A power monitoring system network security hidden danger checking method, system and medium

Abstract

This invention discloses a method, system, and medium for inspecting network security vulnerabilities in a power monitoring system. The method includes: acquiring raw alarm logs from the power monitoring system, preprocessing them, and inputting the preprocessed alarm logs into a multilayer perceptron model for asset identification to obtain an asset list; performing session aggregation, byte count, and session count statistics on real-time collected raw traffic data based on IP and MAC address associations, and combining threshold filtering and weighting to obtain a set of directed edges and edge weights for asset pairs; constructing a directed weighted topology graph based on the asset list, the set of directed edges and edge weights for asset pairs; automatically issuing alarms for non-whitelisted access, unauthorized links, non-compliant configurations, and abnormal traffic; calculating topology importance based on the directed weighted topology graph; and normalizing and linearly weighting the four-dimensional scores of topology importance, device type importance, vulnerability severity, and business impact to generate a comprehensive risk score for each asset.

Description

Technical Field

[0001] This invention relates to the field of power system network security technology, specifically to a method, system, and medium for detecting network security vulnerabilities in power monitoring systems. Background Technology

[0002] With the widespread deployment of smart grids and power monitoring systems, equipment such as remote terminal units (RTUs), phasor measurement units (PMUs), and supervisory control systems (SCADA) are highly coupled with information networks. However, due to differences in manufacturers, protocols, and deployment dates, asset information is scattered and has a low degree of standardization.

[0003] Traditional manual inspections or script-based detection methods cannot efficiently clean massive amounts of logs, traffic, and configuration data, discover dynamic topologies, conduct unified compliance assessments, or identify real-time traffic anomalies, resulting in lagging security situation awareness, lack of risk assessment, and low response efficiency.

[0004] In view of the above, this application is hereby submitted. Summary of the Invention

[0005] The technical problem this invention aims to solve is that traditional manual inspections or script-based detection methods are incapable of efficiently cleaning massive amounts of logs, traffic, and configuration data, dynamically discovering topologies, conducting unified compliance assessments, and identifying real-time traffic anomalies. This results in lagging security situation awareness, inadequate risk assessment, and low response efficiency. The purpose of this invention is to provide a method, system, and medium for inspecting network security vulnerabilities in power monitoring systems to address the above-mentioned technical problems.

[0006] This invention is achieved through the following technical solution:

[0007] In a first aspect, the present invention provides a method for detecting network security vulnerabilities in a power monitoring system, the method comprising:

[0008] Obtain the original alarm logs from the power monitoring system, preprocess the original alarm logs, and input the preprocessed alarm logs into the multilayer perceptron model for asset identification to obtain an asset list;

[0009] Based on the association between IP and MAC addresses, the raw traffic data collected in real time is aggregated for sessions, and the number of bytes and sessions is counted. Combined with threshold filtering and weighting, the directed edge set and edge weight set of asset pairs are obtained. Based on the asset list, the directed edge set of asset pairs and the edge weight set, a directed weighted topology graph is constructed.

[0010] Based on the asset inventory and directed weighted topology graph, automated alerts are generated for non-whitelisted access, unauthorized links, non-compliant configurations, and abnormal traffic; and

[0011] The topology importance is calculated based on a directed weighted topology graph; the four-dimensional scores of topology importance, device type importance, vulnerability severity and business impact are normalized and linearly weighted to generate a comprehensive risk score for each asset.

[0012] Furthermore, the raw alarm logs are preprocessed, including:

[0013] The original alarm logs are cleaned and standardized to obtain cleaned alarm logs;

[0014] The cleaned alarm logs are encapsulated into structured records; the structured records include network segment number, event timestamp, standardized device type, and device name;

[0015] The structured records are mapped to numerical vectors of fixed preset dimensions and concatenated to obtain vectorized alarm logs, which are used as preprocessed alarm logs.

[0016] Furthermore, the vectorized alarm log is represented as follows:

[0017] ;

[0018] In the formula: These are the vectorized IP address (i.e., network address), standardized device type, device name, and event timestamp, respectively.

[0019] Furthermore, the preprocessed alarm logs are input into a multilayer perceptron model for asset identification to obtain an asset list, including:

[0020] The preprocessed alarm logs are input into a multi-layer perceptron model for multi-class classification to obtain log recognition results.

[0021] The log identification results are aggregated by IP address, and the IP address with the highest frequency or the highest confidence level among multiple classifications is used as the final device type, i.e., asset type.

[0022] Based on the log identification results and asset types, an asset list is generated;

[0023] The asset list is supplemented with metadata by combining the configuration management database (CMDB) and the power grid GIS to obtain a supplemented asset list;

[0024] The supplementary asset list is shown as follows: ;

[0025] in, For the i-th asset item, Let IP address be the IP address of the i-th asset item. Let i be the asset type of the i-th asset item. Let i be the name of the asset in the i-th asset item. For the manufacturer of the i-th asset item, For the security domain information of the i-th asset item, This is the identifier for the plant or computer room of the i-th asset item.

