Method and system for security risk assessment of power information network

Abstract

The present invention relates to the technical field of data processing, and in particular to a method and system for security risk assessment of a power information network. The method comprises: retrieving a network log from a power information database; calculating the possibility of risk in the network log on the basis of the proportion of anomalous data points in the network log; using the product of the anomaly importance of the network log and the anomaly degree of the network log as the degree of impact after the occurrence of risk in the network log; calculating a risk level assessment index of the network log on the basis of the product of the probability of risk and the degree of impact after the occurrence of risk, wherein the risk level assessment index of the network log is positively correlated with the product; and acquiring the risk level of a power information network on the basis of the risk level assessment index of the network log. By using the method of the present invention, the accuracy of risk level assessment results of the power information network can be greatly improved.

Description

A method and system for assessing network security risks in the power information network.

[0001] Cross-references to related applications

[0002] This application claims priority to Chinese Patent Application No. 2024109862962, filed on July 23, 2024, entitled "A Method and System for Risk Assessment of Power Information Network Security", the entire contents of which are incorporated herein by reference. Technical Field

[0003] This invention relates to the field of data processing technology. More specifically, this invention relates to a method and system for assessing network security risks in the power information system. Background Technology

[0004] With the continuous advancement of informatization and intelligentization, the various network systems of power enterprises, such as power grids, communications, and data, are becoming increasingly mature. However, at the same time, network security issues are becoming increasingly prominent. The stable operation of power information networks is directly related to the normal operation of power enterprises and the safe and stable supply of electricity. Therefore, accurate assessment and management of power information network security risks are particularly important. Chinese patent application CN115758387A discloses an information security risk assessment method, which can calculate the probability of various risk scenarios relatively accurately. However, this method cannot quantify the degree of impact of power information network security risks.

[0005] By introducing a risk matrix, the likelihood and impact of cybersecurity risks in the power information network can be quantified, enabling enterprises to more intuitively understand the severity of risks and thus develop targeted risk prevention and response measures. A risk matrix is ​​a commonly used risk assessment tool that helps organizations better understand and manage risks by quantifying their likelihood and impact.

[0006] Traditional risk matrices require defining risk assessment dimensions, typically including the probability of risk occurrence and the extent of its impact. The probability of occurrence can be obtained using statistical methods, while the extent of impact often relies on expert judgment or subjectively established metrics. However, these expert judgments and metrics are usually based on subjective assessment and experience, and different application scenarios and experts may use different metrics, making precise quantification difficult. This leads to errors in the constructed risk matrix and ultimately lower accuracy in assessing power information network security risks. Furthermore, subjectively established risk impact metrics cannot be directly compared and quantified, and are difficult to combine with other quantitative methods for comprehensive analysis. Summary of the Invention

[0007] To address the technical problem of low accuracy in assessing network security risks of power information networks using risk matrices in existing technologies, this invention provides solutions in the following aspects.

[0008] In a first aspect, the present invention provides a method for assessing network security risks in the power information network, comprising:

[0009] Retrieve network logs from the power information database;

[0010] The probability of a risk in the network log is calculated based on the proportion of abnormal data points in the network log, and the probability of a risk in the network log is positively correlated with the proportion; the product of the abnormal importance of the network log and the abnormality degree of the network log is used as the impact degree after the risk of the network log occurs; the abnormal importance is used to characterize the probability that the abnormality of the network log is a sudden abnormality.

[0011] The risk level assessment index of the network log is calculated based on the product of the probability of the risk existing and the degree of impact after the risk occurs; the risk level assessment index of the network log is positively correlated with the product;

[0012] The risk level of the power information network is obtained based on the risk level assessment index of the network log.

