Intelligent protection method and system for access threats to distributed photovoltaic terminals

Abstract

The present invention discloses a method and system for intelligent protection against access threats to distributed photovoltaic terminals. The method comprises the following steps: receiving traffic data packets sent by the terminal; decoding and stream reassembling the packets to obtain service data and service types; authenticating the terminal based on the reassembled data packets; if the authentication result indicates that the terminal is legitimate, continuously evaluating the trust level of the terminal based on data packets sent by legitimate terminals; and if the trust level is the trust level, entering a flow control step; if the authentication result indicates that the terminal is illegitimate, adding the current terminal to a blacklist and then entering a flow control step; performing flow control on the judgment result of the data packet; immediately entering this step and discarding the data packet if an anomaly is found in the data packet; otherwise, transmitting the data packet that has passed security verification out of the system to securely execute the designated service. The present invention can prevent access by counterfeit terminals and continuously and real-timely evaluate the trust level of the terminal to prevent terminal communications from being hijacked.

Description

Technical Field

[0001] The present invention belongs to the field of power grid security technology, and in particular relates to a method and system for intelligent protection against access threats to distributed photovoltaic terminals. Background Art

[0002] On the terminal side of distributed photovoltaic scenarios, the PV protocol converter and smart IoT energy meter are both grid-side assets, transmitting PV data and metering data, respectively, upstream to the concentrator. Both devices connect to the concentrator using HPLC communication, using the Modbus protocol. Communication between the energy meter and PV protocol converter and the concentrator presents the risk of data tampering and counterfeiting. If communications are hijacked, attackers can forge control commands to gain control of the terminal or proxy.

[0003] Currently, the security protection method in distributed photovoltaic scenarios is to install ESAM encryption chips in smart IoT electricity meters to encrypt data fields; for photovoltaic protocol converters, random number verification is used to protect against counterfeiting and tampering.

[0004] However, existing technologies are not sensitive enough to identify the following two security risks: First, for the risk of terminal counterfeiting, the random number verification method cannot verify the hardware characteristics of the terminal, so it cannot sensitively identify counterfeit terminals; second, for the problem that terminals that have passed security verification still carry security verification labels after being attacked, existing technologies cannot conduct continuous real-time risk assessments on the terminals while they are interacting with services, so they cannot immediately identify terminals that have been attacked during business interactions, which is very likely to lead to attackers exploiting time differences to hijack communications. Summary of the Invention

[0005] In response to the above-mentioned defects or improvement needs of the prior art, the present invention proposes a distributed photovoltaic terminal access threat intelligent protection system and device, which aims to solve the problem that counterfeit terminals cannot be identified due to the inability of existing security protection methods to take into account both the hardware characteristics and network characteristics of the terminal equipment, and the problem that attacked terminals cannot be identified and intercepted in real time due to the inability to continuously evaluate and securely identify business interaction behaviors.

[0006] The first aspect of the present invention discloses a method for intelligent protection against access threats to distributed photovoltaic terminals, the method comprising the following steps:

[0007] S01: receiving a traffic data packet sent by a terminal; and placing the data packet into a designated queue;

[0008] S02: Obtaining data packets from a designated queue, decoding and stream reassembling the data packets, and obtaining service data and service types;

[0009] S03: Authenticate the terminal based on the reassembled data packet. If the authentication result shows that the terminal is legitimate, perform a continuous trust evaluation on the terminal based on the data packets sent by the legitimate terminal. If the trust level is the trust level, proceed to step S04. If the authentication result shows that the terminal is illegitimate, add the current terminal to the blacklist and then proceed to step S04.

[0010] S04: Perform flow control based on the judgment results of the data packet in steps S02 and S03; when the data packet has an abnormality in steps S02 and S03, enter this step immediately and discard the data packet; otherwise, the data packet that has passed the security verification is transmitted out of the system to safely execute the specified business.

