A substation data security monitoring system based on SCD modeling

Abstract

The application relates to the technical field of data security monitoring, in particular to a transformer substation data security monitoring system based on SCD modeling, which comprises a monitoring center, the monitoring center is in communication connection with a data acquisition module, a data storage module, an SCD modeling module, a decoy cache module, a business data transmission module, a non-intrusive safety detection module and an exception processing module; the data acquisition module is used for acquiring business data; the data storage module is used for storing historical business data; the SCD modeling module is used for constructing a business data integrated model; the decoy cache module is used for laying decoy cache nodes; the business data transmission module is used for transmitting business data through the decoy cache nodes; the non-intrusive safety detection module is used for performing non-intrusive safety detection on equipment; and the exception processing module is used for executing relevant exception processing measures; the system improves the efficiency of the intrusive safety monitoring and further guarantees the business data security of the transformer substation.

Description

Technical Field

[0001] This invention relates to the field of data security monitoring technology, specifically to a substation data security monitoring system based on SCD modeling. Background Technology

[0002] With the trend of integrated development of industrialization and informatization, traditionally isolated and separate communication protocols, equipment, and systems are gradually becoming interconnected. In smart grid systems, due to the large number of connected terminals, complex environments, and widespread use of wireless communication, data also faces a series of security threats, which is detrimental to the development of smart grids.

[0003] The SCD file contains information such as the substation's topology, equipment types, communication parameters, and data model. It provides a unified description method, enabling various devices to understand and interact with each other, thereby achieving more efficient and flexible system integration.

[0004] The comparison document CN114513342B, "A method and system for monitoring the security of communication data in an intelligent substation," generates a security monitoring basis based on the whole-station SCD configuration file, security requirements, and extracted information. According to the security policy, it monitors the legality of data in the intelligent substation communication network in real time and captures, records, traces, and alarms illegal messages on the communication network in real time.

[0005] The reference document CN110737722B, "Synchronization System and Method for Substation Monitoring Backend Database, SCD, and RCD," is used to issue or reclaim modification tokens, which can exist at most once at any given time, and to issue synchronization tokens. Through token settings, it ensures the correctness and reliability of data synchronization. The data synchronization accuracy rate can reach 100%, and the time saving rate exceeds 99%. This not only greatly improves work efficiency but also ensures the reliable and safe operation of the power grid.

[0006] However, substation equipment has high requirements for business continuity and cannot withstand prolonged equipment anomaly testing. It is necessary to avoid the indirect economic losses caused by the decline in power quality due to the shutdown monitoring of substation power equipment. At the same time, how to monitor and prevent illegal intrusion into the business data transmission process inside the substation while avoiding the impact on the safety testing of substation power equipment, and at the same time improve the efficiency of substation data security monitoring, are problems that we urgently need to solve. Here, we provide a substation data security monitoring system based on SCD modeling. Summary of the Invention

[0007] In view of this, the purpose of the present invention is to provide a substation data security monitoring system based on SCD modeling to overcome the above-mentioned technical problems.

[0008] To achieve the above objectives, the present invention adopts the following technical solution:

[0009] This application provides a substation data security monitoring system based on SCD modeling, including a monitoring center, which is communicatively connected to a data acquisition module, a data storage module, an SCD modeling module, a decoy buffer module, a business data transmission module, a non-intrusive security detection module, and an anomaly handling module;

[0010] The data acquisition module is used to collect business data from various devices in the substation and send it to the database for storage, while recording the sending timestamp and receiving timestamp of the business data.

[0011] The data storage module is used to store historical business data of each device in the substation;

[0012] The SCD modeling module is used to generate the logical device layer, grid model layer and time data layer of the substation based on the SCD description file of the entire substation, and to build an integrated business data model.

[0013] The decoy caching module is used to obtain target logical devices that meet the decoy caching node deployment standards in the logical device layer of the integrated business data model, and to obtain the data link path of the target logical devices in the network model layer of the integrated business data model. It then sets up decoy caching nodes on the data link path between the target logical devices and the database, and constructs a traffic splitting link between the decoy caching nodes and the non-intrusive security detection module. The decoy caching node includes a one-way read link and a one-way write link. The one-way write link includes a time verification unit, and the one-way read link includes a data synchronization unit, a read record unit, an automatic deletion unit, and a real-time data unit.

