WO2022242181A1 - 一种智能变电站分层健康度指数评估方法及装置 - Google Patents

一种智能变电站分层健康度指数评估方法及装置 Download PDF

Info

Publication number
WO2022242181A1
WO2022242181A1 PCT/CN2021/142285 CN2021142285W WO2022242181A1 WO 2022242181 A1 WO2022242181 A1 WO 2022242181A1 CN 2021142285 W CN2021142285 W CN 2021142285W WO 2022242181 A1 WO2022242181 A1 WO 2022242181A1
Authority
WO
WIPO (PCT)
Prior art keywords
health index
layer
weight
equipment
information
Prior art date
Application number
PCT/CN2021/142285
Other languages
English (en)
French (fr)
Inventor
王文婷
徐征
刘鑫
耿玉杰
聂其贵
林琳
刘京
吕国栋
赵洋
任天成
赵晓红
Original Assignee
国网山东省电力公司电力科学研究院
国家电网有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 国网山东省电力公司电力科学研究院, 国家电网有限公司 filed Critical 国网山东省电力公司电力科学研究院
Priority to US17/765,055 priority Critical patent/US11954210B2/en
Publication of WO2022242181A1 publication Critical patent/WO2022242181A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
    • G06Q10/063—Operations research, analysis or management
    • G06Q10/0639—Performance analysis of employees; Performance analysis of enterprise or organisation operations
    • G06Q10/06393—Score-carding, benchmarking or key performance indicator [KPI] analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q50/00—Systems or methods specially adapted for specific business sectors, e.g. utilities or tourism
    • G06Q50/06—Electricity, gas or water supply
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/50—Testing arrangements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/18—Protocol analysers
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S10/00—Systems supporting electrical power generation, transmission or distribution
    • Y04S10/50—Systems or methods supporting the power network operation or management, involving a certain degree of interaction with the load-side end user applications

