Substation terminal account anomaly detection method based on machine learning

Abstract

The invention provides a transformer substation terminal account anomaly detection method based on machine learning, which comprises the following steps: acquiring an access log generated when a login account accesses a transformer substation terminal, inputting the access log into a trained behavior analysis engine, and screening out the login account with an abnormal behavior in the access log; obtaining a mapping relationship between the login account and the login IP, and identifying an abnormal type of the login account based on the mapping relationship; and generating an account anomaly detection result of the transformer substation terminal in combination with the login account with the abnormal behavior and the identification result of the anomaly type. According to the method, the UEBA behavior analysis technology is utilized, the access log of the transformer substation terminal is combined, comprehensive monitoring of the access condition of the transformer substation terminal is achieved, the login account deviating from the normal login behavior can be found in time, and the login account and the login IP maliciously accessing the transformer substation terminal can be effectively recognized.

Description

technical field [0001] The invention belongs to the field of substation terminal account management, and in particular relates to a machine learning-based abnormality detection method for substation terminal accounts. Background technique [0002] With the rapid development of Internet of Things technology in the era of big data, remote login is often used to access substation terminals in the substation operation and maintenance of smart grid at this stage. Therefore, the security detection of login accounts has become an important link in maintaining the network security of substation terminals. The current account anomaly detection scheme for substation terminal security scenarios mainly focuses on the comparison features extracted from various vulnerabilities. Some features extracted from the traffic data generated during the login account access process are matched with the comparison features to determine whether the login account is abnormal. , the above-mentioned det...

AI Technical Summary

Problems solved by technology

The current account anomaly detection scheme for substation terminal security scenarios mainly focuses on the comparison features extracted from various vulnerabilities. Some features extracted from the traffic data generated during the login account access process are matched with the comparison features to determine whether the login account is abnormal. , the above detection scheme has the disadvantage of no generalization ability, and can only detect account anomalies for specified vulnerabilities, which has the problem of inaccurate and untimely account anomaly detection

Images