[0013] Its beneficial effects are as follows: The power information network security risk assessment method of this invention calculates the probability of a risk in the network log based on the proportion of abnormal data points to the total number of data points during security risk assessment. The product of the probability that the network log anomaly is a sudden anomaly and the degree of anomaly is used as the impact level after the risk occurs, thus obtaining the final risk assessment level. This reduces the subjective influence of expert judgment or manually determined impact levels, greatly improving the accuracy and interpretability of the risk level assessment results. Furthermore, traditional risk matrices are often based on static data and assumptions, making it difficult to reflect real-time changes in risk. The power information network security risk assessment method of this invention integrates the data anomaly monitoring process into the risk assessment, enabling real-time capture of abnormal system states and dynamic updates to the risk level assessment results, more accurately reflecting the actual situation of the risk.

[0014] In one embodiment, the probability L of the r-th network log entry being at risk is... r The calculation expression:

[0015] In the formula, N rLet σ be the total number of data points in the r-th network log entry. r Let N be the variance of the data points in the r-th network log entry. r,y Let r be the number of anomalous data points in the r-th network log entry. denoted as the proportion of abnormal data points in the r-th network log entry.

[0016] Its beneficial effects are as follows: Since the data in the network log may contain noisy data, and abnormal data is not necessarily real abnormal data, the smaller the variance of the data points in the network log, the higher the credibility of the abnormal data as real abnormal data, and the greater the possibility that the network log has risks. Therefore, when calculating the possibility that the network log has risks, it is necessary to not only consider the proportion of abnormal data points, but also to further combine the variance of the data points in the network log for calculation, thereby greatly improving the accuracy of the calculated possibility that the network log has risks.

[0017] In one embodiment, obtaining the number of anomalous data points in the r-th network log entry includes:

[0018] The LOF algorithm is used to calculate the anomaly score for each data point in the r-th log entry.

[0019] Data points with abnormal scores greater than a preset score threshold are identified as abnormal data points, and the number of abnormal data points is then obtained.

[0020] In one embodiment, the method for calculating the abnormal importance of the network logs includes:

[0021] The degree of abnormality of each abnormal data point in the network log is calculated, and then the sum of the degrees of abnormality of each abnormal data point is obtained; the degree of abnormality of the abnormal data point is positively correlated with the deviation between the abnormal data point and the mean of the data points in the network log;

[0022] Calculate the degree of difference between each normal data point and each abnormal data point in the network log, and then obtain the sum of the degree of difference of each normal data point;

[0023] The importance of the anomaly is calculated based on the sum of the anomaly severity and the sum of the difference severity, and the importance of the anomaly is positively correlated with both the sum of the anomaly severity and the sum of the difference severity.

[0024] Its beneficial effects are as follows: when a sudden anomaly occurs in the network log, the degree to which the abnormal data points deviate from the normal range will be relatively large. Therefore, the greater the degree of abnormality of each abnormal data point, the greater the probability that the anomaly of the network log belongs to a sudden anomaly. The greater the degree of difference between normal data points and abnormal data points, the more reliable the calculated degree of abnormality of each abnormal data point is. Therefore, by making the anomaly importance positively correlated with the sum of the anomaly degrees and the sum of the differences, the anomaly importance of the network log can be calculated more accurately.

[0025] In one embodiment, the degree of difference C between the f-th normal data point and the abnormal data point in the r-th log entry is... r,f The calculation expression is:

[0026] In the formula, x r,f Let x be the value of the f-th normal data point in the r-th network log entry. r,y Let N be the value of the y-th anomalous data point in the r-th network log entry. r,y Let r be the total number of anomalous data points in the r-th network log entry.

[0027] In one embodiment, for the r-th network log entry, its exceptional importance Y r The calculation expression is:

[0028] In the formula, T r,y Let N represent the degree of anomalousness of the y-th anomalous data point in the r-th network log entry. r,y Let C be the number of anomalous data points in the r-th network log entry. r,f N represents the degree of difference between the f-th normal data point and the abnormal data point in the r-th network log. r Let N be the total number of data points in the r-th network log entry. r -N r,y Let r be the number of normal data points in the r-th network log entry.