Definitions

  • the present application relates to the field of electrical technology, in particular to a method and device for evaluating a hierarchical health index of a smart substation.
  • the method includes:
  • the whole station health index of the smart substation is obtained
  • the smart substation is regulated according to the whole station health index of each smart substation equipment, the level health index of each layer and the whole station health index.
  • the step of obtaining the device association according to the communication connection relationship between the device and other devices, and correcting the basic health index of the device according to the device association, and obtaining the health index of the device include:
  • IP address and MAC address information of the data packet add other devices to the associated device list of the device, and the device is also added to the associated device list of other devices;
  • the basic health index of the equipment is corrected to obtain the health index of the equipment.
  • the step of obtaining the hierarchical health index of a layer according to the health index and the importance weight of the equipment in a layer includes:
  • the product of the health index of each device in the layer and the weight ratio of the importance of the device is summed to obtain the layer health index of the layer.
  • the layer health index is used as the basic health of the layer Index, which modifies the basic health index of the level, including:
  • CH i represents the modified hierarchical health index of the i-th layer
  • BCH i represents the hierarchical basic health index of the i-th layer
  • i is a positive integer
  • ⁇ l represents the correction strength of the hierarchical correlation
  • ⁇ w j represents the j-th layer
  • the step of obtaining the whole station health index of the smart substation according to the sum of the hierarchical health index of each layer and the equipment importance weight of each layer includes:
  • the weighted sum of the hierarchical health index and the hierarchical weight of each layer is obtained to obtain the whole station health index of the smart substation.
  • the step of obtaining the basic health index of the device according to the static information and dynamic information of the device includes:
  • the vulnerability scanning method the configuration verification method and the fuzzing test method, the static information of the device is identified, and the static information of the device is obtained;
  • the basic health index of the device is obtained.
  • the static information includes at least one of unfixed vulnerability information, wrong configuration parameter information, open high-risk port information, and open general network service information;
  • the dynamic information includes at least one of unknown connection information, unknown protocol information, malformed message information, and exploit information.
  • a smart substation hierarchical health index evaluation device is provided.
  • the device comprises:
  • the equipment basic health calculation module is used to obtain the basic health index of the equipment according to the static information and dynamic information of the equipment;
  • the device health calculation module is used to obtain the device relevance according to the communication connection relationship between the device and other devices, and correct the basic health index of the device according to the device correlation to obtain the health index of the device;
  • a hierarchical health degree calculation module configured to obtain the hierarchical health index of a stratified device according to the health index and the importance weight of the device in the stratified layer;
  • the whole station health calculation module is used to obtain the whole station health index of the smart substation according to the sum of the level health index of each layer and the equipment importance weight of each layer;
  • the global control module is used to control the intelligent substation according to the whole station health index of each smart substation equipment, the level health index of each layer and the whole station health index.
  • a computer device or a system composed of multiple computing devices includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:
  • the whole station health index of the smart substation is obtained.
  • a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:
  • the whole station health index of the smart substation is obtained.
  • the above-mentioned smart substation hierarchical health index evaluation method, device, computer equipment, and storage medium evaluate and present the network security status of the smart substation from three different levels: equipment, layering, and the whole station, so that the health of the whole station
  • the calculation is more comprehensive and accurate; the basic health index of the equipment is corrected by using the equipment correlation, which fully considers the influence of the spread of network security risks brought about by the equipment correlation on the system security, and ensures that the calculation of the equipment health is more accurate.
  • each smart substation equipment, layering and whole station health index, the continuous monitoring of the health status of the same smart substation and the horizontal comparison of the health index between different smart substations are realized, further realizing the global level of the smart substation system, Trendy health status perception, and finally adjust the smart substation according to the status perception results, so that the smart substation can operate safely and stably.
  • Fig. 1 is a schematic flow chart of a method for evaluating a smart substation hierarchical health index in an embodiment
  • Fig. 2 is a structural block diagram of a smart substation hierarchical health index evaluation device in an embodiment
  • Figure 3 is an internal block diagram of a computer device in one embodiment.
  • the embodiment of this application proposes a smart substation layered health index evaluation method.
  • the smart substation includes multiple layers, and each layer includes multiple devices.
  • the evaluation and presentation of the three different levels of the site makes the calculation of the health index of the whole site more comprehensive and accurate; the basic health index of the device is corrected by using the device correlation, which fully considers the network security risks caused by the device correlation
  • the impact of diffusion on system security ensures that the calculation of equipment health index is more accurate.
  • a method for evaluating the hierarchical health index of a smart substation including the following steps:
  • the static information refers to the vulnerability factors existing on the device, including: at least one of unfixed vulnerability information, wrong configuration parameter information, open high-risk port information, and open general network service information.
  • Dynamic information refers to abnormal behavior events that occur during the system operation of the device, including at least one of unknown connection information, unknown protocol information, malformed message information, and vulnerability utilization information.
  • the basic health index of the device is obtained by analyzing and calculating the static information and dynamic information of the device according to their weights.
  • the greater the value of the static information or the dynamic information the lower the basic health index of the device.
  • device association refers to the existence of communication links and communication behaviors between devices. Device association can be exploited by attackers to launch attacks from a device to its associated devices. For devices, device association is a potential risk of the device, and it should be controlled as far as possible to only associate necessary devices and ensure the security of associated devices.
  • the health index of the device is affected by the health index of the managed device. Therefore, by associating the health index of the device, the basic health index of the device is corrected to obtain a more accurate health index of the device.
  • the importance weight of the equipment is obtained according to the importance of the equipment in each layer of the smart substation, and the weighted average of the health index of the equipment in each layer can be obtained.
  • Stratified Hierarchy Health Index is obtained according to the importance of the equipment in each layer of the smart substation, and the weighted average of the health index of the equipment in each layer.
  • the hierarchical health index is weighted and averaged to obtain the whole station health index.
  • S150 Regulate the smart substation according to the whole station health index of each smart substation equipment, the level health index of each layer and the whole station health index.
  • the network security status of the smart substation is evaluated and presented from three different levels: equipment, layer and whole station, so that the calculation result of the health index of the whole station is more comprehensive and accurate; use the device association to correct the basic health index of the device, fully consider the impact of the spread of network security risks brought about by device association on system security, and ensure that the calculation of the device health index is more accurate.
  • each smart substation equipment, layering and whole station health index, the continuous monitoring of the health status of the same smart substation and the horizontal comparison of the health index between different smart substations are realized, further realizing the global level of the smart substation system, Trendy health status perception, and finally adjust the smart substation according to the status perception results, so that the smart substation can operate safely and stably.
  • the step of obtaining the device relevance according to the communication connection relationship between the devices, and correcting the basic health index of the device according to the device correlation to obtain the health index of the device includes: obtaining the A data packet communicated between the device and other devices; according to the IP address and MAC address information of the data packet, add other devices to the associated device list of the device, and the device is also added to the associated device list of other devices;
  • the associated devices in the associated device list of the device are sorted from low to high according to the basic health index of the device, and the sorted associated devices are obtained; according to the number of associated devices in the associated device list, the association of the associated devices is determined
  • Weight according to the sorted basic health index and associated weight of the associated equipment, the basic health index of the device is corrected to obtain the health index of the device.
  • the device is also added to the associated device list of other devices, if If it already exists, it will not be added repeatedly. For example, when it is detected that device A 1 sends a data packet to device A 2 , device A 2 is added to the list of associated devices of device A 1 , and at the same time, device A 1 is added to the list of associated devices of device A 2 , and device A i 's associated device list with express, represents the jth associated device of device A i , and N i represents the number of associated devices of device A i . Considering that the frequency of communication between some devices is low, the device association identification process needs to be continuously carried out to continuously identify new device associations and update the corresponding associated device list.
  • the basic health index of the associated device After obtaining the basic health index of all devices in a layer, according to the device correlation, use the basic health index of the associated device to modify the basic health index of the device, specifically: use Indicates the basic health index of the jth associated device of device A i , where i and j are positive integers; according to the basic health index of the associated device, it is sorted from low to high, that is The formula for calculating the health index of device A i is as follows:
  • H i represents the health index of device A i
  • BH i is the basic health index of device A i
  • N i represents the number of associated devices of device A i
  • ⁇ a represents the strength of device correlation correction
  • a i represents the i-th equipment.
  • the device correlation correction strength ⁇ a can also be obtained through experience values.
  • the step of calculating the level health index of a layer according to the health index and the equipment importance weight of the equipment in the layer includes: obtaining the preset equipment importance weight; calculating each The proportion of the equipment importance weight of a device in the sum of the equipment importance weights of its layer is obtained, and the equipment importance weight ratio of each device is obtained; the health index of each device in the layer and the equipment importance The sum of the products of sex weight ratios is used to obtain the hierarchical health index of the stratum.
  • the equipment is divided into corresponding levels, A i,j represents the jth equipment of the i-th layer; according to the importance of the equipment, the equipment importance weight w corresponding to the equipment is obtained j , w j represents the device importance weight of the jth device; the formula for calculating the basic health index of the level is as follows:
  • BCH i is the hierarchical basic health index of the i-th layer
  • BCH 1 represents the basic health index of the station control layer
  • BCH 2 represents the basic health index of the interval layer
  • BCH 3 represents the basic health index of the process layer
  • NC i represents the basic health index of the first layer.
  • the number of devices on the i layer, NC 1 represents the number of devices on the station control layer
  • NC 2 represents the number of devices on the interval layer
  • NC 3 represents the number of devices on the process layer
  • H j represents the health index of the jth device
  • i and j are positive integer.
  • the smart substation is divided into three levels, namely the station control level, the interval level and the process level. In other embodiments, the smart substation can also be divided into other levels.
  • the level basic health index of the level may be directly used as the level health index of the level.
  • the layer health index is used as the basic health of the layer Index, modifying the basic health index of the layer, including: traversing all layers to obtain all devices A i,k of each layer, where A i,k represents the kth device of the i-th layer, and j is a positive integer; Calculate the level correction weight between the i-th layer and the j-th layer Will Initialize to 0, traverse all associated devices A i , k l of devices A i, k; wherein, associated device A i, k l represents the lth associated device of the kth device in the i-th layer; when associated device A i, k l belongs to the jth layer, and when i ⁇ j, Among them, w i, k l represent the equipment importance weight corresponding to the associated equipment A i, k l ;