[0026] Furthermore, based on the association between IP and MAC addresses, the raw traffic data collected in real time is subjected to session aggregation, and the number of bytes and sessions is counted. Combined with threshold filtering and weighting, a set of directed edges for asset pairs and a set of edge weights are obtained. Based on the asset list, the set of directed edges for asset pairs, and the set of edge weights, a directed weighted topology graph is constructed, including:

[0027] Raw traffic data is collected in real time. The raw traffic data is obtained by capturing packets between various assets in real time using network monitoring equipment and mirror ports, and recording the source IP, destination IP, source MAC, destination MAC and packet byte count.

[0028] The raw traffic data is grouped according to asset pairs, and packet entries with the same source IP and destination IP are aggregated to generate a set of session entries divided by session boundaries;

[0029] Add up the message byte count of each session entry in the session entry set, and calculate the total byte count and number of sessions for the asset pair within the statistical period;

[0030] By combining the total number of bytes and the number of sessions for each asset pair, filtering is performed according to preset byte thresholds and session frequency thresholds to retain key links in the real operating environment that meet the requirements, thus obtaining the directed edge set and edge weight set for the asset pair.

[0031] Using the asset list as the set of all asset nodes, and combining the directed edge set and edge weight set of asset pairs, a directed weighted topology graph is constructed.

[0032] Furthermore, based on the asset list and the directed weighted topology graph, automated alerts are generated for non-whitelisted access, unauthorized links, non-compliant configurations, and abnormal traffic, including:

[0033] Merge the static whitelist and the dynamic whitelist to obtain the merged whitelist; based on the merged whitelist, if asset i meets the absolute number of illegal external connections or the illegal external connection ratio threshold within window T, an illegal external connection alarm is triggered.

[0034] Using the security zone mapping table and isolation policy rule set of the power monitoring network, illegal cross-chain events are marked; based on the illegal cross-chain events, the number of cross-chain events and the traffic volume of each asset or each security zone pair within window T are counted, and an alarm is triggered by uploading the data.

[0035] Establish a compliance indicator system and conduct compliance assessments based on a weighted risk index. Based on the compliance assessment results, automatically push non-compliance items for each device to the security operations and maintenance platform in the form of structured events. For assets with an overall compliance level below the threshold, a list of high-risk devices will be generated. Based on the list of high-risk devices, combined with the security zone to which the asset belongs and the level of business impact, a rectification work order will be automatically generated.

[0036] Successful login traffic through various protocols is captured and parsed to obtain business traffic; based on protocol function codes and message structures, potential unauthorized services are detected in the business traffic, generating unauthorized service operation alarms and triggering session continuous abnormality alarms.

[0037] Furthermore, topology importance is calculated based on a directed weighted topology graph; the four-dimensional scores of topology importance, device type importance, vulnerability severity, and business impact are normalized and linearly weighted to generate a comprehensive risk score for each asset, including:

[0038] Based on the directed weighted topological graph, calculate the degree centrality, betweenness centrality, and compact centrality;

[0039] The topological importance is obtained by comprehensively evaluating degree centrality, betweenness centrality, and compact centrality.

[0040] Define the importance of equipment type based on the different equipment types in the power system;

[0041] According to the CVSS v3.1 standard, the severity of a vulnerability is calculated using its base score and environment score.

[0042] The business impact of equipment is calculated by normalizing and weighting four dimensions: downtime recovery time, downstream dependence, economic loss, and regulatory penalty risk.

[0043] The four-dimensional scores of topology importance, device type importance, vulnerability severity, and business impact are normalized and linearly weighted to calculate the comprehensive risk score for each asset.

[0044] Furthermore, the formula for calculating the comprehensive risk score is as follows:

[0045] ;

[0046] ;

[0047] In the formula, The overall risk score; Topological importance; Importance of equipment type; The severity of the vulnerability; The business impact of the equipment; , , , These are the corresponding weights for topology importance, device type importance, vulnerability severity, and device business impact, respectively. Let i be the degree centrality. For the betweenness centrality of node i, For the compact centrality of node i, , , These are the corresponding weights for degree centrality, betweenness centrality, and compact centrality, respectively. This represents the maximum value among all asset nodes in the entire network. Let j be the degree centrality. For the betweenness centrality of node j, Let j be the tight centrality of node j.

[0048] Secondly, the present invention provides a network security vulnerability detection system for power monitoring systems, the system comprising:

[0049] The acquisition unit is used to acquire the original alarm logs of the power monitoring system and preprocess the original alarm logs.

[0050] The asset identification unit is used to input the preprocessed alarm logs into the multilayer perceptron model for asset identification and to obtain an asset list.

[0051] The topology graph construction unit is used to perform session aggregation, count bytes and sessions on the raw traffic data collected in real time based on the relationship between IP and MAC addresses, and obtain the directed edge set and edge weight set of asset pairs by combining threshold filtering and weighting; and construct a directed weighted topology graph based on the asset list, the directed edge set of asset pairs and the edge weight set.

[0052] The automatic alarm unit is used to automatically alarm for non-whitelist access, unauthorized links, non-compliant configurations, and abnormal traffic based on the asset list and the directed weighted topology graph.

[0053] The asset risk score calculation unit is used to calculate the topology importance based on the directed weighted topology graph; it normalizes and linearly weights the four-dimensional scores of topology importance, device type importance, vulnerability severity and business impact to generate a comprehensive risk score for each asset.

