An intrusion detection method and system for microgrid industrial control network

Abstract

The present invention relates to an intrusion detection method and system for a microgrid industrial control network, the method comprising: S1. acquiring power data and flow data of a microgrid system, and extracting characteristic parameters of the power data and characteristic parameters of the flow data respectively; S2. combining the characteristic parameters of the power data and the characteristic parameters of the flow data to obtain preliminary features; extracting key characteristic elements of the preliminary features to obtain an optimal feature subset; S3. constructing an intrusion detection model based on the optimal feature subset, training the intrusion detection model, optimizing the trained intrusion detection model, and outputting detection results. The present invention obtains, processes and analyzes communication flow information and power data of multiple nodes within a microgrid, extracts key characteristic parameters, and uses machine learning methods to perform intrusion detection to protect the normal operation of the microgrid.

Description

Technical Field

[0001] The present invention relates to the field of microgrid and network security technology, and in particular to an intrusion detection method and system based on machine learning technology. Background Art

[0002] In recent years, new energy microgrids consisting of wind power generation, photovoltaic power generation, energy storage devices and loads are booming. As an effective supplement to the main power grid, microgrids can realize the efficient application of distributed power sources and enhance the flexibility of the main power grid. With the advancement and development of network technology, the structure of industrial control systems has undergone major changes. The integration of industrialization and informatization is the development trend of industrial control systems. Microgrid systems are also in the process of "industrialization and informatization". At the same time, building an efficient and safe microgrid network control system is a prerequisite for realizing smart grids. The existing microgrid industrial control network lacks corresponding active security defense measures. Network attackers can intrude into the communication network to obtain sensitive power data in operation, tamper with control commands, and even paralyze the entire microgrid, seriously affecting the safe operation of the power system. Summary of the invention

[0003] The purpose of the present invention is to provide an intrusion detection method and system for a microgrid industrial control network, which acquires, processes and analyzes the power data and communication flow information inside the microgrid, extracts key feature elements, and uses machine learning methods to build an intrusion detection model for online monitoring, thereby enhancing the network security protection performance of the microgrid and protecting the normal operation of the microgrid.

[0004] To achieve the above object, the present invention provides the following solutions:

[0005] An intrusion detection method for a microgrid industrial control network includes the following steps:

[0006] S1. Obtaining power data and flow data of the microgrid system, respectively extracting characteristic parameters of the power data and characteristic parameters of the flow data;

[0007] S2. Combining the characteristic parameters of the electric energy data and the characteristic parameters of the flow data to obtain preliminary features; extracting key characteristic elements of the preliminary features to obtain an optimal feature subset;

[0008] S3. construct an intrusion detection model based on the optimal feature subset, train the intrusion detection model, optimize the trained intrusion detection model, and output the detection result.

[0009] Preferably, obtaining the electric energy data and the flow data includes:

[0010] A mirror switch is deployed inside the microgrid system, and nodes of power equipment in the microgrid system are connected to data ports of the mirror switch, and the flow data and the electric energy data are obtained based on the data flow mirror forwarding function of the mirror switch.

[0011] Preferably, extracting the characteristic parameters of the electric energy data and the characteristic parameters of the flow data includes:

[0012] Constructing an industrial control protocol tree hierarchical model, wherein the industrial control protocol tree hierarchical model includes: an application layer, a transport layer, a network layer, and a data link layer;

[0013] Based on the internal communication register address of the power equipment and the communication protocol of the application layer, the power data is parsed from the data link layer to the load content of the application layer in a tree structure, and characteristic parameters of the power data are extracted;

[0014] According to the working principle of the TCP / IP protocol cluster and the communication characteristics of the industrial control protocol, the flow data is analyzed based on a data packet analysis method to extract characteristic parameters of the flow data.

[0015] Preferably, the characteristic parameters of the electric energy data include: photovoltaic array input voltage, input current, inverter output power, inverter temperature and power generation;

[0016] The characteristic parameters of the traffic data include: TCP flag bit, SYN message ratio, SYN / ACK ratio, ARP message ratio, Modbus device ID, function code, reply function code, register start address and register access byte count.

[0017] Preferably, obtaining the optimal feature subset includes:

[0018] Collecting the Ethernet frame data packet status of the microgrid system, and obtaining the preliminary characteristic data packet ratio balance characteristic based on the ratio of the Ethernet frame data packet status;

[0019] Based on the proportional balance characteristics of the preliminary feature data packet, filtered feature selection is applied to the feature parameters of the electric energy data and flow data within the preliminary feature data packet to obtain the weight of each feature parameter, sort the weights, and obtain the optimal feature subset based on the set threshold range.