  • CH i represents the corrected hierarchical health of the i-th layer
  • BCH i represents the hierarchical basic health index of the i-th layer
  • i is a positive integer
  • ⁇ l represents the correction strength of the hierarchical correlation.
  • the hierarchical correlation correction strength ⁇ l is divided into three levels of correction strength: low, medium and high.
  • ⁇ l 0 means low correction strength
  • ⁇ l 0.05 means medium correction strength
  • ⁇ l 0.1 means high correction strength.
  • the hierarchical correlation correction strength ⁇ l can also be obtained through experience.
  • the hierarchical basic health index is corrected according to the equipment correlation, so as to ensure that the calculation process of the hierarchical health index takes into account the linkage effect between different levels of the smart substation caused by the equipment correlation, so that the calculation result is more accurate.
  • the step of calculating the total station health index of the smart substation according to the sum of the hierarchical health index of each layer and the equipment importance weight of each layer includes: calculating each The sum of the device importance weights of all devices in a layer, according to the proportion of the sum of device importance weights of a layer in the sum of device importance weights of all layers, obtain the layer health index of the layer Hierarchical weight: The weighted summation of the hierarchical health index and the hierarchical weight of each layer is obtained to obtain the whole station health index of the smart substation.
  • the calculation formula of the whole station health index of the smart substation is as follows:
  • QH is the whole station health index of the smart substation
  • ⁇ w represents the sum of equipment importance weights of all devices at all levels
  • ⁇ w i represents the sum of equipment importance weights of all devices at the i-th layer
  • CH i represents the The level health index of level i.
  • i is a positive integer, and those skilled in the art can set the corresponding number of layers according to the layering needs.
  • the step of calculating the basic health index of the device according to the static information and dynamic information of the device includes: performing static information on the device according to the vulnerability scanning method, the configuration verification method and the fuzz testing method Identify and obtain the static information of the device; obtain the dynamic information of the device according to the intrusion detection technology method; obtain the preset static information weight of the device and the preset dynamic information weight of the device; according to the static information of the device, the dynamic information of the device information, static information weight, and dynamic information weight to calculate the basic health index of the device.
  • the devices running in the smart substation system are automatically identified to form a device set.
  • the weight corresponding to static information S i j is denoted by s i j , and the size of the weight is related to the risk and severity of the static information, and the higher the risk and severity of the static information, the greater the corresponding weight.
  • the dynamic information of the device is identified through intrusion detection technical means such as blacklist, whitelist and security baseline.
  • the weight corresponding to dynamic information D i j is denoted by d i j , and the size of the weight is related to the risk and severity of the dynamic information. The higher the risk and severity of the dynamic information, the greater the corresponding weight.
  • the basic health index calculation formula of the device is as follows:
  • BH i represents the basic health index of the equipment, Indicates the weight of static information, Indicates the weight of dynamic information, and The value range of is between 0 and 1, and The user can dynamically adjust the proportion of static information and dynamic information in the calculation of the basic equipment health index according to the actual evaluation needs; N i s represents the amount of static information of device A i , and S i j represents the jth item of device A i Static information, the corresponding weight of static information S i j is represented by s i j , N i d represents the number of dynamic information of device A i , D i j represents the jth dynamic information of device A i , and dynamic information D i j corresponds to weight d i j said.
  • the static information includes at least one of unfixed vulnerability information, wrong configuration parameter information, open high-risk port information, and open general network service information.
  • the dynamic information includes at least one of unknown connection information, unknown protocol information, malformed packet information, and exploit information.
  • steps in the flow chart of FIG. 1 are displayed sequentially as indicated by the arrows, these steps are not necessarily executed sequentially in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least some of the steps in FIG. 1 may include multiple steps or stages, and these steps or stages may not necessarily be executed at the same time, but may be executed at different times, and the execution sequence of these steps or stages may also be It is not necessarily performed sequentially, but may be performed alternately or alternately with other steps or at least a part of steps or stages in other steps.
  • a smart substation hierarchical health index evaluation device including: an equipment basic health index calculation module 210, an equipment health index calculation module 220, and a hierarchical health index calculation module 230 And the whole station health index calculation module 240, wherein:
  • the equipment basic health calculation module 210 is configured to calculate the basic health index of the equipment according to the static information and dynamic information of the equipment.
  • the device health calculation module 220 is configured to obtain the device relevance according to the communication connection relationship between the device and other devices, and modify the basic health index of the device according to the device correlation to obtain the device health index.
  • the layer health calculation module 230 is configured to calculate the layer health index of a layer according to the health index of the equipment in the layer and the importance weight of the equipment.
  • the whole station health calculation module 240 is used to obtain the whole station health index of the smart substation according to the sum of the level health index of each layer and the equipment importance weight of each layer.
  • the global regulation module 250 is configured to regulate the smart substation according to the whole station health index of each smart substation equipment, the level health index of each layer and the whole station health index.
  • the device health calculation module 220 includes: a data packet obtaining unit, configured to obtain data packets communicated between the device and other devices; an associated device list adding unit, configured to and MAC address information, add other devices to the list of associated devices of the device, and the device is also added to the list of associated devices of other devices; the sorting unit is used to sort the associated devices in the list of associated devices of the device, according to the The basic health index is sorted from low to high to obtain the sorted associated devices; the associated weight determination unit is used to determine the associated weight of the associated device according to the number of associated devices in the associated device list; the device health calculation unit , modify the basic health index of the device according to the sorted basic health index and the associated weight of the associated device to obtain the health index of the device.
  • the hierarchical health calculation module 230 includes: a device importance weight acquisition unit, configured to obtain a preset device importance weight; a proportion calculation unit, configured to calculate the device importance weight of each device in The ratio of the sum of the importance weights of the devices in the layer to obtain the weight ratio of the device importance of each device; the layer health calculation unit is used to compare the health index of each device in the layer The sum of the products of sex weight ratios is used to obtain the hierarchical health index of the stratum.
  • the smart substation hierarchical health index evaluation device further includes: a hierarchical health correction module, which is used to use the hierarchical health index obtained by the hierarchical health calculation module 230 as the basic health of the hierarchy Degree index, to modify the basic health index of the layer, including: traversing all layers, obtaining all devices A i,k of each layer, where A i,k represents the kth device of the i-th layer, and j is Positive integer; calculate the level correction weight between the i-th layer and the j-th layer Will Initialize to 0, and traverse all associated devices A i , k l of devices A i, k; wherein, associated device A i, k l represents the l-th associated device of the k-th device in the i-th layer, and l is a positive integer; when The associated device A i, k l belongs to the jth layer, and when i ⁇ j, Among them, w i, k l represent the equipment
  • CH i represents the modified hierarchical health index of the i-th layer
  • BCH i represents the hierarchical basic health index of the i-th layer
  • i is a positive integer
  • ⁇ l represents the correction strength of the hierarchical correlation
  • ⁇ w j represents the j-th layer
  • the whole station health degree calculation module 240 includes: a level weight calculation unit, which is used to calculate the sum of the equipment importance weights of all equipment in each level, according to the sum of the equipment importance weights of a level The proportion in the sum of the equipment importance weights of all layers is used to obtain the layer weight of the layer health index of the layer; the whole station health degree calculation unit is used to calculate the layer health index and layer weight of each layer The weighted summation is carried out to obtain the whole station health index of the smart substation.
  • the device basic health calculation module 210 includes: a static information acquisition unit, configured to identify the static information of the device according to the vulnerability scanning method, the configuration verification method and the fuzzing test method, and obtain the static information of the device;
  • the dynamic information acquisition unit is used to obtain the dynamic information of the device according to the intrusion detection technology;
  • the information weight acquisition unit is used to obtain the preset static information weight of the device and the preset dynamic information weight of the device;
  • the calculation of the basic health of the device A unit configured to calculate the basic health degree of the device according to the static information of the device, the dynamic information of the device, the weight of the static information and the weight of the dynamic information.
  • each module in the above smart substation layered health index evaluation device can be fully or partially realized by software, hardware and combinations thereof.
  • the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, and can also be stored in the memory of the computer device in the form of software, so that the processor can invoke and execute the corresponding operations of the above-mentioned modules.
  • a computer device or a system composed of multiple computing devices is provided.
  • the computer device may be a server, and its internal structure may be shown in FIG. 3 .
  • the computer device includes a processor, memory and a network interface connected by a system bus. Wherein, the processor of the computer device is used to provide calculation and control capabilities.
  • the memory of the computer device includes a non-volatile storage medium and an internal memory.
  • the non-volatile storage medium stores an operating system, computer programs and databases.
  • the internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium.
  • the database of the computer device is used to store static information and dynamic information data.
  • the network interface of the computer device is used to communicate with an external terminal via a network connection.
  • FIG. 3 is only a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation to the computer equipment on which the solution of the application is applied.
  • the specific computer equipment can be More or fewer components than shown in the figures may be included, or some components may be combined, or have a different arrangement of components.
  • a computer device including a memory and a processor, and a computer program is stored in the memory, and when the processor executes the computer program, the steps in the above embodiments of the smart substation hierarchical health index evaluation method are implemented .
  • a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps in the above-mentioned embodiments of the smart substation hierarchical health index evaluation method are implemented.
  • Non-volatile memory may include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory or optical memory, etc.
  • Volatile memory can include Random Access Memory (RAM) or external cache memory.
  • RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Theoretical Computer Science (AREA)
  • Human Resources & Organizations (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Economics (AREA)
  • Strategic Management (AREA)
  • Computing Systems (AREA)
  • Tourism & Hospitality (AREA)
  • General Business, Economics & Management (AREA)
  • Marketing (AREA)
  • Health & Medical Sciences (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Educational Administration (AREA)
  • Development Economics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Game Theory and Decision Science (AREA)
  • Primary Health Care (AREA)
  • General Health & Medical Sciences (AREA)
  • Water Supply & Treatment (AREA)
  • Public Health (AREA)
  • Quality & Reliability (AREA)
  • Operations Research (AREA)
  • Medical Treatment And Welfare Office Work (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种智能变电站分层健康度指数评估方法。所述方法包括：根据设备的静态信息和动态信息，获得该设备的基础健康度指数（S110）；根据该设备与其他设备之间的通信连接关系获得设备关联性，并根据设备关联性修正该设备的基础健康度指数，获得该设备的健康度指数（S120）；根据一个分层中设备的健康度指数和设备重要性权重，获得该分层的层级健康度指数（S130）；根据每一个分层的层级健康度指数和每一个分层的设备重要性权重总和，获得智能变电站的全站健康度指数（S140）；根据每个智能变电站设备的全站健康度指数、每个分层的层级健康度指数和全站健康度指数对所述智能变电站进行调控（S150）。所述方法能够提高全站健康度指数计算的准确性。

