AI-Based Global Situational Awareness System Design and Application for IT Terminals
Yongqiang Wang, Hong Wei Hu, Yingcong Chen, Zhiming Chen, Zilong Li · 2024
Cyber security threats to power systems are constantly evolving, and traditional security protection means are difficult to cope with new and complex attacks. This paper proposes a global situational awareness system for IT terminals based on artificial intelligence, which realizes real-time monitoring and early warning of IT terminals and networks through intelligent analysis and active defense. The system adopts a global data collection method to comprehensively monitor user operational behavior and network traffic through a user behavior data collection tool based on browser plug-ins and a network traffic collection tool based on agent software. To address the issues of user operational behavior deviation and network traffic security, the system introduces a user behavior analysis model based on graph matching algorithm and a network security situational awareness model, which can effectively identify abnormal user behavior and potential risks of the power grid, and significantly improve the system response capability. The system has been applied in the power grid industry and has shown excellent protection effects in the complex and changing network environment.