User security access control method and system for electric power industrial control system of digital substation

Abstract

The invention belongs to the field of electric power industrial control system safety. The invention provides a digital substation power industrial control system user security access control method and system innovatively. The method comprises the following steps: calculating an abnormal score # imgabs0 # that a kth user Vk accesses a digital substation power industrial control system for the ith time, and calculating an abnormal score set of each access of all users according to the abnormal score # imgabs1 #; the abnormal scores in the abnormal score set are ranked from small to large according to numerical values to obtain S ', access recognition is conducted according to the ranked abnormal score set, the problems that a traditional access method is complex in implementation and needs to process a large amount of data are solved, and the method is scientific, reasonable, low in energy consumption, easy to implement and high in practicability. The user access can be evaluated and judged more accurately, and the access safety of the electric power industrial control system of the digital substation is effectively ensured.

Description

Technical Field

[0001] The present invention relates to the field of power industrial control system security, and in particular to a user security access control method and system for a digital substation power industrial control system. Background Art

[0002] The statements in this section merely provide background art related to the present invention and do not necessarily constitute prior art.

[0003] The security of the power industrial control system of digital substation is a focus of great concern in the power industry, because it is directly related to the stability of power supply and the safe operation of the entire power grid. The main purpose of studying the user security access control method in the power industrial control system of digital substation is to ensure the security and stability of the system, prevent unauthorized access and operation, and thus ensure the reliable operation of the power system. Protect the system from illegal access, formulate an effective user access control strategy, and ensure that only authorized users can enter the system; enhance the system's defense capabilities, and improve the defense capabilities of the power industrial control system of the substation against various security threats by researching and implementing advanced access control technologies; reduce operational risks, ensure that the user access control strategy can effectively distinguish the permissions of different users, prevent users from exceeding their authority, and thus reduce the risks brought by operational errors or malicious behavior; improve user management efficiency, optimize user access control mechanisms, simplify user management processes, and improve the work efficiency of administrators.

[0004] Industrial Control Systems (ICS) usually include Supervisory Control and Data Acquisition (SCADA) systems, Distributed Control Systems (DCS), Remote Terminal Units (RTU), Programmable Logic Controllers (PLC), etc. These systems are responsible for monitoring and controlling various parts of the power network. The industrial control system of digital substations has been widely used in recent years.

[0005] With the development of technology and the popularization of applications, user security access control has become increasingly important. The main research methods are: Multi-factor authentication (MFA), a technology that enhances user identity authentication, improves system security by combining multiple authentication factors such as passwords, hardware tokens, and fingerprints. In digital substations, MFA is often used to ensure that only authorized users can access the system, especially in scenarios where remote access is required. Role-based access control (RBAC), RBAC simplifies permission management and improves system manageability and security by assigning specific permissions to different roles.

[0006] In power industrial control systems, RBAC can ensure that users of different levels and functions can perform specific operations only when authorized. Attribute-based access control (ABAC) determines access rights based on user attributes, resource attributes, and environmental conditions, providing more refined control than RBAC. It is suitable for complex access control requirements and can handle complex operating scenarios and changing user needs in substations.

[0007] However, the security of power industrial control systems still faces many problems. For example, as power systems transform toward intelligence and networking, industrial control systems are increasingly connected to the Internet, increasing the possibility of cyber attacks. In large-scale power industrial control systems, especially in dynamically changing environments, user role and permission management becomes extremely complex. Summary of the invention

[0008] In order to address the deficiencies in the prior art, the present invention provides a method and system for user security access control of a digital substation power industrial control system, which solves the problem that traditional access methods are relatively complex to implement and require the processing of large amounts of data. The method is scientific, reasonable, low-energy-consuming, and easy to implement, and effectively ensures the access security of the digital substation power industrial control system.

[0009] In order to achieve the above object, the present invention adopts the following technical solution:

[0010] In a first aspect, the present invention provides a method for controlling user security access to a power industrial control system of a digital substation.

[0011] A method for controlling user security access to a digital substation power industrial control system includes the following steps:

[0012] Get the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation and abnormal access deviation vector group Calculate the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation Model and abnormal access deviation vector group Model

[0013] Calculate the kth user V k Abnormal score of the i-th visit to the power industrial control system of the digital substation Based on the anomaly score Calculate the set of anomaly scores for each visit of all users;

[0014] Arrange the anomaly scores in the anomaly score set from small to large according to the numerical value to obtain S ′ , access identification is performed based on the arranged anomaly score set.

