CN114493339A - Power grid information safety early warning system based on data feature extraction - Google Patents

Abstract

The invention discloses a power grid information security early warning system based on data feature extraction, comprising: a big data collection layer, an attack information feature extraction storage layer, a data analysis layer and a decision-making layer; wherein, the big data collection layer realizes Real-time collection of facility operation data, information system operation data and information network operation data, and synchronous collection of internal data and external data; the attack information feature extraction storage layer is used to extract the operation features of the current power grid attack intelligence, and realize the attack feature Extraction and recording of information; the data analysis layer is used to realize efficient integration, calculation and analysis of collected data; the decision layer is used to realize timely early warning of information network risks. The invention realizes the comprehensive perception of the operation situation of the power information network, the real-time early warning of the operation risk and the timely disposal of the early warning events.

Description

A power grid information security early warning system based on data feature extraction

technical field

The invention relates to the field of power system security, in particular to a power grid information security early warning system based on data feature extraction.

Background technique

At present, new technologies such as the Internet of Things, cloud computing, and big data are changing with each passing day. We have entered the Web6.0 era. New concepts such as smart earth, Internet+, and self-media are constantly emerging. Information networks have achieved full coverage in various fields and industries. Full popularity and full application. The problems brought about by the new development and new applications of the information network are: the order of magnitude of data is rapidly increasing, the types of data are more complex, the sources of data are more and more diverse, and the virus and attack events are more hidden. In order to respond to security attacks in the big data environment in a timely manner, effectively curb various network attacks, and truly achieve "the magic height is one foot, the road is one foot high", it is urgent to study the network security situational awareness technology in the big data environment, and give full play to the big data technology. It breaks through the "bottleneck" problems of traditional situational awareness models such as large equipment limitations, poor data fusion capabilities, and weak data mining levels, and builds a big data-oriented network security situational awareness model. Establish a security protection framework that matches the big data environment to achieve the goals of efficient acquisition of multi-source and multi-type data, high-speed fusion of massive data, intelligent and effective analysis models, accurate and reliable data mining, rich types of situation display, and reasonable emergency response decision-making. The development and application of information technology in various fields and departments is escorted.

Network and information security are directly related to the safe production of the company's power grid and the normal operation of its business. The company is facing an increasingly severe internal and external information security situation. It is urgent to improve the level of "intrinsic security" and create a new situation of security protection. With the continuous improvement of the company's informatization level, higher standards and requirements are put forward for the power information network. The company needs to change the passive management mode of alarming and emergency repair after a fault occurs, so as to realize risk warning and intelligent management before the fault occurs. The active management mode of the power information network for operation and maintenance is conducive to improving the ability of the power information network to deal with security risks, and contributes to the construction of the smart grid and even the global energy Internet.

SUMMARY OF THE INVENTION

In order to solve the above problems, the present invention provides a power grid information security early warning system based on data feature extraction.

For achieving the above object, the technical scheme adopted in the present invention is as follows:

A power grid information security early warning system based on data feature extraction, comprising: a big data collection layer, a data analysis layer and a decision-making layer;

Wherein, the big data collection layer realizes real-time collection of infrastructure operation data, information system operation data and information network operation data, and synchronously collects internal data and external data;

The data analysis layer is used to realize efficient integration, calculation and analysis of collected data;

The decision-making layer is used to realize timely early warning of information network risks.

Optionally, the data analysis layer includes an integration module, a calculation module, and an analysis module, wherein the integration module is used for data integration of the big data collection layer, that is, data extraction, data conversion, and data cleaning. The calculation module is used to process batch data processing and stream data processing on the integrated data, and the analysis module is used to analyze the calculated data.

Optionally, the analysis module includes an analysis library module and an early warning model, the analysis library module is used to provide an analysis model, and the early warning model implements active risk early warning management of power information according to the analysis model, and the analysis library module includes: State early warning model, threshold early warning model, fast change early warning model, evaluation early warning model and graded early warning model.

Optionally, the early warning model includes a basic framework evaluation model, a real-time reliability model and a historical operation evaluation model, wherein the basic framework evaluation model obtains the information network topology framework through topology discovery technology, and then analyzes all the basic frameworks in the topology framework. The importance of the facility is evaluated and its monitoring indicators are collected; the real-time reliability model responds to the real-time monitoring indicators of the main pages of the information system and the response and response time of the monitoring pages; the historical operation evaluation model is based on the historical operation of the information system and is used for historical Number of alarms and historical alarm severity.

