CN-121980609-A - Access control method, device, system and medium for power data

CN121980609ACN 121980609 ACN121980609 ACN 121980609ACN-121980609-A

Abstract

The invention relates to the technical field of electric power data regulation and control, and provides an electric power data access control method, device, system and medium. The method comprises the steps of responding to a power data access request of a user, checking request data carried in the power data access request to obtain a check result, automatically triggering a context information acquisition interface to acquire multi-dimensional power data of the user to generate multi-dimensional feature vectors of the user if the check result is that the check result is passed, carrying out anomaly detection on the multi-dimensional feature vectors through a pre-trained anomaly detection model to obtain anomaly scores, carrying out anomaly prediction on the multi-dimensional feature vectors through a pre-trained classification model to obtain risk probability values, and determining a target access strategy based on service dimension data, the anomaly scores and the risk probability values in the request data and the multi-dimensional power data to execute target actions according to the target access strategy. The embodiment of the invention can realize intelligent safety control on the electric power data access request.

Inventors

ZHAO WEISEN
Li Ruicui
CAO WEI
SUN YONGMING
WANG LIANG
SHEN JIAYU
ZHAO XING
ZHANG YANHUI

Assignees

国网商用大数据有限公司

Dates

Publication Date: 20260505
Application Date: 20260106

Claims (10)

1. A method of access control of power data, comprising: responding to a power data access request of a user, and checking request data carried in the power data access request to obtain a check result; If the verification result is that verification is passed, automatically triggering a context information acquisition interface to acquire multi-dimensional power data of the user so as to generate a multi-dimensional feature vector of the user; Performing anomaly detection on the multi-dimensional feature vector through a pre-trained anomaly detection model to obtain an anomaly score; performing abnormal prediction on the multidimensional feature vector through a pre-trained classification model to obtain a risk probability value; And determining a target access policy based on the request data, the business dimension data in the multi-dimensional power data, the abnormality score and the risk probability value, so as to execute a target action according to the target access policy, wherein the target action comprises access approval, access rejection and secondary verification.
2. The method according to claim 1, wherein the responding to the power data access request of the user and verifying the request data carried in the power data access request to obtain the verification result includes: analyzing the power data access request to obtain the request data; formatting and packaging the request data to obtain a standardized request object; carrying out integrity check on the standardized request object to obtain an integrity check result; Carrying out validity check on the signature field in the standardized request object to obtain a validity check result; Carrying out validity check on the request time stamp in the standardized request object to obtain a validity check result; and if the integrity check result, the validity check result and the validity check result are all checked, carrying out identity check on the user to obtain the check result.
3. The method of claim 1, wherein automatically triggering a context information collection interface to collect the user's multi-dimensional power data to generate the user's multi-dimensional feature vector if the verification result is verification pass, comprises: Acquiring data of the user in user identity information dimension, equipment and terminal dimension, time and space dimension, network dimension, service dimension and power grid running state dimension through the context information acquisition interface to obtain multi-dimensional power data of the user; Encoding the multi-dimensional electric power data to obtain numerical value type feature vectors corresponding to each dimensional data; And splicing the numerical type feature vectors to obtain the multidimensional feature vector of the user.
4. The method according to claim 1, wherein the performing anomaly detection on the multi-dimensional feature vector by using a pre-trained anomaly detection model to obtain an anomaly score comprises: Compressing the multidimensional feature vector through an encoder network in the anomaly detection model to obtain potential representation; Reconstructing the potential representation through a decoder network in the anomaly detection model to obtain a reconstructed feature vector; calculating a reconstruction error based on a difference between the reconstructed feature vector and the multi-dimensional feature vector, wherein the reconstruction error comprises a mean square error or a weighted reconstruction error; And determining the abnormality score based on the reconstruction error.
5. The method according to claim 1, wherein the performing anomaly prediction on the multi-dimensional feature vector by using a pre-trained classification model to obtain a risk probability value comprises: Loading the classification model, wherein the number of risk categories output by the classification model is 3; Taking the multi-dimensional feature vector as an input of the classification model, and respectively carrying out forward propagation on the multi-dimensional feature vector through each gradient lifting decision tree integrated by the classification model: traversing from a root node to a leaf node along a preset branch rule in the gradient lifting decision tree based on the value of the multidimensional feature vector; Determining a predicted value of the gradient lifting decision tree based on the scores corresponding to the risk categories in the leaf nodes, wherein the predicted value comprises a predicted score of each risk category; Summing the prediction scores of the risk categories according to the aggregation requirement of the same risk category based on the prediction value of each gradient lifting decision tree to obtain the comprehensive prediction score of each risk category; Carrying out probability distribution mapping on the comprehensive prediction scores of the risk categories through a preset activation function to obtain prediction probability values of the risk categories; and determining the risk probability value based on the probability prediction value of each risk category.
6. The method of claim 1, wherein the determining a target access policy based on the request data, traffic dimension data in the multi-dimensional power data, the anomaly score, and the risk probability value to perform a target action according to the target access policy, wherein the target action includes granting access, denying access, and secondary checking includes: determining a context sensitivity factor based on business dimension data in the multi-dimensional power data; carrying out weighted summation on the context sensitivity factor, the abnormality degree score and the risk probability value to obtain a comprehensive risk score; if the request access internet protocol address in the request data is not in a preset white list and the comprehensive risk score is larger than a preset first score threshold, determining a trigger secondary verification mechanism as the target access strategy so as to carry out secondary verification on the request of the user according to the target access strategy; If the access object in the request data is a power dispatching main database and the comprehensive risk score is larger than a preset second score threshold, determining a pause access request as the target access policy so as to reject the power data access request of the user according to the target access policy; And if the comprehensive risk score is smaller than a preset third score threshold, determining the access grant as the target access policy, so as to grant the power data access request of the user according to the target access policy.
7. The method of claim 1, wherein the determining a target access policy based on the request data, traffic dimension data in the multi-dimensional power data, the anomaly score, and the risk probability value, to perform a target action in accordance with the target access policy, the method further comprises: Generating an access audit log of the user about the current request based on the request data, the multidimensional power data, the abnormality score, the risk probability value and the target access policy, and storing the access audit log in a alliance chain or a state secret blockchain node; Loading a log abstract of the user about the last request from a trusted memory certificate node or a local cache; and calculating the access audit log of the user about the current request and the log abstract of the last request based on a preset hash algorithm to obtain the log abstract of the user about the current request.
8. An access control device for electric power data, comprising: The request data verification module is used for responding to a power data access request of a user and verifying request data carried in the power data access request to obtain a verification result; the context information acquisition module is used for automatically triggering a context information acquisition interface to acquire the multi-dimensional power data of the user if the verification result is that the verification is passed, so as to generate a multi-dimensional feature vector of the user; The anomaly detection module is used for carrying out anomaly detection on the multidimensional feature vector through a pre-trained anomaly detection model to obtain an anomaly score; the anomaly prediction module is used for carrying out anomaly prediction on the multidimensional feature vector through a pre-trained classification model to obtain a risk probability value; and the access control module is used for determining a target access strategy based on the request data, the service dimension data in the multi-dimensional power data, the abnormality degree score and the risk probability value so as to execute a target action according to the target access strategy, wherein the target action comprises access approval, access rejection and secondary verification.
9. An access control system for power data, comprising: And a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-7.
10. A non-transitory computer readable storage medium storing computer instructions for causing a computer to perform the method of any one of claims 1-7.