[0015] In a second aspect, the present invention provides a user security access control system for a digital substation power industrial control system.

[0016] A user security access control system for a digital substation power industrial control system, comprising:

[0017] The deviation vector group acquisition unit is configured to: obtain the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation and abnormal access deviation vector group Calculate the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation Model and abnormal access deviation vector group Model

[0018] The abnormal score set generating unit is configured to: calculate the kth user V k Abnormal score of the i-th visit to the power industrial control system of the digital substation Based on the anomaly score Calculate the set of anomaly scores for each visit of all users;

[0019] The abnormal access judgment unit is configured to: arrange the abnormal scores in the abnormal score set from small to large according to the numerical value to obtain S ′ , access identification is performed based on the arranged anomaly score set.

[0020] In a third aspect, the present invention provides a computer device, comprising: a processor and a computer-readable storage medium;

[0021] a processor adapted to execute a computer program;

[0022] A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by the processor, the user security access control method for the digital substation power industrial control system as described in the first aspect of the present invention is implemented.

[0023] In a fourth aspect, the present invention provides a computer-readable storage medium storing a computer program, wherein the computer program is suitable for being loaded by a processor and executing the user security access control method for a digital substation power industrial control system as described in the first aspect of the present invention.

[0024] In a third aspect, the present invention provides a computer program product, characterized in that the computer program product comprises a computer program, and when the computer program is executed by a processor, it implements the user security access control method for the digital substation power industrial control system as described in the first aspect of the present invention.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] The present invention innovatively proposes a user security access control method for a digital substation power industrial control system, and calculates the kth user V k Abnormal score of the i-th visit to the power industrial control system of the digital substation Based on the anomaly score Calculate the abnormal score set of all users for each visit; arrange the abnormal scores in the abnormal score set from small to large according to the numerical value to obtain S ′ , access identification (including normal access, suspicious access or unauthorized access) is performed according to the arranged abnormal score set, which solves the problem that the traditional access method is complicated in implementation and needs to process a large amount of data. It is scientific, reasonable, low-energy, easy to implement, and can evaluate and judge user access more accurately, effectively ensuring the access security of the digital substation power industrial control system.

[0027] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0029] Figure 1 A schematic diagram of a user security access control method for a digital substation power industrial control system provided in Embodiment 1 of the present invention;

[0030] Figure 2A schematic diagram of a user security access control system for a digital substation power industrial control system provided in Embodiment 2 of the present invention;

[0031] Figure 3 A schematic diagram of a computer device provided in Example 3 of the present invention. DETAILED DESCRIPTION

[0032] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0033] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0034] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0035] Embodiment 1:

[0036] This implementation proposes a user security access control method for a digital substation power industrial control system, including the following processes:

[0037] S1: Collection of user access information of digital substation power industrial control system.

[0038] Assume that there are M users in the digital substation power control system, and define the user set V = (k 1 ,V 2 ,…,V M ), the kth user V k The duration of the i-th access to the digital substation power industrial control system is k=1,2,…,M,i=1,2,…, For the kth user V k Number of visits to the digital substation power industrial control system in the past year, The unit is hour, the kth user V k The time interval from the i-th visit to the i+1-th visit is The unit is hours, define the kth

[0039] User V k The frequency of the i-th visit for:

[0040]

[0041] Define the access type set of digital substation power industrial control system R = (r 1 ,r 2 ,r 3,r 4 ,r 5 ,r 6 ), where r 1 Represents the relay protection system, r 2 represents the electric energy metering system, r 3 represents the distribution network automation system, r 4 represents the electricity market trading system, r 5 represents the substation integrated automation system, r 6 represents the communication system; the kth user V k The i-th visit to the digital substation power industrial control system is expressed as represents the kth user V k The qth system in R is visited for the i-th time, q = 1, 2, ..., 6, and the initial state If the kth user V k The qth system r in R is visited for the i-th time q , then let

[0042] S2: User access information processing of digital substation power industrial control system.