[0020] Preferably, the Ethernet frame data packet status includes: Normal, DoS, Probe and MITM;

[0021] Among them, the Normal is the status of the power data and the flow data in the normal state of the continuous time series; the DoS is the status of the power data and the flow data in the continuous time series that suffers from a denial of service attack; the Probe is the status of the power data and the flow data in the continuous time series that suffers from a network scanning attack; the MITM is the status of the power data and the flow data in the continuous time series that suffers from a man-in-the-middle spoofing attack.

[0022] Preferably, training the intrusion detection model includes:

[0023] The intrusion detection model is trained based on a deep learning algorithm to obtain the trained intrusion detection model.

[0024] Preferably, optimizing the trained intrusion detection model includes:

[0025] Optimizing the trained intrusion detection model based on a hyperparameter optimization method;

[0026] The optimization objective formula of the intrusion detection model is:

[0027] argmax x∈X f(x)

[0028] Among them, x is a set of setting values ​​of hyperparameters, X is the mixed parameter space, and f(x) is the objective function set in hyperparameter optimization, that is, the detection accuracy of the model.

[0029] Preferably, outputting the detection result includes:

[0030] The optimized intrusion detection model is put into practical application to obtain the real-time power data and the captured flow data, analyze and monitor them one by one according to the time series, make a decision on whether the data in the microgrid system is normal or abnormal, and finally output the detection results.

[0031] To achieve the above object, the present invention also provides an intrusion detection system for a microgrid industrial control network, comprising:

[0032] Microgrid control device: used to control the power generation and distribution process of the microgrid system;

[0033] Mirror switch: used to obtain traffic data and power data;

[0034] Local monitoring station: used to monitor the data obtained by the mirror switch;

[0035] Intrusion detection device: used for analyzing and monitoring the acquired power data and flow data according to time series, and outputting a detection signal;

[0036] Remote monitoring center: used to determine whether the detection signal is a malicious network behavior, and decide whether to issue an alarm based on the judgment result;

[0037] The microgrid control device is connected to the mirror switch, and the mirror switch is respectively connected to the intrusion detection device, the local monitoring station and the remote monitoring center.

[0038] The beneficial effects of the present invention are:

[0039] The present invention obtains, processes and analyzes the communication flow information and power data of multiple nodes inside the microgrid, extracts key characteristic parameters, and uses machine learning methods to perform intrusion detection to protect the normal operation of the microgrid. The present invention summarizes the algorithm flow and implementation method of the present invention in combination with specific examples. Through the method described in this specification, the constructed intrusion detection system can effectively detect network malicious attacks against the microgrid system, such as denial of service attacks, network scanning and man-in-the-middle spoofing attacks, etc., with high detection accuracy, easy deployment, and can effectively ensure the safe operation of the microgrid. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0041] Figure 1 A schematic diagram of the working process of an intrusion detection method for a microgrid industrial control network according to an embodiment of the present invention;

[0042] Figure 2 A schematic diagram of a hierarchical model of an industrial control protocol tree is constructed for an embodiment of the present invention;

[0043] Figure 3 The present invention is a schematic diagram of the deployment of an intrusion detection system for a microgrid industrial control network according to an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0046] like Figure 1 As shown, an intrusion detection method and system workflow for a microgrid industrial control network mainly includes the following steps:

[0047] S1. Obtaining power data and flow data of the microgrid system, respectively extracting characteristic parameters of the power data and characteristic parameters of the flow data;

[0048] S2. Combining the characteristic parameters of the electric energy data and the characteristic parameters of the flow data to obtain preliminary features; extracting key characteristic elements of the preliminary features to obtain an optimal feature subset;

[0049] S3. construct an intrusion detection model based on the optimal feature subset, train the intrusion detection model, optimize the trained intrusion detection model, and output the detection result.

[0050] The specific algorithm includes the following steps:

[0051] When the microgrid system is in normal power generation state and without affecting the normal network communication of the power nodes, a mirror switch is placed at a suitable location, and all power equipment nodes such as photovoltaic inverters, power data monitoring instruments, PLC controllers, etc. are connected to the data mirror port of the switch. The flow data of the entire microgrid system is obtained by relying on the data flow mirror forwarding function of the switch. The flow data of the entire microgrid system includes: communication data packets between the monitoring center and the microgrid power equipment nodes;

[0052] Among them, the communication data packets of the monitoring center are flow data, and the communication data packets of the microgrid power equipment nodes are electric energy data.

