Substation network security situation awareness method and system

Abstract

The invention discloses a substation network security situation sensing method and system, wherein the system comprises a network scanning module used for analyzing network messages to realize network topology discovery and network abnormal alarm. The host computer checking module is used for comparing each host computer with the baseline library to obtain the security state of the host computer.The vulnerability scanning module is used for scanning the vulnerability of each host to obtain the vulnerability information of the host. The message parsing module is used to parse the substation message in depth to detect whether there is malformation or attack message. The network equipment detection module is used to monitor the network equipment and security equipment to collect the log. Situation awareness module is used to carry out threat analysis, vulnerability analysis and association analysis according to the information collected by each module. Aiming at the characteristics of the substation network, the invention provides the data objects which are collected for the network security situation perception. And the processing flow and control method are given, which is helpfulto improve the overall network security of the substation.

Description

technical field [0001] The invention relates to a substation network security situation awareness method and system, belonging to the fields of substation network security and electric power automation. Background technique [0002] With the comprehensive popularization and advancement of smart substations, the network of substations at the station control layer, bay layer and process layer is becoming more and more complex. The increasingly complex network environment of substations has also brought more security risks, and the network security in substations has been paid more and more attention. The current network security of substations mainly relies on dedicated networks, security partitions, horizontal isolation, and vertical authentication to achieve boundary protection between security zones and substations. However, the internal network security protection of substations is relatively weak. Once the internal host or secondary equipment is infected with viruses, o...

AI Technical Summary

Problems solved by technology

Once the internal host or secondary equipment is infected with viruses, or non-malicious illegal operations by operators, it will pose a serious security threat to the operation of the substation

Images