[0043] For the kth user V k The duration of the i-th visit to the digital substation power industrial control system The kth user V k The frequency of the i-th visit to the digital substation power industrial control system Then the kth user V k Average duration of access to the power industrial control system of digital substations in the past year and the kth user V k Standard deviation of the duration of visits to the power industrial control system of the digital substation in the past year Defined as:

[0044]

[0045] For the kth user V k The duration of the i-th visit to the digital substation power industrial control system Perform zero mean normalization on the overall data to obtain the kth user V k Standardized access duration of the ith access to the power industrial control system of the digital substation

[0046]

[0047] The kth user V k Average frequency of access to digital substation power industrial control system in the past year and the kth user V k Standard deviation of the frequency of visits to the power industrial control system of the digital substation in the past year for:

[0048]

[0049] For the kth user V k The frequency of the i-th visit to the digital substation power industrial control system Perform zero mean normalization on the overall data to obtain the kth user V k Normalized access frequency of the ith access to the digital substation power industrial control system

[0050]

[0051] The kth user V k Duration of visits to the digital substation power industrial control system in the past year In, if This means that the access time is normal, otherwise it is abnormal. k Frequency of visits to the digital substation power industrial control system in the past year In, if It means that the access frequency this time is a normal access frequency, otherwise it is an abnormal access frequency; e is an empirical value, which can be adjusted according to the sensitivity of the digital substation power industrial control system to normal access and abnormal access. By default, e=2.

[0052] For the jth user V k The average normal access time of the digital substation power industrial control system in the past year is calculated and recorded as For the kth user V k The variance of the normal access time of the power industrial control system of the digital substation in the past year is calculated and recorded as For the kth user V k The duration of the i-th visit to the digital substation power industrial control system Perform zero mean normalization on the normal access time data to obtain the kth user V k The normalized access time of the ith access to the digital substation power control system in the normal access time data

[0053]

[0054] For the kth user V kThe average value of abnormal access time to the power industrial control system of the digital substation in the past year is recorded as For the kth user V k The variance of the abnormal access time of the power industrial control system of the digital substation in the past year is calculated and recorded as For the kth user V k The duration of the i-th visit to the digital substation power industrial control system Perform zero mean normalization on the abnormal access duration data to obtain the kth user V k The normalized access time of the ith access to the digital substation power control system in the abnormal access time data is denoted as

[0055]

[0056] For the kth user V k The average value of the normal access frequency to the power industrial control system of the digital substation in the past year is calculated and recorded as For the kth user V k The variance of the normal access frequency of the power industrial control system of the digital substation in the past year is calculated and recorded as For the kth user V k The frequency of the i-th visit to the digital substation power industrial control system Perform zero mean normalization on the normal access frequency data to obtain the kth user V k The normalized access duration of the ith access to the digital substation power control system in the normal access frequency data is recorded as

[0057]

[0058] For the kth user V k The average frequency of abnormal access to the power industrial control system of the digital substation in the past year is calculated and recorded as For the kth user V k The variance of the abnormal access frequency to the power industrial control system of the digital substation in the past year is calculated and recorded as For the kth user V k The frequency of the i-th visit to the digital substation power industrial control system Perform zero mean normalization on the abnormal access frequency data to obtain the kth user V k The normalized access duration of the ith access to the digital substation power control system in the abnormal access frequency data is denoted as

[0059]

[0060] Construct the kth user V k The overall probability set of system types that accessed the power industrial control system of the digital substation in the past year in, For the kth user V k Visit the relay protection system of the power industrial control system of the digital substation in the last year 1 The probability of For the kth user V k Visit the electric energy metering system of the digital substation power industrial control system in the last year 2 The probability of For the kth user V k The distribution network automation system of the power industrial control system of the digital substation has been visited in the last year 3 The probability of For the kth user V k The power market trading system of the power industrial control system of the digital substation in the last year 4 The probability of For the kth user V k In the past year, I have visited the digital substation power industrial control system of the substation integrated automation system. 5 The probability of For the kth user V k Visit the communication system of the power industrial control system of the digital substation in the last year 6 The probability of is expressed as:

[0061]