Optionally, the state early warning model includes hardware, software, basic support resources and virtual resources, and is used for detecting all information resources at regular intervals (once, and judging their states.

Optionally, the threshold early warning model is used to make early warning threshold judgment, and its algorithm is as follows:

Among them, T _0max and T _0min are the initial values of the upper threshold and the lower threshold, respectively, t is the current date, h is the current time, m is the number of days, and n is the number of hours. According to the above algorithm, the index threshold T of the information resource is between the upper threshold T _max and the lower threshold T _min .

Optionally, the fast-changing early warning model is used for early warning of abnormal mutation, and its algorithm is as follows:

Among them, Si represents the load of the _i -th device, and α is the fast-changing threshold configured by the user;

Among them, R _max and R _min are the maximum and minimum values of historical operating data after data cleaning, respectively, A is the average value of historical data, and L represents the reasonable operating range of the indicator.

Optionally, the evaluation and early warning model is used to realize the evaluation of infrastructure, and the evaluation and early warning algorithm is as follows:

Based on the initial score S ₀ set by the user, the number m/n/p, weight α and deduction value f of each level of information network events, the final evaluation score S of the information resource can be obtained, and risk early warning can be carried out according to the score.

Optionally, the hierarchical early warning model is used to classify early warning events into index level, infrastructure level and information network level.

Optionally, the decision-making layer includes a resource management module, a risk early warning module, and a decision analysis module.

Compared with the prior art, the technical progress achieved by the present invention is:

The power grid information security early warning system based on data feature extraction realizes comprehensive awareness of the power information network operation situation, real-time early warning of operation risks and timely disposal of early warning events. Real-time assessment of the security situation of the network through all available information provides a basis for network security administrators' decision-making and analysis, and minimizes the risks and losses caused by unsafe factors. The model is of great significance in improving the network monitoring ability, emergency response ability and predicting the development trend of network security. It provides a strong guarantee for the information security of power and communication systems, and has good application effects.

Description of drawings

The accompanying drawings are used to provide a further understanding of the present invention, and constitute a part of the specification, and are used to explain the present invention together with the embodiments of the present invention, and do not constitute a limitation to the present invention.

In the attached image:

FIG. 1 is a schematic structural diagram of the present invention.

Detailed ways

The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. Embodiments of the present invention will be described below with reference to the accompanying drawings.

It should be noted that the terminology used herein is for the purpose of describing specific embodiments only, and is not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly dictates otherwise, the singular is intended to include the plural as well, furthermore, it is to be understood that when the terms "comprising" and/or "including" are used in this specification, it indicates that There are features, steps, operations, devices, components and/or combinations thereof.

As shown in FIG. 1 , the present invention discloses a power grid information security early warning system based on data feature extraction, including: a big data collection layer, an attack information feature extraction storage layer, a data analysis layer and a decision-making layer;

Among them, the big data collection layer realizes the real-time collection of infrastructure operation data, information system operation data and information network operation data, and simultaneously collects internal data and external data; among them, the internal data is: including reputation intelligence and attack intelligence, reputation intelligence Including URLs, IP addresses, domain names, attack intelligence includes attack sources, attack tools, vulnerabilities, and methods used. It mainly refers to monitoring internal abnormal behaviors. The damage caused by internal abnormal behaviors is the main factor leading to security incidents. External attacks The attacker initiates an APT attack, and some of the links need to “walk inside” to access sensitive data, so as to achieve the purpose of stealing or destroying. Threat sources within the enterprise include malicious insiders who may be ready to leave, long-term slow information leakage of insiders, etc. Internal attacks may also be initiated by partners or third parties with internal access rights. By formulating different scenarios, taking samples, modeling normal behavior, and analyzing internal network traffic or behavior on terminal servers, anomalies can be detected early. Internal scenario mainly refers to the access behavior scenario from "subject" to "object", the subject is a person or an application, and the object is an application or data. The factors included in the scenario are 5W (Who, When, Where, What, How). Common abnormal scenarios include: abnormal login behavior, including abnormal time, frequent login failures, etc.; business violations, including high-frequency business access, business circumvention, etc. Power grid external threat intelligence includes abnormal login behaviors and business violations, abnormal login behaviors include abnormal time and frequent login failure behaviors, and business violations include high-frequency business access and business detours.