[0053] The traffic data is parsed from the data mirror observation port of the switch, and an industrial control protocol tree hierarchical model is constructed based on a series of application layer communication protocols (ModbusTCP, S7 and DNP3, etc.) and the predefined internal communication register addresses of power equipment products. The industrial control protocol tree hierarchical model includes: application layer, transport layer, network layer and data link layer. The power data is parsed in a tree structure from the data link layer until the application layer load content is obtained, and the characteristic parameters of the power data of each power equipment node in the load content are extracted, such as the input voltage PV of the photovoltaic array, the input current PI, the inverter output power P, and the inverter temperature T inverter and power generation capacity, such as Figure 2 shown.

[0054] At the same time, based on the working principle of the TCP / IP protocol cluster and the communication characteristics of the industrial control protocol, and using data packet parsing methods, the characteristic parameters of the flow data are extracted from the flow data inside the entire microgrid system, such as TCP flag bit, SYN message ratio (ratio1), SYN / ACK ratio (ratio2), ARP message ratio (ratio3), Modbus device ID, function code Func_code, reply function code Resp_code, register starting address memory and register access byte count, etc.

[0055]

[0056]

[0057]

[0058] where number syn Indicates the number of TCP packets in every 100 consecutive Ethernet frames, in which the connection request flag SYN is 1; number ack Indicates the number of TCP packets in every 100 consecutive Ethernet frames that carry the reply flag ACK as 1; number arp It represents the number of ARP packets in every 100 consecutive Ethernet frames. In addition, parameters such as Modbus device ID, function code Func_code, reply function code Resp_code, register start address memory and register access byte count are the field contents carried by the industrial control network protocol used by the microgrid system, which can be simply obtained according to the standard protocol through Ethernet data packet parsing without calculation.

[0059] The characteristic parameters of the electric energy data and the characteristic parameters of the flow data calculated at the same time are combined to obtain a set of new data to obtain the preliminary characteristics F = {a1, a2, ..., a n ,b1,b2,…,b m}, where a x Represents the characteristic parameter of a certain electric energy data, b x Represents the characteristic parameter of a certain flow data, n and m represent the number of characteristic parameters of electric energy data and flow data respectively, let d=n+m, then F is a d-dimensional real number vector.

[0060] In view of the network attacks faced by microgrids, the properties of all Ethernet frame data packets in the microgrid system are divided into four states, namely Normal, DoS, Probe and MITM, where Normal represents the state of the power data and flow data in the normal state of the continuous time series; DoS represents the state of the power data and flow data in the continuous time series under denial of service attack; Probe represents the state of the power data and flow data in the continuous time series under network scanning attack; MITM represents the state of the power data and flow data in the continuous time series under man-in-the-middle spoofing attack. The label of the preliminary feature F is one of the above four states, which is used to represent the network attack state represented by the characteristic parameters of the flow data and power data of the current microgrid system. Each vector of the network attack sample set X constructed according to the time series consists of the parameter instance of the preliminary feature F and the corresponding label value, that is, a d+1-dimensional real number set.

[0061] By deeply analyzing the proportions of the four states of the captured Ethernet frame data packets, the data packet proportion balance characteristics in the preliminary feature F are obtained. For example, if the number of Normal categories is greater than 10 times the number of MITM categories, the minority class attack samples such as the man-in-the-middle spoofing attack are used to generate new samples using the minority class sample synthesis oversampling technology to enhance the recognition ability of the data packets of the minority class attack samples. The specific generation method process is as follows:

[0062] Select each sample x from the minority class sample in turn i As the root sample for synthesizing new samples; secondly, according to the upsampling factor N, from x i Randomly select a sample from several neighboring samples of the same category as the auxiliary sample for synthesizing a new sample, repeat N times, and each auxiliary sample is recorded as Where j = 1, 2, ..., N; then in the sample x i Through linear interpolation between auxiliary samples, synthetic samples are finally generated The expression of its generation method is:

[0063]

[0064] where x i ∈R d+1 , is a d+1-dimensional real number set; γ is a random number between [0,1].

