Priority-considered multi-level backup blocking method for attack exception of an industrial control system

Abstract

The invention relates to a priority-considered industrial control system attack abnormity multistage backup blocking method. The method comprises the steps of intrusion detection, path reconstruction,blocking decision, rule optimization and the like. The method can effectively improve the network security analysis quality and efficiency of the power grid, guarantees the safe and stable operationof the power grid, can promote the large-scale application of the information security protection technology in each industry, improves the technical level in the field of industrial control security,and achieves the autonomous control of the industrial control security. The method has a certain application value for an existing source network load interaction industrial control system.

Description

technical field [0001] The invention relates to an event preprocessing method for integrating power grid information and physical abnormalities, and belongs to the technical field of electric power system security. Background technique [0002] With the construction of the global energy Internet, the rapid development of UHV power grids and distributed energy, micro-grids, controllable users, electric vehicles, etc. have the ability to interact with the power grid in two directions, and have the dual characteristics of "source" and "load". The proportion is also showing a rising trend. The spatio-temporal distribution characteristics of the grid power flow are also becoming more and more complex, and the importance and urgency of interactive collaborative control among the grid, power sources, and users is also increasing. In the context of source-grid-load interaction, the industrial control systems widely distributed in power supply companies, power plants, and substation...

AI Technical Summary

Problems solved by technology

[0003] 1. The accuracy of attack and abnormal identification is low;

[0004] 2. Single means of security defense;

[0005] 3. The reliability of blocking operation cannot be guaranteed

[0006] At present, the blocking methods for abnormal attacks are mainly based on equipment or fixed policies, which are prone to failure due to equipment failure and traffic congestion.

In addition, the backup blocking system based on business impact analysis is not considered, and the business impact is not analyzed and evaluated. The protection strategy between devices is fixed and lacks coordination, and the reliability of attack abnormal blocking cannot be guaranteed. The safe and stable operation of the power grid industrial control system involved has brought hidden dangers

Images