Threat Tracing of Power Distribution Automation System Based on Spatiotemporal and Business Logic Correlation Technology of Security Events

As an important part of the power system, the Internet of Things of power distribution is essential for the stable and reliable operation of the entire power system. In order to deal with new cyber attacks and threats, this paper proposes a threat tracing technology for power distribution Internet of Things security events. Firstly, the types of security incidents that may occur in the “cloud, pipe, edge, and end” links of the power distribution Internet of Things are sorted out. Secondly, on the basis of multi-source databases, the knowledge graph of security events is constructed to realize the correlation of security events. Thirdly, the knowledge graph is used to model the scene, and the attack scenario is reconstructed through the association between the event and the scene, so as to accurately reconstruct the generation path of the security event. Finally, experiments show that the technology can quickly locate the source of security events and realize the threat tracing of power distribution Internet of Things security events.