[0065] The feature parameters of the power data and flow data in the preliminary feature F are subjected to feature selection algorithms such as filtering feature selection (ReliefF) to obtain the weights of each feature parameter and sort them in descending order, and the optimal feature subset F'={feature1, feature2, ...} is obtained according to the set threshold interval, where the weights of each feature parameter are the key feature elements of the preliminary feature, and the features that can focus on reflecting the DoS attack behavior are {ratio1, ratio2, PV, PI, ...}. Specifically, ratio1>90%, ratio2>50, PV=0, PI=0, and the feature parameter ratio1 reflects the abnormal increase in the number of TCP communication connection messages in the microgrid system under DoS attack. The value of the feature parameters PV and PI is 0, which reflects that real-time monitoring is currently impossible. The dangerous state of the power data of the microgrid system, that is, the input voltage and input current values ​​of the photovoltaic array are both 0; the characteristics reflecting the Probe attack behavior are {ratio3, PV, PI, ...}, specifically, ratio3>90%, the reception of characteristic parameters such as PV and PI is normal, reflecting the communication state of the microgrid system under network scanning; the characteristics reflecting the MITM attack behavior are {PV, PI, P, Func_code, memory, count, ...}, specifically, under normal conditions, the values ​​of parameters such as the input voltage PV and the input current PI of the photovoltaic array are all in a certain threshold range, and exceeding the threshold is judged as abnormal, such as 345≤PV≤360, 0.5≤PI≤8, etc., among which Func_code, memory and count focus on the process of the middleman tampering with the communication protocol field. The above feature subsets can effectively reflect the connection between the characteristic parameters of power data and flow data and various network attack behaviors, such as denial of service attacks, network sniffing and middleman attacks.

[0066] The intrusion detection model of the microgrid system is constructed with the optimal feature subset F' as the final data source, and the model training is carried out using machine learning algorithms such as extreme gradient boosting tree (XGBoost) or deep learning algorithms such as convolutional neural network (CNN) to achieve accurate perception of microgrid flow data.

[0067] Use grid search, Bayesian and other hyperparameter optimization methods to determine the optimal parameter space during machine learning or deep learning algorithm training to enhance the efficiency and accuracy of intrusion detection, and put it into online operation after optimization is completed.

[0068] The optimization objectives of the intrusion detection model are as follows:

[0069] argmax x∈X f(x)

[0070] Among them, x is a set of setting values ​​of hyperparameters, X is the mixed parameter space, and f(x) is the objective function set in hyperparameter optimization, that is, the detection accuracy of the model.

[0071] After the machine learning or deep learning algorithm has been fully trained with data, the intrusion detection model can be optimized and put into practical use, and an intrusion detection system for microgrid scenarios can be built. The real-time power data and captured flow data can be analyzed and monitored one by one in time series, and finally the mapping relationship between the characteristic parameters of the microgrid power data and flow data and the network attack behavior can be obtained, and a decision can be made quickly on whether it belongs to normal data or abnormal data, and finally the detection results can be output.

[0072] An intrusion detection system for a microgrid industrial control network, comprising:

[0073] Microgrid control device: used to control the power generation and distribution process of the microgrid system;

[0074] Mirror switch: used to obtain traffic data and power data;

[0075] Local monitoring station: used to monitor the data obtained by the mirror switch;

[0076] Intrusion detection device: used for analyzing and monitoring the acquired power data and flow data according to time series, and outputting a detection signal;

[0077] Remote monitoring center: used to determine whether the detection signal is a malicious network behavior, and decide whether to issue an alarm based on the judgment result;

[0078] The microgrid control device is connected to the mirror switch, and the mirror switch is respectively connected to the intrusion detection device, the local monitoring station and the remote monitoring center.

[0079] like Figure 3 As shown in the figure, the deployment and operation of the intrusion detection system in the microgrid scenario. The main equipment includes intrusion detection system (IDS), mirror switch, microgrid control cabinet, local monitoring station and remote monitoring center.

[0080] After the intrusion detection system is deployed online, with the help of the mirror switch's mirror forwarding function for network data streams, the real-time power data and captured traffic data can be analyzed and monitored one by one in time series, and decisions can be made quickly on whether they are normal data or abnormal data. Finally, the detection signal is output and connected to supporting alarm devices such as sound and light alarms, so that local microgrid operation and maintenance personnel can fully grasp the network security status of the microgrid.

[0081] The embodiments described above are only descriptions of the preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the protection scope determined by the claims of the present invention.

