Intelligent substation network anomaly traffic detection model construction method based on probability

Abstract

The invention discloses an intelligent substation network anomaly traffic detection model construction method based on a probability. According to the method, by carrying out repeated FARIMA simulation on acquired intelligent substation station control layer communication traffic data, a station control layer normal communication traffic threshold model is obtained; and a network anomaly case shown on the station control layer traffic level is subjected to key analysis, KDD99 anomaly data traffic is extracted and overlaid into original background traffic, anomaly network traffic is generated and used as a threshold datum thereout, and an evaluation index and an algorithm of an intelligent substation communication network are designed to analyze an operation condition of a power communication network. According to the invention, detailed algorithm description is given out by actual acquired traffic of a station control layer of a certain substation in Tianjin as test data, and examples are designed to carry out detection and early warning on substation communication network anomaly traffic.

Description

technical field [0001] The invention relates to a method for constructing a probability-based intelligent substation communication traffic anomaly detection model, which belongs to the field of power grid information security detection. Background technique [0002] While rapidly building intelligent substations, the network security issues of industrial control systems are also receiving increasing attention. The higher the network density of industrial systems is, the more serious the network security problems will be. For example, in 2015, Ukraine's power infrastructure was attacked by malicious code such as BlackEnergy, which finally caused a long power outage and created chaos in the entire society. In recent years, such cyber attacks with the level of information warfare have occurred frequently; the reason is the lack of awareness of cyber security for industrial control systems. [0003] Once an abnormal phenomenon occurs in the network, it may cause the loss of fu...

AI Technical Summary

Problems solved by technology

[0003] Once an abnormal phenomenon occurs in the network, it may cause the loss of functions of smart terminals, protection equipment and other equipment, which will affect the reliable operation of smart substations and even cause chain power safety accidents.

When a network storm occurs, a large number of repeated messages are transmitted in the network, causing network congestion, abnormal monitoring data, equipment interoperability failure, the reliability of protection actions is affected, and the entire substation will eventually appear out of control; and when network intrusion occurs At that time, the IED (Intelligent Electric Device) equipment was arbitrarily controlled by the intruder, and the data of the station control layer was tampered with, causing large-scale power outages and dangerous accidents

Images