External data is aimed at external attacks, mainly through obtaining threat intelligence, relying on a professional security analysis team, after comprehensive analysis, the intelligence disposal decision is formed, and the decision is executed through the network security device or the security software on the terminal to realize the prevention against advanced attacks. , the whole process can be performed automatically by the device. Threat intelligence generally includes reputation intelligence ("bad" URLs, IP addresses, domain names, etc.), attack intelligence (attack sources, attack tools, exploited vulnerabilities, methods taken, etc.). Security warning notices, vulnerability notices, threat notices, etc. can usually be obtained from security service vendors, CERTs, antivirus vendors, government agencies, and security organizations, which are typical security threat intelligence.

The attack information feature extraction storage layer is used to extract the operation features of the current power grid attack intelligence, and realize the extraction and recording of the attack feature information;

The data analysis layer is used to achieve efficient integration, calculation and analysis of collected data;

The decision-making layer is used to realize timely early warning of information network risks.

Specifically, the attack information feature extraction storage layer is based on the power grid attack intelligence of the power grid big data storage module, combined with the topology, operation status and historical data of the current power system to determine key sections, and uses a combination of main features, auxiliary features and numerical features. The method comprehensively extracts the attack feature information of the current power grid, and the attack feature information includes SNMPThreat, RPC Threat, FTP Threat, HTTP Threat, TELNET Threat and DNS Threat.

Attack information feature extraction The storage layer obtains the attack information features and stores them by itself. If such an attack is encountered again in the future, it can match the attack information features quickly, and then quickly give an early warning.

The data analysis layer includes an integration module, a calculation module and an analysis module. The integration module is used for data integration of the big data collection layer, that is, data extraction, data conversion and data cleaning, and the calculation module is used to process the integrated data. Batch data processing and stream data processing, the analysis module is used to analyze the calculated data.

The analysis module includes the analysis library module and the early warning model. The analysis library module is used to provide the analysis model. The early warning model realizes the active risk early warning management of power information according to the analysis model. Early warning model and graded early warning model.

The early warning model includes an infrastructure evaluation model, a real-time reliability model, and a historical operation evaluation model. The infrastructure evaluation model obtains the information network topology structure through topology discovery technology, and then evaluates the importance of all infrastructures in the topology structure and collects them. Monitor metrics. The infrastructure includes host equipment, network equipment, security equipment, storage equipment, database, and middleware.

Real-time reliability model Based on the real-time monitoring indicators of the main pages of the information system, and whether the page has a response and the response time, a real-time reliability evaluation model of the information system is designed. The information system reliability evaluation is based on the detection results of the active detection system. The active detection system detects the information system and its main pages according to 5min/time disclosure, and the feedback results are whether the target page has a response and the page response time of the target system;

The historical operation evaluation model is based on the historical operation of the information system and is used for the number and severity of historical alarms.

The state early warning model includes hardware, software, basic support resources, virtual resources, etc., and is the basic component of the power information network. All information resources are probed every once in a while (usually 30s to 5min), and their status is judged according to whether the relevant resources respond, mainly including the following three categories:

1) Normal state: every time the information resource is detected, it responds;

2) Disconnected state: no response for 3 consecutive detections, and a timely alarm is required;

3) Unstable state: between the normal state and the disconnected state, there is no response to multiple detections, but the condition of the disconnected state is not reached, and a risk warning is required.

The hardware may include: PC servers, blade machines, minicomputers, industrial computers, dedicated servers, disk arrays, tape libraries, optical disc libraries, routers, switches, load balancers, hubs, wireless access devices, protocol converters, storage Optical switch, network circuit, data transfer channel interface, firewall, anti-virus gateway equipment, intrusion monitoring equipment, intrusion prevention equipment, traffic monitoring equipment, vulnerability scanning equipment, VPN equipment, network isolation equipment, other security equipment, desktop, handheld Terminals, notebook computers, workstations, tablet computers, dedicated terminals, cloud terminals, printers, digital plotters, copiers, fax machines, photocopiers, scanners, projectors, screen devices, monitors, mice, keyboards, speakers, mobile Storage, other external devices, memory, CPU, disks, network cards, HBA cards, UPS batteries, ports, logical CPUs, file systems, installed software, critical processes, storage volumes, physical VLANs, links, routing, etc.