[0014] The business data transmission module is used to transmit business data from the integrated business data model to the database through the decoy cache node. Through a time verification unit set within the one-way write link, when the business data in the integrated business data model is sent to the database via the one-way write link, the time verification unit obtains the sending timestamp of the business data based on the time data layer in the integrated business data model and sends the sending timestamp to the database. It also obtains the receiving timestamp of the existing business data in the database and compares it with the sending timestamp sent to the database. If the sending timestamp is greater than the receiving timestamp, the one-way write link allows the business data to be stored in the database. Simultaneously, the business data and its sending timestamp are synchronously copied to the one-way read link and sent to the non-intrusive... The security detection module sends security detection information. When the sending timestamp is less than or equal to the receiving timestamp, the one-way write link marks the service data as abnormal delayed data and refuses to store the abnormal delayed data in the database. When the one-way write link receives the abnormal delayed data three times consecutively, it generates network layer abnormal information for the corresponding logical device and sends it to the abnormal handling module. It is also used to store the service data synchronously copied from the one-way write link to the one-way read link through a data synchronization unit set within the one-way read link; to record read records of completed access read operations of service data in the data synchronization unit through the read record unit; and to determine whether a read record of the service data exists in the read record unit through the automatic deletion unit. When a read record of the service data exists in the read record unit, the automatic deletion unit deletes the service data stored in the data synchronization unit.

[0015] The non-intrusive security detection module is used to determine the transmission timestamp of the service data based on the received security detection information, and to compare the transmission timestamp of the service data stored in the real-time data unit with the transmission timestamp of the service data determined by the security detection information. When the transmission timestamp of the service data stored in the real-time data unit is consistent with the transmission timestamp of the service data determined by the security detection information, the non-intrusive security detection module reads the service data stored in the real-time data unit of the unidirectional read link through the split link. When there is no service data in the real-time data unit that is consistent with the transmission timestamp of the service data determined by the security detection information, the non-intrusive security detection module generates network layer anomaly information of the logical device corresponding to the service data and sends it to the anomaly handling module; it is also used to generate hardware layer processing information of the corresponding logical device based on the successfully read service data.

[0016] The exception handling module includes a hardware layer exception handling unit and a network layer exception handling unit. The hardware layer exception handling unit is used to execute corresponding hardware exception handling measures based on the received hardware layer processing information of the logical device. The network layer exception handling unit is used to execute corresponding software exception handling measures based on the received network layer exception information of the logical device.

[0017] Furthermore, in the system described above, the process by which the SCD modeling module generates the logical device layer, network structure model layer, and time data layer of the substation based on the SCD description file of the entire substation, and constructs an integrated business data model, includes:

[0018] Based on the SCD description file of the entire substation, obtain the data exchange relationships between various devices in the substation, the data exchange relationships between various devices and other functional modules, the data types of various devices, and the functional units of various devices.

[0019] Establish a logical device layer for the substation based on the functional units of each device in the substation;

[0020] A network structure model layer of the substation is established based on the data exchange relationships between various devices in the substation and the data exchange relationships between various devices and other functional modules.

[0021] Obtain the service data, transmission timestamp, and reception timestamp of each logical device in the logical device layer, and construct a timestamp data list of the service data based on the transmission timestamp and reception timestamp to obtain the time data layer;

[0022] The integrated business data model is obtained by overlaying the network structure model layer and the time data layer on the logical device layer.

[0023] Furthermore, in the system described above, establishing a logical device layer of the substation based on the functional units of each device in the substation includes:

[0024] Building digital spaces;

[0025] Obtain the physical entities of the substation equipment in the physical space during the operation of the substation;

[0026] Based on the SCD description file, each functional unit in the substation equipment is represented as a logical node, and the physical entity of the substation equipment is represented as a logical device composed of several logical nodes and mapped to the digital space to obtain a logical device layer.