[0054] Thirdly, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-mentioned method for detecting network security vulnerabilities in a power monitoring system.

[0055] Fourthly, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-described method for detecting network security vulnerabilities in a power monitoring system.

[0056] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0057] This invention discloses a method, system, and medium for detecting network security vulnerabilities in a power monitoring system. First, the original alarm logs are cleaned and vectorized by aggregating IP addresses, device types, device names, and times. This data is then input into a multilayer perceptron model to complete asset identification, and the asset list is supplemented using CMDB / GIS metadata. Second, based on the asset list generated by S1, the collected traffic is aggregated by IP and MAC address relationships, and the number of bytes and sessions is counted. A directed weighted topology graph reflecting actual operation is constructed based on threshold filtering and weighting. Then, based on the asset list of S1 and the directed weighted topology graph of S2, four functions are integrated: unauthorized external connections, cross-security zone communication, configuration compliance checks, and traffic anomaly detection. Automated alarms are issued for non-whitelisted access, unauthorized links, non-compliant configurations, and traffic anomalies. Finally, combining the device types from S1 and the directed weighted topology graph from S2, multi-dimensional scores such as topology importance, device type weight, vulnerability severity, and business impact are normalized and linearly weighted to generate a comprehensive risk score for each asset. This invention enables efficient cleaning of massive logs, traffic, and configuration data, dynamic topology discovery, unified compliance assessment, and real-time traffic anomaly identification, solving the problems of lagging security situation awareness, lack of risk assessment, and low response efficiency. Attached Figure Description

[0058] The accompanying drawings, which are included to provide a further understanding of embodiments of the invention and form part of this application, do not constitute a limitation thereof. In the drawings:

[0059] Figure 1 This is a flowchart of a method for detecting network security vulnerabilities in a power monitoring system according to the present invention;

[0060] Figure 2 This is a structural block diagram of a network security vulnerability detection system for a power monitoring system according to the present invention. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. The illustrative embodiments and descriptions of this invention are only for explaining this invention and are not intended to limit this invention.

[0062] Example 1

[0063] like Figure 1 As shown, the present invention provides a method for detecting network security vulnerabilities in a power monitoring system, the method comprising:

[0064] S1. Obtain the original alarm logs of the power monitoring system, preprocess the original alarm logs, and input the preprocessed alarm logs into the multilayer perceptron model for asset identification to obtain an asset list.

[0065] In this embodiment, step S1 specifically includes:

[0066] S11: Obtain the raw alarm logs from the power monitoring system and preprocess them to ensure the consistency and accuracy of feature extraction and vectorization. Preprocessing includes:

[0067] The original alarm logs are cleaned and standardized to obtain cleaned alarm logs;

[0068] The cleaned alarm logs are encapsulated into structured records; the structured records include network segment number, event timestamp, standardized device type, and device name;

[0069] The structured records are mapped to numerical vectors of fixed preset dimensions and concatenated to obtain vectorized alarm logs, which are used as preprocessed alarm logs.

[0070] Specifically, S11 includes:

[0071] S111: First, regular expressions are used to remove non-numeric and period characters. Then, each numeric string is parsed according to its decimal value to remove leading zeros. Finally, it is uniformly converted to the dotted decimal representation of standard IPv4 and assigned a corresponding integer number in the full network segment dictionary. At the same time, any possible IPv6 characters are directly hashed to the same number space to ensure that the dimension of the model input vector is controllable.

[0072] S112: This invention adopts a "raw string → standard type" mapping relationship. For different device type descriptions of the same device, prefix matching is performed first, followed by lowercase, space, and underscore normalization, ultimately unifying them to a predefined type dictionary 𝒯. Entries with mapping failures are labeled "Unknown" and enter a manual review process to ensure that there is no interfering data during model training and robustness during detection.

[0073] S113: When cleaning the equipment name field, first use a unified regular expression to remove the serial number (SN:\d+) and special punctuation (#, / , \ etc.), then replace Chinese and English parentheses, underscores, and hyphens with spaces, and finally segment the string by spaces, remove common stop words (such as "Device" and "Unit"), and separate the remaining keywords (such as "WestStation" and "PMU") with spaces to provide high-quality input for subsequent recognition model training.

[0074] S114: After cleaning, the cleaned alarm logs are encapsulated into structured records, including network segment number, event timestamp, standardized device type, and device name, for easy unified vectorization and subsequent model input. The structured records formed after cleaning. :

[0075]

[0076] In the formula: Indicates IP address, Indicates timestamp, Indicates device type, Indicates the device name.

[0077] S12 maps the structured records from S11 to fixed-dimensional numerical vectors. Each cleaned log entry needs to be mapped to a fixed-length numerical vector. Numerical values ​​are converted to decimal vectors, and text values ​​are used to construct a dictionary. This allows the subsequent multilayer perceptron model to learn directly. The final feature concatenation is as follows:

[0078]

[0079] In the formula: These are the vectorized IP address (i.e., network address), standardized device type, device name, and event timestamp, respectively.

