The invention provides a method and a
system for detecting and defending cross-domain threats of a power
system. The method comprises the following steps: after carrying out anomaly identification on operation
monitoring data of a physical domain node in a target
power grid region to obtain an anomaly identification result and carrying out
denial of service attack identification according to network flow data of an
information domain node to obtain an
attack identification result, carrying out abnormal event association analysis on the anomaly identification result and the
attack identification result to obtain an
attack cross-domain anomaly identification result; according to key nodes and key risk propagation paths in a cross-domain attack chain generated based on a
graph theory algorithm, generating an attack tracing atlas, and according to
vulnerability information of the key nodes in the atlas, obtaining a corresponding power
system topological graph and a corresponding communication network
topological graph; and iteratively generating an
active defense rule based on a game theory
algorithm and a
reinforcement learning algorithm, and issuing the
active defense rule to the node. According to the method, the cross-domain attack risk is accurately perceived in real time and
adaptive security defense is executed through cross-domain abnormal event association analysis, so that the comprehensiveness and reliability of security protection of the power system are improved.