A method for abnormal detection of network traffic in process layer of intelligent substation

Abstract

The invention discloses a method for detecting abnormality of network traffic at a process layer of an intelligent substation, comprising the following steps: step S1, acquiring network traffic at a process layer; step S2, detecting minimum and maximum traffic, and comparing the acquired network traffic with the minimum and maximum traffic thresholds. By comparison, for the flow data smaller than the minimum flow threshold and larger than the maximum flow threshold, it is directly judged as abnormal flow; Step S3, using the flow data satisfying the threshold, calculate the variance of the difference sequence at the current moment and the flow abnormality index; Step S4, judge the flow at time t Whether the degree of abnormality is greater than 0; Step S5, determine whether the variance of the differential sequence at time t is greater than or equal to the variance of the differential sequence at time t-1; Step S6, if the continuous attack coefficient e at time t is equal to or greater than the threshold e m , it is considered that there is an attack at time t, and the program alarms. The invention can identify the burst flow and abnormal flow existing in the process layer of the substation; the response speed is fast, and the requirement of high responsiveness of the substation is satisfied.

Description

technical field [0001] The invention relates to the field of smart grid information security, in particular to a method for detecting abnormal flow in a process layer of a smart substation. Background technique [0002] The process layer network that carries the transmission of key information flows such as GOOSE and SV messages is the basis for the control of smart substations and even the power grid. Its real-time and reliability directly affect the safe and reliable operation of smart substations and even the power grid. Therefore, the real-time monitoring and abnormal flow detection of network information flow at the process layer are crucial to maintaining the smooth and safe operation of smart substations and even the entire power grid. [0003] Using the network analyzer equipped in the process layer of the substation, the flow information of all IED ports in the process layer can be obtained in real time. By analyzing the flow information, the running status of each...

AI Technical Summary

Problems solved by technology

[0005] However, the smart substation process layer network has event-driven normal burst traffic

In this case, threshold detection will be difficult to apply

Images