[0080] S13, after completing the feature vectorization in S12, will The data is input into a multi-layer perceptron model for multi-category classification to identify the asset information corresponding to the logs and generate an asset list.

[0081] Specifically, step S13 includes:

[0082] S131, the preprocessed alarm logs are input into a multi-level perceptron model for multi-class classification to obtain log recognition results; the multi-level perceptron model consists of one input layer, two hidden layers, and one output layer, where the activation function of the hidden layers is ReLU, and the model is as follows:

[0083]

[0084]

[0085]

[0086]

[0087]

[0088]

[0089] In the formula: , , These represent the outputs of the first-level linear transformation, the second-level linear transformation, and the output layer linear transformation, respectively. , , These represent the first-layer weight matrix, the second-layer weight matrix, and the output-layer weight matrix, respectively. , These represent the output after the first layer is activated and the output after the second layer is activated, respectively. , , These represent the first layer bias vector, the second layer bias vector, and the output layer bias vector, respectively. This represents the predicted probability that sample j belongs to category a; is the wandering indicator; A represents the set of device categories.

[0090] S132, aggregate the log identification results by IP address, and determine the IP address with the highest frequency or the highest confidence level among multiple classifications. This highest frequency or the highest confidence level among all IP addresses is used as the final device type, i.e., asset type. The device type determination formula is as follows:

[0091]

[0092] In the formula: Indicates the asset type.

[0093] S133, Generate an asset list based on log identification results and asset types;

[0094] S134, and in conjunction with the Configuration Management Database (CMDB) and the Power Grid GIS, supplement the asset list with metadata to obtain a supplemented asset list; including:

[0095] After deduplication of asset entries and identification of equipment types, the system first reads the vendor field of each asset item from the CMDB (Configuration Management Database). If this field is empty, it is completed by parsing key vendor terms (such as "Cisco" or "Siemens") in the equipment name or type. Simultaneously, security zone information is automatically obtained from the IP→protection zone mapping table maintained in the network management system. The plant or data center identifier is first extracted from the siteID field in the power grid GIS or CMDB. If this information is missing in the CMDB, the system will query and complete the matching record in the geographic information database based on the asset's IP prefix. Each asset record ultimately written to the CMDB includes not only the IP address and identified equipment type, but also complete metadata such as a reliable vendor, the security zone, and the physical location. The final asset list is written to the CMDB or configuration management platform, and the completed asset list is represented as follows:

[0096]

[0097] in, For the i-th asset item, Let IP address be the IP address of the i-th asset item. Let i be the asset type of the i-th asset item. Let i be the name of the asset in the i-th asset item. For the manufacturer of the i-th asset item, For the security domain information of the i-th asset item, This is the identifier for the plant or computer room of the i-th asset item.

[0098] S2 performs session aggregation, counts bytes and sessions on the raw traffic data collected in real time based on the relationship between IP and MAC addresses, and obtains the directed edge set and edge weight set of asset pairs by combining threshold filtering and weighting; and constructs a directed weighted topology graph based on the asset list, the directed edge set of asset pairs and the edge weight set.

[0099] In this embodiment, step S2 specifically includes:

[0100] S21, real-time collection of raw traffic data. The raw traffic data is obtained by capturing packets between assets in real time using network monitoring equipment and mirror ports, and recording the source IP, destination IP, source MAC, destination MAC and packet byte count.

[0101] Specifically, network monitoring equipment and mirror ports are used to capture packets between assets in real time, recording source IP, destination IP, source MAC, destination MAC, and packet byte count, and writing this data to a traffic database as the raw input for subsequent session aggregation. The raw traffic data F is in the following format:

[0102]

[0103] In the formula: These are the source IP index and the destination IP index, respectively. These are the source MAC index and the destination MAC index, respectively. The number of bytes in the message; This represents the number of messages.

[0104] S22, group the raw traffic data according to asset pairs, summarize the packet entries with the same source IP and destination IP, and generate a set of session entries divided by session boundaries;

[0105] Specifically, all traffic records collected in S21 are grouped by asset pairs (i,j), and packet entries with the same source IP and destination IP are aggregated to generate a set of entries divided by session boundaries for statistical analysis and topology construction. Session entry set for:

[0106]

[0107] S23, sum the number of message bytes of each session entry in the session entry set, and calculate the total number of bytes and the number of sessions for the asset pair within the statistical period;

[0108] Specifically, for each pair of assets (i,j) after aggregation of session entries, the number of its message bytes is accumulated, and the total byte traffic and number of sessions for that asset pair within the statistical period are calculated.

[0109]

[0110]

[0111] In the formula: Indicates the total number of bytes; Indicates the number of sessions.

[0112] S24, combining the total number of bytes and the number of sessions for each asset pair, filtering is performed according to the preset byte threshold and session frequency threshold to retain the key links in the real operating environment that meet the requirements, and to obtain the directed edge set and edge weight set of the asset pair;

[0113] Specifically, the edge weights defined using traffic and session frequency, and the combined edge weights are as follows:

[0114]

[0115]

[0116] In the formula: Represents the edge between asset i and asset j in the asset topology graph; This represents the overall weight of the edges; and These are the byte count threshold and the session count threshold, respectively.

