CN116132161B - A threat analysis and assessment method for power monitoring system - Google Patents

Abstract

The present invention is a threat analysis and assessment method for an electric power monitoring system, which is characterized in that the method includes the calculation of the weight of security feature parameters based on absolute correlation, the calculation of the risk of security feature parameters based on three dimensions of information security, and the calculation of the comprehensive threat assessment value of the electric power monitoring system. The method first summarizes the collected security feature parameters and uses them as the basis for threat analysis and assessment, establishes an observation matrix using security feature parameters, calculates the weight of security feature parameters using absolute correlation, and then uses CIA triples as analysis tuples to complete the calculation of the risk of security feature parameters of the electric power monitoring system. Finally, the calculated global impact weight of the security feature parameters and the risk assessment value caused by the attack in the three dimensions of CIA are used to obtain the comprehensive threat assessment value of the electric power monitoring system, and update it in real time. It has the advantages of scientific and reasonable methods, strong applicability, and good effects.

Description

A threat analysis and assessment method for power monitoring system

Technical Field

The invention belongs to the technical field of network security and relates to a threat analysis and assessment method for an electric power monitoring system.

Background technique

In the prior art, the power monitoring system refers to intelligent equipment and systems that play a monitoring and control role in the process of power production and transmission, which are used to support the safe and stable operation of the power system and ensure the reliable supply of electricity. The functions of the power monitoring system include user management, data acquisition and processing, event recording, fault alarm, as well as telesignaling, remote control, and telemetry. With the increasingly widespread application of computer information technology in the power industry, the power monitoring system has inevitably become the target of various network attacks due to its vulnerability and importance. Therefore, it is an urgent problem to be solved in this field to conduct threat analysis and assessment on the power monitoring system, improve the security of the power system, and ensure stable power supply. The current threat analysis and assessment methods for power monitoring systems mainly have the following problems:

(1) Existing threat analysis methods require real-time scanning of system resources such as system logs, which may cause device overload;

(2) Existing threat analysis methods may accidentally cut out useful information when uniformly formatting multi-source heterogeneous data;

(3) Due to the complexity of the power monitoring system itself, the system may have a delayed response to some attacks, which is unacceptable for some devices with high real-time requirements.

Summary of the invention

The purpose of the present invention is to overcome the deficiencies of the prior art and provide a threat analysis and assessment method for an electric power monitoring system, which can assess the degree and scope of impact of an attack on a target and can be optimized in terms of real-time performance and reliability.

The objective of the present invention is to be optimized and realized by the following technical scheme: a threat analysis and assessment method for an electric power monitoring system, characterized in that the method comprises: calculation of security feature parameter weights based on absolute correlation, calculation of security feature parameter risks based on three dimensions of information security, and calculation of a comprehensive threat assessment value of an electric power monitoring system.

Furthermore, the calculation of the security feature parameter weight based on the absolute correlation is to calculate the impact value of the security feature parameter in the global network, summarize the collected security feature parameters, and use them as the basis for threat analysis and assessment. The observation matrix is established using the security feature parameters. Suppose there are m security feature parameters in total, and the m security feature parameters include system log analysis, attack alarm information, equipment anomaly analysis and comprehensive risk analysis. The established observation matrix A is expressed as:

The i-th column of matrix A, i=1,2,...,m, represents the impact value of the i-th safety feature parameter at time t, t=1,2,...,T. In order to make the data sets more comparable, the element x _i (t) of matrix A is initialized according to formula (2) to obtain x _i ′(t):

Wherein, _xi (t) is the influence value of the ith safety feature parameter at time t, and _xi (1) is the influence value of the ith safety feature parameter at time t=1, which is the first row element of matrix A. Thus, the initialized matrix A′ is obtained:

Based on the matrix A′, the correlation coefficient of each sub-item is calculated and the correlation matrix is constructed. In the matrix A′, the first column is the reference sequence, that is, X ₁ ={x ₁ ′(1),x ₁ ′(2),...,x ₁ ′(T)}={1,x ₁ ′(2),...,x _{1 ′} (T)}, and the remaining columns are the comparison sequences, that is, _Xi ={ _xi ′(1),xi _′ (2),...,xi ′(T)}={1, _xi ′(2),..., _xi ′(T)}, i=2,3,...,m. The reference sequence is subtracted once to generate Δx ₁ (t) and the comparison sequence is subtracted once to generate _Δxi (t) according to formulas (4) and (5):

Δx ₁ (t) = x ₁ ′(t) - x ₁ ′(t-1), t = 2, 3, ..., T (4)

_Δxi (t)＝ _xi ′(t)-xi _′ (t-1),i＝2,3,...,m；t＝2,3,...,T (5)

Then calculate the correlation coefficient γ _i (t):

This gives the correlation matrix R:

From formulas (8), (9) and (10), we can get any two safety feature parameters: and/> The correlation between

Thus, the new incidence matrix R′ is obtained:

The matrix R′ is an m×m non-negative symmetric matrix. Assume that the matrix R′ has a maximum eigenvalue λ _max and an eigenvector P such that λ _max P＝R′P, P＝[ω ₁ ,ω ₂ ,...,ω _m ] ^T , where ω _i represents the global impact weight of the i-th security feature parameter, i＝1,2,...,m, and the calculation of the global impact weights of the m security feature parameters on the network is completed accordingly.

Furthermore, the calculation of the security characteristic parameter risk based on the three dimensions of information security is to realize the calculation of the security characteristic parameter risk value of the power monitoring system when responding to attacks. The CIA triplet, namely: confidentiality, integrity, and availability, is used as the analysis tuple, and the importance of the elements a ₁ , a ₂ , ..., a _n in the lower layer propagation level tuple is compared, as shown in formula (12):

Among them, u _jk , v _jk and w _jk represent the results of the elements of confidentiality, integrity and availability after importance comparison, thereby obtaining the confidentiality fuzzy matrix M _C , the integrity fuzzy matrix M _I and the availability fuzzy matrix _MA respectively:

Determine whether the matrix satisfies fuzzy consistency. If the matrix is a fuzzy inconsistent matrix, adjust it to a fuzzy consistent matrix. According to the determination principle of the fuzzy consistent matrix, the difference between the corresponding elements of two rows in the matrix is a constant. Then, the fuzzy consistent matrix is:

Wherein, u _fg ,u _fh ,u _gh ∈M _c ,v _fg ,v _fh ,v _gh ∈M _I ,w _fg ,w _fh ,w _gh ∈M _A ,f＝1,2,···,n，g＝1,2,···,n，h＝1,2,···,n，f≠g≠h, and the matrix is unified according to formula (17):

Among them, u′ _fg , v′ _fg and w′ _fg represent the results of unifying the elements in the fuzzy matrices M _C , M _I and _MA in the three dimensions of confidentiality, integrity and availability respectively;

Calculate the threat assessment index of the attack in the three dimensions of CIA:

After calculating the threat evaluation indexes of different dimensions, the risk assessment values f _C , f _I and f _A caused by the attack in the three dimensions of CIA are calculated as follows:

Among them, the value of function T(x) increases with the increase of the number of attacks x, and its expression is defined as:

Based on this, the calculation of the safety characteristic parameter risks of the power monitoring system is completed.

Furthermore, the calculation of the comprehensive threat assessment value of the power monitoring system is to use the calculated global impact weights ω _i of the m security feature parameters, i=1, 2, ..., m, and the risk assessment values f _C , f _I and f _A caused by the attack in the three dimensions of CIA, and finally obtain the comprehensive threat assessment value CT of the power monitoring system, and update it in real time. The calculation method is shown in formula (21):

Wherein, x _i (t) is the impact value of the i-th security feature parameter at time t, ω _i represents the global impact weight of the i-th security feature parameter, i=1,2,...,m, f _C , f _I and f _A are the risk assessment values caused by the attack in the three dimensions of CIA respectively, and α, β and χ are used to measure the weights of f _C , f _I and f _A respectively.

