A method for detecting power grid monitoring equipment based on channel electrical characteristic fingerprint recognition

Abstract

The present invention provides a method for detecting power grid monitoring equipment based on channel electrical characteristic fingerprint identification. The method for detecting power grid monitoring equipment based on channel electrical characteristic fingerprint identification includes: a physical channel signal acquisition module, a weak signal noise reduction extraction and fingerprint construction module and a silent monitoring equipment detection module; the physical channel signal acquisition module is to deploy a special data receiving device to collect characteristic signal data reflecting the changes in the electrical characteristics of the communication network channel, and is used to construct the channel electrical characteristic fingerprint of the communication network. The method for detecting power grid monitoring equipment based on channel electrical characteristic fingerprint identification provided by the present invention can effectively realize the detection of physical access to silent devices, can quickly detect and accurately identify illegal access devices to the smart grid, and can further improve the information security level of the smart grid infrastructure.

Description

Technical Field

[0001] The present invention belongs to the technical field of power grid monitoring equipment detection based on channel electrical characteristic fingerprint identification, and in particular relates to a power grid monitoring equipment detection method based on channel electrical characteristic fingerprint identification. Background Art

[0002] Detecting illegal access devices in the power grid and reducing the damage caused by attacks to the system are very important in the field of smart grid security. There are currently two mainstream solutions to the problem of detecting and identifying illegal access devices in communication networks: (1) using intrusion detection technology to identify devices with abnormal behavior; (2) using identity recognition technology to identify the legitimate identity of the device;

[0003] Silent monitoring devices are illegal devices connected to the fieldbus communication network that shares the communication medium. They can obtain system information by monitoring the message transmission on the communication line, but they do not actively send any messages to the outside. They cannot be detected by intrusion detection methods and require the use of identity recognition technology.

[0004] Fingerprint recognition technology can build a fingerprint information library based on the differentiated characteristics of communication devices to realize the identification and detection of device identities. It is divided into active and passive recognition methods. The active method needs to send messages to actively collect the information of the authenticated device. The passive device fingerprint recognition method extracts the information of the authenticated device by analyzing and monitoring the communication traffic. In the research of passive device fingerprint recognition methods, the current methods of constructing device fingerprints are mainly divided into those based on device hardware differences and those based on time characteristics.

[0005] Existing research methods have the following shortcomings when applied to smart grids: (1) Since the communication behaviors of silent listening devices and camouflaged response devices are highly concealed, existing intrusion detection technologies based on message content and basic traffic statistics perform poorly in detecting these illegal access devices. (2) Due to the limited communication and computing resources of smart grid terminal devices, identity recognition methods based on encryption authentication technology have significant limitations in terms of security performance and usage scenarios.

[0006] Therefore, it is necessary to provide a new power grid monitoring device detection method based on channel electrical characteristic fingerprint recognition to solve the above technical problems. Summary of the invention

[0007] The technical problem solved by the present invention is to provide a power grid monitoring device detection method based on channel electrical characteristic fingerprint recognition, which can effectively realize the detection of physical access to silent devices, quickly detect and accurately identify illegal access devices to smart grids, and further improve the information security level of smart grid infrastructure.

[0008] In order to solve the above technical problems, the present invention provides a power grid monitoring device detection method based on channel electrical characteristic fingerprint recognition, which includes: a physical channel signal acquisition module, a weak signal noise reduction extraction and fingerprint construction module, and a silent monitoring device detection module;

[0009] The physical channel signal acquisition module is used to construct the channel electrical characteristic fingerprint of the communication network by deploying a dedicated data receiving device to collect characteristic signal data reflecting the changes in the electrical characteristics of the communication network channel;

[0010] The weak signal noise reduction extraction and fingerprint construction module utilizes the time correlation between the characteristic signal and the known input signal to extract the weak characteristic signal variation through the sequence correlation detection method, and constructs the channel electrical characteristic fingerprint of the smart grid communication network;

[0011] The silent monitoring device detection module uses the extracted channel electrical characteristic fingerprint to construct a fingerprint sequence, and adopts the cumulative sum control chart method in the industrial control system to analyze the abnormal deviation of system characteristics, thereby detecting whether there is a silent device connected to the network.