[0117] S25 uses the asset list as the set of all asset nodes, and combines the directed edge set and edge weight set of asset pairs to construct a directed weighted topology graph.

[0118] Specifically, let V be the set of all asset nodes, E be the set of directed edges between asset pairs after S24 filtering, and label each directed edge with the edge weight function W. A directed weighted topology graph G, which can be used for risk analysis, is constructed as follows:

[0119]

[0120] S3, based on the asset list and the directed weighted topology graph, automatically alerts users to non-whitelist access, unauthorized links, non-compliant configurations, and abnormal traffic.

[0121] In this embodiment, step S3 specifically includes:

[0122] S31, merge the static whitelist and the dynamic whitelist to obtain the merged whitelist; based on the merged whitelist, if asset i meets the absolute number threshold or the ratio threshold for illegal external connections within window T, then trigger an illegal external connection alarm.

[0123] Specifically, step S31 includes:

[0124] The static and dynamic whitelists are merged. The static whitelist is defined by network topology and business processes, and includes legitimate destination IPs / network segments. The dynamic whitelist is based on normal operating traffic, including destination addresses that have not triggered alarms within a consecutive window. The merged whitelist is as follows. Represented as:

[0125]

[0126] In the formula: Indicates a static whitelist; This indicates a dynamic whitelist.

[0127] Define the amount of illegal external link instructions for each record. Time window Total number of outflow records for asset i The number of unauthorized external contact incidents is :

[0128]

[0129]

[0130]

[0131]

[0132] In the formula: If ∈{0,1}, =1 indicates a violation of external communication rules; It is the timestamp of the kth traffic item; Asset indexing functions.

[0133] An external violation alarm is triggered when asset i meets any condition within window T. The alarm triggering condition is:

[0134]

[0135] In the formula: represents the threshold for the absolute number of unauthorized external connections; r represents the threshold for the percentage of unauthorized external connections.

[0136] S32 uses the security zone mapping table and isolation policy rule set of the power monitoring network to mark illegal cross-chain events; based on the illegal cross-chain events, it counts the number of cross-chain events and the traffic volume of each asset or each security zone pair within window T, and uploads the data to trigger an alarm.

[0137] Specifically, step S32 includes:

[0138] Security zone mapping table using power monitoring network and isolation strategy rule set That is, the allowed safe zone to The set. For any flow F k ,like If a cross-chain event is detected, it is marked as an illegal cross-chain event. The number of cross-chain transactions and the volume of traffic for each asset or each security pair within window T are statistically analyzed and uploaded to trigger an alert.

[0139] S33, establish a compliance indicator system and conduct compliance assessments based on a weighted risk index compliance assessment method; based on the compliance assessment results, automatically push non-compliance items of each device to the security operation and maintenance platform in the form of structured events; for assets with overall compliance below the threshold, a high-risk device list will also be generated; and based on the high-risk device list, combined with the security zone to which the asset belongs and the business impact level, a rectification work order will be automatically generated.

[0140] Specifically, step S33 includes:

[0141] S331: Establish a configuration compliance indicator system, defining configuration compliance indicators for multiple dimensions in the power monitoring system, including operating system / firmware version, high-risk port access status, management password policy, antivirus database status, patch installation status, and service / protocol authorization. The configuration compliance check standards of this invention are as follows:

[0142] a. Implement whitelist management for operating system and device firmware versions, clearly defining the allowed version numbers, patch release deadlines, and emergency response timeframes.

[0143] b. Classify network service ports into high-risk ports (such as SSH 22, Telnet 23, RDP 3389, FTP 21, etc.) and non-high-risk ports. Only high-risk ports that appear in the whitelist are allowed to be opened and must be opened in a controlled manner.

[0144] c. The management password policy stipulates that the password length must not be less than 12 characters, must contain uppercase and lowercase letters, numbers and special characters, the password replacement cycle must not exceed 30 days, and the storage method must comply with industry cryptographic standards.

[0145] d. The antivirus software database must be automatically updated daily, and the version number must not be lower than the specified security baseline. In terms of patch management, the security patch installation rate must not be lower than 95%, and the emergency patch response time for serious security vulnerabilities must not exceed 72 hours.

[0146] e. Issue alerts for unauthorized services such as SSH login, SNMP community name transmission, web management interface access, and anonymous services.

[0147] S332: This invention proposes a compliance assessment method based on a weighted risk index. Let m be the total number of compliance items for asset i, and define the indicator for the j-th configuration check result as follows:

[0148]

[0149] And assign a security impact weight to each item. With severity coefficient Therefore, the non-compliance risk index for this item is:

[0150]

[0151] The overall compliance risk index of device i is Its value range is [0,1], compliance for:

[0152]

[0153]

[0154] S333: After the compliance assessment is completed, the system automatically pushes non-compliance items for each device to the security operations platform in the form of structured events, including device identifier, compliance item name, test results, risk index, and rectification suggestions; for overall compliance... For assets below the threshold, a summary list of high-risk equipment will be generated, and a rectification work order will be automatically generated based on the security zone to which the asset belongs and the business impact level, so as to facilitate management audit and compliance checks. At the same time, historical data will be stored and version managed to ensure that the rectification process is traceable.

