Research on the Optimization of Power System Alarm Functions Based on the ATT&CK Framework

The power monitoring system faces untimely alerts, incomplete coverage, and insufficient defense when dealing with complex and variable APT attacks. The ATT&CK framework can provide comprehensive tagging and identification of attack processes, establishing attack models. This paper integrates the characteristics of the power monitoring system with the ATT&CK framework to achieve intelligent alert functions. The text elaborates on the tactics, techniques, and related foundational concepts and content of the ATT&CK framework; it then analyzes and summarizes the current state of ATT&CK framework applications, including the practical use of the ATT&CK framework structure and the utilization of knowledge base characteristics. Finally, it designs an ATT&CK framework suitable for use in power monitoring systems, considering the characteristics of power monitoring systems.