[0062] Construct the kth user V k Distribution of system types for the i-th visit to the power industrial control system of digital substation in, For the kth user V k The i-th visit to the relay protection system of the digital substation power industrial control system r 1 The probability of For the kth user V k The i-th visit to the electric energy metering system of the digital substation power industrial control system r 2 The probability of For the kth user V k The i-th visit to the distribution network automation system of the digital substation power industrial control system r 3 The probability of For the kth user V k The i-th visit to the digital substation power industrial control system power market trading system r 4 The probability of For the kth user Vk The i-th visit to the digital substation power industrial control system of the substation integrated automation system r 5 The probability of For the kth user V k The communication system r of the digital substation power industrial control system is visited for the i-th time 6 The probability is calculated as:

[0063]

[0064] Define the kth user V k Similarity between the distribution of system types and the overall probability of the i-th visit to the power industrial control system of the digital substation for:

[0065]

[0066] like Then it means that the kth user V k The i-th access to the digital substation power industrial control system is a normal access system type, otherwise it is an abnormal access system type; the k-th user V k The probability of each system type appearing in all normal access system types in the last year is recorded as The kth user V k The probability of each system type appearing in all abnormal access system types in the past year is recorded as

[0067] S3: Exception handling of user access records in the power industrial control system of digital substations.

[0068] Construct the kth user V k The access feature vector group of the i-th access to the digital substation power industrial control system The kth user V k Normal access model for the i-th access to the power industrial control system of digital substation The kth user V k Abnormal access model for the i-th access to the power industrial control system of digital substation

[0069] Calculate the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation and abnormal access deviation vector group

[0070]

[0071] Calculate the kth user V kNormal access deviation vector group of the i-th access to the power industrial control system of the digital substation Model and abnormal access deviation vector group Model

[0072]

[0073] Calculate the kth user V k Abnormal score of the i-th visit to the power industrial control system of the digital substation

[0074]

[0075] Among them, α is the amplitude adjustment factor, which is used to adjust the amplitude of the anomaly score. It can be adjusted according to the expected magnitude of the anomaly score. The default setting is α = 10. β is the slope adjustment factor, which is used to control the slope of the overall function and determines the rate at which the anomaly score changes with the degree of deviation. It can be adjusted according to the actual situation. The default setting is β = 1, θ U and θ Z They are the thresholds for normal access and abnormal access respectively. The threshold for normal access is set by default as the average value of the modulus of the deviation vector group of all users' normal access, and the threshold for abnormal access is set by default as the average value of the modulus of the deviation vector group of all users' abnormal access. The calculation formula can be expressed as:

[0076]

[0077] S4: User security access judgment of digital substation power industrial control system.

[0078] According to the kth user V k Abnormal score of the i-th visit to the power industrial control system of the digital substation The set of abnormal scores for each visit of all users is obtained as follows:

[0079]

[0080] Arrange the anomaly scores in the set from small to large by numerical value to get S ′ , select the 95th percentile in the set as Select the 99th percentile in the set as like Indicates that the user is accessing normally. Indicates suspicious user access. Indicates that the user has unauthorized access.

[0081] Embodiment 2:

[0082] like Figure 2As shown, this implementation method provides a user security access control system for a digital substation power industrial control system, including:

[0083] The deviation vector group acquisition unit is configured to: obtain the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation and abnormal access deviation vector group Calculate the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation Model and abnormal access deviation vector group Model

[0084] The abnormal score set generating unit is configured to: calculate the kth user V k Abnormal score of the i-th visit to the power industrial control system of the digital substation Based on the anomaly score Calculate the set of anomaly scores for each visit of all users;

[0085] The abnormal access judgment unit is configured to: arrange the abnormal scores in the abnormal score set from small to large according to the numerical value to obtain S ′ , access identification is performed based on the arranged anomaly score set.

[0086] The specific processes of the above-mentioned units are described in Example 1 and will not be repeated here.

[0087] It is understandable that the above-mentioned various units can be separately or all combined into one or several other units to constitute, or some (some) units therein can also be split into multiple smaller units in function to constitute, which can achieve the same operation without affecting the realization of the technical effects of the embodiments of the present application. The above-mentioned units are divided based on logical functions. In practical applications, the function of a unit can also be realized by multiple units, or the function of multiple units can be realized by one unit. In other embodiments of the present application, the system can also include other units. In practical applications, these functions can also be implemented with the assistance of other units, and can be implemented by the collaboration of multiple units.