[0011] Furthermore, after receiving the traffic data packet sent by the terminal, before placing the data packet into the designated queue, the method further includes: performing a first filtering on the data packet through connection rule management, basic firewall rules and security protection rules, specifically in the following manner:

[0012] S011: In the packet filtering process of iptables, activate the hook function to obtain the starting address of the rule in the table;

[0013] S012: Starting from the rule start address, get the next rule in sequence;

[0014] S013: Compare the data packet currently being processed with all the filter items in a certain rule in order to see if they match: if they do, process the data packet using the action in this rule; if they do not match, check whether the return value is "continue": if so, go to step S012; otherwise, go to step S014;

[0015] S014: End packet filtering.

[0016] Furthermore, obtaining data packets from a designated queue, decoding and stream reassembling the data packets, includes:

[0017] S021: Receive data packets from the queue, decode the data packets, analyze and detect the header information of the data packets, and save them in the packet structure Packet;

[0018] S022: Reassemble the data packet: parse the application layer protocol data packet from the application layer protocol related information parsed from the header;

[0019] S023: Complete the flow reassembly, fill the data packet Packet structure content, save the business data and type of the data packet, and end the traffic parsing.

[0020] Furthermore, the application layer parsing method is:

[0021] Read the header data in the ADU and check whether its protocol ID, data length and device address are in the correct range. If they are correct, continue; otherwise, end the analysis and enter step S04;

[0022] Read the function code and service data in the PDU. If the function code belongs to 0-8, 11-12, 15-17, 20-24, 43 and the data verification is correct, parse the service type and enter step S023; if the function code range is incorrect or the data verification is abnormal, end the parsing and enter step S04.

[0023] Furthermore, the specific method of identity authentication in step S03 is:

[0024] S31: Acquire a wireless radio frequency signal on the terminal side, extract time domain information and frequency domain information therein, form a radio frequency fingerprint, and store it in a fingerprint database;

[0025] S32: When the terminal accesses the concentrator, the captured data packets are authenticated. At this time, the blacklist information in the database is first read and the current terminal is matched against the blacklist. If the terminal is on the blacklist, the process proceeds to step S04; otherwise, the process proceeds to step S33.

[0026] S33: Read the fingerprint database information, perform fingerprint matching on the current terminal, and return the fingerprint matching result.

[0027] Furthermore, the specific method of the continuous trust evaluation in step S03 is:

[0028] S41: Obtain the ratio of the number of data packets sent to the number of data packets received by the current terminal in unit time, the average delay of sending data packets, and the entropy value of the destination IP address distribution, which are recorded as K1, K2, and K3 respectively;

[0029] S42: Calculate the median absolute deviation value of the communication parameters of the current service based on the communication parameters;

[0030] S43: Calculate the trust value T1 of the current terminal;

[0031] S44: Search the historical communication data of the past 10 time units in the server, obtain the communication parameters, and calculate the median absolute deviation and the historical trust value T2;

[0032] S45: Calculate the final trust value based on the current terminal trust value and the terminal's historical trust value. The calculation formula is:

[0033]

[0034] Furthermore, the median absolute deviation of the communication parameters of the current service is calculated based on the communication parameters, as follows:

[0035] S421: Summarize the communication parameters of all terminals requesting this service within the current time unit and take the median of the communication parameters. The total number of terminals is recorded as m, and the medians are recorded as median(K1), median(K2), and median(K3).

[0036] S422: Calculate the difference between the communication parameters of all terminals and the median, take the absolute value, and finally take the median, which is recorded as median(|K ij -median(K i )), where i = 1, 2, 3, j = 1, 2, ..., m;

[0037] S423: Calculate the median absolute deviation (MAD) based on the median value. The calculation formula is:

[0038] MAD=b×median(|K ij -median(K i )|).

[0039] Furthermore, the trust value of the current terminal is calculated as follows:

[0040] S431: Calculate the determination coefficient of the terminal communication parameter. The calculation formula is:

[0041]

[0042] S432: Integrate the determination coefficient vector and calculate the outlier value. The calculation formula is:

[0043]

[0044] S433: Calculate the terminal trustworthiness based on the outlier value. The calculation formula is:

[0045]

[0046] The threshold of the determination coefficient is 2.5. If the determination coefficient is greater than the threshold, it is considered an outlier.