Software can include: business system, database, operating system, middleware, cluster software, storage backup software, operation and maintenance management software, tool software, office automation software, mail server software, Web server software, FTP server software, other basic software, Database replication software, etc.

Basic support resources can include:

VLAN, IP, domain name, firewall policy, power load, load balancing policy, account permissions, cabinet space, computer room space, patch panel ports, computer room, material warehouse, office space, etc.

Virtual resources can include: resource groups, resource pools, and virtual hosts.

The threshold early warning model is used to make early warning threshold judgments. The traditional operating thresholds of information resources are manually set by unified standards or operation and maintenance personnel based on experience. If the detection indicators are within the threshold range, the information resources are considered to be in a normal state; otherwise, if the detection If the indicator exceeds the threshold range, it is considered that the monitoring object meets the early warning conditions, and an early warning event is generated. With the dynamic expansion of the information network, the artificially set fixed thresholds can easily be inconsistent with the actual situation, resulting in false early warning and no early warning. The threshold early warning method is based on big data technology. Through effective analysis of historical data, the normal operating range of information resource indicators is obtained, and the threshold is set adaptively according to the analysis results. The specific algorithm is as follows:

Among them, T _0max and T _0min are the initial values of the upper threshold and the lower threshold, respectively, t is the current date, h is the current time, m is the number of days, and n is the number of hours. According to the above algorithm, the index threshold T of the information resource is between the upper threshold T _max and the lower threshold T _min . The upper and lower thresholds are calculated based on the manually set initial thresholds and recent operating data of information resources to ensure that they are consistent with the actual situation. At the same time, information network managers can adjust the threshold of information resource indicators through the weight K to make up for the deficiencies of the system.

The fast-changing early warning model is used for early warning of abnormal mutations. Some information network failures will cause abnormal mutations in information resource indicators, but such mutations are within the normal threshold range, and conventional early warning methods are difficult to identify. Rapid-change early warning includes two methods: horizontal early warning and vertical early warning. Early warning is carried out by identifying abnormal changes in information resource indicators. Horizontal early warning refers to the early warning formed by comparing with similar information resources. If a certain information resource is too different from other information resource indicators in the same environment, early warning is required. The specific algorithm is as follows:

Among them, S _i represents the load of the i-th device, and α is the fast-changing threshold configured by the user; the algorithm determines whether the device needs to be warned by calculating the difference between the load of a device and the average load of the entire cluster.

Vertical early warning refers to the early warning formed by comparing with its own historical data. It is mainly based on big data statistical analysis technology, mining and analyzing historical data, and applying the analysis results to the information network risk early warning model. Through data cleaning of the historical operating data of the indicator, outliers are eliminated, and then the historical data is statistically analyzed to determine its maximum, minimum and average values to determine the reasonable operating range of the indicator. The vertical early warning algorithm is as follows:

Among them, R _max and R _min are the maximum and minimum values of historical operating data after data cleaning, respectively, A is the average value of historical data, and L represents the reasonable operating range of the indicator.

The evaluation and early warning model is used to realize the evaluation of the infrastructure, based on the evaluation of the indicators, to realize the evaluation of the infrastructure; based on the evaluation of the infrastructure, to analyze the topology of the information network to realize the evaluation of the infrastructure of the information network; to actively detect the indicators , including whether there is a response on the system page and the response time index, to realize the reliability evaluation of the information system; based on the evaluation of the infrastructure of the information system and the reliability of the information system, to realize the risk assessment and early warning of the information network. The evaluation and early warning algorithm is as follows:

Based on the initial score S ₀ set by the user, the number m/n/p, weight α and deduction value f of each level of information network events, the final evaluation score S of the information resource can be obtained, and risk early warning can be carried out according to the score.

The hierarchical early warning model divides early warning events into index level, infrastructure level and information network level. The most basic early warning events are all at the indicator level; if an early warning occurs on multiple indicators of a certain infrastructure, the related early warning events will be merged into one infrastructure-level early warning event; , the related early warning events are grouped into an information network-level early warning event. The classification strategy of early warning events can assist managers to identify the importance of different early warning events and respond effectively to them.

Therefore, the power grid information security early warning system based on data feature extraction realizes comprehensive awareness of the power information network operation situation, real-time early warning of operation risks and timely disposal of early warning events. Real-time assessment of the security situation of the network through all available information provides a basis for network security administrators' decision-making and analysis, and minimizes the risks and losses caused by unsafe factors. The model is of great significance in improving the network monitoring ability, emergency response ability and predicting the development trend of network security. It provides a strong guarantee for the information security of power, communication and other systems, and has good application effects.