[0012] As a further solution of the present invention, the physical channel signal acquisition module is specifically as follows:

[0013] (1) In the sampling period [t, t+ΔT], given the known voltage input signal x(t) and the periodic request message sent by the host computer, the signal y received on device m m (t) is sampled and stored, and recorded as the characteristic signal of the physical signal of the communication network, and the differential voltage signal received on device m is as follows:

[0014] y' m (t) = ρ' m ·x(t) (1)

[0015] Among them, ρ' m It represents the signal reception coefficient of device m after the attacker implants a silent monitoring device. At this time, the change in the characteristic signal on device m is expressed as:

[0016] δ m (t) = y' m (t)-y m (t)=(ρ' m -ρ m )·x(t) (2).

[0017] As a further solution of the present invention, the ΔT is a signal sampling duration.

[0018] As a further solution of the present invention, the weak signal denoising extraction and fingerprint construction module is specifically as follows:

[0019] (1) In the actual RS845 communication network, there is channel noise on the signal transmission line due to thermal noise of equipment components, power supply fluctuations and other reasons. The amplitude of the change in the characteristic signal to be detected is much smaller than the signal amplitude of the channel noise and will be submerged by the channel noise. Therefore, it is necessary to reduce noise and extract the weak characteristic signal. After considering the channel noise of the system, the change in the characteristic signal received at the detection device m is:

[0020] σ m (t) = δ m (t)+ω(t)=(ρ' m -ρ m )·x(t)+ω(t) (3)

[0021] Where ω(t) represents the noise component detected at device m. According to the mathematical model described in formula (3), the characteristic signal change δ m (t) is linearly related to the input signal x(t), while the channel noise and the input signal are independent of each other;

[0022] Considering the determinism of the characteristic signal variation and the randomness of the channel noise signal, the signal correlation detection method is used to eliminate the influence of the noise signal on the process of extracting the characteristic signal variation. m (t) Perform cross-correlation operation and obtain the following:

[0023] R xσ (t,t-τ)=E[x(t)σ m (t-τ)]

[0024] =E[(ρ' m -ρ m )x(t)x(t-τ)+x(t)ω(t-τ)] (4)

[0025] =(ρ' m -ρ m )E[x(t)x(t-τ)]+E[x(t)ω(t-τ)]

[0026] =(ρ' m -ρ m )R xx (t,t-τ)+R xω (t,t-τ)

[0027] Since x(t) and ω(t) are uncorrelated, when the signal sampling is sufficient, we have R xω (t,t-τ)=0, then:

[0028] R xσ(t,t-τ)=(ρ' m -ρ m )R xx (t,t-τ) (5)

[0029] Therefore, R xσ The calculation result of (t, t-τ) is basically not affected by the system channel noise. The cross-correlation operation result with time delay τ = 0 is R(t) = R xσ (t,t), ideally, when a new device is connected, the network topology and impedance characteristics do not change (ρ' m -ρ m ), R(t)=0;

[0030] When a new device is connected (ρ' m ≠ρ m ), R(t)≠0, therefore, R(t) can be taken as the channel electrical characteristic fingerprint of the communication network to characterize the characteristic network topology and impedance characteristics of the system.

[0031] As a further solution of the present invention, the silent monitoring device detection module is specifically as follows:

[0032] (1) Assume that the channel electrical characteristic fingerprint sequence R is obtained by correlation detection in the sampling period [0, ΔT), [ΔT, 2ΔT), ..., [qΔT, (q+1)ΔT) 0 ,R 1 ,R 2 ,...,R q , where R i =R(iΔT) represents the channel electrical characteristic fingerprint collected in the time period [iΔT, (i+1)ΔT). By detecting the channel electrical characteristic fingerprint under normal conditions, the allowable deviation of the channel electrical characteristic fingerprint can be determined. That is, when there is no device access, there is always At this time, the control upper limit is obtained according to the following formula and the lower control limit

[0033]

[0034]

[0035] Among them, the initial value represents the cumulative and positive value, represents cumulative and negative values, and The larger the value, the greater the possibility of deviation of the channel electrical characteristic fingerprint. The detection threshold is set to ε. When , it is determined that the channel electrical characteristic fingerprint has deviated significantly, and there may be silent devices connected, causing the impedance distribution of the communication network topology to change.