[0047] The second aspect of the present invention discloses a distributed photovoltaic terminal access threat intelligent protection system, which includes a flow collection module, a flow analysis module, an identity authentication module and a flow control module;

[0048] The traffic collection module receives traffic data packets sent by the terminal and puts the data packets into a designated queue;

[0049] The traffic analysis module obtains data packets from a designated queue, decodes and reassembles the data packets, and obtains service data and service types;

[0050] The identity authentication module performs identity authentication on the terminal based on the reassembled data packet. If the authentication result shows that the terminal is legal, the terminal performs continuous trust evaluation on the terminal based on the data packets sent by the legal terminal. If the trust level is the trust level, the data packet is sent to the flow control module; if the authentication result shows that the terminal is illegal, the current terminal is added to the blacklist and the data packet is then sent to the flow control module;

[0051] The flow control module performs flow control based on the judgment results of the flow analysis module and the identity authentication module on the data packet; when there is an abnormality in the data packet, the flow analysis module and the identity authentication module immediately transfer the data packet to the flow control module, and the flow control module discards the data packet; otherwise, the data packet that has passed the security verification is transmitted out of the system to safely execute the specified business.

[0052] Furthermore, the traffic analysis module is specifically used to:

[0053] Receive data packets from the queue, decode the data packets, analyze and detect the data packet header information, and save them in the packet structure Packet;

[0054] Reassemble the data packet: parse the application layer protocol related information from the header and parse the application layer protocol data packet;

[0055] Complete the stream reassembly, fill the packet structure content, save the business data and type of the packet, and end the traffic parsing.

[0056] The beneficial effects of the present invention are as follows:

[0057] The present invention can take into account both hardware features (identity authentication module) and network features (traffic analysis and trust assessment module) to perform identity authentication and business interaction security verification on terminals (smart IoT electricity meters and photovoltaic protocol converters) accessing the concentrator, thereby preventing access by counterfeit terminals.

[0058] The present invention performs continuous real-time trust level evaluation on the terminal during business interaction, thereby preventing the terminal from being attacked during business interaction and causing communication hijacking due to failure to identify abnormalities in real time. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 System structure diagram of the present invention;

[0060] Figure 2 The data packet basic rule filtering flow chart of the present invention. DETAILED DESCRIPTION

[0061] The present invention will be further described below with reference to the accompanying drawings, but the present invention is not limited in any way. Any changes or substitutions made based on the teachings of the present invention fall within the scope of protection of the present invention.

[0062] The distributed photovoltaic terminal access threat intelligent protection system disclosed in the present invention includes: a concentrator, an intelligent IoT electric energy meter and a photovoltaic protocol converter;

[0063] The photovoltaic protocol converter is connected to the concentrator through communication, connected to the inverter through RS485 / RS232 / network cable, electrically connected to the Bluetooth photovoltaic miniature circuit breaker, the Bluetooth photovoltaic miniature circuit breaker is connected to the smart IoT electric energy meter, and the smart IoT electric energy meter is connected to the concentrator through communication;

[0064] The concentrator includes a traffic procurement module, a traffic analysis module, an identity authentication module, a continuous trust assessment module, a traffic control module, and a business execution module;

[0065] The traffic procurement module is used to capture terminal traffic data packets and send the data packets to the traffic analysis module. After the traffic analysis module parses the data packets, it sends them to the identity authentication module for identity authentication, and sends the data packets that pass the identity authentication to the continuous trust assessment module; the traffic control module is used to perform traffic control on the judgment results of the data packets; the business execution module executes the business determined to be safe.

[0066] The present invention also discloses a distributed photovoltaic terminal access threat intelligent protection method, the specific steps are as follows:

[0067] S00: Connect the smart IoT energy meter and photovoltaic protocol converter to the concentrator.

[0068] S01: The traffic collection module in the system captures terminal traffic data packets through iptables and performs the first filtering of the data packets through connection rule management, basic firewall rules and security protection rules. The data packets that pass the filtering are placed in the specified queue by setting NFQUEUE.