Description

一种智能变电站分层健康度指数评估方法及装置 技术领域
本申请涉及电气技术领域，特别是涉及一种智能变电站分层健康度指数评估方法及装置。
背景技术
随着变电站控制系统的自动化、智能化水平不断提升，系统软硬件的规模和复杂度快速增长，其安全稳定运行面临的风险与挑战与日俱增。
电力系统作为关系到国计民生的关键基础设施，一直是黑客攻击的首要目标，2010年震网病毒利用西门子工控系统的0Day漏洞，破坏了伊朗大量的铀浓缩设施；2015年乌克兰电力部门遭到恶意代码攻击，导致多个变电站出现故障，超八万用户遭受停电，对社会生活稳定造成了巨大影响；2019年委内瑞拉多次出现大面积停电事件，造成大规模交通拥堵，学校、医院、工厂、机场等都受到严重影响，给民众造成了巨大的恐慌。这些事件都为电力系统的网络安全工作敲响了警钟。智能变电站作为电力系统的重要组成，其网络安全评估和防护手段亟待改进和完善。
然而，现有的智能变电站仅通过网络安全信息的采集进行信息安全测试，实现对网络安全的预警，不能根据智能变电站分层来评价其健康度，以提前采取安全防御措施。
发明内容
基于此，有必要针对上述技术问题，提供一种智能变电站分层健康度指数评估方法及装置，以提高全站健康度指数计算的准确性。
根据本申请的第一方面，提出了一种智能变电站分层健康度评估方法。
在一个实施例中，所述方法包括：
根据设备的静态信息和动态信息，获得该设备的基础健康度指数；
根据该设备与其他设备之间的通信连接关系获得设备关联性，并根据设备关联性修正该设备的基础健康度指数，获得该设备的健康度指数；
根据一个分层中设备的健康度指数和设备重要性权重，获得该分层的层级健康度指数；
根据每一个分层的层级健康度指数和每一个分层的设备重要性权重总和，获得智能变电站的全站健康度指数；
根据每个智能变电站设备的全站健康度指数、每个分层的层级健康度指数和全站健康度指数对所述智能变电站进行调控。
在其中一个实施例中，所述根据该设备与其他设备之间的通信连接关系获得设备关联性，并根据设备关联性修正该设备的基础健康度指数，获得该设备的健康度指数的步骤，包括：
获取该设备与其他设备之间通信的数据包；
根据数据包的IP地址和MAC地址信息，将其他设备加至该设备的关联设备列表，该设备也被加至其他设备的关联设备列表；
将该设备的关联设备列表中的关联设备，根据设备的基础健康度指数，按从低到高顺序进行排序，得到排序后的关联设备；
根据关联设备列表中关联设备的数目，确定关联设备的关联权重；
根据排序后的关联设备的基础健康度指数和关联权重，对该设备的基础健康度指数进行修正，获得该设备的健康度指数。
在其中一个实施例中，所述根据一个分层中设备的健康度指数和设备重要性权重，获得该分层的层级健康度指数的步骤，包括：
获取预设的设备重要性权重；
计算每个设备的设备重要性权重在其所在分层的设备重要性权重之和中的占比，获得每个设备的设备重要性权重占比；
将分层中每个设备的健康度指数与设备重要性权重占比的乘积求和，获得该分层的层级健康度指数。
在其中一个实施例中，所述根据一个分层中设备的健康度指数和设备重要性权重，计算该分层的层级健康度指数的步骤之后，将所述层级健康度指数作为层级基础健康度指数，对层级基础健康度指数进行修正，包括：
遍历所有分层，获得每个分层的所有设备A i,k，其中，A i,k表示第i层的第k个设备， j为正整数；
计算第i层与第j层之间的层级修正权重
Figure PCTCN2021142285-appb-000001
将
Figure PCTCN2021142285-appb-000002
初始化为0，遍历设备A i,k的所有关联设备A i,k l；其中，关联设备A i,k l表示第i层第k个设备的第l个关联设备，l为正整数；当关联设备A i,k l属于第j层，且i≠j时，
Figure PCTCN2021142285-appb-000003
其中w i,k l表示关联设备A i,k l对应的设备重要性权重；
根据层级修正权重
Figure PCTCN2021142285-appb-000004
对层级基础健康度指数进行修正，修正公式如下式所示：
Figure PCTCN2021142285-appb-000005
其中，CH i表示第i层的修正后层级健康度指数，BCH i表示第i层的层级基础健康度指数，i为正整数；γ l表示层级关联性修正强度，∑w j表示第j层的所有设备的设备重要性权重总和；当i＝j时，层级修正权重
Figure PCTCN2021142285-appb-000006
为0。
在其中一个实施例中，所述根据每一个分层的层级健康度指数和每一个分层的设备重要性权重的总和，获得智能变电站的全站健康度指数的步骤，包括：
计算每一个分层的所有设备的设备重要性权重之和，根据一个分层的设备重要性权重之和在所有分层的设备重要性权重之和中的占比，获得该分层的层级健康度指数的层级权重；
对各分层的层级健康度指数和层级权重进行加权求和，得到智能变电站的全站健康度指数。
在其中一个实施例中，所述根据设备的静态信息和动态信息，获得设备的基础健康度指数的步骤，包括：
根据漏洞扫描方法、配置核查方法和模糊测试方法，对设备的静态信息进行识别，获得设备的静态信息；
根据入侵检测技术方法，获得设备的动态信息；
获取预设的设备的静态信息权重和动态信息权重；
根据设备的静态信息、动态信息、静态信息权重和动态信息权重，获得设备的基础健康度指数。
在其中一个实施例中，所述静态信息包括未修复的漏洞信息、错误的配置参数信息、开放的高危端口信息和开放的通用网络服务信息中至少一种；
所述动态信息包括未知连接信息、未知协议信息、畸形报文信息和漏洞利用信息中至少一种。
根据本申请的第二方面，提供了一种智能变电站分层健康度指数评估装置。
在一个实施例中，所述装置包括：
设备基础健康度计算模块，用于根据设备的静态信息和动态信息，获得该设备的基础健康度指数；
设备健康度计算模块，用于根据设备与其他设备之间的通信连接关系获得设备关联性，并根据所述设备关联性修正该设备的基础健康度指数，获得该设备的健康度指数；
层级健康度计算模块，用于根据一个分层中设备的健康度指数和设备重要性权重，获得该分层的层级健康度指数；
全站健康度计算模块，用于根据每一个分层的层级健康度指数和每一个分层的设备重要性权重总和，获得智能变电站的全站健康度指数；
全局调控模块，用于根据每个智能变电站设备的全站健康度指数、每个分层的层级健康度指数和全站健康度指数对所述智能变电站进行调控。
一种计算机设备或由多个计算设备所组成的系统，包括存储器和处理器，所述存储器存储有计算机程序，所述处理器执行所述计算机程序时实现以下步骤：
根据设备的静态信息和动态信息，获得该设备的基础健康度指数；
根据该设备与其他设备之间的通信连接关系获得设备关联性，并根据设备关联性修正该设备的基础健康度指数，获得该设备的健康度指数；
根据一个分层中设备的健康度指数和设备重要性权重，获得该分层的层级健康度指数；
根据每一个分层的层级健康度指数和每一个分层的设备重要性权重总和，获得智能变电站的全站健康度指数。
一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现以下步骤：
根据设备的静态信息和动态信息，获得该设备的基础健康度指数；
根据该设备与其他设备之间的通信连接关系获得设备关联性，并根据设备关联性 修正该设备的基础健康度指数，获得该设备的健康度指数；
根据一个分层中设备的健康度指数和设备重要性权重，获得该分层的层级健康度指数；
根据每一个分层的层级健康度指数和每一个分层的设备重要性权重总和，获得智能变电站的全站健康度指数。
上述一种智能变电站分层健康度指数评估方法、装置、计算机设备和存储介质，对智能变电站的网络安全状态从设备、分层和全站三个不同层级进行评估和呈现，使得全站健康度计算更加全面和准确；利用设备关联性，对设备基础健康度指数进行修正，充分考虑了由于设备关联性所带来的网络安全风险扩散对系统安全性的影响，保证设备健康度计算更加准确。根据每个智能变电站设备、分层和全站健康度指数，实现对同一个智能变电站站健康状态的持续监控和不同智能变电站之间健康度指数的横向比较，进一步实现对智能变电站系统全局级、趋势性的健康状态感知，最后根据状态感知结果对智能变电站进行调控，使得智能变电站能够安全稳定运行。
附图说明
图1为一个实施例中一种智能变电站分层健康度指数评估方法的流程示意图；
图2为一个实施例中智能变电站分层健康度指数评估装置的结构框图；
图3为一个实施例中计算机设备的内部结构图。
具体实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
本申请实施例提出了一种智能变电站分层健康度指数评估方法中，智能变电站包括多个分层，每一个分层包括多个设备，对智能变电站的网络安全状态从设备、分层和全站三个不同层级进行评估和呈现，使得全站健康度指数的计算结果更加全面和准确；利用设备关联性对设备基础健康度指数进行修正，充分考虑了由于设备关联所带来的网络安全风险扩散对系统安全性的影响，保证设备健康度指数计算更加准确。
在一个实施例中，如图1所示，提供了一种智能变电站分层健康度指数评估方法，包括以下步骤：
S110，根据设备的静态信息和动态信息，计算得到设备的基础健康度指数。
其中，静态信息指设备上存在的脆弱性因素，包括：未修复的漏洞信息、错误的配置参数信息、开放的高危端口信息、开放的通用网络服务信息中的至少一种。动态信息指设备在系统运行过程中发生的异常行为事件，包括：未知连接信息、未知协议信息、畸形报文信息、漏洞利用信息中的至少一种。可选地，通过对设备的静态信息和动态信息按照其权重进行分析运算，得到设备的基础健康度指数。可选地，静态信息或动态信息的值越大，设备的基础健康度指数越低。
S120，根据设备与其他设备之间的通信连接关系获得设备关联性，并根据设备关联性修正该设备的基础健康度指数，得到该设备的健康度指数。
