In electric power system (EPS), it is difficult to fuse the security data of multi-source heterogeneous networks, and the real-time situation awareness is not good. Therefore, this article presents a network security situation awareness (NSSA) algorithm based on semantic alignment and lightweight graph neural network. By constructing power security ontology, the semantic unification of multi-source data such as logs, traffic and control messages is achieved. This method uses the improved D-S evidence theory for dynamic weight fusion, and reduces the redundant alarm rate to 634/72 hours, which is nearly 50% higher than the traditional method. On this basis, a hierarchical risk assessment model is designed, and a comprehensive risk index is generated by combining asset importance, threat severity and vulnerability exposure. In the study, knowledge distillation technology is also introduced to compress GNN model, which can ensure the accuracy of 86.9% and the performance of 0.887 AUC, and at the same time control the single reasoning delay within 34.8 ms. The results show that this method is superior to the existing schemes in the ability of compound attack identification and alarm merging efficiency, and has a good engineering application prospect.
Chen et al. (Sun,) studied this question.