[0069] S02: The traffic analysis module in the system obtains data packets from the queue, decodes and reassembles the data packets, analyzes the application layer data, obtains the service data and service type, and saves them.

[0070] S03: The reassembled data packet is passed to the identity authentication module, which authenticates the current access terminal and returns the authentication result. If the authentication result indicates that the terminal is legal, the process proceeds to step S04; if the authentication result indicates that the terminal is illegal, the current terminal is added to the blacklist and the process proceeds to step S05.

[0071] S04: Terminal data packets with legitimate identity authentication results are passed to the continuous trust assessment module, which performs a continuous trust assessment on the currently connected terminal and generates a trust level. Trust levels are categorized into five levels: fully trusted, relatively trusted, generally trusted, somewhat trusted, and untrusted. If the trust level is fully trusted or relatively trusted, the process proceeds to step S05. If the trust level is generally trusted or somewhat trusted, alarm data is generated and stored, and the process proceeds to step S05. If the trust level is untrusted, the current terminal is added to a blacklist, and the process proceeds to step S05.

[0072] S05: The system flow control module performs flow control based on the data packet's judgment results in steps S02, S03, and S04. If an anomaly is found in steps S02, S03, or S04 (e.g., incorrect application data verification, illegal identity authentication, blacklisted terminal, or unsafe trust level), this step is immediately entered and the data packet is discarded. Otherwise, the data packet that has passed security verification is transmitted out of the system, and step S06 is entered.

[0073] S06: The service execution module of the concentrator securely executes the designated service.

[0074] Preferably, Figure 2 As shown, the specific method of filtering data packets based on the rules in step S01 is:

[0075] 1-1 In the iptables packet filtering module, the hook function is first activated to obtain table information. A hook is essentially a program that processes system messages and is embedded into the system through system calls. The iptables component is a tool, also known as userspace, that can insert, modify, and remove rules from the packet filtering table. Hook functions are part of the operating system's message processing mechanism. By setting "hooks," applications can filter all messages and events at the system level, accessing messages that would normally be inaccessible.

[0076] 1-2 Get the starting address of the rule in the table.

[0077] 1-3 starts from the rule start address and gets the next rule in sequence.

[0078] Steps 1-4 compare the currently processed data packet with all the filter items in a rule in order. If they match, the data packet is processed using the action in the rule. If they do not match, the return value is checked to see if it is "Continue." If so, the process proceeds to step 1-3. Otherwise, the process proceeds to step 1-5.

[0079] 1-5 ends packet filtering.

[0080] Preferably, the specific method of traffic analysis in step S02 is:

[0081] 2-1 Traffic parsing module first receives data packets from the queue, decodes the data packets, analyzes and detects the data packet header information (protocol ID, data length, device address, etc.), and saves it in the packet structure Packet.

[0082] 2-2 Data packet stream reassembly: The application layer protocol-related information parsed from the header is passed to the application layer parsing submodule in the traffic parsing module, where the application layer protocol data packet is parsed. The specific application layer parsing method is as follows: First, read the header data in the ADU and check whether its protocol ID, data length, and device address are within the correct range. If they are correct, continue parsing; otherwise, terminate the parsing and proceed to step S05. Next, read the function code and service data in the PDU. If the function code is within the range of 0-8, 11-12, 15-17, 20-24, or 43 and the data is verified to be correct, parse the service type and proceed to step 2-3. If the function code is within the incorrect range or the data verification is abnormal, terminate the parsing and proceed to step S05.

[0083] 2-3 Complete the stream reassembly, fill the packet structure content, save the business data and type of the packet, and end the traffic parsing.

[0084] Preferably, the specific method of identity authentication in step S03 is:

[0085] 3-1 On the terminal side, RF signal acquisition equipment is used to acquire wireless RF signals, extract time and frequency domain information, and form a RF fingerprint that is stored in a fingerprint database. This RF fingerprint uniquely identifies a terminal.

[0086] 3-2 When a terminal connects to the concentrator, data packets captured by the security system's traffic collection are passed to the identity authentication module. The system's database contains a pre-stored blacklist of terminals. The system first reads the blacklist information from the database and performs a blacklist match against the current terminal. If the terminal is on the blacklist, the process proceeds to step S05; otherwise, the process proceeds to step 3-3.