[0088] According to another embodiment of the present application, the system described in this embodiment can be constructed, and the method of Example 1 of the present application can be implemented by running a computer program (including program code) capable of executing the steps involved in the corresponding method described in Example 1 on a general computing device such as a computer, which includes processing elements and storage elements such as a central processing unit (CPU), random access memory (RAM), and read-only memory (ROM). The computer program can be recorded on, for example, a computer-readable recording medium, and loaded into the above-mentioned computing device through the computer-readable recording medium and run therein.

[0089] Embodiment 3:

[0090] like Figure 3 As shown, this implementation provides an electronic device, which includes a processor 1001, a communication interface 1002, and a computer-readable storage medium 1003. The processor 1001, the communication interface 1002, and the computer-readable storage medium 1003 may be connected via a bus or other means.

[0091] Among them, the communication interface 1002 is used to receive and send data, the computer-readable storage medium 1003 can be stored in the memory of the electronic device, the computer-readable storage medium 1003 is used to store a computer program, the computer program includes program instructions, and the processor 1001 is used to execute the program instructions stored in the computer-readable storage medium 1003.

[0092] Processor 1001 (or CPU (Central Processing Unit)) is the computing core and control core of the electronic device, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to implement corresponding method processes or corresponding functions.

[0093] The processor 1001 is configured to execute the following process:

[0094] Get the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation and abnormal access deviation vector group Calculate the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation Model and abnormal access deviation vector group Model

[0095] Calculate the kth user V k Abnormal score of the i-th visit to the power industrial control system of the digital substation Based on the anomaly score Calculate the set of anomaly scores for each visit of all users;

[0096] Arrange the anomaly scores in the anomaly score set from small to large according to the numerical value to obtain S ′ , access identification is performed based on the arranged anomaly score set.

[0097] The specific process is described in Example 1 and will not be repeated here.

[0098] Embodiment 4:

[0099] This implementation provides a computer-readable storage medium (Memory), which is a memory device in an electronic device for storing programs and data. It is understandable that the computer-readable storage medium here can include both built-in storage media in the electronic device and, of course, extended storage media supported by the electronic device. The computer-readable storage medium provides a storage space that stores the processing system of the electronic device.

[0100] In addition, the storage space also stores one or more instructions suitable for being loaded and executed by the processor, and these instructions may be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here may be a high-speed RAM memory, or a non-volatile memory, such as at least one disk memory; optionally, it may also be at least one computer-readable storage medium located away from the aforementioned processor.

[0101] In one embodiment, the computer-readable storage medium stores one or more instructions; the processor loads and executes the one or more instructions stored in the computer-readable storage medium to implement the following process:

[0102] Get the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation and abnormal access deviation vector group Calculate the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation Model and abnormal access deviation vector group Model

[0103] Calculate the kth user V kAbnormal score of the i-th visit to the power industrial control system of the digital substation Based on the anomaly score Calculate the set of anomaly scores for each visit of all users;

[0104] Arrange the anomaly scores in the anomaly score set from small to large according to the numerical value to obtain S ′ , access identification is performed based on the arranged anomaly score set.

[0105] The specific process is described in Example 1 and will not be repeated here.

[0106] Embodiment 5:

[0107] The present implementation provides a computer program product or a computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device performs the following process:

[0108] Get the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation and abnormal access deviation vector group Calculate the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation Model and abnormal access deviation vector group Model

[0109] Calculate the kth user V k Abnormal score of the i-th visit to the power industrial control system of the digital substation Based on the anomaly score Calculate the set of anomaly scores for each visit of all users;

[0110] Arrange the anomaly scores in the anomaly score set from small to large according to the numerical value to obtain S ′ , access identification is performed based on the arranged anomaly score set.

[0111] The specific process is described in Example 1 and will not be repeated here.

[0112] A person skilled in the art can appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0113] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When loading and executing computer program instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instruction can be stored in a computer-readable storage medium or transmitted by a computer-readable storage medium. The computer instruction can be transmitted from a website site, a computer, a server or a data center to another website site, a computer, a server or a data center by wired (for example, coaxial cable, optical fiber, digital line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data processing device such as a server, a data center, etc. that contains one or more available media integration. Available media can be magnetic media (for example, floppy disk, hard disk, tape), optical media (for example, DVD), or semiconductor media (for example, solid-state drive (Solid State Disk, SSD)) and the like.

