Dynamic defense system and method of new energy centralized control station network based on dynamic IP

Patent metadata

Field	Value
Publication number	US-12289333-B2
Application number	US-202418808231-A
Country	US
Kind code	B2
Filing date	Aug 19, 2024
Priority date	Mar 7, 2024
Publication date	Apr 29, 2025
Grant date	Apr 29, 2025

Abstract

A method of a new energy centralized control station network based on dynamic IP can determine the occurrence frequency and the occurrence interval of the abnormal traffic, further analyze and determine the defense state of a new energy centralized control station based on this, and execute the corresponding dynamic optimization solution according to different defense states, so that the IP address and the firewall of the new energy centralized control station can be dynamically adjusted to ensure the security performance of the new energy centralized control station, reduce the risk of external intrusion, effectively resist malicious network reconnaissance such as scanning attacks and ensure the stable operation of a new energy power generation system.

First claim

What is claimed is:

1. A dynamic defense method of a new energy centralized control station network based on dynamic IP, comprising:
acquiring network parameters of a defense target, wherein the network parameters comprise an IP address, a port number and a protocol type;
constructing an IP address mapping table according to the network parameters, wherein the IP address mapping table is used for recording an association relationship between the IP address and a device;
monitoring a network traffic of the defense target in real time, calibrating the network traffic as a monitoring parameter, and inputting the monitoring parameter into a verification model to obtain a traffic state, wherein the traffic state comprises a normal traffic and an abnormal traffic;
constructing a monitoring period, calculating an occurrence frequency and an occurrence interval of the abnormal traffic in the monitoring period, calibrating the occurrence frequency and the occurrence interval as a first to-be-evaluated parameter and a second to-be-evaluated parameter and inputting the first to-be-evaluated parameter and the second to-be-evaluated parameter into an evaluation model to obtain a defense state of the defense target, wherein the defense state comprises a normal defense state and an abnormal defense state; comprising:
acquiring the first to-be-evaluated parameter and the second to-be-evaluated parameter;
invoking a first evaluation function and a second evaluation function from the evaluation model;
inputting the first to-be-evaluated parameter into the first evaluation function, and calibrating an output result as an abnormal deviation;
inputting the second to-be-evaluated parameter into the second evaluation function, and calibrating an output result as an abnormal trend value;
inputting the abnormal deviation and the abnormal trend value into the evaluation model respectively, and outputting the defense state of the defense target;
inputting the abnormal deviation and the abnormal trend value into the evaluation model respectively, and outputting the defense state of the defense target specifically comprises:
acquiring the abnormal deviation and the abnormal trend value in real time;
invoking a first evaluation threshold and a second evaluation threshold from the evaluation model, comparing the abnormal deviation with the first evaluation threshold, and comparing the abnormal trend value with the second evaluation threshold;
if any one of the abnormal deviation and the abnormal trend value exceeds the corresponding first evaluation threshold or second evaluation threshold, issuing an alarm signal immediately, and calibrating the defense state of the defense target as an abnormal defense state;
if the abnormal deviation and the abnormal trend value are both less than the corresponding first evaluation threshold and second evaluation threshold, calibrating the defense state of the defense target as a normal defense state;
summarizing data packets corresponding to the network traffic in the monitoring period, inputting the data packets into a dynamic optimization model, and dynamically adjusting the IP address by the dynamic optimization model according to the defense state.

2. The dynamic defense method of the new energy centralized control station network based on dynamic IP according to claim 1 , wherein a step of inputting the monitoring parameter into the verification model to obtain a traffic state comprises:
acquiring historical network traffic data of the defense target, and classifying the historical network traffic data into a normal traffic database and an abnormal traffic database;
comparing the monitoring parameter with the historical network traffic data in the abnormal traffic database, and when the monitoring parameter has the data packet consistent with the historical network traffic data in the abnormal traffic database, calibrating the monitoring parameter as abnormal traffic; otherwise, comparing the monitoring parameter with the historical network traffic data in the normal traffic database and calibrating a comparison result as a to-be-verified parameter;
invoking a verification threshold from the verification model and comparing with the to-be-verified parameter;
if the to-be-verified parameter is greater than or equal to the verification threshold, indicating that the monitoring parameter is secure and allowing normal access and transmission;
if the to-be-verified parameter is less than the verification threshold, indicating that the monitoring parameter is not secure, intercepting all abnormal data packets under the monitoring parameter and summarizing into the abnormal traffic database.

3. The dynamic defense method of the new energy centralized control station network based on dynamic IP according to claim 2 , wherein a step of comparing the monitoring parameter with the historical network traffic data in the normal traffic database and calibrating a comparison result as a to-be-verified parameter comprises:
acquiring the historical network traffic data in the normal traffic database and calibrating the data as a reference parameter;
performing vector conversion on the reference parameter and the monitoring parameter to obtain a reference vector corresponding to the reference parameter and a verification vector corresponding to the monitoring parameter;
acquiring a verification function, inputting the reference vector and the verification vector into the verification function for combined operation, and calibrating an output result as a to-be-verified parameter;
wherein a value of the to-be-verified parameter is 0 to 1, and the greater the value of the to-be-verified parameter is, the closer the reference parameter is to the monitoring parameter.

4. The dynamic defense method of the new energy centralized control station network based on dynamic IP according to claim 1 , wherein a step of constructing a monitoring period, calculating an occurrence frequency and an occurrence interval of the abnormal traffic in the monitoring period, and calibrating the occurrence frequency and the occurrence interval as a first to-be-evaluated parameter and a second to-be-evaluated parameter comprises:
setting a plurality of sampling nodes within the monitoring period, and counting the monitoring parameters under each sampling nodes;
calibrating the total occurrence times of the abnormal traffic directly as the first to-be-evaluated parameter;
acquiring all sampling nodes corresponding to the abnormal traffic, calibrating the sampling nodes as abnormal nodes, and arranging all abnormal nodes from front to back according to an occurrence sequence;
acquiring a time interval between the adjacent abnormal nodes and calibrating the time interval as the second to-be-evaluated parameter.

5. The dynamic defense method of the new energy centralized control station network based on dynamic IP according to claim 1 , wherein a step of summarizing data packets corresponding to the network traffic in the monitoring period, inputting the data packets into the dynamic optimization model, and dynamically adjusting the IP address according to the defense state by a dynamic optimization module comprises:
acquiring the data packets corresponding to the network traffic in the monitoring period and calibrating the data packets as to-be-optimized data;
invoking a preoptimization condition from the dynamic optimization model, wherein the preoptimization condition comprises normal optimization and abnormal optimization, the normal optimization corresponds to the normal defense state, and the abnormal optimization corresponds to the abnormal defense state;
if the preoptimization condition is normal optimization, traversing abnormal fields in all the abnormal data packets, and adjusting an IP address and firewall rules f

Assignees

• State Grid Jiangxi Electric Power Res Institute
• State Grid Jiangxi Electric Power Co Ltd
• State Grid Corp China

Inventors

• Yang Hao
• Xu Jian
• Xiao Yongcai
• Zhang Lingling
• Pan Shuhui

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• Y04S40/20

  Information technology specific aspects, e.g. CAD, simulation, modelling, system security · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title