[0155] S34 captures and parses successful login traffic through various protocols to obtain business traffic; based on protocol function codes and message structures, it performs potential unauthorized service detection on the business traffic, generates unauthorized service operation alarms, and triggers session continuous abnormality alarms.

[0156] Specifically, step S34 includes:

[0157] S341: Capture and parse successful login traffic via protocols such as SSH, Telnet, and HTTPS. First, extract the credential identifier used for each successful login from the traffic data. and its event timestamp The system also needs to retrieve the last modification time of the credential from the asset management database or password management system. When a certain certificate is in use at the current time... Compared to the last modified time The interval between :

[0158]

[0159] Exceeding the preset maximum safety period If the password expires, the system will identify the voucher as potentially invalid and automatically trigger an alarm for the associated asset i, prompting security personnel to change the password or enable multi-factor authentication as soon as possible.

[0160] S342: The opening of unauthorized high-risk ports can provide attackers with potential entry points. This invention defines a set of ports that are commonly used for remote management and are vulnerable to weak password attacks as follows: And within the monitoring window T, port statistics are performed on all traffic entries for each asset i, with the statistical value being... :

[0161]

[0162]

[0163] If any port exists within the window period Visited (i.e.) If the port number is high, the security console will be reported to show the port list, access frequency, and session details. It is recommended to immediately close the port or strengthen access control policies.

[0164] S343: Utilizing the power control system protocol parser and the power control system traffic fingerprint database, combined with protocol function codes and message structures, to perform potential unauthorized service detection on IEC 60870-5-104, PMU, MMS and other service traffic in the power monitoring network.

[0165] The set of service types observed by asset i within window T Allowed service whitelist set Unauthorized service indications They are respectively:

[0166]

[0167]

[0168]

[0169] In the formula: This indicates the j-th service type observed for asset i within window T; This represents the allowed services of class k. When... When this occurs, the system generates an alarm for unauthorized service operation, along with a set of unauthorized service names, session duration, and a sample of triggered traffic.

[0170] S344: First, calculate the average duration and standard deviation of historical session durations based on the duration of asset i across M sessions:

[0171]

[0172]

[0173] In the formula: This refers to the number of historical conversations counted. The duration of the m-th historical session for asset i; This represents the average duration of historical sessions for asset i; Let be the standard deviation of the historical session duration of asset i.

[0174] Then, set the session duration threshold. Defined as the maximum allowed duration and statistical threshold Larger value:

[0175]

[0176] In the formula: This is the preset absolute maximum allowed duration threshold; This is a statistical threshold multiple.

[0177] Finally, for the newly generated j-th session, record its duration. and heartbeat / synchronization indicator (If it is a heartbeat / synchronization link) =1, otherwise =0). Define the traffic anomaly indicator as:

[0178]

[0179] If any session j exists within the monitoring window T such that... If this occurs, a session continuous abnormality alarm will be triggered, and details such as the session duration, port number, and data volume will be output.

[0180] S4 calculates topology importance based on a directed weighted topology graph; it normalizes and linearly weights the four-dimensional scores of topology importance, device type importance, vulnerability severity, and business impact to generate a comprehensive risk score for each asset.

[0181] In this embodiment, step S4 specifically includes:

[0182] S41, Calculate degree centrality based on directed weighted topological graph. Betweenness centrality Close centrality Degree centrality Betweenness centrality Close centrality A comprehensive evaluation is conducted to obtain the topological importance.

[0183] Specifically, degree centrality Used to measure the number of directly connected neighboring nodes of a node, reflecting the busyness or frequency of access of that node in the local structure.

[0184]

[0185] In the formula: This represents the number of neighboring nodes of node i; This indicates the total amount of assets.

[0186] Betweenness centrality It is used to measure the degree of mediation of a node in all shortest paths, that is, the number of shortest paths between nodes that pass through the node.

[0187]

[0188] In the formula: This represents the total number of shortest paths from node u to node v; It represents the number of shortest paths that pass through node i.

[0189] tight centrality It is used to measure the reciprocal of the average distance between a node and all other nodes in the network, reflecting its efficiency in reaching various parts of the network.

[0190]

[0191] In the formula: This represents the shortest path length from i to j in the graph.

[0192] Degree centrality Betweenness centrality Close centrality A comprehensive evaluation was conducted to obtain the topological importance. ;

[0193]

[0194] In the formula: Let i be the degree centrality. For the betweenness centrality of node i, For the compact centrality of node i, , , These are the corresponding weights for degree centrality, betweenness centrality, and compact centrality, respectively. This represents the maximum value among all asset nodes in the entire network. Let j be the degree centrality. For the betweenness centrality of node j, Let j be the tight centrality of node j.

[0195] S42, Define the importance of equipment type according to different equipment types in the power system. ;

[0196]

[0197] S43. Based on the CVSS v3.1 standard, calculate the vulnerability severity using the vulnerability's base score and environment score. :

[0198]

[0199] In the formula: This represents the CVSS baseline score, with a value range of [0,10]. The environmental score range is [0, 10].