[0114] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for controlling user security access to a digital substation power industrial control system, characterized in that: The process includes: Get the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation and abnormal access deviation vector group Calculate the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation Model and abnormal access deviation vector group Model Calculate the kth user V k Abnormal score of the i-th visit to the power industrial control system of the digital substation Based on the anomaly score Calculate the set of anomaly scores for each visit of all users; Arrange the anomaly scores in the anomaly score set from small to large according to the numerical value to obtain S ′ , access identification is performed based on the arranged anomaly score set.

2. The user security access control method for the digital substation power industrial control system according to claim 1 is characterized in that: Get the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation and abnormal access deviation vector group include: According to the kth user V k Standardized access duration of the ith access to the power industrial control system of the digital substation The kth user V k Normalized access frequency of the ith access to the digital substation power industrial control system The kth user V k The i-th visit to the digital substation power industrial control system is expressed as Constructing access feature vector groups According to the kth user V k Normalized access time of the ith access to the digital substation power control system in the normal access time data The kth user V k Normalized access duration of the ith access to the digital substation power control system in normal access frequency data The kth user V k The probability of each system type appearing in all normal access system types during the last year of access Building a normal access model According to the kth user V k Normalized access duration of the ith access to the digital substation power industrial control system in the abnormal access duration data The kth user V k Normalized access duration of the ith access to the digital substation power control system in abnormal access frequency data The kth user V k The probability of occurrence of various system types among all abnormal access system types in the past year Building an abnormal access model 3. The user security access control method for the digital substation power industrial control system according to claim 2 is characterized in that: Calculate the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation Model and abnormal access deviation vector group Model include:

4. The user security access control method for the digital substation power industrial control system according to any one of claims 1 to 3, characterized in that: Calculate the kth user V k Abnormal score of the i-th visit to the power industrial control system of the digital substation include: Among them, α is the amplitude adjustment factor, β is the slope adjustment factor, and θ U and θ Z are the thresholds for normal access and abnormal access respectively.

5. The user security access control method for the digital substation power industrial control system according to claim 4 is characterized in that: The threshold value of normal access is θ U for: Abnormal access threshold θ Z for: Where M is the total number of users, For the kth user V k Number of visits to the digital substation power industrial control system in the past year; or, The kth user V k Duration of visits to the digital substation power industrial control system in the past year In, if Then the access time is the normal access time, otherwise it is the abnormal access time; The kth user V k Frequency of visits to the digital substation power industrial control system in the past year In, if Then the access frequency this time is the normal access frequency, otherwise it is the abnormal access frequency; Among them, e is the experience value, For the kth user V k Average duration of access to the digital substation power industrial control system in the past year, For the kth user V k Standard deviation of the duration of visits to the power industrial control system of the digital substation in the past year, For the kth user V k Average frequency of access to the digital substation power industrial control system in the past year, For the kth user V k Standard deviation of the frequency of visits to the power industrial control system of the digital substation in the past year; or, Define the kth user V k Similarity between the distribution of system types and the overall probability of the i-th visit to the power industrial control system of the digital substation for: like Then it means that the kth user V k The i-th access to the digital substation power industrial control system is a normal access system type, otherwise it is an abnormal access system type. The k-th user V k The probability of each system type appearing in all normal access system types in the last year is recorded as The kth user V k The probability of each system type appearing in all abnormal access system types in the past year is recorded as in, For the kth user V k The probability of visiting the relay protection system r1 of the digital substation power industrial control system for the i-th time, For the kth user V k The probability of visiting the electric energy metering system r2 of the digital substation power industrial control system for the i-th time, For the kth user V k The probability of the distribution network automation system r3 visiting the digital substation power industrial control system for the i-th time, For the kth user V k The probability of visiting the digital substation power industrial control system power market trading system r4 for the i-th time, For the kth user V k The probability of the i-th visit to the substation integrated automation system r5 of the digital substation power industrial control system, For the kth user V k The probability of visiting the communication system r6 of the digital substation power industrial control system for the i-th time; For the kth user V k The probability of accessing the relay protection system r1 of the power industrial control system of the digital substation in the past year, For the kth user V k The probability of accessing the electric energy metering system r2 of the digital substation power industrial control system in the past year, For the kth user V k The probability of accessing the distribution network automation system r3 of the digital substation power industrial control system in the past year, For the kth user V k The probability of accessing the power market trading system r4 of the digital substation power industrial control system in the past year, For the kth user V k The probability of accessing the substation integrated automation system r5 of the digital substation power industrial control system in the past year, For the kth user V k The probability of accessing the communication system r6 of the power industrial control system of the digital substation in the last year; or, α＝10，β＝1； or, Select the 95th percentile in the anomaly score set as Select the 99th percentile in the set as like represents the kth user V k If the user accesses normally, represents the kth user V k Suspicious access, if represents the kth user V k Unauthorized access.