其中，设备关联指设备间存在通信链路和通信行为。设备关联可被攻击者利用，从而通过某一设备向其相关联的设备发起攻击行为。对设备而言，设备关联是该设备的潜在风险，应当尽量控制仅关联必要设备，并确保关联设备的安全性。设备的健康度指数受管理那设备的健康度指数影响，因此，通过关联设备的健康度指数，对该设备的基础健康度指数进行修正，得到更为准确的设备的健康度指数。
S130，根据一个分层中设备的健康度指数和设备重要性权重，计算该分层的层级健康度指数。
其中，在已获得的设备的健康度指数基础上，根据智能变电站各分层中的设备的重要性得到设备重要性权重，对各分层中的设备的健康度指数进行加权求平均可得到对应分层的层级健康度指数。
S140，根据每一个分层的层级健康度指数和每一个分层的设备重要性权重的总和，计算得到智能变电站的全站健康度指数。
其中，在已获得的层级健康度指数的基础上，根据各分层设备对应的设备重要性权重的总和，对层级健康度指数进行加权求平均可得到全站健康度指数。
S150，根据每个智能变电站设备的全站健康度指数、每个分层的层级健康度指数和全站健康度指数对所述智能变电站进行调控。
上述实施例的智能变电站分层健康度指数评估方法中，对智能变电站的网络安全 状态从设备、分层和全站三个不同层级进行评估和呈现，使得全站健康度指数的计算结果更加全面和准确；利用设备关联性对设备基础健康度指数进行修正，充分考虑了由于设备关联所带来的网络安全风险扩散对系统安全性的影响，保证设备健康度指数计算更加准确。根据每个智能变电站设备、分层和全站健康度指数，实现对同一个智能变电站站健康状态的持续监控和不同智能变电站之间健康度指数的横向比较，进一步实现对智能变电站系统全局级、趋势性的健康状态感知，最后根据状态感知结果对智能变电站进行调控，使得智能变电站能够安全稳定运行。
在其中一个实施例中，所述根据设备与设备之间的通信连接关系获得设备关联性，并根据设备关联性修正设备的基础健康度指数，得到设备的健康度指数的步骤，包括：获取该设备与其他设备之间通信的数据包；根据所述数据包的IP地址和MAC地址信息，将其他设备加至该设备的关联设备列表，该设备也被加至其他设备的关联设备列表；将该设备的关联设备列表中的关联设备，根据设备的基础健康度指数，按从低到高顺序进行排序，得到排序后的关联设备；根据关联设备列表中关联设备的数目，确定关联设备的关联权重；根据排序后的关联设备的基础健康度指数和关联权重，对该设备的基础健康度指数进行修正，获得该设备的健康度指数。
可选地，通过流量监听和深度包解析技术，根据数据包的IP地址和MAC地址信息，将其他设备加至该设备的关联设备列表，该设备也被加至其他设备的关联设备列表，若已存在则不重复添加。例如，当监听到设备A 1向设备A 2发送数据包时，将设备A 2加至设备A 1的关联设备列表中，同时将设备A 1加至设备A 2的关联设备列表中，设备A i的关联设备列表用
Figure PCTCN2021142285-appb-000007
表示，
Figure PCTCN2021142285-appb-000008
表示设备A i的第j个关联设备，N i表示设备A i的关联设备数量。考虑到部分设备间的通信频率较低，因此设备关联性识别过程需要持续进行，不断识别新出现设备关联性，并对相应的关联设备列表进行更新。
在得到一个分层中所有设备的基础健康度指数后，根据设备关联性，用关联设备的基础健康度指数对该设备的基础健康度指数进行修正，具体为：用
Figure PCTCN2021142285-appb-000009
表示设备A i的第j项关联设备的基础健康度指数，i、j为正整数；根据关联设备的基础健康度指数，按从低到高顺序进行排序，即
Figure PCTCN2021142285-appb-000010
设备A i的健康度指数计算公式如下式所示：
Figure PCTCN2021142285-appb-000011
其中，H i表示设备A i的健康度指数，BH i为设备A i的基础健康度指数，N i表示设备A i的关联设备数量，γ a表示设备关联性修正强度，γ a数值越大，设备关联性修正强度越大，当γ a＝0时，相当于不进行设备的基础健康度指数修正，A i表示第i个设备。通过上述计算公式，对所有关联设备的基础健康度指数进行加权求平均，基础健康度指数越低的关联设备对应的权重越大，进而对该设备的基础健康度指数进行修正。上述计算公式中，当某一设备的关联设备少时，其关联设备对应的权重分配集中，权重较大；当某一设备的关联设备多时，其关联设备对应的权重分配均匀，权重较小。可选地，设备关联性修正强度γ a分为低、中、高三档修正强度，γ a＝0表示低修正强度，γ a＝0.1表示中修正强度，γ a＝0.3表示高修正强度。当然，设备关联性修正强度γ a也可以通过经验值获得。
在其中一个实施例中，所述根据一个分层中设备的健康度指数和设备重要性权重，计算该分层的层级健康度指数的步骤，包括：获取预设的设备重要性权重；计算每个设备的设备重要性权重在其所在分层的设备重要性权重之和中的占比，获得每个设备的设备重要性权重占比；将分层中每个设备的健康度指数与设备重要性权重占比的乘积求和，得到该分层的层级健康度指数。
可选地，根据智能变电站的层级设计特点，将设备划分至对应的层级，A i,j表示第i层的第j个设备；根据设备的重要程度，获取该设备对应的设备重要性权重w j，w j表示第j个设备的设备重要性权重；层级基础健康度指数计算公式如下式所示：
Figure PCTCN2021142285-appb-000012
其中，BCH i为第i层的层级基础健康度指数，BCH 1表示站控层基础健康度指数，BCH 2表示间隔层基础健康度指数，BCH 3表示过程层基础健康度指数，NC i表示第i层的设备数量，NC 1表示站控层的设备数量，NC 2表示间隔层的设备数量，NC 3过程层的设备数量，H j表示第j个设备的健康度指数，i、j为正整数。本实施例中，智能变电站共划分3个层级，分别为站控层、间隔层和过程层，在其他实施例中，智能变电站还 可以划分其他数量的层级。
可选地，若不进行层级健康度指数修正，可以直接将分层的层级基础健康度指数作为该分层的层级健康度指数。
在其中一个实施例中，所述根据一个分层中设备的健康度指数和设备重要性权重，计算该分层的层级健康度指数的步骤之后，将所述层级健康度指数作为层级基础健康度指数，对层级基础健康度指数进行修正，包括：遍历所有层级，获得每个层级的所有设备A i,k，其中，A i,k表示第i层的第k个设备，j为正整数；计算第i层与第j层之间的层级修正权重
Figure PCTCN2021142285-appb-000013
将
Figure PCTCN2021142285-appb-000014
初始化为0，遍历设备A i,k的所有关联设备A i,k l；其中，关联设备A i,k l表示第i层第k个设备的第l个关联设备；当关联设备A i,k l属于第j层，且i≠j时，
Figure PCTCN2021142285-appb-000015
其中w i,k l表示关联设备A i,k l对应的设备重要性权重；根据层级修正权重
Figure PCTCN2021142285-appb-000016
对层级基础健康度指数进行修正，修正公式如下式所示：
Figure PCTCN2021142285-appb-000017
其中，CH i表示第i层的修正后层级健康度，BCH i表示第i层的层级基础健康度指数，i为正整数，γ l表示层级关联性修正强度，γ l数值越大，层级关联性修正强度越大，∑w j表示对第j层的所有设备的设备重要性权重总和；当i＝j时，层级修正权重δ i j为0。上述公式中j＝1、2、3分别对应智能变电站站控层、间隔层和过程层，当然j为正整数，本领域技术人员可以根据分层需要进行相应数量的分层设置。可选地，层级关联性修正强度γ l分为低、中、高三档修正强度，γ l＝0表示低修正强度，γ l＝0.05表示中修正强度，γ l＝0.1表示高修正强度。可选地，层级关联性修正强度γ l也可以通过经验值获得。
本实施例中，根据设备关联性，对层级基础健康度指数进行修正，确保层级健康度指数计算过程考虑了由于设备关联性导致的智能变电站不同层级间的联动影响，使得计算结果更加准确。
在其中一个实施例中，所述根据每一个分层的层级健康度指数和每一个分层的设备重要性权重的总和，计算得到智能变电站的全站健康度指数的步骤，包括：计算每一个分层的所有设备的设备重要性权重之和，根据一个分层的设备重要性权重之和在所有分层的设备重要性权重之和中的占比，获得该分层的层级健康度指数的层级权重； 对各分层的层级健康度指数和层级权重进行加权求和，得到智能变电站的全站健康度指数。
可选地，智能变电站的全站健康度指数计算公式如下式所示：
Figure PCTCN2021142285-appb-000018
其中，QH为智能变电站的全站健康度指数，∑w表示所有层级的所有设备的设备重要性权重之和，∑w i表示第i层所有设备的设备重要性权重之和，CH i表示第i层的层级健康度指数。上述公式中i＝1、2、3分别对应智能变电站站控层、间隔层和过程层，当然i为正整数，本领域技术人员可以根据分层需要进行相应数量的分层设置。
在其中一个实施例中，所述根据设备的静态信息和动态信息，计算得到设备的基础健康度指数的步骤，包括：根据漏洞扫描方法、配置核查方法和模糊测试方法，对设备的静态信息进行识别，获得设备的静态信息；根据入侵检测技术方法，获得设备的动态信息；获取预设的设备的静态信息权重和预设的设备的动态信息权重；根据所述设备的静态信息、设备的动态信息、静态信息权重和动态信息权重，计算得到设备的基础健康度指数。
可选地，通过主动扫描和设备指纹识别技术，对智能变电站系统中运行的设备进行自动识别，形成设备集合，设备集合用{A i，i＝1，…，N}进行表示，A i表示第i个设备，N表示设备数量。
可选地，通过漏洞扫描、配置核查、模糊测试等技术手段，对设备的静态信息进行识别。设备A i的静态信息用{S i j，j＝1,…,N i s}表示，S i j表示设备A i的第j项静态信息，N i s表示设备A i的静态信息数量。静态信息S i j对应权重用s i j表示，权重的大小与静态信息的风险性和严重性相关，风险性和严重性越高的静态信息对应的权重越大。
