Gene similarity intrusion detection method based on electric power network IEC protocol

Abstract

The invention provides a gene similarity intrusion detection method based on an electric power network IEC protocol. The method comprises the following steps of carrying out information collection onkey nodes of an electric power monitoring system, performing protocol analysis on the acquired IEC message; establishing three levels of mapping models of behavior, events and relations; solving the relationship aggregation between events through automatic discovery of reasoning rules and depth relationship mining; merging of events, carrying out multi-dimensional relationship association, establishing a power network abnormal behavior gene feature library, discovery hidden attacks through gene similarity comparison based on a mean value and deviation model, achieving active defense of security events through multi-mode combination alarm, and blocking network attacks in real time. Local monitoring system paralysis and out-of-control are prevented, hazard spreading is prevented, and situation development is avoided.

Description

technical field [0001] The present invention relates to the technical field of transmission detection of digital information of electric communication technology, in particular to a gene similarity intrusion detection method based on IEC protocol of electric power network. Background technique [0002] The large-scale power outage in Ukraine in 2015 reflected that the power system in the network era has become the preferred target of international cyber warfare, and the power monitoring system and its network security situation is becoming increasingly severe. [0003] At present, the security model of network intrusion detection products in the market mainly adopts passive identity authentication and access control to ensure the security of the system. However, passive protection technology cannot resist attacks such as vulnerable passwords, protocol attacks, Trojan horses, and network sniffers. For access control, intruders can also use system vulnerabilities and vulnerabl...

AI Technical Summary

Problems solved by technology

However, passive protection technology cannot resist attacks such as vulnerable passwords, protocol attacks, Trojan horses, and network sniffers. For access control, intruders can also use system vulnerabilities and vulnerable programs to bypass access control or elevate user rights.

At the same time, network intrusion detection products in the market have problems such as complex functions, high prices, and unsuitability for power system needs.

Images