The threat analysis and assessment method for the electric power monitoring system of the present invention first summarizes the collected security feature parameters and uses them as the basis for threat analysis and assessment, establishes an observation matrix using the security feature parameters, calculates the weights of the security feature parameters using the absolute correlation, and then uses the CIA triple as the analysis tuple to complete the calculation of the risk of the security feature parameters of the electric power monitoring system. Finally, the global impact weight of the calculated security feature parameters and the risk assessment value caused by the attack in the three dimensions of CIA are used to obtain the comprehensive threat assessment value of the electric power monitoring system and update it in real time. It can evaluate the degree and scope of the impact of the attack on the target, and can optimize in terms of real-time performance and reliability. It has the advantages of scientific and reasonable methods, strong applicability, and good effects.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of a threat analysis and assessment method for a power monitoring system according to the present invention.

Detailed ways

The present invention will be further described below using the accompanying drawings and specific implementation methods.

1, a threat analysis and assessment method for a power monitoring system proposed in the present invention includes: calculation of security feature parameter weights based on absolute correlation, calculation of security feature parameter risks based on three dimensions of information security, and calculation of a comprehensive threat assessment value of a power monitoring system, and the specific contents are as follows:

1) Calculation of security feature parameter weights based on absolute correlation

In order to calculate the impact value of security feature parameters in the global network, the collected security feature parameters are summarized and used as the basis for threat analysis and assessment. The observation matrix is established using the security feature parameters. Suppose there are m security feature parameters in total, which include system log analysis, attack alarm information, device anomaly analysis and comprehensive risk analysis. The established observation matrix A is expressed as:

The i-th column of matrix A, i=1,2,...,m, represents the impact value of the i-th safety feature parameter at time t, t=1,2,...,T. In order to make the data sets more comparable, the element x _i (t) of matrix A is initialized according to formula (2) to obtain x _i ′(t):

Wherein, _xi (t) is the influence value of the ith safety feature parameter at time t, and _xi (1) is the influence value of the ith safety feature parameter at time t=1, which is the first row element of matrix A. Thus, the initialized matrix A′ is obtained:

Based on the matrix A′, the correlation coefficient of each sub-item is calculated and the correlation matrix is constructed. In the matrix A′, the first column is the reference sequence, that is, X ₁ ={x ₁ ′(1), x ₁ ′(2), ..., x ₁ ′(T)} ={1, x ₁ ′(2), ..., x ₁ ′(T)}, and the remaining columns are the comparison sequences, that is, _Xi ={ _xi ′(1),xi _′ (2), ...,xi _′ (T)} ={1, _xi ′(2), ..., _xi ′(T)}, i = 2, 3, ..., m. The reference sequence is subtracted once to generate Δx ₁ (t) and the comparison sequence is subtracted once to generate Δx _i (t) according to formulas (4) and (5):

Δx ₁ (t) = x ₁ ′(t) - x ₁ ′(t-1), t = 2, 3, ..., T (4)

_Δxi (t)＝ _xi ′(t)-xi _′ (t-1),i＝2,3,...,m；t＝2,3,...,T (5)

Then calculate the correlation coefficient γ _i (t):

This gives the correlation matrix R:

Any two safety feature parameters can be obtained from formulas (8), (9) and (10): and/> The correlation between

Thus, the new incidence matrix R′ is obtained:

The matrix R′ is an m×m non-negative symmetric matrix. Assume that the matrix R′ has a maximum eigenvalue λ _max and an eigenvector P such that λ _max P＝R′P, P＝[ω ₁ ,ω ₂ ,...,ω _m ] ^T , where ω _i represents the global impact weight of the i-th security feature parameter, i＝1,2,...,m, and the global impact weight of the m security feature parameters on the network is calculated accordingly;

2) Calculation of security characteristic parameter risks based on the three dimensions of information security

In order to calculate the risk value of security characteristic parameters of the power monitoring system when responding to attacks, the CIA triplet, namely, confidentiality, integrity, and availability, is used as the analysis tuple, and the importance of the elements a ₁ , a ₂ , ..., a _n in the lower propagation level tuple is compared, as shown in formula (12):