[0036] Compared with the related art, the power grid monitoring device detection method based on channel electrical characteristic fingerprint recognition provided by the present invention has the following beneficial effects:

[0037] 1. The present invention can effectively detect the physical access of silent devices. In practical application, an enhanced network intrusion detection system is developed on the existing smart grid communication simulation experimental platform to achieve rapid detection and accurate identification of illegal access devices to the smart grid, thereby improving the information security level of the smart grid infrastructure. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0039] Figure 1 It is a schematic diagram of the present invention;

[0040] Figure 2 It is a schematic diagram of the principle of the present invention. DETAILED DESCRIPTION

[0041] Please refer to Figure 1 and Figure 2 ,in, Figure 1 It is a schematic diagram of the present invention; Figure 2 The schematic diagram of the principle of the present invention is as follows. The power grid monitoring device detection method based on channel electrical characteristic fingerprint recognition includes: a physical channel signal acquisition module, a weak signal noise reduction extraction and fingerprint construction module and a silent monitoring device detection module;

[0042] The physical channel signal acquisition module is used to construct the channel electrical characteristic fingerprint of the communication network by deploying a dedicated data receiving device to collect characteristic signal data reflecting the changes in the electrical characteristics of the communication network channel;

[0043] The weak signal noise reduction extraction and fingerprint construction module utilizes the time correlation between the characteristic signal and the known input signal to extract the weak characteristic signal variation through the sequence correlation detection method, and constructs the channel electrical characteristic fingerprint of the smart grid communication network;

[0044] The silent monitoring device detection module uses the extracted channel electrical characteristic fingerprint to construct a fingerprint sequence, and adopts the cumulative sum control chart method in the industrial control system to analyze the abnormal deviation of system characteristics, thereby detecting whether there is a silent device connected to the network.

[0045] The physical channel signal acquisition module is specifically as follows:

[0046] (1) In the sampling period [t, t+ΔT], given the known voltage input signal x(t) and the periodic request message sent by the host computer, the signal y received on device m m (r) is sampled and stored, and recorded as the characteristic signal of the physical signal of the communication network, and the differential voltage signal received on device m is as follows:

[0047] y' m (t) = ρ' m ·x(t) (1)

[0048] Among them, ρ' m It represents the signal reception coefficient of device m after the attacker implants a silent monitoring device. At this time, the change in the characteristic signal on device m is expressed as:

[0049] δ m (t) = y' m (t)-y m (t)=(ρ' m -ρ m )·x(t) (2).

[0050] The ΔT is the signal sampling duration.

[0051] The weak signal denoising extraction and fingerprint construction module is specifically as follows:

[0052] (1) In the actual RS845 communication network, there is channel noise on the signal transmission line due to thermal noise of equipment components, power supply fluctuations and other reasons. The amplitude of the change in the characteristic signal to be detected is much smaller than the signal amplitude of the channel noise and will be submerged by the channel noise. Therefore, it is necessary to reduce noise and extract the weak characteristic signal. After considering the channel noise of the system, the change in the characteristic signal received at the detection device m is:

[0053] σ m (t) = δ m (t)+ω(t)=(ρ' m -ρ m )·x(t)+ω(t) (3)

[0054] Where ω(t) represents the noise component detected at device m. According to the mathematical model described in formula (3), the characteristic signal change δ m (t) is linearly related to the input signal x(t), while the channel noise and the input signal are independent of each other;

[0055] Considering the determinism of the characteristic signal variation and the randomness of the channel noise signal, the signal correlation detection method is used to eliminate the influence of the noise signal on the process of extracting the characteristic signal variation. m (t) Perform cross-correlation operation and obtain the following:

[0056] R xσ (t,t-τ)=E[x(t)σ m (t-τ)]

[0057] =E[(ρ' m -ρ m )x(t)x(t-τ)+x(t)ω(t-τ)] (4)

[0058] =(ρ' m -ρ m )E[x(t)x(t-τ)]+E[x(t)ω(t-τ)]

[0059] =(ρ' m -ρ m )R xx (t,t-τ)+R xω (t,t-τ)

[0060] Since x(t) and ω(t) are uncorrelated, when the signal sampling is sufficient, we have R xω (t,t-τ)=0, then:

[0061] R xσ (t,t-τ)=(ρ' m -ρ m )R xx (t,t-τ) (5)

[0062] Therefore, R xσ The calculation result of (t, t-τ) is basically not affected by the system channel noise. The cross-correlation operation result with time delay τ = 0 is R(t) = R xσ (t,t), when a new device is connected, the network topology and impedance characteristics do not change (ρ' m -ρ m ), R(t)=0;

[0063] When a new device is connected (ρ' m ≠ρ m ), R(t)≠0, therefore, R(t) can be taken as the channel electrical characteristic fingerprint of the communication network to characterize the characteristic network topology and impedance characteristics of the system.