可选地，通过黑名单、白名单和安全基线等入侵检测技术手段，对设备的动态信息进行识别。设备A i的动态信息用{D i j，j＝1,…,N i d}表示，D i j表示设备A i的第j项动态信息，N i d表示设备A i的动态信息数量。动态信息D i j对应权重用d i j表示，权重的大小与动态信息的风险性和严重性相关，风险性和严重性越高的动态信息对应的权重越大。
可选地，设备的基础健康度指数计算公式如下式所示：
Figure PCTCN2021142285-appb-000019
其中，BH i表示设备的基础健康度指数，
Figure PCTCN2021142285-appb-000020
表示静态信息所占权重，
Figure PCTCN2021142285-appb-000021
表示动态信息所占权重，
Figure PCTCN2021142285-appb-000022
和
Figure PCTCN2021142285-appb-000023
的取值范围在0和1之间，且
Figure PCTCN2021142285-appb-000024
用户可根据实际评估需要，动态调整静态信息和动态信息在设备基础健康度指数计算中所占的比重；N i s表示设备A i的静态信息数量，S i j表示设备A i的第j项静态信息，静态信息S i j对应权重用s i j表示，N i d表示设备A i的动态信息数量，D i j表示设备A i的第j项动态信息，动态信息D i j对应权重用d i j表示。
在其中一个实施例中，所述静态信息包括未修复的漏洞信息、错误的配置参数信息、开放的高危端口信息和开放的通用网络服务信息中至少一种。
在其中一个实施例中，所述动态信息包括未知连接信息、未知协议信息、畸形报文信息和漏洞利用信息中至少一种。
应该理解的是，虽然图1的流程图中的各个步骤按照箭头的指示依次显示，但是这些步骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，图1中的至少一部分步骤可以包括多个步骤或者多个阶段，这些步骤或者阶段并不必然是在同一时刻执行完成，而是可以在不同的时刻执行，这些步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤中的步骤或者阶段的至少一部分轮流或者交替地执行。
在一个实施例中，如图2所示，提供了智能变电站分层健康度指数评估装置，包括：设备基础健康度指数计算模块210、设备健康度指数计算模块220、层级健康度指数计算模块230和全站健康度指数计算模块240，其中：
设备基础健康度计算模块210，用于根据设备的静态信息和动态信息，计算得到该设备的基础健康度指数。
设备健康度计算模块220，用于根据该设备与其他设备之间的通信连接关系获得设备关联性，并根据设备关联性修正该设备的基础健康度指数，得到该设备的健康度指数。
层级健康度计算模块230，用于根据一个分层中设备的健康度指数和设备重要性权重，计算该分层的层级健康度指数。
全站健康度计算模块240，用于根据每一个分层的层级健康度指数和每一个分层的设备重要性权重总和，获得智能变电站的全站健康度指数。
全局调控模块250，用于根据每个智能变电站设备的全站健康度指数、每个分层的层级健康度指数和全站健康度指数对所述智能变电站进行调控。
在其中一个实施例中，所述设备健康度计算模块220包括：数据包获取单元，用于获取设备与其他设备之间通信的数据包；关联设备列表添加单元，用于根据数据包的IP地址和MAC地址信息，将其他设备加至该设备的关联设备列表，该设备也被加至其他设备的关联设备列表；排序单元，用于将该设备的关联设备列表中的关联设备，根据设备的基础健康度指数，按从低到高顺序进行排序，得到排序后的关联设备；关联权重确定单元，用于根据关联设备列表中关联设备的数目，确定关联设备的关联权重；设备健康度计算单元，根据排序后的关联设备的基础健康度指数和关联权重，对该设备的基础健康度指数进行修正，获得该设备的健康度指数。
在其中一个实施例中，层级健康度计算模块230包括：设备重要性权重获取单元，用于获取预设的设备重要性权重；占比计算单元，用于计算每个设备的设备重要性权重在其所在分层的设备重要性权重之和中的占比，获得每个设备的设备重要性权重占比；层级健康度计算单元，用于将分层中每个设备的健康度指数与设备重要性权重占比的乘积求和，得到该分层的层级健康度指数。
在其中一个实施例中，所述智能变电站分层健康度指数评估装置，还包括：分层健康度修正模块，用于将所述层级健康度计算模块230获得的层级健康度指数作为层级基础健康度指数，对层级基础健康度指数进行修正，包括：遍历所有分层，获得每个分层的所有设备A i,k，其中，A i,k表示第i层的第k个设备，j为正整数；计算第i层与第j层之间的层级修正权重
Figure PCTCN2021142285-appb-000025
将
Figure PCTCN2021142285-appb-000026
初始化为0，遍历设备A i,k的所有关联设备A i,k l；其中，关联设备A i,k l表示第i层第k个设备的第l个关联设备，l为正整数；当关联设备A i,k l属于第j层，且i≠j时，
Figure PCTCN2021142285-appb-000027
其中w i,k l表示关联设备A i,k l对应的设备重要性权重；根据层级修正权重
Figure PCTCN2021142285-appb-000028
对层级基础健康度指数进行修正，修正公式如下式所示：
Figure PCTCN2021142285-appb-000029
其中，CH i表示第i层的修正后层级健康度指数，BCH i表示第i层的层级基础健康度指数，i为正整数；γ l表示层级关联性修正强度，∑w j表示第j层的所有设备的设备重要性权重总和；当i＝j时，层级修正权重
Figure PCTCN2021142285-appb-000030
为0。
在其中一个实施例中，全站健康度计算模块240包括：层级权重计算单元，用于计算每一个分层的所有设备的设备重要性权重之和，根据一个分层的设备重要性权重之和在所有分层的设备重要性权重之和中的占比，获得该分层的层级健康度指数的层级权重；全站健康度计算单元，用于对各分层的层级健康度指数和层级权重进行加权求和，得到智能变电站的全站健康度指数。
在其中一个实施例中，设备基础健康度计算模块210包括：静态信息获取单元，用于根据漏洞扫描方法、配置核查方法和模糊测试方法，对设备的静态信息进行识别，获得设备的静态信息；动态信息获取单元，用于根据入侵检测技术方法，获得设备的动态信息；信息权重获取单元，用于获取预设的设备的静态信息权重和预设的设备的动态信息权重；设备基础健康度计算单元，用于根据所述设备的静态信息、设备的动态信息、静态信息权重和动态信息权重，计算得到设备基础健康度。
关于智能变电站分层健康度指数评估装置的具体限定可以参见上文中对于一种智能变电站分层健康度指数评估方法的限定，在此不再赘述。上述智能变电站分层健康度指数评估装置中的各个模块可全部或部分通过软件、硬件及其组合来实现。上述各模块可以硬件形式内嵌于或独立于计算机设备中的处理器中，也可以以软件形式存储于计算机设备中的存储器中，以便于处理器调用执行以上各个模块对应的操作。
在一个实施例中，提供了一种计算机设备或由多个计算设备所组成的系统，该计算机设备可以是服务器，其内部结构图可以如图3所示。该计算机设备包括通过系统总线连接的处理器、存储器和网络接口。其中，该计算机设备的处理器用于提供计算和控制能力。该计算机设备的存储器包括非易失性存储介质、内存储器。该非易失性存储介质存储有操作系统、计算机程序和数据库。该内存储器为非易失性存储介质中的操作系统和计算机程序的运行提供环境。该计算机设备的数据库用于存储静态信息和动态信息数据。该计算机设备的网络接口用于与外部的终端通过网络连接通信。该 计算机程序被处理器执行时以实现上述智能变电站分层健康度指数评估方法实施例中的步骤。
本领域技术人员可以理解，图3中示出的结构，仅仅是与本申请方案相关的部分结构的框图，并不构成对本申请方案所应用于其上的计算机设备的限定，具体的计算机设备可以包括比图中所示更多或更少的部件，或者组合某些部件，或者具有不同的部件布置。
在一个实施例中，还提供了一种计算机设备，包括存储器和处理器，存储器中存储有计算机程序，该处理器执行计算机程序时实现上述智能变电站分层健康度指数评估方法实施例中的步骤。
在一个实施例中，提供了一种计算机可读存储介质，其上存储有计算机程序，该计算机程序被处理器执行时实现上述智能变电站分层健康度指数评估方法实施例中的步骤。
本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指令相关的硬件来完成，所述的计算机程序可存储于一非易失性计算机可读取存储介质中，该计算机程序在执行时，可包括如上述各方法的实施例的流程。其中，本申请所提供的各实施例中所使用的对存储器、存储、数据库或其它介质的任何引用，均可包括非易失性和易失性存储器中的至少一种。非易失性存储器可包括只读存储器(Read-Only Memory，ROM)、磁带、软盘、闪存或光存储器等。易失性存储器可包括随机存取存储器(Random Access Memory，RAM)或外部高速缓冲存储器。作为说明而非局限，RAM可以是多种形式，比如静态随机存取存储器(Static Random Access Memory，SRAM)或动态随机存取存储器(Dynamic Random Access Memory，DRAM)等。
以上实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。
以上所述实施例仅表达了本申请的几种实施方式，其描述较为具体和详细，但并不能因此而理解为对发明专利范围的限制。应当指出的是，对于本领域的普通技术人员来说，在不脱离本申请构思的前提下，还可以做出若干变形和改进，这些都属于本 申请的保护范围。因此，本申请专利的保护范围应以所附权利要求为准。

