Intelligent substation process level network flow abnormity detection method

Abstract

The invention discloses an abnormity detection method for process-level network traffic of an intelligent substation. The method comprises the following steps: S1, acquiring the process-level networktraffic; S2, carrying out minimum and maximum flow detection: comparing the acquired network flow with a minimum and maximum flow threshold, and directly judging the flow data which is less than the minimum flow threshold and greater than the maximum flow threshold as abnormal flow; S3, calculating a difference sequence variance and a flow abnormality index at the current moment by using the flowdata meeting the threshold; S4, judging whether the traffic abnormality degree at the moment t is greater than 0 or not; S5, judging whether the variance of the difference sequence at time t is greater than or equal to the variance of the difference sequence at time t-1; and S6, if the continuous attack coefficient e at the moment t is equal to or greater than a threshold value em, considering that an attack exists at the moment t, and performing program alarming. According to the invention, burst flow and abnormal flow existing in a transformer substation process layer can be identified; theresponse speed is high, and the high responsiveness requirement of the transformer substation is met.

Description

technical field [0001] The invention relates to the field of smart grid information security, in particular to a detection method suitable for abnormal flow in the process layer of a smart substation. Background technique [0002] The process layer network carrying GOOSE, SV messages and other key information flow transmission is the basis of smart substation and even grid control, and its real-time performance and reliability directly affect the safe and reliable operation of smart substation and even grid. Therefore, the real-time monitoring and abnormal flow detection of network information flow at the process layer is crucial to maintaining the smooth and safe operation of smart substations and even the entire power grid. [0003] Using the network analyzer equipped in the process layer of the substation, the flow information of all IED ports in the process layer can be obtained in real time. By analyzing these traffic information, the operating status of each device in...

AI Technical Summary

Problems solved by technology

[0005] However, the smart substation process layer network has event-driven normal burst traffic

In this case, threshold detection will be difficult to apply

Images