Intelligent attack capture system based on smartgrid

Abstract

The invention discloses a Smart Grid based intelligent attack capture system. The system comprises a power grid flow calculation center, an SCADA subsystem, a Web display subsystem and an audit and capture subsystem. The power grid flow calculation center comprises a power grid model and a calculation program, and simulates the operation of a real power grid. The SCADA subsystem simulates an intelligent electricity meter and an executive device in the real power grid. The Web display subsystem displays and simulates states and control information of nodes of the power grid. The audit and capture subsystem monitors all ports used by the system. The system fuses an intelligent power grid and a network security technology, has the same framework, parts and network interaction interface as the real power grid, and can calculate a power grid state in real time; a correct response is made when power grid data are changed; and when an attacker invades the power grid, the same response as the real power grid is made to meet the expectation of the attacker, and the attacker is inveigled into performing a next attack, so that a true attack purpose and a complete attack way are exposed and finally all behaviors of the attacker are captured.

Description

technical field [0001] The invention belongs to the technical field of smart grid security, in particular to an attack intelligent capture system based on Smart Grid. Background technique [0002] The smart grid (Smart Grid) system is an important industrial control system and the focus of the national "two modernizations" strategy, but there are many security holes in the smart grid, which may be invaded by attackers at any time. [0003] The number one threat to industrial control systems is malicious code attacks from the network. Industrial control systems use a large number of general-purpose protocols, general-purpose hardware and general-purpose software, and use the TCP / IP protocol to connect to the Internet, which provides sufficient convenience for the spread of malicious codes, making the security problems of industrial control systems increasingly serious. The reason why the "Stuxnet" (Stuxnet) incident caused heavy losses to Iran's nuclear power plant is that d...

AI Technical Summary

Problems solved by technology

The traditional protection method is to replace the software and hardware in the power grid system to reduce the loopholes in the system, but this protection method has obvious disadvantages, namely hysteresis and vulnerability. Only when the power grid is attacked and losses are caused, the administrator Only then can we discover the existence of network attacks, so we can only passively replace the equipment, but cannot grasp the attacker's attack path, attack method, attack tool and exploited loopholes, cannot prescribe the right medicine, and cannot completely avoid the attacker's re-invasion, thus falling into the " In the vicious cycle of being attacked—replacing equipment—being attacked”

Images