Among them, u _jk , v _jk and w _jk represent the results of the elements of confidentiality, integrity and availability after importance comparison, thereby obtaining the confidentiality fuzzy matrix M _C , the integrity fuzzy matrix M _I and the availability fuzzy matrix _MA respectively:

Determine whether the matrix satisfies fuzzy consistency. If the matrix is a fuzzy inconsistent matrix, adjust it to a fuzzy consistent matrix. According to the determination principle of the fuzzy consistent matrix, the difference between the corresponding elements of two rows in the matrix is a constant. Then, the fuzzy consistent matrix is:

Wherein, u _fg ,u _fh ,u _gh ∈M _c ,v _fg ,v _fh ,v _gh ∈M _I ,w _fg ,w _fh ,w _gh ∈M _A ,f＝1,2,···,n，g＝1,2,···,n，h＝1,2,···,n，f≠g≠h, and the matrix is unified according to formula (17):

Among them, u′ _fg , v′ _fg and w′ _fg represent the results of unifying the elements in the fuzzy matrices M _C , M _I and _MA in the three dimensions of confidentiality, integrity and availability respectively;

Calculate the threat assessment index of the attack in the three dimensions of CIA:

After calculating the threat evaluation indexes of different dimensions, the risk assessment values f _C , f _I and f _A caused by the attack in the three dimensions of CIA are calculated as follows:

Among them, the value of function T(x) increases with the increase of the number of attacks x, and its expression is defined as:

Based on this, the calculation of the safety characteristic parameter risk of the power monitoring system is completed;

3) Calculation of comprehensive threat assessment value of power monitoring system

Using the calculated global impact weights ω _i of the m security feature parameters, i = 1, 2, ..., m, and the risk assessment values f _C , f _I and f _A caused by the attack in the three dimensions of CIA, the comprehensive threat assessment value CT of the power monitoring system is finally obtained and updated in real time. The calculation method is shown in formula (21):

Wherein, x _i (t) is the impact value of the i-th security feature parameter at time t, ω _i represents the global impact weight of the i-th security feature parameter, i=1,2,...,m, f _C , f _I and f _A are the risk assessment values caused by the attack in the three dimensions of CIA respectively, and α, β and χ are used to measure the weights of f _C , f _I and f _A respectively.

The software program used in the present invention is compiled based on automation, network and computer processing technologies, which are technologies familiar to those skilled in the art.

The specific implementation methods of the present invention are not exhaustive and do not constitute a limitation on the scope of protection of the claims. Based on the inspiration obtained from the embodiments of the present invention, those skilled in the art can think of other substantially equivalent alternatives without creative work, all of which are within the scope of protection of the present invention.

Claims (1)

1. A threat analysis and evaluation method for an electric power monitoring system is characterized in that: the method comprises the steps of calculating safety characteristic parameter weights based on absolute association, calculating safety characteristic parameter risks based on three dimensions of information safety and calculating comprehensive threat assessment values of a power monitoring system;

the calculation of the security feature parameter weight based on the absolute association degree is to calculate the influence value of the security feature parameter in the network global, collect the collected security feature parameter, use the security feature parameter to establish an observation matrix as the basis of threat analysis and evaluation, and set m security feature parameters in total, wherein the m security feature parameters comprise system log analysis, attack alarm information, equipment abnormality analysis and comprehensive risk analysis, and the established observation matrix A is expressed as:

wherein, the ith column, i of matrix AThe values of the influence of the ith safety feature parameter at T, t=1, 2,.. _i (t) performing initial value operation according to the formula (2) to obtain x _i ′(t)：

Wherein x is _i (t) is the influence value, x of the ith safety feature parameter at the time t _i (1) For the impact value of the ith security feature parameter at time t=1, i.e. the first row element of matrix a, an initialized matrix a' is thus obtained:

calculating the association coefficient of each sub-item based on a matrix A 'and forming an association matrix, wherein the first column in the matrix A' is a reference sequence, namely X ₁ ＝{x ₁ ′(1),x ₁ ′(2),...,x ₁ ′(T)}＝{1,x ₁ ′(2),...,x ₁ 'T', the remaining columns being comparison sequences, X _i ＝{x _i ′(1),x _i ′(2),...,x _i ′(T)}＝{1,x _i ′(2),...,x _i ' s (T) }, i=2, 3,..m, generating Deltax by one time subtracting the reference sequence by the formulas (4), (5) ₁ (t) one subtraction of the comparison sequence to yield Δx _i (t)：