Claims (16)

  1. 一种智能变电站分层健康度指数评估方法，其特征在于，包括以下步骤：
    根据设备的静态信息和动态信息，获得该设备的基础健康度指数；
    根据该设备与其他设备之间的通信连接关系获得设备关联性，并根据设备关联性修正该设备的基础健康度指数，获得该设备的健康度指数；
    根据一个分层中设备的健康度指数和设备重要性权重，获得该分层的层级健康度指数；
    根据每一个分层的层级健康度指数和每一个分层的设备重要性权重总和，获得智能变电站的全站健康度指数；
    根据每个智能变电站设备的全站健康度指数、每个分层的层级健康度指数和全站健康度指数对所述智能变电站进行调控。
  2. 根据权利要求1所述的方法，其特征在于，所述根据该设备与其他设备之间的通信连接关系计算设备关联性，并根据设备关联性修正该设备的基础健康度指数，获得该设备的健康度指数的步骤，包括：
    获取该设备与其他设备之间通信的数据包；
    根据数据包的IP地址和MAC地址信息，将其他设备加至该设备的关联设备列表，该设备也被加至其他设备的关联设备列表；
    将该设备的关联设备列表中的关联设备，根据设备的基础健康度指数，按从低到高顺序进行排序，得到排序后的关联设备；
    根据关联设备列表中关联设备的数目，确定关联设备的关联权重；
    根据排序后的关联设备的基础健康度指数和关联权重，对该设备的基础健康度指数进行修正，获得该设备的健康度指数。
  3. 根据权利要求1所述的方法，其特征在于，所述根据一个分层中设备的健康度指数和设备重要性权重，获得该分层的层级健康度指数的步骤，包括：
    获取预设的设备重要性权重；
    计算每个设备的设备重要性权重在其所在分层的设备重要性权重之和中的占比，获得每个设备的设备重要性权重占比；
    将分层中每个设备的健康度指数与设备重要性权重占比的乘积求和，获得该分层的层级健康度指数。
  4. 根据权利要求1所述的方法，其特征在于，所述根据一个分层中设备的健康度指数和设备重要性权重，获得该分层的层级健康度指数的步骤之后，将所述层级健康度指数作为层级基础健康度指数，对层级基础健康度指数进行修正，包括：
    遍历所有分层，获得每个分层的所有设备A i,k，其中，A i,k表示第i层的第k个设备，j为正整数；
    计算第i层与第j层之间的层级修正权重
    Figure PCTCN2021142285-appb-100001
    将
    Figure PCTCN2021142285-appb-100002
    初始化为0，遍历设备A i,k的所有关联设备A i,k l；其中，关联设备A i，k l表示第i层第k个设备的第l个关联设备，l为正整数；当关联设备A i,k l属于第j层，且i≠j时，
    Figure PCTCN2021142285-appb-100003
    其中w i,k l表示关联设备A i,k l对应的设备重要性权重；
    根据层级修正权重
    Figure PCTCN2021142285-appb-100004
    对层级基础健康度指数进行修正，修正公式如下式所示：
    Figure PCTCN2021142285-appb-100005
    其中，CH i表示第i层的修正后层级健康度指数，BCH i表示第i层的层级基础健康度指数，i为正整数；γ l表示层级关联性修正强度，Σw j表示第j层的所有设备的设备重要性权重总和；当i＝j时，层级修正权重
    Figure PCTCN2021142285-appb-100006
    为0。
  5. 根据权利要求1所述的方法，其特征在于，所述根据每一个分层的层级健康度指数和每一个分层的设备重要性权重的总和，获得智能变电站的全站健康度指数的步骤，包括：
    计算每一个分层的所有设备的设备重要性权重之和，根据一个分层的设备重要性权重之和在所有分层的设备重要性权重之和中的占比，获得该分层的层级健康度指数的层级权重；
    对各分层的层级健康度指数和层级权重进行加权求和，得到智能变电站的全站健康度指数。
  6. 根据权利要求1所述的方法，其特征在于，所述根据设备的静态信息和动态信息，获得设备的基础健康度指数的步骤，包括：
    根据漏洞扫描方法、配置核查方法和模糊测试方法，对设备的静态信息进行识别，获得设备的静态信息；
    根据入侵检测技术方法，获得设备的动态信息；
    获取预设的设备的静态信息权重和动态信息权重；
    根据设备的静态信息、动态信息、静态信息权重和动态信息权重，获得设备的基础健康度指数。
  7. 根据权利要求1至6任一项所述的方法，其特征在于，
    所述静态信息包括未修复的漏洞信息、错误的配置参数信息、开放的高危端口信息和开放的通用网络服务信息中至少一种；
    所述动态信息包括未知连接信息、未知协议信息、畸形报文信息和漏洞利用信息中至少一种。
  8. 一种计算机设备或由多个计算设备所组成的系统，包括存储器和处理器，所述存储器存储有计算机程序，其特征在于，所述处理器执行所述计算机程序时实现权利要求1至7中任一项所述的方法的步骤。
  9. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现权利要求1至7中任一项所述的方法的步骤。
  10. 一种智能变电站分层健康度指数评估装置，其特征在于，所述装置包括：
    设备基础健康度计算模块，用于根据设备的静态信息和动态信息，获得该设备的基础健康度指数；
    设备健康度计算模块，用于根据设备与其他设备之间的通信连接关系获得设备关联性，并根据所述设备关联性修正该设备的基础健康度指数，获得该设备的健康度指数；
    层级健康度计算模块，用于根据一个分层中设备的健康度指数和设备重要性权重，获得该分层的层级健康度指数；
    全站健康度计算模块，用于根据每一个分层的层级健康度指数和每一个分层的设备重要性权重总和，获得智能变电站的全站健康度指数；
    全局调控模块，用于根据每个智能变电站设备的全站健康度指数、每个分层的层级健康度指数和全站健康度指数对所述智能变电站进行调控。
  11. 如权利要求10所述的一种智能变电站分层健康度指数评估装置，其特征在于，
    所述设备健康度计算模块包括：
    数据包获取单元，用于获取设备与其他设备之间通信的数据包；
    关联设备列表添加单元，用于根据数据包的IP地址和MAC地址信息，将其他设备加至该设备的关联设备列表，该设备也被加至其他设备的关联设备列表；
    排序单元，用于将该设备的关联设备列表中的关联设备，根据设备的基础健康度指数，按从低到高顺序进行排序，得到排序后的关联设备；
    关联权重确定单元，用于根据关联设备列表中关联设备的数目，确定关联设备的关联权重；
    设备健康度计算单元，根据排序后的关联设备的基础健康度指数和关联权重，对该设备的基础健康度指数进行修正，获得该设备的健康度指数。
  12. 如权利要求10所述的一种智能变电站分层健康度指数评估装置，其特征在于，
    所述层级健康度计算模块包括：
    设备重要性权重获取单元，用于获取预设的设备重要性权重；
    占比计算单元，用于计算每个设备的设备重要性权重在其所在分层的设备重要性权重之和中的占比，获得每个设备的设备重要性权重占比；
    层级健康度计算单元，用于将分层中每个设备的健康度指数与设备重要性权重占比的乘积求和，得到该分层的层级健康度指数。
  13. 如权利要求10所述的一种智能变电站分层健康度指数评估装置，其特征在于，
    还包括：分层健康度修正模块，用于将所述层级健康度计算模块获得的层级健康度指数作为层级基础健康度指数，对层级基础健康度指数进行修正，包括：
    遍历所有分层，获得每个分层的所有设备A i,k，其中，A i,k表示第i层的第k个设备，j为正整数；
    计算第i层与第j层之间的层级修正权重
    Figure PCTCN2021142285-appb-100007
    将
    Figure PCTCN2021142285-appb-100008
    初始化为0，遍历设备A i,k的所有关联设备A i,k l；其中，关联设备A i,k l表示第i层第k个设备的第l个关联设备，l为正整数；当关联设备A i,k l属于第j层，且i≠j时，
    Figure PCTCN2021142285-appb-100009
    其中w i,k l表示关联设备A i,k l对应的设备重要性权重；
    根据层级修正权重
    Figure PCTCN2021142285-appb-100010
    对层级基础健康度指数进行修正，修正公式如下式所示：
    Figure PCTCN2021142285-appb-100011
    其中，CH i表示第i层的修正后层级健康度指数，BCH i表示第i层的层级基础健康度指 数，i为正整数；γ l表示层级关联性修正强度，Σw j表示第j层的所有设备的设备重要性权重总和；当i＝j时，层级修正权重
    Figure PCTCN2021142285-appb-100012
    为0。
  14. 如权利要求10所述的一种智能变电站分层健康度指数评估装置，其特征在于，
    所述全站健康度计算模块包括：
    层级权重计算单元，用于计算每一个分层的所有设备的设备重要性权重之和，根据一个分层的设备重要性权重之和在所有分层的设备重要性权重之和中的占比，获得该分层的层级健康度指数的层级权重；
    全站健康度计算单元，用于对各分层的层级健康度指数和层级权重进行加权求和，得到智能变电站的全站健康度指数。
  15. 如权利要求10所述的一种智能变电站分层健康度指数评估装置，其特征在于，
    所述设备基础健康度计算模块包括：
    静态信息获取单元，用于根据漏洞扫描方法、配置核查方法和模糊测试方法，对设备的静态信息进行识别，获得设备的静态信息；
    动态信息获取单元，用于根据入侵检测技术方法，获得设备的动态信息；
    信息权重获取单元，用于获取预设的设备的静态信息权重和动态信息权重；
    设备基础健康度计算单元，用于根据所述设备的静态信息、动态信息、静态信息权重和动态信息权重，计算得到设备的基础健康度。
  16. 如权利要求10至15任一项所述的一种智能变电站分层健康度指数评估装置，其特征在于，
    所述静态信息包括未修复的漏洞信息、错误的配置参数信息、开放的高危端口信息和开放的通用网络服务信息中至少一种；
    所述动态信息包括未知连接信息、未知协议信息、畸形报文信息和漏洞利用信息中至少一种。
PCT/CN2021/142285 2021-05-17 2021-12-29 一种智能变电站分层健康度指数评估方法及装置 WO2022242181A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/765,055 US11954210B2 (en) 2021-05-17 2021-12-29 Hierarchical health index evaluation method and apparatus for intelligent substation

