Detection method, based on entropy analysis, of traffic abnormity of smart grid communication network

Abstract

The invention discloses a detection method, based on entropy analysis, of traffic abnormity of a smart grid communication network. The method comprises the following steps: S1, receiving characteristic values of log information produced during operation of a smart grid in real time; S2, making statistics of the probability of occurrence of each characteristic value within a time threshold; S3, computing the entropy of each characteristic value, and performing normalization processing, so as to produce entropy vectors; S4, repeating S1 to S3, computing the difference value of entropy vectors of the current time threshold and the previous time threshold, and judging the types of network traffic abnormity according to the difference value of the entropy vectors and network traffic attack characteristics. According to the method, the method for acquiring the entropy vectors is relatively simple, and the demand of smart grid log information real-time detection can be effectively met. On the other hand, the method can not only detect log abnormity, but also judge the types of abnormity according to obtained log information, further obtain reasons of smart grid log abnormity, and properly meet the detection requirements of the smart grid.

Description

technical field [0001] The invention relates to a method for detecting abnormal flow of a communication network of a smart grid, in particular to a method for detecting abnormal flow of a communication network of a smart grid based on entropy analysis, and belongs to the technical field of electric power communication security. Background technique [0002] With the rapid expansion of network scale, the security problems faced by the network are becoming more and more complex. The analysis of network traffic is an important research content of network security management, especially intrusion detection analysis. Network anomalies are one of the major threats to networks. Typical abnormal network activities include Distributed Denial of Service (DDos), port scanning, worms and viruses, etc. Nowadays, although there has been a large amount of related research on network anomaly detection, it is still a challenge to find a generic method to detect network anomalies. [0003] ...

AI Technical Summary

Problems solved by technology

[0006] However, as a two-way power and information flow infrastructure that integrates power distribution systems and communication networks, the smart grid will generate a large amount of log information during operation. Requirements for real-time log detection

On the other hand, the above processing method can only detect log anomalies, and cannot judge the anomaly type based on the acquired log information, and then obtain the cause of smart grid log anomalies, which cannot well meet the detection needs of smart grid

Images