[0087] 3-3 The system reads the fingerprint database information, performs fingerprint matching on the current terminal, and returns the fingerprint matching result (the result is legal / illegal).

[0088] Preferably, the specific method of continuous trust evaluation in step S04 is:

[0089] 4-1 Obtain the ratio of packets sent to received per unit time by the current terminal, the average packet sending delay, and the entropy of the destination IP address distribution, denoted as K1, K2, and K3, respectively. The entropy of the destination IP address distribution is calculated as the information entropy of the destination IP address distribution. The specific method for calculating information entropy is common knowledge in the art and will not be detailed here.

[0090] 4-2 Calculate the median absolute deviation of the communication parameters of the current service based on the communication parameters, as follows:

[0091] 4-2-1 Summarize the communication parameters of all terminals requesting this service within the current time unit, and take the median of the communication parameters. The total number of terminals is recorded as m, and the median is recorded as median(K1), median(K2), and median(K3).

[0092] 4-2-2 Calculate the difference between the communication parameters of all terminals and the median, take the absolute value, and finally take the median, which is recorded as median(|K ij -median(K i )), where i=1, 2, 3, j=1, 2, …, m.

[0093] 4-2-3 Calculate the median absolute deviation (MAD) based on the median value in step 4-2-2. The calculation formula is:

[0094] MAD=b×median(|K ij -median(K i )|)

[0095] 4-3 Calculate the trust value of the current terminal, as follows:

[0096] 4-3-1 Calculate the determination coefficient of the terminal communication parameters. The calculation formula is:

[0097]

[0098] 4-3-2 Integrate the determination coefficient vector and calculate the outlier value. The calculation formula is:

[0099]

[0100] 4-3-3 Calculate the terminal trust based on the outlier value. The calculation formula is:

[0101]

[0102] The threshold of the determination coefficient is 2.5. If the determination coefficient is greater than the threshold, it is considered an outlier.

[0103] 4-4 Search for the historical communication data of the past 10 time units in the server, obtain the communication parameters, calculate the median absolute deviation according to the method in step 4-2, and calculate the historical trust value T2 according to the method in step 4-3.

[0104] 4-5 Calculate the final trust value based on the current terminal trust value calculated in step 4-3 and the terminal historical trust value calculated in step 4-4. The calculation formula is:

[0105]

[0106] Preferably, the present invention further discloses a distributed photovoltaic terminal access threat intelligent protection device, comprising a processor, a communication interface, a memory and a communication bus;

[0107] The processor, the communication interface and the memory communicate with each other via a communication bus; the memory is used to store computer programs;

[0108] The processor is used to execute the program stored in the memory to implement the above method.

[0109] Compared with existing protection methods, the present invention has the following beneficial effects:

[0110] The present invention can take into account both hardware features (identity authentication module) and network features (traffic analysis and trust assessment module) to perform identity authentication and business interaction security verification on terminals (smart IoT electricity meters and photovoltaic protocol converters) accessing the concentrator, thereby preventing access by counterfeit terminals.

[0111] At the same time, the present invention can perform continuous real-time trust level evaluation on the terminal during business interaction, preventing the terminal from being attacked during business interaction and causing communication hijacking due to the inability to identify abnormalities in real time.

[0112] As used herein, the word "preferred" is intended to serve as an example, instance, or illustration. Any aspect or design described herein as "preferred" is not necessarily to be construed as advantageous over other aspects or designs. Rather, the use of the word "preferred" is intended to present concepts in a concrete manner. As used in this application, the term "or" is intended to mean an inclusive "or" rather than an exclusive "or." That is, unless otherwise specified or clear from the context, "X employs A or B" is intended to mean any of the naturally inclusive permutations. That is, if X employs A; X employs B; or X employs both A and B, then "X employs A or B" is satisfied in any of the foregoing examples.