[0027] Furthermore, in the system described above, the step of establishing the substation grid model layer based on the data exchange relationships between various devices in the substation and the data exchange relationships between various devices and other functional modules includes:

[0028] Based on the data exchange relationships between various devices in the substation and the data exchange relationships between various devices and other functional modules, the data link paths of various logical devices in the digital space are constructed to obtain the grid model layer.

[0029] Furthermore, in the system described above, the process by which the decoy caching module acquires the target logical device that conforms to the decoy caching node deployment standard in the logical device layer of the integrated business data model includes:

[0030] The safety event data of each device in the substation is obtained based on the historical business data stored in the data storage module.

[0031] Evaluation indicators are selected based on the safety event data of each device in the substation. The indicator weights and safety importance levels of the evaluation indicators are set. The membership matrix of each device in the substation to the safety importance level is determined by fuzzy comprehensive evaluation.

[0032] The safety importance level of each piece of equipment in the substation is obtained based on the membership matrix and the index weights.

[0033] Based on the safety importance level of each device in the substation, determine whether the corresponding logical device in the substation is the target logical device.

[0034] Furthermore, in the system described above, determining whether the logical device corresponding to each piece of equipment in the substation is the target logical device based on the safety importance level of each piece of equipment in the substation includes:

[0035] Set a preset security importance level;

[0036] The logic devices corresponding to the devices in the substation whose safety importance level is higher than the preset safety importance level are set as the target logic devices.

[0037] Furthermore, in the system described above, the process by which the non-intrusive security detection module generates hardware layer processing information for the logical device based on successfully read business data includes:

[0038] Based on the substation-wide SCD configuration file, a device-level safety monitoring rule configuration file is generated, and the standard parameter indicators of each logical device in the integrated business data model are determined according to the device-level safety monitoring rule configuration file.

[0039] When the non-intrusive security detection module successfully reads the business data of the logical device in the decoy cache node, it obtains the operating parameter value of the logical device based on the business data and compares the operating parameter value with the standard parameter index.

[0040] When the operating parameter value does not meet the standard parameter index, the non-intrusive security detection module generates the hardware layer processing information of the logic device and sends it to the exception handling module.

[0041] Furthermore, in the system described above, the security event data includes attack data stream type, number of data attacks, and data attack frequency.

[0042] Furthermore, in the system described above, the business data includes at least: transformer data, circuit breaker data, busbar data, relay data, and control system data.

[0043] Furthermore, in the system described above, the functional units include at least: a functional unit representing a switching device, a functional unit representing a measuring device, a functional unit representing a protection device, a functional unit representing a control device, a functional unit representing a monitoring device, and a functional unit representing a data transmission and communication device.

[0044] The beneficial effects of this invention are as follows:

[0045] This invention employs an intrusive security monitoring module to perform non-intrusive security monitoring of event logs and business data of substation equipment. This avoids the indirect economic losses caused by power quality degradation resulting from downtime monitoring of equipment at the equipment layer. Furthermore, by identifying abnormal behavior at the equipment layer, potential threats at the network layer, and signs of network layer attacks, it allows for timely countermeasures. The entire monitoring activity does not affect the normal operation of the substation system, achieving a protective effect. Simultaneously, the integrated business data model makes the display of business data clearer and more intuitive. Moreover, by setting decoy caching nodes and traffic splitting links, the business data read from the database by the non-intrusive security monitoring module is transformed into read... By retrieving business data from the decoy cache node, network congestion caused by simultaneous access to the database by multiple non-intrusive security monitoring modules in the substation is avoided, thus improving the efficiency of non-intrusive security monitoring. Furthermore, when unauthorized data intrusion attempts to steal business data within the substation, the decoy cache node is accessed first, and the accessed data is automatically deleted. When the non-intrusive security monitoring module accesses business data that was not detected by the decoy cache node, it determines that unauthorized data intrusion has occurred and generates relevant alarm information, sending it to the anomaly handling module. The decoy cache node, while improving the efficiency of intrusive security monitoring, further safeguards the business data security of the substation. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is a schematic diagram of the structure of an embodiment of a substation data security monitoring system based on SCD modeling according to the present invention. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be described in detail below. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other implementation methods obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0049] Figure 1 This is a schematic diagram of the structure of an embodiment of a substation data security monitoring system based on SCD modeling according to the present invention. Please refer to... Figure 1 This embodiment may include: a monitoring center 1, which is communicatively connected to a data acquisition module 2, a data storage module 3, an SCD modeling module 4, a decoy caching module 5, a business data transmission module 6, a non-intrusive security detection module 7, and an anomaly handling module 8;