Δx ₁ (t)＝x ₁ ′(t)-x ₁ ′(t-1)，t＝2,3,....,T (4)

Δx _i (t)＝x _i ′(t)-x _i ′(t-1),i＝2,3,...,m；t＝2,3,...,T (5)

Then calculate the association coefficient gamma _i (t)：

Thereby obtaining an association matrix R:

obtaining any two safety characteristic parameters according to formulas (8), (9) and (10)And->Correlation between->

Thereby obtaining a new association matrix R':

the matrix R 'is a non-negative symmetric matrix of m x m, provided that the matrix R' has a maximum eigenvalue lambda _max And there is a feature vector P such that lambda _max P＝R′P,P＝[ω ₁ ,ω ₂ ,...,ω _m ] ^T Wherein ω is _i Representing the security feature parameter of item iGlobal impact weight, i=1, 2,..m, accordingly, the calculation of the global influence weight of the m security feature parameters on the network is completed;

the calculation of the security feature parameter risk based on information security three dimensions is the calculation of the security feature parameter risk value of the power monitoring system when the power monitoring system is in response to attack, and CIA triples are used, namely: confidentiality (importance), integrity (Integrity), availability (Availability) as analysis tuples, for element a in the underlying propagation hierarchy tuple ₁ ,a ₂ ,...,a _n The importance comparison is carried out as shown in a specific formula (12):

wherein u is _jk 、v _jk And w _jk The confidentiality fuzzy matrix M can be obtained by comparing the results of the elements with three dimensions of confidentiality, integrity and availability _C Integrity fuzzy matrix M _I And availability ambiguity matrix M _A ：

Judging whether the matrix meets the fuzzy consistency, if the matrix is a fuzzy inconsistent matrix, adjusting the matrix into the fuzzy consistency matrix, and designating the difference between two rows of corresponding elements in the matrix as a constant according to the judging principle of the fuzzy consistency matrix, wherein the fuzzy consistency matrix is as follows:

wherein u is _fg ,u _fh ,u _gh ∈M _c ，v _fg ,v _fh ,v _gh ∈M _I ，w _fg ,w _fh ,w _gh ∈M _A F=1, 2, ··, n, g=1, 2, the terms, n, h=1, 2, n, f +.g +.h, the matrix is normalized according to equation (17):

wherein u' _fg 、v′ _fg And w' _fg Respectively represent the fuzzy matrix M in three dimensions of confidentiality, integrity and availability _C 、M _I And M _A A result of the element unification processing;

calculating threat assessment index of attack in CIA three dimensions:

after threat evaluation indexes of different dimensions are calculated, attack is performed on risk evaluation values f respectively caused by CIA three-dimensions _C 、f _I And f _A The calculation formula is as follows:

wherein the value of the function T (x) increases with the number of attacks x, and the expression is defined as:

the calculation of the safety characteristic parameter risk of the power monitoring system is completed according to the risk;

the calculation of the comprehensive threat assessment value of the power monitoring system is to utilize the global influence weight omega of m security feature parameters obtained by calculation _i I=1, 2,..m, and risk assessment value f by attack on CIA three-dimension, respectively _C 、f _I And f _A Finally, the comprehensive threat assessment value CT of the power monitoring system is obtained and updated in real time, and the calculation method is shown as a formula (21):

wherein x is _i (t) is the influence value, omega, of the ith safety feature parameter at the time t _i Global impact weight representing the i-th security feature parameter, i=1, 2,.. _C 、f _I And f _A Is a risk evaluation value respectively caused by attacks in CIA three-dimension, and alpha, beta and χ are respectively used for measuring f _C 、f _I And f _A Is a weight of (2).