[0113] Moreover, although the present disclosure has been shown and described with respect to one or implementation, those skilled in the art will think of equivalent variations and modifications based on reading and understanding of this specification and the accompanying drawings. The present disclosure includes all such modifications and variations and is limited only by the scope of the appended claims. In particular, with respect to the various functions performed by the above-mentioned components (such as elements, etc.), the terms used to describe such components are intended to correspond to any component (unless otherwise indicated) that performs the specified function of the component (such as it is functionally equivalent), even if structurally different from the disclosed structure that performs the function in the exemplary implementation of the present disclosure shown herein. In addition, although the specific features of the present disclosure have been disclosed with respect to only one of several implementations, such features can be combined with one or other features of other implementations that can be desired and advantageous for a given or specific application. Moreover, insofar as the terms "including", "having", "containing" or their variations are used in specific embodiments or claims, such terms are intended to be included in a manner similar to the term "comprising".

[0114] The functional units in the embodiments of the present invention may be integrated into a single processing module, or each unit may exist physically separately, or multiple or more units may be integrated into a single module. The aforementioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium. The aforementioned storage medium may be a read-only memory, a magnetic disk, or an optical disk, etc. The aforementioned devices or systems may execute the storage method in the corresponding method embodiment.

[0115] In summary, the above embodiment is one implementation method of the present invention, but the implementation method of the present invention is not limited to the described embodiment. Any other changes, modifications, substitutions, combinations, and simplifications that deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the scope of protection of the present invention.

Claims

1. A distributed photovoltaic terminal access threat intelligent protection method, characterized in that: The method comprises the following steps: S01: receiving a traffic data packet sent by a terminal; and placing the data packet into a designated queue; S02: Obtaining data packets from a designated queue, decoding and stream reassembling the data packets, and obtaining service data and service types; S03: Authenticate the terminal based on the reassembled data packet. If the authentication result shows that the terminal is legitimate, perform a continuous trust evaluation on the terminal based on the data packets sent by the legitimate terminal. If the trust level is the trust level, proceed to step S04. If the authentication result shows that the terminal is illegitimate, add the current terminal to the blacklist and then proceed to step S04. The specific method of the continuous trust evaluation is as follows: S41: Get the ratio of the data packets sent by the current terminal to the data packets received in unit time , the average delay of sending data packets and the entropy value of the destination IP address distribution ; S42: According to the communication parameters Calculate the median absolute deviation of the communication parameters of the current service; S43: Calculate the trust value T1 of the current terminal based on the above median absolute deviation value; S44: Search the historical communication data of the past 10 time units in the server and obtain the historical communication parameters , calculate the historical median absolute deviation, and calculate the terminal historical trust value based on the historical median absolute deviation value ; S45: Calculate the final trust value based on the current terminal trust value and the terminal's historical trust value. The calculation formula is: ; S04: Perform flow control based on the judgment results of the data packet in steps S02 and S03; when the data packet has an abnormality in steps S02 and S03, enter this step immediately and discard the data packet; otherwise, the data packet that has passed the security verification is transmitted out of the system to safely execute the specified business.

2. The distributed photovoltaic terminal access threat intelligent protection method according to claim 1 is characterized in that: After receiving the traffic data packet sent by the terminal, before placing the data packet into the designated queue, the process also includes: performing a first filtering of the data packet through connection rule management, basic firewall rules, and security protection rules. The specific method is as follows: S011: In the packet filtering process of iptables, activate the hook function to obtain the starting address of the rule in the table; S012: Starting from the rule start address, get the next rule in sequence; S013: Compare the data packet currently being processed with all the filter items in a certain rule in order to see if they match: if they do, process the data packet using the action in this rule; if they do not match, check whether the return value is "continue": if so, go to step S012; otherwise, go to step S014; S014: End packet filtering.

3. The distributed photovoltaic terminal access threat intelligent protection method according to claim 1 is characterized in that: Get data packets from a specified queue, decode the data packets, and reassemble the streams, including: S021: Receive data packets from the queue, decode the data packets, analyze and detect the header information of the data packets, and save them in the packet structure Packet; S022: Reassemble the data packet: parse the application layer protocol data packet from the application layer protocol related information parsed from the header; S023: Complete the flow reassembly, fill the data packet Packet structure content, save the business data and type of the data packet, and end the traffic parsing.