[0050] Data acquisition module 2 is used to collect business data from various devices in the substation and send it to the database for storage, while recording the sending and receiving timestamps of the business data;

[0051] Data storage module 3 is used to store historical business data of various devices in the substation;

[0052] SCD modeling module 4 is used to generate logical device layers, grid model layers, and time data layers of the substation based on the SCD description file of the entire substation, and to build an integrated business data model.

[0053] The decoy cache module 5 is used to acquire target logical devices that meet the decoy cache node deployment standards in the logical device layer of the integrated business data model, and to acquire the data link path of the target logical devices in the network model layer of the integrated business data model. It sets up decoy cache nodes on the data link path between the target logical devices and the database, and builds a traffic splitting link between the decoy cache nodes and the non-intrusive security detection module. The decoy cache node contains a one-way read link and a one-way write link. The one-way write link is equipped with a time verification unit, and the one-way read link is equipped with a data synchronization unit, a read record unit, an automatic deletion unit, and a real-time data unit.

[0054] The business data transmission module 6 transmits business data from the integrated business data model to the database via decoy cache nodes. Through a time verification unit set within the one-way write link, when business data from the integrated business data model is sent to the database, the time verification unit obtains the sending timestamp of the business data based on the time data layer in the integrated business data model and sends it to the database. It then obtains the receiving timestamp of existing business data in the database and compares it with the sending timestamp sent to the database. If the sending timestamp is greater than the receiving timestamp, the one-way write link allows the business data to be stored in the database. Simultaneously, the business data and its sending timestamp are synchronously copied to the one-way read link and sent to the non-intrusive security detection module 7. The system sends security detection information. When the sending timestamp is less than or equal to the receiving timestamp, the one-way write link marks the service data as abnormal delayed data and refuses to store the abnormal delayed data in the database. When the one-way write link receives abnormal delayed data three times in a row, it generates network layer abnormal information for the corresponding logical device and sends it to the abnormal handling module 8. It is also used to store the service data synchronously copied from the one-way write link to the one-way read link through the data synchronization unit set in the one-way read link, record the read records of the service data in the data synchronization unit that have been accessed and read through the read record unit, and determine whether there is a read record of service data in the read record unit through the automatic deletion unit. When there is a read record of service data in the read record unit, the automatic deletion unit deletes the service data stored in the data synchronization unit.

[0055] The non-intrusive security detection module 7 is used to determine the transmission timestamp of the service data based on the received security detection information, and to compare the transmission timestamp of the service data stored in the real-time data unit with the transmission timestamp of the service data determined by the security detection information. When the transmission timestamp of the service data stored in the real-time data unit is consistent with the transmission timestamp of the service data determined by the security detection information, the non-intrusive security detection module 7 reads the service data stored in the real-time data unit of the one-way read link through the split link. When there is no service data in the real-time data unit with the transmission timestamp of the service data determined by the security detection information, the non-intrusive security detection module 7 generates network layer abnormal information of the logical device corresponding to the service data and sends it to the abnormality handling module 8; it is also used to generate hardware layer processing information of the corresponding logical device based on the successfully read service data.

[0056] The exception handling module 8 is equipped with a hardware layer exception handling unit and a network layer exception handling unit. The hardware layer exception handling unit is used to execute corresponding hardware exception handling measures according to the hardware layer processing information of the received logical device; the network layer exception handling unit is used to execute corresponding software exception handling measures according to the network layer exception information of the received logical device.