[0200] S44, utilizing downtime recovery time Downstream Dependence Economic losses Risk of legal penalties Four-dimensional index normalization and weighting, calculating the business impact of computing devices. :

[0201]

[0202] In the formula: Downstream dependency is the ratio of the number of downstream nodes to the total number of nodes.

[0203] S45 normalizes and linearly weights the four-dimensional scores of topology importance, device type importance, vulnerability severity, and business impact to calculate the comprehensive risk score for each asset. The formula for calculating the comprehensive risk score is as follows:

[0204]

[0205] In the formula, The overall risk score; Topological importance; Importance of equipment type; The severity of the vulnerability; The business impact of the equipment; , , , These are the corresponding weights for topology importance, device type importance, vulnerability severity, and device business impact.

[0206] Example 2

[0207] like Figure 2 As shown, the difference between this embodiment and Embodiment 1 is that this embodiment provides a network security vulnerability inspection system for a power monitoring system, which corresponds one-to-one with the network security vulnerability inspection method for a power monitoring system in Embodiment 1; the system includes:

[0208] The acquisition unit is used to acquire the original alarm logs of the power monitoring system and preprocess the original alarm logs.

[0209] The asset identification unit is used to input the preprocessed alarm logs into the multilayer perceptron model for asset identification and to obtain an asset list.

[0210] The topology graph construction unit is used to perform session aggregation, count bytes and sessions on the raw traffic data collected in real time based on the relationship between IP and MAC addresses, and obtain the directed edge set and edge weight set of asset pairs by combining threshold filtering and weighting; and construct a directed weighted topology graph based on the asset list, the directed edge set of asset pairs and the edge weight set.

[0211] The automatic alarm unit is used to automatically alarm for non-whitelist access, unauthorized links, non-compliant configurations, and abnormal traffic based on the asset list and the directed weighted topology graph.

[0212] The asset risk score calculation unit is used to calculate the topology importance based on the directed weighted topology graph; it normalizes and linearly weights the four-dimensional scores of topology importance, device type importance, vulnerability severity and business impact to generate a comprehensive risk score for each asset.

[0213] The execution process of each unit can be carried out according to the steps of the power monitoring system network security vulnerability inspection method in Embodiment 1, and will not be described in detail in this embodiment.

[0214] Meanwhile, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the above-mentioned method for checking network security vulnerabilities in a power monitoring system.

[0215] Meanwhile, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-mentioned method for detecting network security vulnerabilities in a power monitoring system.

[0216] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0217] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0218] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0219] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0220] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting network security vulnerabilities in a power monitoring system, characterized in that, The method includes: Obtain the original alarm logs of the power monitoring system, preprocess the original alarm logs, and input the preprocessed alarm logs into the multilayer perceptron model for asset identification to obtain an asset list; Based on the association between IP and MAC addresses, the raw traffic data collected in real time is aggregated for sessions, and the number of bytes and sessions is counted. Combined with threshold filtering and weighting, the directed edge set and edge weight set of asset pairs are obtained. Based on the asset list, the directed edge set of asset pairs and the edge weight set, a directed weighted topology graph is constructed. Based on the asset list and the directed weighted topology graph, automated alerts are generated for non-whitelisted access, unauthorized links, non-compliant configurations, and abnormal traffic; and The topology importance is calculated based on the directed weighted topology graph; the four-dimensional scores of topology importance, device type importance, vulnerability severity and business impact are normalized and linearly weighted to generate a comprehensive risk score for each asset.

2. The method for detecting network security vulnerabilities in a power monitoring system according to claim 1, characterized in that, The original alarm logs are preprocessed, including: The original alarm logs are cleaned and normalized to obtain cleaned alarm logs; The cleaned alarm logs are encapsulated into structured records; the structured records include network segment number, event timestamp, standardized device type, and device name; The structured records are mapped to fixed preset dimension numerical vectors and concatenated to obtain vectorized alarm logs, which are used as preprocessed alarm logs.

3. The method for detecting network security vulnerabilities in a power monitoring system according to claim 1, characterized in that, The preprocessed alarm logs are input into a multilayer perceptron model for asset identification to obtain an asset list, including: The preprocessed alarm logs are input into a multi-layer perceptron model for multi-class classification to obtain log recognition results. The log identification results are aggregated by IP address, and the IP address with the highest frequency or the highest confidence level among multiple classifications is used as the final device type, i.e., asset type. Based on the log identification results and the asset types, an asset list is generated; The asset list is supplemented with metadata by combining the configuration management database (CMDB) and the power grid GIS to obtain a supplemented asset list; The supplementary asset list is shown as follows: ;in, For the i-th asset item, Let IP address be the IP address of the i-th asset item. Let i be the asset type of the i-th asset item. Let i be the name of the asset in the i-th asset item. For the manufacturer of the i-th asset item, For the security domain information of the i-th asset item, This is the identifier for the plant or computer room of the i-th asset item.