Finally, it should be noted that the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, for those skilled in the art, the The technical solutions described in the foregoing embodiments may be modified, or some technical features thereof may be equivalently replaced. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the scope of protection of the claims of the present invention.

Claims (10)

1. The utility model provides a power grid information safety early warning system based on data characteristic draws which characterized in that includes: the system comprises a big data acquisition layer, an attack information characteristic extraction storage layer, a data analysis layer and a decision layer;

the big data acquisition layer acquires infrastructure operation data, information system operation data and information network operation data in real time and synchronously acquires internal data and external data;

the attack information characteristic extraction storage layer is used for extracting the operation characteristics of the current power grid attack information and realizing the extraction and recording of attack characteristic information;

the data analysis layer is used for realizing efficient integration, calculation and analysis of collected data;

and the decision layer is used for realizing the timely early warning of the information network risk.

2. The power grid information safety early warning system based on data feature extraction as claimed in claim 1, wherein: the data analysis layer comprises an integration module, a calculation module and an analysis module, wherein the integration module is used for integrating data of the big data acquisition layer, namely performing data extraction, data conversion and data cleaning, the calculation module is used for processing batch data processing and stream data processing on the integrated data, and the analysis module is used for analyzing the calculated data.

3. The power grid information safety early warning system based on data feature extraction as claimed in claim 2, wherein: the analysis module comprises an analysis base module and an early warning model, the analysis base module is used for providing an analysis model, the early warning model realizes active risk early warning management of electric power information according to the analysis model, and the analysis base module comprises a state early warning model, a threshold early warning model, a quick change early warning model, an evaluation early warning model and a grading early warning model.

4. The power grid information safety early warning system based on data feature extraction as claimed in claim 3, wherein: the early warning model comprises a basic framework evaluation model, a real-time reliability model and a historical operation evaluation model, wherein the basic framework evaluation model obtains an information network topology framework through a topology discovery technology, then performs importance evaluation on all infrastructure in the topology framework and acquires monitoring indexes of the infrastructure; the real-time reliability model monitors the real-time monitoring index of the main page of the information system and monitors the page response and the response duration; the historical operation evaluation model is based on the historical operation condition of the information system and is used for the historical alarm quantity and the historical alarm level.

5. The power grid information safety early warning system based on data feature extraction as claimed in claim 3, wherein: the state early warning model comprises hardware, software, basic supporting resources and virtual resources and is used for detecting all information resources once every a period of time and judging the states of the information resources.

6. The power grid information safety early warning system based on data feature extraction as claimed in claim 3, wherein: the threshold early warning model is used for judging an early warning threshold, and the algorithm is as follows:

T∈[T_min，T_max]

wherein, T_0maxAnd T_0minAre initial values of an upper threshold and a lower threshold respectively, t is the current date, h is the current time, m is the number of days, and n is the number of hours. According to the algorithm, the index threshold T of the information resource is the upper threshold T_maxAnd a lower threshold T_minIn the meantime.

7. The power grid information safety early warning system based on data feature extraction as claimed in claim 3, wherein: the quick change early warning model is used for early warning abnormal sudden change, and the algorithm is as follows:

wherein S is_iRepresenting the load of the ith equipment, and alpha is a fast-changing threshold value configured by a user;

wherein R is_maxAnd R_minThe data are respectively the maximum value and the minimum value of historical operating data after data cleaning, A is the average value of the historical data, and L represents the reasonable operating range of the index.

8. The power grid information safety early warning system based on data feature extraction as claimed in claim 3, wherein: the evaluation early warning model is used for realizing the evaluation of infrastructure, and the evaluation early warning algorithm is as follows:

initial score S based on user-defined setting₀And obtaining the final evaluation score S of the information resources according to the number m/n/p, the weight alpha and the deduction value f of the information network events at each level, and carrying out risk early warning according to the score.

9. The power grid information safety early warning system based on data feature extraction as claimed in claim 3, wherein: the hierarchical early warning model is used for dividing early warning events into an index level, an infrastructure level and an information network level.

10. The power grid information safety early warning system based on data feature extraction as claimed in claim 6, wherein: the decision layer comprises a resource management module, a risk early warning module and a decision analysis module.

Images