[0064] The silent monitoring device detection module is specifically as follows:

[0065] (1) Assume that the channel electrical characteristic fingerprint sequence R is obtained by correlation detection in the sampling period [0, ΔT), [ΔT, 2ΔT), ..., [qΔT, (q+1)ΔT) 0 ,R 1 ,R 2 ,...,R q , where R i =R(iΔT) represents the channel electrical characteristic fingerprint collected in the time period [iΔT, (i+1)ΔT). By detecting the channel electrical characteristic fingerprint under normal conditions, the allowable deviation of the channel electrical characteristic fingerprint can be determined. That is, when there is no device access, there is always At this time, the control upper limit is obtained according to the following formula and the lower control limit

[0066]

[0067]

[0068] Among them, the initial value represents the cumulative and positive value, represents cumulative and negative values, and The larger the value, the greater the possibility of deviation of the channel electrical characteristic fingerprint. The detection threshold is set to ε. When , it is determined that the channel electrical characteristic fingerprint has deviated significantly, and there may be silent devices connected, causing the impedance distribution of the communication network topology to change.

[0069] In view of the difficulty that silent monitoring devices in smart grids do not have any interactive behavior after accessing the network, it is difficult to detect them through traffic feature analysis methods. In this paper, the current mainstream intrusion detection system framework is expanded and enhanced by combining fingerprint recognition technology, and it is committed to building a more complete theoretical method system for detecting illegal access devices in smart grids, and improving the information security level of smart grid infrastructure.

[0070] The sequence correlation detection technology is used to extract the channel electrical characteristic fingerprint that can characterize the change of the electrical parameters of the communication network from the weak change of the received signal, and the change of the fingerprint is further amplified by the CUSUM method, so as to identify the access behavior of the silent monitoring device;

[0071] Shift from analyzing the digital signal domain (the content and statistical characteristics of network traffic) to analyzing the analog signal domain (the electrical signals of the physical channel) to solve the problem of behavioral characteristic modeling and detection of silent listening devices.

[0072] By analyzing the changes in the electrical characteristics of the communication network channel caused by the access of the silent monitoring device, and selecting features that can reflect the change, the channel electrical characteristics fingerprint of the communication network is constructed to achieve effective detection of the physical access behavior of the silent monitoring device. In this way, illegal access devices can be detected in a timely and effective manner in various usage scenarios, which can eliminate the huge hidden dangers behind the safe operation of the smart grid and ensure the safe and reliable operation of the smart grid infrastructure, which is of great significance to maintaining social stability, efficient production and national security.

[0073] It can effectively detect the physical access of silent devices. At the practical application level, an enhanced network intrusion detection system is developed on the existing smart grid communication simulation experimental platform to achieve rapid detection and accurate identification of illegal access devices to the smart grid, and improve the information security level of the smart grid infrastructure.

[0074] Although the embodiments of the present invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations may be made to these embodiments or applied directly or indirectly without departing from the principles and spirit of the present invention. In other related technical fields, the scope of the present invention is defined by the appended claims and their equivalents, which are equally included in the scope of patent protection of the present invention.