[0029] In one embodiment, the method for calculating the anomaly level of the network logs includes:

[0030] Obtain network logs for multiple historical dates corresponding to the time period of the network logs, and calculate the absolute value of the difference between the number of abnormal data points in the network logs and the number of abnormal data points in the network logs for each historical date.

[0031] The credibility of the anomaly degree of the network log is calculated based on the sum of the absolute values ​​of all the differences. The credibility is negatively correlated with the sum of the absolute values. The anomaly degree of the network log is calculated based on the credibility of the anomaly degree and the mean of the deviations between the sum of the anomaly data of the network log and the sum of the anomaly data of the network log for each historical date. The anomaly degree is positively correlated with the credibility of the anomaly degree and the deviations.

[0032] The beneficial effects are as follows: When the network logs for a given historical date and time period are normal, the greater the deviation between the sum of abnormal data in the currently collected network logs and the sum of abnormal data in the network logs for the same historical date and time period, the higher the degree of abnormality in the currently collected network logs. However, if abnormalities occurred in the network logs for that historical date and time period, even if the sum of abnormal data in the currently collected network logs is large, the deviation between the sum of abnormal data in the currently collected network logs and the sum of abnormal data in the network logs for that historical date and time period may be small, leading to a misjudgment of the currently collected network logs as having no abnormalities or a low degree of abnormality. To avoid misjudgment, the deviation between the sum of abnormal data in the currently collected network logs and the sum of abnormal data in logs for that time period from multiple historical dates is calculated separately. Then, the average of all deviations is taken. Based on this average and combined with the reliability of the degree of abnormality, the degree of abnormality of the currently collected network logs is measured, thereby avoiding misjudgment and improving the accuracy of the network log abnormality calculation results.

[0033] In one embodiment, for the r-th network log entry, the confidence level of its anomaly is KT. r The calculation expression is:

[0034] In the formula, N r,y Let N be the number of anomalous data points in the r-th network log entry. l,y′ Let n be the number of outlier data points in the network log for the l-th historical date. t Let be the total number of historical dates, and exp be an exponential function with base e.

[0035] In one embodiment, obtaining the risk level of the power information network based on the risk level assessment index of the network log includes: dividing the value range of the risk level assessment index into multiple intervals, with different intervals corresponding to different risk levels, and the larger the value of the left endpoint of the interval, the higher the corresponding risk level; constructing a risk matrix based on each interval and the risk level corresponding to each interval, the risk matrix including two rows, one row being the intervals and the other row being the risk level corresponding to each interval; and obtaining the risk level of the power information network by combining the risk matrix with the value of the risk level assessment index.

[0036] In a second aspect, the present invention provides a power information network security risk assessment system, including a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the power information network security risk assessment method of the present invention is implemented. Attached Figure Description

[0037] The above and other objects, features, and advantages of exemplary embodiments of the present invention will become readily apparent upon reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of the invention are illustrated by way of example and not limitation, and like or corresponding reference numerals denote like or corresponding parts, wherein:

[0038] Figure 1 is a flowchart illustrating an embodiment of the power information network security risk assessment method of the present invention;

[0039] Figure 2 is a flowchart illustrating a method for obtaining the number of abnormal data points in the r-th network log according to an embodiment of the present invention;

[0040] Figure 3 is a flowchart illustrating an embodiment of the present invention for calculating the abnormal importance of network logs;

[0041] Figure 4 is a flowchart illustrating a method for calculating the anomaly level of network logs according to an embodiment of the present invention;

[0042] Figure 5 is a schematic diagram illustrating the structure of a power information network security risk assessment system according to an embodiment of the present invention. Detailed Implementation

[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0045] Example of a power information network security risk assessment method:

[0046] As shown in Figure 1, the power information network security risk assessment method of the present invention includes:

[0047] S101. Retrieve network logs from the power information database.