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110532030.7A CN113159638B (zh) 2021-05-17 2021-05-17 一种智能变电站分层健康度指数评估方法及装置
CN202110532030.7 2021-05-17

Publications (1)

Publication Number Publication Date
WO2022242181A1 true WO2022242181A1 (zh) 2022-11-24

Family

ID=76876068

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/142285 WO2022242181A1 (zh) 2021-05-17 2021-12-29 一种智能变电站分层健康度指数评估方法及装置

Country Status (3)

Country Link
US (1) US11954210B2 (zh)
CN (1) CN113159638B (zh)
WO (1) WO2022242181A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113159638B (zh) * 2021-05-17 2023-04-18 国网山东省电力公司电力科学研究院 一种智能变电站分层健康度指数评估方法及装置
CN113672924A (zh) * 2021-08-24 2021-11-19 李宇佳 分布式云计算系统的数据入侵检测方法及装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170346845A1 (en) * 2016-05-25 2017-11-30 Blue Coat Systems, Inc. System and method for hierarchical and chained internet security analysis
CN107612144A (zh) * 2017-10-30 2018-01-19 南方电网科学研究院有限责任公司 变电站设备重要性检测系统和方法
CN108776855A (zh) * 2018-04-17 2018-11-09 中国电力科学研究院有限公司 一种智能设备健康状态评价方法及系统
CN110928752A (zh) * 2019-11-14 2020-03-27 青岛民航空管实业发展有限公司 空管台站健康度评估方法、装置及设备
CN112162907A (zh) * 2020-09-30 2021-01-01 上海新炬网络信息技术股份有限公司 基于监控指标数据的健康度评估方法
CN113159638A (zh) * 2021-05-17 2021-07-23 国网山东省电力公司电力科学研究院 一种智能变电站分层健康度指数评估方法及装置

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2011030190A1 (en) * 2009-09-14 2011-03-17 Abb Technology Ltd A method and a system for simulation in a substation
CN102624696B (zh) * 2011-12-27 2014-11-05 中国航天科工集团第二研究院七〇六所 一种网络安全态势评估方法
US10574550B2 (en) * 2013-03-15 2020-02-25 Time Warner Cable Enterprises Llc Methods and apparatus for scoring the condition of nodes in a communication network and taking action based on node health scores
CN107172004A (zh) * 2016-03-08 2017-09-15 中兴通讯股份有限公司 一种网络安全设备的风险评估方法和装置
CN107194149B (zh) * 2017-04-19 2020-01-10 北京工业大学 一种高速公路机电系统健康指数评估方法
CN106992904A (zh) * 2017-05-19 2017-07-28 湖南省起航嘉泰网络科技有限公司 基于动态综合权重的网络设备健康度评估方法
CN107483240A (zh) * 2017-08-07 2017-12-15 国网安徽省电力公司淮北供电公司 基于网络资源关联关系的电力通信网业务健康度分析方法
US11153156B2 (en) * 2017-11-03 2021-10-19 Vignet Incorporated Achieving personalized outcomes with digital therapeutic applications
CN108768710B (zh) * 2018-05-18 2021-12-24 国家电网公司信息通信分公司 一种光传输网络健康的动态权重评估方法、模型及装置
US10805165B2 (en) * 2019-02-28 2020-10-13 Afero, Inc. System and method for managing and configuring attributes of internet of things (IOT) devices
CN110598404A (zh) * 2019-09-17 2019-12-20 腾讯科技（深圳）有限公司 安全风险监控方法、监控装置、服务器和存储介质
CN111131274A (zh) * 2019-12-27 2020-05-08 国网四川省电力公司电力科学研究院 一种非侵入式智能变电站漏洞检测方法
CN111371758B (zh) * 2020-02-25 2022-03-25 东南大学 一种基于动态贝叶斯攻击图的网络欺骗效能评估方法
CN111581782B (zh) * 2020-04-16 2023-01-13 北京航空航天大学 一种基于健康状态层流逻辑模型的卫星健康层级评估方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170346845A1 (en) * 2016-05-25 2017-11-30 Blue Coat Systems, Inc. System and method for hierarchical and chained internet security analysis
CN107612144A (zh) * 2017-10-30 2018-01-19 南方电网科学研究院有限责任公司 变电站设备重要性检测系统和方法
CN108776855A (zh) * 2018-04-17 2018-11-09 中国电力科学研究院有限公司 一种智能设备健康状态评价方法及系统
CN110928752A (zh) * 2019-11-14 2020-03-27 青岛民航空管实业发展有限公司 空管台站健康度评估方法、装置及设备
CN112162907A (zh) * 2020-09-30 2021-01-01 上海新炬网络信息技术股份有限公司 基于监控指标数据的健康度评估方法
CN113159638A (zh) * 2021-05-17 2021-07-23 国网山东省电力公司电力科学研究院 一种智能变电站分层健康度指数评估方法及装置

Also Published As

Publication number Publication date
CN113159638B (zh) 2023-04-18
US11954210B2 (en) 2024-04-09
CN113159638A (zh) 2021-07-23
US20240054226A1 (en) 2024-02-15

Similar Documents

Publication Publication Date Title
US10084822B2 (en) Intrusion detection and prevention system and method for generating detection rules and taking countermeasures
WO2022242181A1 (zh) 一种智能变电站分层健康度指数评估方法及装置
Greensmith et al. Dendritic cells for SYN scan detection
US20160308725A1 (en) Integrated Community And Role Discovery In Enterprise Networks
CN114584405B (zh) 一种电力终端安全防护方法及系统
Kumar et al. Increasing performance of intrusion detection system using neural network
Otoum et al. A comparative study of ai-based intrusion detection techniques in critical infrastructures
CN108270723A (zh) 一种电力网络预测攻击路径的获取方法
Yin et al. Towards accurate intrusion detection based on improved clonal selection algorithm
CN107231345A (zh) 基于ahp的网络用户行为风险评估方法
CN109698823A (zh) 一种网络威胁发现方法
CN114615016A (zh) 一种企业网络安全评估方法、装置、移动终端及存储介质
Al-Sanjary et al. Comparison and detection analysis of network traffic datasets using K-means clustering algorithm
US10419449B1 (en) Aggregating network sessions into meta-sessions for ranking and classification
Karimpour et al. Intrusion detection in network flows based on an optimized clustering criterion
Hassan et al. GITM: A GINI index-based trust mechanism to mitigate and isolate Sybil attack in RPL-enabled smart grid advanced metering infrastructures
Selim et al. Intrusion detection using multi-stage neural network
Shen et al. Prior knowledge based advanced persistent threats detection for IoT in a realistic benchmark
Elrawy et al. IDS in telecommunication network using PCA
CN115766081A (zh) 一种电力工控云平台的异常流量检测方法及装置
CN114398635A (zh) 分层安全联邦学习方法、装置、电子设备及存储介质
Abdi et al. The Role of Deep Learning in Advancing Proactive Cybersecurity Measures for Smart Grid Networks: A Survey
Ming et al. Fuzzy Comprehensive Evaluation Algorithm for Power Information System Security Level Based on the Internet of Things.
Zhang et al. A novel network intrusion attempts prediction model based on fuzzy neural network
Villaluna et al. Information security technology for computer networks through classification of cyber-attacks using soft computing algorithms

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 17765055

Country of ref document: US

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21940623

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE