed the screening was found under the current online effective model, the current candidate policy library, and the current screening parameters.

[0175] Each policy in the backup response policy library includes a policy identifier, applicable attack event type, applicable affected target, asset level, business level, allowed system operating mode, preconditions for response equipment, command set, prohibited action set, rollback conditions, version number, and integrity verification value. Backup response policies undergo offline simulation or testing verification, authorization signature, and version integrity verification before being added to the library; the default security policy employs corresponding offline verification and integrity protection measures.

[0176] When the confidence level of attack event type identification is not lower than the preset threshold, a backup handling strategy is matched according to the attack event type, affected target, asset level, business level, system operating mode, and availability of handling equipment; when the confidence level of attack event type identification is lower than the preset threshold, a preset default security strategy is selected according to the asset level, business level, system operating mode, and availability of handling equipment.

[0177] Backup response strategies are used to reduce security deviations, prevent risk spread, or maintain critical business operations, and are not automatically considered to meet the original approximate survival threshold. Before the backup response strategy is issued, permission verification, parameter range verification, and device-level security interlock review are still performed. After issuance, corresponding alarms are output and audit information is recorded, and then the strategy continues to run in the next response cycle.

[0178] The audit log should at least save the original technical indicators, network security situation status vector, data quality identifier, marked attack events, model version, candidate control policy version, random number generation algorithm and random seed for ordinary random prediction scenarios, stress scenario identifier, cumulative deviation statistical estimate, various error margins, finite time domain approximate survivability screening results, key variable constraint check results, device-level security interlock check results, performance cost, issued commands and action execution receipts; when an anomaly occurs, it should also save the anomaly type, related status or validity identifier update results, online alternative policy recalculation condition judgment results, normal recalculation or conservative mode recalculation identifier, and the identifier and triggering reason of the called backup handling policy or default security policy.

[0179] like Figure 2 As shown, after inputting the current augmented decision state, the online effective model, and a finite set of candidate control strategies, each candidate control strategy is evaluated sequentially. For each candidate control strategy, a normal stochastic prediction scenario is first generated, the predicted state trajectory and the statistical estimate of the cumulative deviation are calculated, and the sampling error, model error, and discretization error margin are superimposed to obtain a conservative estimate of the cumulative deviation. If this conservative estimate meets the preset approximate survival threshold, a stress scenario is further generated, and key variable constraints and equipment-level safety interlocking conditions are checked. Only candidate control strategies that simultaneously meet the finite-time-domain approximate survivability screening conditions, key variable constraints, and equipment-level safety interlocking conditions are added to the permissible control strategy set. After all candidate strategies are evaluated, the permissible control strategy set is output and returned. Figure 1 .

[0180] like Figure 3 As shown, when situations such as abnormal action execution, lack of permissible control policies, abnormal model validity, insufficient data quality, or policy calculation timeout occur, the system triggers an exception handling process and updates the corresponding status or validity flag according to the exception type. Specifically, when an action execution abnormality occurs, the system records the action execution receipt and updates the availability status of the handling equipment, the actual effective action, and the system operating mode. If a usable online valid model still exists, the current augmented decision state can be reliably constructed, and the remaining handling time meets the online calculation requirements, then a candidate control policy is regenerated and invoked. Figure 2 The process involves screening; if the model or data confidence decreases but still meets the minimum requirements for online prediction, the online recalculation is performed according to the preset conservative mode parameters. If an acceptable control strategy exists after recalculation, the process returns... Figure 1 Continue to optimize performance and execute actions within the allowed control policy set; if the online recalculation conditions are not met or the allowed control policy still does not exist after recalculation, then enter the standby handling process. Match the standby handling policy that has been verified offline based on the attack event type identification result or select the default security policy. After verification of permissions, parameter ranges and device-level security interlocks, issue the corresponding actions, output alarms and record audit information, and then enter the next handling cycle.

[0181] Example 2 In a typical embodiment of the present invention, a power monitoring and handling system based on finite-time-domain approximate survivability screening is provided, comprising: Data acquisition module: used to acquire data from the power monitoring system; Situation Construction Module: Used to construct network security situation state vectors and extract labeled attack event sequences; Model building module: used to build a discretized controlled jump diffusion prediction model and a conditional event intensity model based on the state vector and the attack event sequence; Strategy generation and screening module: In each handling cycle, it generates a set of candidate control strategies and constructs a set of safety state constraints and constraint check conditions; it generates random scenarios for each candidate control strategy using a prediction model and an intensity model, calculates a conservative estimate of the cumulative deviation of the predicted state from the set of safety state constraints, and screens approximate survival strategies based on the condition that the conservative estimate is not greater than a preset threshold. After constraint check, an allowable control strategy set is formed. The strategy execution and rolling module is used to select a strategy from the set of permissible control strategies, execute the first action, and then execute it on a rolling basis in the next action cycle. Anomaly Handling Module: This module is used to trigger anomaly handling when there is no permissible control policy or when the action execution is abnormal. When the online alternative policy recalculation conditions are met, it regenerates and filters candidate control policies based on the updated current augmented decision state. When the online alternative policy recalculation conditions are not met or there is still no permissible control policy after recalculation, it executes the backup handling policy.

[0182] Example 3 The purpose of this embodiment is to provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the steps of the method of Embodiment 1.

[0183] Example 4 The purpose of this embodiment is to provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method of Embodiment 1.

[0184] The steps and methods involved in Embodiments 3 and 4 above correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0185] Those skilled in the art will understand that the modules or steps of the present invention described above can be implemented using general-purpose computer devices. Optionally, they can be implemented using computer-executable program code, thereby allowing them to be stored in a storage device for execution by a computer device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. The present invention is not limited to any particular combination of hardware and software.

[0186] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0187] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A power monitoring and handling method based on finite-time-domain approximate survivability screening, characterized in that, include: Acquire data from the power monitoring system; Construct a network security situational vector and extract labeled attack event sequences; Based on the state vector and the attack event sequence, a discretized controlled jump diffusion prediction model and a conditional event intensity model are established. In each processing cycle, a set of candidate control strategies is generated, and a set of safety state constraints and constraint check conditions are constructed. Random scenarios are generated for each candidate control strategy using a prediction model and an intensity model. The cumulative deviation of the predicted state from the set of safety state constraints is conservatively estimated. Approximate survival strategies are selected based on the condition that the conservatively estimated value is not greater than a preset threshold. After constraint check, an allowable control strategy set is formed. Select a policy from the allowable control policy set, execute the first handling action, and roll it over in the next handling cycle; trigger exception handling when there is no allowable control policy or the action is executed abnormally, and execute the backup handling policy when no new allowable control policy can be obtained.

2. The power monitoring and handling method based on finite-time-domain approximate survivability screening as described in claim 1, characterized in that, Based on power monitoring system data, calculate raw status indicators including authentication anomalies, abnormal messages, remote control and adjustment records, link quality, database access, and host behavior. After performing exponential smoothing or asymmetric exponential smoothing on the original state indicators, a dimensionless network security situation state vector is constructed. Original alarms with the same or related event source, affected target, and event type, and whose adjacent time is no greater than a preset aggregation threshold, are aggregated into a labeled attack event sequence that includes event type, affected target, severity, and context information.

3. The power monitoring and handling method based on finite-time-domain approximate survivability screening as described in claim 1, characterized in that, The controlled jump diffusion prediction model is obtained by discretizing the continuous-time network security situation state model; the continuous-time network security situation state model consists of a drift term, a diffusion term, and an attack event jump term.

4. The power monitoring and handling method based on finite-time-domain approximate survivability screening as described in claim 1, characterized in that, The conditional event intensity model adopts a multi-type labeled exponential decaying kernel linear self-excitation point process, and its intensity is composed of the sum of the basic intensity and the decaying kernel excitation effect of historical events.

5. The power monitoring and handling method based on finite-time-domain approximate survivability screening as described in claim 1, characterized in that, Based on the current augmented decision state, action template, action retention and cooldown time, and subsequent action rules based on currently available information, generate a finite number of candidate control strategies. Simultaneously, safe state boundaries are constructed using box-type constraints and coupled linear constraints, and key variable constraints and equipment-level safety interlocks are set as constraint check conditions.

6. The power monitoring and handling method based on finite-time-domain approximate survivability screening as described in claim 1, characterized in that, The random scenarios include ordinary random prediction scenarios and stress scenarios; The ordinary random prediction scenario is used to calculate the statistical estimate of the cumulative deviation; the stress scenario is used to check the alternative capability under key variable constraints and equipment failure, and the stress scenario includes at least one or more combinations of high attack intensity, action execution delay, loss of key data source or failure of disposal equipment.

7. The power monitoring and handling method based on finite-time-domain approximate survivability screening as described in claim 1, characterized in that, The cumulative deviation is conservatively estimated as the sum of the statistical estimate of the cumulative deviation and the finite scenario sampling error margin, model error margin, and discretization error margin.

8. A power monitoring and handling system based on finite-time-domain approximate survivability screening, characterized in that, include: Data acquisition module: used to acquire data from the power monitoring system; Situation Construction Module: Used to construct network security situation state vectors and extract labeled attack event sequences; Model building module: used to build a discretized controlled jump diffusion prediction model and a conditional event intensity model based on the state vector and the attack event sequence; Strategy generation and screening module: In each handling cycle, it generates a set of candidate control strategies and constructs a set of safety state constraints and constraint check conditions; it generates random scenarios for each candidate control strategy using a prediction model and an intensity model, calculates a conservative estimate of the cumulative deviation of the predicted state from the set of safety state constraints, and screens approximate survival strategies based on the condition that the conservative estimate is not greater than a preset threshold. After constraint check, an allowable control strategy set is formed. The strategy execution and rolling module is used to select a strategy from the set of permissible control strategies, execute the first action, and then execute it on a rolling basis in the next action cycle. Exception handling module: used to trigger exception handling when there is no allowable control policy or when the action is executed abnormally, and to execute the backup handling policy when a new allowable control policy cannot be obtained.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method as described in any one of claims 1-7.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1-7.

Images