Claims

1. A method for detecting power grid monitoring equipment based on channel electrical characteristic fingerprint recognition, characterized in that: include: Physical channel signal acquisition module, weak signal noise reduction extraction and fingerprint construction module and silent monitoring device detection module; The physical channel signal acquisition module is used to construct the channel electrical characteristic fingerprint of the communication network by deploying a dedicated data receiving device to collect characteristic signal data reflecting the changes in the electrical characteristics of the communication network channel; The weak signal noise reduction extraction and fingerprint construction module utilizes the time correlation between the characteristic signal and the known input signal to extract the weak characteristic signal variation through the sequence correlation detection method, and constructs the channel electrical characteristic fingerprint of the smart grid communication network; The silent listening device detection module uses the extracted channel electrical characteristic fingerprint to construct a fingerprint sequence, and uses the cumulative sum control chart method in the industrial control system to analyze the abnormal deviation of system characteristics, thereby detecting whether there is a silent device connected to the network; The weak signal denoising extraction and fingerprint construction module is specifically as follows: In the actual RS845 communication network, there is channel noise on the signal transmission line due to thermal noise of equipment components and power fluctuations. The amplitude of the change in the characteristic signal to be detected is much smaller than the signal amplitude of the channel noise and will be submerged by the channel noise. Therefore, it is necessary to reduce noise and extract the weak characteristic signal. After considering the channel noise of the system, the change in the characteristic signal received at the detection device m is: s m (t)=δ m (t)+ω(t)=(ρ m -r m )·x(t)+ω(t) (3) Among them, ω(t) represents the noise component detected at device m. From formula (3), we can see that the characteristic signal change δ m (t) is linearly related to the input signal x(t), while the channel noise and the input signal are independent of each other: Considering the determinism of the characteristic signal variation and the randomness of the channel noise signal, the signal correlation detection method is used to eliminate the influence of the noise signal on the process of extracting the characteristic signal variation. m (t) Perform cross-correlation operation and obtain the following: R xσ (t,t-τ)=E[x(t)σ m (t-t)] =E[(ρ′ m -r m )x(t)x(t-τ)+x(t)ω(t-τ)] =(ρ′ m -r m )E[x(t)x(t-τ)]+E[x(t)ω(t-τ)] =(ρ′ m -r m )R xx (t,t-τ)+R xω (t,t-τ) (4) Since x(t) and ω(t) are uncorrelated, when the signal sampling is sufficient, we have R xω (t, t-τ) = 0, then: R xσ (t,t-τ)=(ρ′ m -r m )R xx (t,t-τ) (5) Therefore, R xσ The calculation result of (t, t-τ) is not affected by the system channel noise. The cross-correlation operation result with time delay τ = 0 is R(t) = R xσ (t, t), when a new device is connected, the network topology and impedance characteristics do not change ρ′ m -ρ m , R(t)=0; When a new device is connected, ρ′ m ≠ρ m , R(t)≠0, therefore, R(t) can be taken as the channel electrical characteristic fingerprint of the communication network to characterize the characteristic network topology and impedance characteristics of the system; The silent monitoring device detection module is specifically as follows: Assume that the channel electrical characteristic fingerprint sequence R0, R1, R2, ..., R is obtained by correlation detection in the sampling period [0, ΔT), [ΔT, 2ΔT), ..., [qΔT, (q+1)ΔT) g , where R i =R(iΔT) represents the channel electrical characteristic fingerprint collected in the time period [iΔT, (i+1)ΔT). By detecting the channel electrical characteristic fingerprint under normal conditions, the allowable deviation of the channel electrical characteristic fingerprint can be determined. That is, when there is no device access, there is always At this time, the control upper limit is obtained according to the following formula and the lower control limit Among them, the initial value represents the cumulative and positive value, represents cumulative and negative values, and The larger the value, the greater the possibility of deviation of the channel electrical characteristic fingerprint. The detection threshold is set to ε. When , it is determined that the channel electrical characteristic fingerprint has deviated significantly, and there may be silent devices connected, causing the impedance distribution of the communication network topology to change.

2. The power grid monitoring device detection method based on channel electrical characteristic fingerprint recognition according to claim 1 is characterized in that: The physical channel signal acquisition module is specifically as follows: In the sampling period [t, t+ΔT], given the known voltage input signal x(t) and the periodic request message sent by the host computer, the signal y received on device m is m (t) is sampled and stored, recorded as the characteristic signal of the physical signal of the communication network, and the differential voltage signal received on device m is as follows: y′ m (t)=ρ′ m ·x(t) (1) Among them, ρ′ m It represents the signal reception coefficient of device m after the attacker implants a silent monitoring device. At this time, the change in the characteristic signal on device m is expressed as: δ m (t)=y′ m (t)-y m (t)=(ρ′ m -ρ m )·x(t) (2)。 3. The power grid monitoring device detection method based on channel electrical characteristic fingerprint recognition according to claim 2 is characterized in that: The ΔT is the signal sampling duration.

Images