Claims

1. An intrusion detection method for a microgrid industrial control network, characterized in that: include: S1. Obtaining power data and flow data of the microgrid system, respectively extracting characteristic parameters of the power data and characteristic parameters of the flow data; S2. Combining the characteristic parameters of the electric energy data and the characteristic parameters of the flow data to obtain preliminary characteristics; Extracting key feature elements of the preliminary features to obtain an optimal feature subset; Obtaining the optimal feature subset includes: Collecting the Ethernet frame data packet status of the microgrid system, and obtaining the preliminary characteristic data packet ratio balance characteristic based on the ratio of the Ethernet frame data packet status; Based on the proportional balance characteristics of the preliminary feature data packet, filtering feature selection is applied to the feature parameters of the electric energy data and the flow data within the preliminary feature data packet to obtain the weight of each feature parameter, sort the weights, and obtain the optimal feature subset according to the set threshold interval; S3. construct an intrusion detection model based on the optimal feature subset, train the intrusion detection model, optimize the trained intrusion detection model, and output the detection result.

2. The intrusion detection method for a microgrid industrial control network according to claim 1, characterized in that: Acquiring the electric energy data and the flow data includes: A mirror switch is deployed inside the microgrid system, and nodes of power equipment in the microgrid system are connected to data ports of the mirror switch, and the flow data and the electric energy data are obtained based on the data flow mirror forwarding function of the mirror switch.

3. The intrusion detection method for a microgrid industrial control network according to claim 2 is characterized in that: Extracting the characteristic parameters of the electric energy data and the characteristic parameters of the flow data includes: Constructing an industrial control protocol tree hierarchical model, wherein the industrial control protocol tree hierarchical model includes: an application layer, a transport layer, a network layer, and a data link layer; Based on the internal communication register address of the power equipment and the communication protocol of the application layer, the power data is parsed from the data link layer to the load content of the application layer in a tree structure, and characteristic parameters of the power data are extracted; According to the working principle of the TCP / IP protocol cluster and the communication characteristics of the industrial control protocol, the flow data is analyzed based on a data packet analysis method to extract characteristic parameters of the flow data.

4. The intrusion detection method for a microgrid industrial control network according to claim 3 is characterized in that: The characteristic parameters of the electric energy data include: photovoltaic array input voltage, input current, inverter output power, inverter temperature and power generation; The characteristic parameters of the traffic data include: TCP flag bit, SYN message ratio, SYN / ACK ratio, ARP message ratio, Modbus device ID, function code, reply function code, register start address and register access byte count.

5. The intrusion detection method for a microgrid industrial control network according to claim 1, characterized in that: The Ethernet frame data packet status includes: Normal, DoS, Probe and MITM; Among them, the Normal is the status of the power data and the flow data in the normal state of the continuous time series; the DoS is the status of the power data and the flow data in the continuous time series that suffers from a denial of service attack; the Probe is the status of the power data and the flow data in the continuous time series that suffers from a network scanning attack; the MITM is the status of the power data and the flow data in the continuous time series that suffers from a man-in-the-middle spoofing attack.

6. The intrusion detection method for a microgrid industrial control network according to claim 1, characterized in that: Training the intrusion detection model includes: The intrusion detection model is trained based on a deep learning algorithm to obtain the trained intrusion detection model.

7. The intrusion detection method for a microgrid industrial control network according to claim 1, characterized in that: Optimizing the trained intrusion detection model includes: Optimizing the trained intrusion detection model based on a hyperparameter optimization method; The optimization objective formula of the intrusion detection model is: argmax x∈X f(x) Among them, x is a set of setting values ​​of hyperparameters, X is the mixed parameter space, and f(x) is the objective function set in hyperparameter optimization, that is, the detection accuracy of the model.

8. The intrusion detection method for a microgrid industrial control network according to claim 1, characterized in that: Outputting the detection result includes: The optimized intrusion detection model is put into practical application to obtain the real-time power data and the captured flow data, analyze and monitor them one by one according to the time series, make a decision on whether the data in the microgrid system is normal or abnormal, and finally output the detection results.

9. An intrusion detection system for a microgrid industrial control network, using the intrusion detection method according to any one of claims 1 to 8 for detection, characterized in that: include: Microgrid control device: used to control the power generation and distribution process of the microgrid system; Mirror switch: used to obtain traffic data and power data; Local monitoring station: used to monitor the data obtained by the mirror switch; Intrusion detection device: used for analyzing and monitoring the acquired power data and flow data according to time series, and outputting a detection signal; Remote monitoring center: used to determine whether the detection signal is a malicious network behavior, and decide whether to issue an alarm based on the judgment result; The microgrid control device is connected to the mirror switch, and the mirror switch is respectively connected to the intrusion detection device, the local monitoring station and the remote monitoring center.

Images