[0048] In this embodiment, the retrieved network logs are aggregated log records. A single log entry may contain traffic statistics within a certain time window, which can be per second, per minute, or per hour. The traffic statistics include total bytes count, network traffic, etc. In other embodiments, the retrieved network logs may also be other forms of log records.

[0049] S102. Calculate the probability of a risk in the network log and the degree of impact after the risk of the network log occurs, specifically: calculate the probability of a risk in the network log based on the proportion of abnormal data points in the network log, and the probability of a risk in the network log is positively correlated with the ratio; take the product of the abnormal importance of the network log and the abnormality degree of the network log as the degree of impact after the risk of the network log occurs; the abnormal importance is used to characterize the probability that the abnormality of the network log is a sudden abnormality.

[0050] Sudden anomalies refer to unpredictable abnormal situations, such as anomalies caused by cyberattacks.

[0051] When calculating the impact of a risk in a network log, the impact is calculated based on the overall anomaly of all data points in the network log, rather than based on the anomaly of a single data point. This allows for a comprehensive consideration of all data points in the network log, avoiding the pitfall of "generalizing from a single instance" that could affect the risk assessment level. It also helps to better capture and assess the overall impact of the risk, and provides a more complete understanding of the extent to which the risk affects the system or business.

[0052] S103. Calculate the risk level assessment index of the network log, specifically: calculate the risk level assessment index of the network log based on the product of the probability of the existence of the risk and the degree of impact after the risk occurs; the risk level assessment index of the network log is positively correlated with the product.

[0053] S104. Obtain the risk level of the power information network based on the risk level assessment index of the network log.

[0054] In this embodiment, the risk level of the power information network can be directly assessed based on the magnitude of the risk level assessment index of the network logs; the larger the risk level assessment index, the higher the corresponding risk level. In other embodiments, the risk level can also be calculated based on the value of the risk level assessment index combined with the risk level calculation expression.

[0055] The value range of the risk level assessment index can be divided into multiple intervals, with different intervals corresponding to different risk levels. The larger the value of the left endpoint of the interval, the higher the corresponding risk level. A risk matrix is ​​constructed based on each interval and the risk level corresponding to each interval. The risk matrix includes two rows, one row being the interval and the other row being the risk level corresponding to each interval. The risk level of the power information network is obtained by combining the risk matrix with the value of the risk level assessment index.

[0056] The risk level corresponding to the interval to which the risk level assessment index belongs is taken as the risk level of the power information network.

[0057] Traditional risk matrices first categorize the likelihood of a risk and its subsequent impact separately to obtain the risk level. This embodiment directly categorizes risk levels based on the product of the likelihood and the impact, eliminating the multiple categorization steps of traditional risk matrices. Only one categorization is needed to obtain the final risk level, making the construction of the risk matrix convenient and flexible. Furthermore, the result obtained through multiplication directly reflects the comprehensive level of risk, making it easier to understand and explain to relevant stakeholders.

[0058] The power information network security risk assessment method of this invention calculates the probability of a risk in the network log based on the proportion of abnormal data points to the total number of data points. The product of the probability that the network log anomaly is sudden and the degree of anomaly is used as the impact level of the risk after it occurs, thus obtaining the final risk assessment level. This reduces the subjective influence of expert judgment or manually determined impact levels, greatly improving the accuracy and interpretability of the risk level assessment results. Furthermore, traditional risk matrices are often based on static data and assumptions, making it difficult to reflect real-time changes in risk. The power information network security risk assessment method of this invention integrates the data anomaly monitoring process into the risk assessment, enabling real-time capture of system anomalies and dynamic updates to the risk level assessment results, more accurately reflecting the actual risk situation.

[0059] As can be seen from the above embodiments, the probability of a network log being risky is positively correlated with the proportion of abnormal data points in the network log. In one embodiment, the probability L of the r-th network log being risky is... r The calculation expression:

[0060] In the formula, N r Let σ be the total number of data points in the r-th network log entry. rLet N be the variance of the data points in the r-th network log entry. r,y Let r be the number of anomalous data points in the r-th network log entry. denoted as the proportion of abnormal data points in the r-th network log entry.