4. The method for detecting network security vulnerabilities in a power monitoring system according to claim 1, characterized in that, Based on the relationship between IP and MAC addresses, the raw traffic data collected in real time is aggregated for sessions, and the number of bytes and sessions is counted. Combined with threshold filtering and weighting, the directed edge set and edge weight set of asset pairs are obtained. Based on the asset list, the directed edge set of asset pairs, and the edge weight set, a directed weighted topology graph is constructed, including: Real-time collection of raw traffic data, which is the source IP, destination IP, source MAC, destination MAC and packet byte count of the packets captured in real time by network monitoring equipment and mirror ports. The raw traffic data is grouped according to asset pairs, and packet entries with the same source IP and destination IP are aggregated to generate a set of session entries divided by session boundaries; The message byte count of each session entry in the session entry set is accumulated, and the total byte count and number of sessions for the asset pair within the statistical period are calculated. By combining the total number of bytes and the number of sessions for each asset pair, filtering is performed according to preset byte thresholds and session frequency thresholds to retain key links in the real operating environment that meet the requirements, thus obtaining the directed edge set and edge weight set for the asset pair. Using the asset list as the set of all asset nodes, and combining the directed edge set and edge weight set of the asset pairs, a directed weighted topology graph is constructed.

5. The method for detecting network security vulnerabilities in a power monitoring system according to claim 1, characterized in that, Based on the asset list and the directed weighted topology graph, automated alerts are generated for non-whitelisted access, unauthorized links, non-compliant configurations, and abnormal traffic, including: Merge the static whitelist and the dynamic whitelist to obtain a merged whitelist; based on the merged whitelist, if asset i meets the absolute number of illegal external connections or the illegal external connection ratio threshold within window T, an illegal external connection alarm is triggered. Using the security zone mapping table and isolation policy rule set of the power monitoring network, illegal cross-chain events are marked; based on the illegal cross-chain events, the number of cross-chain events and the traffic volume of each asset or each security zone pair within window T are counted, and an alarm is triggered. Establish a compliance indicator system and conduct compliance assessments based on a weighted risk index. Based on the compliance assessment results, automatically push non-compliance items for each device to the security operations and maintenance platform in the form of structured events. For assets with an overall compliance level below the threshold, a list of high-risk devices will be generated. Based on the list of high-risk devices, combined with the security zone to which the asset belongs and the level of business impact, a rectification work order will be automatically generated. Successful login traffic through various protocols is captured and parsed to obtain business traffic; based on protocol function codes and message structures, potential unauthorized services are detected in the business traffic, generating unauthorized service operation alarms and triggering session continuous abnormality alarms.

6. The method for detecting network security vulnerabilities in a power monitoring system according to claim 1, characterized in that, Calculate the topological importance based on the directed weighted topological graph; The four-dimensional scores of topology importance, device type importance, vulnerability severity, and business impact are normalized and linearly weighted to generate a comprehensive risk score for each asset, including: Based on the aforementioned directed weighted topological graph, calculate the degree centrality, betweenness centrality, and compact centrality; The degree centrality, betweenness centrality, and compact centrality are comprehensively evaluated to obtain the topological importance. Define the importance of equipment type based on the different equipment types in the power system; According to the CVSS v3.1 standard, the severity of a vulnerability is calculated using its base score and environment score. The business impact of equipment is calculated by normalizing and weighting four dimensions: downtime recovery time, downstream dependence, economic loss, and regulatory penalty risk. The four-dimensional scores of topology importance, device type importance, vulnerability severity, and business impact are normalized and linearly weighted to calculate the comprehensive risk score for each asset.

7. A method for detecting network security vulnerabilities in a power monitoring system according to claim 6, characterized in that, The formula for calculating the comprehensive risk score is as follows: ； ； In the formula, The overall risk score; Topological importance; Importance of equipment type; The severity of the vulnerability; The business impact of the equipment; , , , These are the corresponding weights for topology importance, device type importance, vulnerability severity, and device business impact, respectively. Let i be the degree centrality. For the betweenness centrality of node i, For the compact centrality of node i, , , These are the corresponding weights for degree centrality, betweenness centrality, and compact centrality, respectively. This represents the maximum value among all asset nodes in the entire network. Let the degree centrality of node j be... For the betweenness centrality of node j, Let j be the tight centrality of node j.

8. A network security vulnerability detection system for power monitoring systems, characterized in that, The system includes: The acquisition unit is used to acquire the original alarm logs of the power monitoring system and preprocess the original alarm logs. The asset identification unit is used to input the preprocessed alarm logs into the multilayer perceptron model for asset identification and to obtain an asset list. The topology graph construction unit is used to perform session aggregation, count bytes and sessions on the raw traffic data collected in real time based on the association between IP and MAC addresses, and combine threshold filtering and weighting to obtain the directed edge set and edge weight set of asset pairs; based on the asset list, the directed edge set of asset pairs and the edge weight set, a directed weighted topology graph is constructed. An automatic alarm unit is used to automatically alarm for non-whitelist access, unauthorized links, non-compliant configurations, and abnormal traffic based on the asset list and the directed weighted topology graph. The asset risk score calculation unit is used to calculate the topology importance based on the directed weighted topology graph; normalize and linearly weight the four-dimensional scores of topology importance, device type importance, vulnerability severity and business impact to generate a comprehensive risk score for each asset.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a method for checking network security vulnerabilities in a power monitoring system as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements a method for checking network security vulnerabilities in a power monitoring system as described in any one of claims 1 to 7.

Images