6. A user security access control system for a digital substation power industrial control system, characterized in that: include: The deviation vector group acquisition unit is configured to: obtain the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation and abnormal access deviation vector group Calculate the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation Model and abnormal access deviation vector group Model The abnormal score set generating unit is configured to: calculate the kth user V k Abnormal score of the i-th visit to the power industrial control system of the digital substation Based on the anomaly score Calculate the set of anomaly scores for each visit of all users; The abnormal access judgment unit is configured to: arrange the abnormal scores in the abnormal score set from small to large according to the numerical value to obtain S ′ , access identification is performed based on the arranged anomaly score set.

7. The user security access control system for the digital substation power industrial control system according to claim 6 is characterized in that: The kth user V k Duration of visits to the digital substation power industrial control system in the past year In, if Then the access time is the normal access time, otherwise it is the abnormal access time; The kth user V k Frequency of visits to the digital substation power industrial control system in the past year In, if Then the access frequency this time is the normal access frequency, otherwise it is the abnormal access frequency; Among them, e is the experience value, For the kth user V k Average duration of access to the digital substation power industrial control system in the past year, For the kth user V k Standard deviation of the duration of visits to the power industrial control system of the digital substation in the past year, For the kth user V k Average frequency of access to the digital substation power industrial control system in the past year, For the kth user V k Standard deviation of the frequency of visits to the power industrial control system of the digital substation in the past year; or, Get the kth user V k Normal access deviation vector group of the i-th access to the power industrial control system of the digital substation and abnormal access deviation vector group include: According to the kth user V k Standardized access duration of the ith access to the power industrial control system of the digital substation The kth user V k Normalized access frequency of the ith access to the digital substation power industrial control system k users V k The i-th visit to the digital substation power industrial control system is expressed as Constructing access feature vector groups According to the kth user V k Normalized access time of the ith access to the digital substation power control system in the normal access time data The kth user V k Normalized access duration of the ith access to the digital substation power control system in normal access frequency data The kth user V k The probability of each system type appearing in all normal access system types during the last year of access Building a normal access model According to the kth user V k Normalized access duration of the ith access to the digital substation power industrial control system in the abnormal access duration data The kth user V k Normalized access duration of the ith access to the digital substation power control system in abnormal access frequency data The kth user V k The probability of occurrence of various system types among all abnormal access system types in the past year Building an abnormal access model or, Select the 95th percentile in the anomaly score set as Select the 99th percentile in the set as like represents the kth user V k If the user accesses normally, represents the kth user V k Suspicious access, if represents the kth user V k Unauthorized access; or, Calculate the kth user V k Abnormal score of the i-th visit to the power industrial control system of the digital substation include: Among them, α is the amplitude adjustment factor, β is the slope adjustment factor, and θ U and θ Z are the thresholds for normal access and abnormal access, α=10, β=1; or, The digital substation power industrial control system comprises: Relay protection system, electric energy metering system, distribution network automation system, power market trading system, substation integrated automation system and communication system.

8. A computer device, characterized in that: include: a processor and a computer readable storage medium; a processor adapted to execute a computer program; A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by the processor, the user security access control method for the digital substation power industrial control system according to any one of claims 1 to 5 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor and executing the user security access control method for the digital substation power industrial control system according to any one of claims 1 to 5.

10. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the method for user security access control of a digital substation power industrial control system as claimed in any one of claims 1 to 5 is implemented.

Images