Description

Access control method, device, system and medium for power data Technical Field The present invention relates to the field of power data control technologies, and in particular, to a method, an apparatus, a system, and a medium for controlling access to power data. Background In the process of production scheduling, equipment operation and maintenance, customer service, market transaction and other business processes, the power enterprise gradually forms a large amount of power data related to the running state of the power grid, the power consumption behavior of the user and the operation management information. The above-mentioned power data generally provides access support to different types of access agents through various business systems, data interfaces or open service modes. Conventional power data access control generally relies on a static access control policy based on roles or rights lists, and mainly determines whether access is allowed or not through user identity authentication, rights matching and other manners. However, such a manner only focuses on the static identity information of the access subject, and when the source, the access behavior or the running environment of the access request changes, the fixed access control rule is difficult to timely and accurately reflect the potential security risk, which easily causes insufficient identification of the high-risk access request or misinterception of the normal access request. Therefore, how to perform intelligent analysis and security control on the electric power data access request to improve the security and the intelligence level in the electric power data access process is a problem to be solved in the art. Disclosure of Invention The invention provides a method, a device, a system and a medium for controlling access to electric power data, which can solve at least one technical problem. In a first aspect, an embodiment of the present invention provides a method for controlling access to power data, including: responding to a power data access request of a user, and checking request data carried in the power data access request to obtain a check result; If the verification result is that verification is passed, automatically triggering a context information acquisition interface to acquire multi-dimensional power data of the user so as to generate a multi-dimensional feature vector of the user; Performing anomaly detection on the multi-dimensional feature vector through a pre-trained anomaly detection model to obtain an anomaly score; performing abnormal prediction on the multidimensional feature vector through a pre-trained classification model to obtain a risk probability value; And determining a target access policy based on the request data, the business dimension data in the multi-dimensional power data, the abnormality score and the risk probability value, so as to execute a target action according to the target access policy, wherein the target action comprises access approval, access rejection and secondary verification. In a second aspect, an embodiment of the present invention provides an access control device for power data, including: The request data verification module is used for responding to a power data access request of a user and verifying request data carried in the power data access request to obtain a verification result; the context information acquisition module is used for automatically triggering a context information acquisition interface to acquire the multi-dimensional power data of the user if the verification result is that the verification is passed, so as to generate a multi-dimensional feature vector of the user; The anomaly detection module is used for carrying out anomaly detection on the multidimensional feature vector through a pre-trained anomaly detection model to obtain an anomaly score; the anomaly prediction module is used for carrying out anomaly prediction on the multidimensional feature vector through a pre-trained classification model to obtain a risk probability value; and the access control module is used for determining a target access strategy based on the request data, the service dimension data in the multi-dimensional power data, the abnormality degree score and the risk probability value so as to execute a target action according to the target access strategy, wherein the target action comprises access approval, access rejection and secondary verification. In a third aspect, an embodiment of the present invention further provides an access control system for power data, including at least one processor, and a memory communicatively connected to the at least one processor, where the memory stores instructions executable by the at least one processor, the instructions being executable by the at least one processor to enable the at least one processor to perform the method according to any one of the embodiments of the present invention. In a fourth aspect, embodiments of the pr