[0061] Since network logs may contain noisy data, and outlier data is not necessarily true outlier data, the smaller the variance of the data points in the network log, the higher the credibility of the outlier data as true outlier data, and the greater the possibility that the network log is at risk. Therefore, when calculating the possibility of network logs being at risk, we not only consider the proportion of outlier data points, but also further combine the variance of the data points in the network log for calculation, thereby greatly improving the accuracy of the calculated possibility of network logs being at risk.

[0062] As can be seen from the above embodiments, before calculating the probability that the r-th network log has a risk, it is necessary to obtain the number of abnormal data points in the r-th network log. As shown in Figure 2, in one embodiment, obtaining the number of abnormal data points in the r-th network log includes:

[0063] S201. Use the LOF algorithm to calculate the anomaly score of each data point in the r-th network log.

[0064] S202. Obtain the number of abnormal data points, specifically: determine the data points whose abnormal scores are greater than a preset score threshold as abnormal data points, and then obtain the number of abnormal data points.

[0065] In one embodiment, as shown in Figure 3, the method for calculating the abnormal importance of network logs includes:

[0066] S301. Obtain the sum of the abnormality levels of each abnormal data point in the network log, specifically by: calculating the abnormality level of each abnormal data point in the network log, and then obtaining the sum of the abnormality levels of each abnormal data point; the abnormality level of the abnormal data point is positively correlated with the deviation between the abnormal data point and the mean of the data points in the network log;

[0067] In this embodiment, for the y-th anomalous data point in the r-th network log, its anomalousness level T r,y The calculation expression is: T r,y =|x r,y -μ r | (2)

[0068] In the formula, x r,y Let μ be the value of the y-th anomalous data point in the r-th log entry. r Let be the mean of the data points in the r-th network log.

[0069] The greater the difference between the value of an abnormal data point and the mean value of the data points in the log, the greater the degree of abnormality of the abnormal data point. The abnormality degree expression in this embodiment can accurately and efficiently calculate the degree of abnormality of each abnormal data point.

[0070] S302. Obtain the sum of the degree of difference of each normal data point, specifically by calculating the degree of difference between each normal data point and each abnormal data point in the network log, and then obtaining the sum of the degree of difference of each normal data point.

[0071] The degree of difference C between the f-th normal data point and the abnormal data point in the r-th network log entry. r,f The calculation expression is:

[0072] In the formula, x r,f Let x be the value of the f-th normal data point in the r-th network log entry. r,y Let N be the value of the y-th anomalous data point in the r-th network log entry. r,y Let r be the total number of anomalous data points in the r-th network log entry.

[0073] After obtaining the degree of difference corresponding to each normal data point, the degree of difference corresponding to each normal data point is added together to obtain the sum of the degree of difference of each normal data point.

[0074] S303. Calculate the importance of the anomaly, specifically: calculate the importance of the anomaly based on the sum of the anomaly degrees and the sum of the differences, wherein the importance of the anomaly is positively correlated with both the sum of the anomaly degrees and the sum of the differences.

[0075] When a sudden anomaly occurs in a network log, the abnormal data points will deviate significantly from the normal range. Therefore, the greater the degree of abnormality of each abnormal data point, the greater the likelihood that the anomaly in the network log is a sudden anomaly. The greater the difference between normal data points and abnormal data points, the more reliable the calculated degree of abnormality of each abnormal data point is. Therefore, by making the anomaly importance positively correlated with the sum of the anomaly degrees and the sum of the differences, the anomaly importance of the network log can be calculated more accurately.

[0076] As can be seen from the above embodiments, the importance of the anomaly is positively correlated with the sum of the anomaly degrees and the sum of the differences. In one embodiment, for the r-th network log, its anomaly importance Y is... r The calculation expression is:

[0077] In the formula, T r,y Let N represent the degree of anomalousness of the y-th anomalous data point in the r-th network log entry. r,yLet C be the number of anomalous data points in the r-th network log entry. r,f N represents the degree of difference between the f-th normal data point and the abnormal data point in the r-th network log. r Let N be the total number of data points in the r-th network log entry. r -N r,y Let r be the number of normal data points in the r-th network log entry.

[0078] As shown in Figure 4, in one embodiment, the method for calculating the anomaly level of the network logs includes:

[0079] S401. Obtain the network logs for the corresponding historical dates and the number of abnormal data points in the logs. Specifically, obtain the network logs for multiple historical dates corresponding to the time period of the network logs, and calculate the absolute value of the difference between the number of abnormal data points in the network logs and the number of abnormal data points in the network logs for each historical date.

[0080] Typically, a network log is a record of a specific time period within a day. Multiple historical dates within the same time period refer to the network logs from several consecutive days prior to the current date, where the last day of those consecutive days is the day before the current date. For example, assuming the current network log is from 1 PM to 2 PM today, then the logs from 1 PM to 2 PM the day before yesterday and the day before that are the historical log records for that corresponding time period.

[0081] In this embodiment, "consecutive days" refers to 7 consecutive days.

[0082] S402. Calculate the degree of anomaly of the network logs, specifically: calculate the reliability of the degree of anomaly of the network logs based on the sum of the absolute values ​​of all the differences, wherein the reliability is negatively correlated with the sum of the absolute values; and calculate the degree of anomaly of the network logs based on the reliability of the degree of anomaly, the mean of the deviations between the sum of the abnormal data of the network logs and the sum of the abnormal data of the network logs for each historical date, wherein the degree of anomaly is positively correlated with the reliability of the degree of anomaly and the deviations.

[0083] The larger the sum of the absolute values ​​of the differences, the greater the possibility that the number of abnormal data points in the network log has a trend change, and the less reliable the log is. Therefore, the reliability is negatively correlated with the sum of the absolute values ​​of the differences.

[0084] For the r-th network log entry, the confidence level of its anomaly is KT. r Represented as:

[0085] In the formula, N r,y Let N be the number of anomalous data points in the r-th network log entry.l,y′ Let n be the number of anomalous data points in the l-th historical network log entry. t Let be the total number of historical dates, and exp be an exponential function with base e.

[0086] If the network logs for a given historical date and time period are normal, the greater the deviation between the sum of abnormal data in the currently collected network logs and the sum of abnormal data in the network logs for the same historical date and time period, the higher the degree of abnormality in the currently collected network logs. However, if the network logs for that historical date and time period showed abnormalities, even if the sum of abnormal data in the currently collected network logs is large, the deviation between the sum of abnormal data in the currently collected network logs and the sum of abnormal data in the network logs for that historical date and time period may be small, leading to a misjudgment of the currently collected network logs as having no abnormalities or a low degree of abnormality. To avoid misjudgment, the deviation between the sum of abnormal data in the currently collected network logs and the sum of abnormal data in logs for the same historical date and time period is calculated separately. Then, the average of all deviations is taken. This average, combined with the reliability of the abnormality level, is used to measure the degree of abnormality in the currently collected network logs, thereby avoiding misjudgment and improving the accuracy of the network log abnormality level calculation results.

[0087] In one embodiment, the expression for calculating the anomaly level of the network logs is:

[0088] In the formula, x r,y Let N be the value of the y-th anomalous data point in the r-th network log entry. r,y Let x be the number of anomalous data points in the r-th network log entry. l,y′ Let N be the value of the y'th outlier data point in the network log for the l-th historical date. l,y′ Let n be the number of outlier data points in the network log for the l-th historical date. t KT represents the total number of historical dates. r Let be the reliability of the anomaly level of the r-th network log entry.

[0089] As can be seen from the above embodiments, the risk level assessment index of the network log is positively correlated with the product of the probability of the risk existing and the degree of impact after the risk occurs. In one embodiment, the calculation expression of the risk level assessment index of the network log is: R r =1-exp(-S r ×L r (7)

[0090] In the formula, S r L represents the degree of impact after the risk of the r-th network log occurs. rThe probability of the r-th network log being at risk is given by exp(), which is an exponential function. Here, the function 1-exp(-x) is used to control the result within the range of 0-1.

[0091] As can be seen from the above embodiments, the value range of the risk level assessment index is 0 to 1. Before obtaining the risk level of the power information network based on the risk level assessment index of the network log, the value range of the risk level assessment index needs to be divided into multiple intervals. In one embodiment, the value range can be divided into five intervals, namely [0,0.2), [0.2,0.5), [0.5,0.7), [0.7,0.9), and (0.9,1]. Among them, the risk level corresponding to [0,0.2) is acceptable, the risk level corresponding to [0.2,0.5) is low risk, the risk level corresponding to [0.5,0.7) is medium risk, the risk level corresponding to [0.7,0.9) is high risk, and the risk level corresponding to (0.9,1) is extremely high risk. The constructed risk matrix is ​​shown in the table below:

[0092] Table 1

[0093] Example of a power information network security risk assessment system:

[0094] This invention also provides a power information network security risk assessment system. As shown in Figure 5, the power information network security risk assessment system includes a processor and a memory. The memory stores computer program instructions, which, when executed by the processor, implement the power information network security risk assessment method according to the first aspect of this invention.

[0095] The power information network security risk assessment system also includes other components well known to those skilled in the art, such as communication buses and communication interfaces. Their settings and functions are known in the art and will not be described in detail here.

[0096] In this invention, the aforementioned memory can be any tangible medium containing or storing a program that can be used or combined with an instruction execution system, apparatus, or device. For example, a computer-readable storage medium can be any suitable magnetic or magneto-optical storage medium, such as resistive random access memory (RRAM), dynamic random access memory (DRAM), static random access memory (SRAM), enhanced dynamic random access memory (EDRAM), high-bandwidth memory (HBM), hybrid memory cube (HMC), etc., or any other medium that can be used to store desired information and can be accessed by an application, module, or both. Any such computer storage medium can be part of a device or accessible to or connected to a device. Any application or module described in this invention can be implemented using computer-readable / executable instructions that can be stored or otherwise maintained by such a computer-readable medium.

[0097] In the description of this specification, "multiple" or "several" means at least two, such as two, three or more, unless otherwise explicitly specified.

[0098] While this specification has shown and described numerous embodiments of the invention, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Many modifications, alterations, and alternatives will occur to those skilled in the art without departing from the spirit and essence of the invention. It should be understood that various alternatives to the embodiments of the invention described herein may be employed in the practice of this invention.

Claims

1. A method for assessing network security risks in the power information network, characterized in that, include: Retrieve network logs from the power information database; The probability that the network logs are at risk is calculated based on the proportion of abnormal data points in the network logs, and the probability that the network logs are at risk is positively correlated with the proportion. The product of the abnormal importance of the network log and the abnormality degree of the network log is used as the impact degree after the risk of the network log occurs; the abnormal importance is used to characterize the probability that the abnormality of the network log is a sudden abnormality. The risk level assessment index of the network log is calculated based on the product of the probability of the risk existing and the degree of impact after the risk occurs; the risk level assessment index of the network log is positively correlated with the product; The risk level of the power information network is obtained based on the risk level assessment index of the network log.

2. The power information network security risk assessment method as described in claim 1, characterized in that, The possibility of risk in the r-th network log entry L r The calculation expression: In the formula, N r Let σ be the total number of data points in the r-th network log entry. r Let N be the variance of the data points in the r-th network log entry. r,y Let r be the number of anomalous data points in the r-th network log entry. denoted as the proportion of abnormal data points in the r-th network log entry.

3. The power information network security risk assessment method as described in claim 2, characterized in that, Retrieving the number of anomalous data points in the r-th network log entry includes: The LOF algorithm is used to calculate the anomaly score for each data point in the r-th log entry. Data points with abnormal scores greater than a preset score threshold are identified as abnormal data points, and the number of abnormal data points is then obtained.

4. The power information network security risk assessment method as described in claim 1, characterized in that, The method for calculating the abnormal importance of the network logs includes: The degree of abnormality of each abnormal data point in the network log is calculated, and then the sum of the degrees of abnormality of each abnormal data point is obtained; the degree of abnormality of the abnormal data point is positively correlated with the deviation between the abnormal data point and the mean of the data points in the network log; Calculate the degree of difference between each normal data point and each abnormal data point in the network log, and then obtain the sum of the degree of difference of each normal data point; The importance of the anomaly is calculated based on the sum of the anomaly severity and the sum of the difference severity, and the importance of the anomaly is positively correlated with both the sum of the anomaly severity and the sum of the difference severity.

5. The power information network security risk assessment method as described in claim 4, characterized in that, The degree of difference C between the f-th normal data point and the abnormal data point in the r-th network log entry. r,f The calculation expression is: In the formula, x r,f Let x be the value of the f-th normal data point in the r-th network log entry. r,y Let N be the value of the y-th anomalous data point in the r-th network log entry. r,y Let r be the total number of anomalous data points in the r-th network log entry.

6. The power information network security risk assessment method as described in claim 4, characterized in that, For the r-th network log entry, its exceptional importance Y r The calculation expression is: In the formula, T r,y Let N represent the degree of anomalousness of the y-th anomalous data point in the r-th network log entry. r,y Let C be the number of anomalous data points in the r-th network log entry. r,f N represents the degree of difference between the f-th normal data point and the abnormal data point in the r-th network log. r Let N be the total number of data points in the r-th network log entry. r -N r,y Let r be the number of normal data points in the r-th network log entry.

7. The power information network security risk assessment method as described in any one of claims 1 to 6, characterized in that, The method for calculating the anomaly level of the network logs includes: Obtain network logs for multiple historical dates corresponding to the time period of the network logs, and calculate the absolute value of the difference between the number of abnormal data points in the network logs and the number of abnormal data points in the network logs for each historical date. The credibility of the anomaly degree of the network log is calculated based on the sum of the absolute values ​​of all the differences. The credibility is negatively correlated with the sum of the absolute values. The anomaly degree of the network log is calculated based on the credibility of the anomaly degree and the mean of the deviations between the sum of the anomaly data of the network log and the sum of the anomaly data of the network log for each historical date. The anomaly degree is positively correlated with the credibility of the anomaly degree and the deviations.

8. The power information network security risk assessment method as described in claim 7, characterized in that, For the r-th network log entry, the confidence level of its anomaly is KT. r The calculation expression is: In the formula, N r,y Let N be the number of anomalous data points in the r-th network log entry. l,y′ Let n be the number of outlier data points in the network log for the l-th historical date. t Let be the total number of historical dates, and exp be an exponential function with base e.

9. The power information network security risk assessment method as described in claim 1, characterized in that, The step of obtaining the risk level of the power information network based on the risk level assessment index of the network log includes: dividing the value range of the risk level assessment index into multiple intervals, with different intervals corresponding to different risk levels, and the larger the value of the left endpoint of the interval, the higher the corresponding risk level; constructing a risk matrix based on each interval and the risk level corresponding to each interval, the risk matrix including two rows, one row being the intervals and the other row being the risk level corresponding to each interval; and using the risk matrix in combination with the value of the risk level assessment index to obtain the risk level of the power information network.

10. A power information network security risk assessment system, comprising a processor and a memory, wherein the memory stores computer program instructions, characterized in that, When the computer program instructions are executed by the processor, the power information network security risk assessment method according to any one of claims 1 to 9 is implemented.

Images