Transformer station network intrusion detection and analysis method based on character fingerprint

Abstract

A transformer station network intrusion detection and analysis method based on a character fingerprint is configured to detect and analyze the transformer station industrial control network intrusion. The method comprises the following steps: (1) establishing a transformer station network topology structure chart through analysis of the transformer station communication network; (2) establishing a character fingerprint bank layering model through the stratification analysis method; (3) performing extraction and analysis of the flow through adoption of the DPI and DFI technologies, extracting the character fingerprint and improving the character fingerprint bank; and (4) establishing a character fingerprint bank assessment system based on the established character fingerprint bank, and performing detection and analysis of the network character fingerprint. The transformer station network intrusion detection and analysis method based on the character fingerprint can perform comprehensive detection and analysis of the transformer station industrial control network intrusion and can rapidly determine the abnormal nodes.

Description

technical field [0001] The invention relates to a substation network intrusion detection and analysis method based on characteristic fingerprints, and belongs to the field of network information security. Background technique [0002] With the vigorous development of information technology, the industrial control system has also achieved rapid development, and the integration between substations and information technology has become more and more close, which has brought a lot of convenience to the operation of the entire substation system, but it is also very important. To a certain extent, the possibility of substations facing security threats is greatly increased. [0003] Due to the increasing use of information and data in digital substations, its role is also more important. Many important functions in digital substations have achieved automatic control, which needs to be achieved through information communication between various devices. The communication is based on...

AI Technical Summary

Problems solved by technology

Traditional network intrusion detection methods based on traffic analysis can accurately detect large-traffic attacks and attacks with obvious characteristics, but attacks with indistinct traffic characteristics are often missed; protocol-based network intrusion detection requires deep packet inspection of packets , there is a problem of low efficiency; based on the detection of device status and configuration, it is not easy to find the specific location of the device

On the whole, the current research is mostly a single detection and analysis, lacking a comprehensive detection and analysis method

Images