4. The distributed photovoltaic terminal access threat intelligent protection method according to claim 3 is characterized in that: The application layer parsing method is: Read the header data in the ADU and check whether its protocol ID, data length and device address are in the correct range. If they are correct, continue; otherwise, end the analysis and enter step S04; Read the function code and service data in the PDU. If the function code belongs to 0-8, 11-12, 15-17, 20-24, 43 and the data verification is correct, parse the service type and enter step S023; if the function code range is incorrect or the data verification is abnormal, end the parsing and enter step S04.

5. The distributed photovoltaic terminal access threat intelligent protection method according to claim 1 is characterized in that: The specific method of identity authentication described in step S03 is: S31: Acquire a wireless radio frequency signal on the terminal side, extract time domain information and frequency domain information therein, form a radio frequency fingerprint, and store it in a fingerprint database; S32: When the terminal accesses the concentrator, the captured data packets are authenticated. At this time, the blacklist information in the database is first read and the current terminal is matched against the blacklist. If the terminal is on the blacklist, the process proceeds to step S04; otherwise, the process proceeds to step S33. S33: Read the fingerprint database information, perform fingerprint matching on the current terminal, and return the fingerprint matching result.

6. The distributed photovoltaic terminal access threat intelligent protection method according to claim 1 is characterized in that: According to the communication parameters Calculate the median absolute deviation of the communication parameters of the current service as follows: S421: Summarize the communication parameters of all terminals requesting this service within the current time unit, and take the median of the communication parameters. The total number of terminals is recorded as m, and the median is recorded as median ( ), median( ), median( ); S422: Calculate the difference between the communication parameters of all terminals and the median, take the absolute value, and finally take the median, which is recorded as , where i=1, 2, 3, j=1, 2, ..., m; S423: Calculate the median absolute deviation (MAD) based on the median value. The calculation formula is: 。 7. The distributed photovoltaic terminal access threat intelligent protection method according to claim 1 is characterized in that: Calculate the trust value of the current terminal as follows: S431: Calculate the determination coefficient of the terminal communication parameter. The calculation formula is: ； S432: Integrate the determination coefficient vector and calculate the outlier value. The calculation formula is: ； S433: Calculate the terminal trustworthiness based on the outlier value. The calculation formula is: ； The threshold of the determination coefficient is 2.

5. If the determination coefficient is greater than the threshold, it is considered an outlier. .

8. A distributed photovoltaic terminal access threat intelligent protection system, characterized in that: The system implements the distributed photovoltaic terminal access threat intelligent protection method according to any one of claims 1 to 7, comprising a flow collection module, a flow analysis module, an identity authentication module and a flow control module; The traffic collection module receives traffic data packets sent by the terminal and puts the data packets into a designated queue; The traffic analysis module obtains data packets from a designated queue, decodes and reassembles the data packets, and obtains service data and service types; The identity authentication module performs identity authentication on the terminal according to the reassembled data packet. If the authentication result shows that the terminal is legal, the terminal performs continuous trust evaluation on the data packet sent by the legal terminal. If the trust level is the trust level, the data packet is sent to the flow control module. If the authentication result shows that the terminal is illegal, the current terminal will be added to the blacklist and the data packet will be sent to the flow control module; The flow control module performs flow control based on the judgment results of the flow analysis module and the identity authentication module on the data packet; when there is an abnormality in the data packet, the flow analysis module and the identity authentication module immediately transfer the data packet to the flow control module, and the flow control module discards the data packet; otherwise, the data packet that has passed the security verification is transmitted out of the system to safely execute the specified business.

9. The distributed photovoltaic terminal access threat intelligent protection system according to claim 8, characterized in that: The traffic analysis module is specifically used for: Receive data packets from the queue, decode the data packets, analyze and detect the data packet header information, and save them in the packet structure Packet; Reassemble the data packet: parse the application layer protocol related information from the header and parse the application layer protocol data packet; Complete the stream reassembly, fill the packet structure content, save the business data and type of the packet, and end the traffic parsing.

Images