[0057] It is understandable that this embodiment, by setting up an intrusion-based security monitoring module, performs non-intrusive security monitoring of event logs and business data of substation equipment. This avoids the indirect economic losses caused by power quality degradation resulting from downtime monitoring of equipment at the equipment layer. Simultaneously, by identifying abnormal behavior at the equipment layer, potential threats at the network layer, and signs of network layer attacks, it allows for timely and appropriate countermeasures. The entire monitoring activity does not affect the normal operation of the substation system and achieves a protective effect. Furthermore, the integrated business data model makes the display of business data clearer and more intuitive. By setting up decoy caching nodes and traffic splitting links, the business data read from the database by the non-intrusive security monitoring module is transferred... By reading business data from the decoy cache node, the network congestion caused by multiple non-intrusive security monitoring modules accessing the database simultaneously is avoided, thus improving the efficiency of non-intrusive security monitoring. Simultaneously, when illegal data intrusion steals business data from within the substation, it first accesses the business data in the decoy cache node, and the business data in the decoy cache node is automatically deleted after being accessed. When the non-intrusive security monitoring module accesses business data that was not detected by the decoy cache node, it determines that illegal intrusion data exists and generates relevant alarm information, sending it to the anomaly handling module 8. The decoy cache node, while improving the efficiency of intrusive security monitoring, further ensures the security of the substation's business data.

[0058] It should be noted that the business data includes: transformer data, specifically monitoring data such as transformer temperature, humidity, oil level, oil quality, current, and voltage, as well as test data such as insulation resistance, grounding resistance, and winding resistance;

[0059] Circuit breaker data, specifically: monitoring data such as circuit breaker current, voltage, switch status, and number of operations;

[0060] Busbar data specifically includes: monitoring data such as busbar current, voltage, temperature, and humidity, as well as test data such as busbar grounding resistance;

[0061] Relay data specifically includes: monitoring data such as current, voltage, frequency, and phase of the relay protection device, as well as event data such as fault records and protection action records;

[0062] Control system data specifically includes: control system operation commands, status information, alarm information, equipment configuration, and other data.

[0063] The functional units represented by logical nodes in a device include, but are not limited to:

[0064] Functional units used to represent switching equipment, such as circuit breakers and disconnectors; functional units used to represent measuring equipment, such as current transformers and voltage transformers; functional units used to represent protection equipment, such as differential protection and overvoltage protection; functional units used to represent control equipment, such as automated control devices and remote control devices; functional units used to represent monitoring equipment, such as status monitoring devices and fault recording devices; and functional units used to represent data transmission and communication equipment, such as communication interfaces and Ethernet switches.

[0065] Preferably, the process of SCD modeling module 4 generating logical device layers, grid model layers, and time data layers of the substation based on the SCD description file of the entire substation, and constructing an integrated business data model includes:

[0066] Based on the SCD description file of the entire substation, obtain the data exchange relationships between various devices in the substation, the data exchange relationships between various devices and other functional modules, the data types of various devices, and the functional units of various devices.

[0067] Establish a logical device layer for the substation based on the functional units of each device in the substation;

[0068] Establish a network structure model layer for the substation based on the data exchange relationships between various devices in the substation and the data exchange relationships between various devices and other functional modules.

[0069] Obtain the service data, transmission timestamp, and reception timestamp of each logical device in the logical device layer. Construct a timestamp data list of the service data based on the transmission timestamp and reception timestamp to obtain the time data layer.

[0070] By overlaying a network structure model layer and a time data layer on top of the logical device layer, an integrated business data model is obtained.

[0071] Preferably, a logical device layer of the substation is established based on the functional units of each device in the substation, including:

[0072] Building digital spaces;

[0073] To obtain the physical entities of substation equipment in the physical space during substation operation;

[0074] Based on the SCD description file, each functional unit in the substation equipment is represented as a logical node, and the physical entity of the substation equipment is represented as a logical device composed of several logical nodes and mapped to the digital space to obtain the logical device layer.

[0075] Preferably, a network model layer of the substation is established based on the data exchange relationships between various devices in the substation and the data exchange relationships between various devices and other functional modules, including:

[0076] Based on the data exchange relationships between various devices in the substation and the data exchange relationships between various devices and other functional modules, the data link paths of various logical devices in the digital space are constructed to obtain the grid model layer.

[0077] It should be noted that the functional units represented by logical nodes in the device include, but are not limited to:

[0078] Functional units used to represent switching equipment, such as circuit breakers and disconnectors; functional units used to represent measuring equipment, such as current transformers and voltage transformers; functional units used to represent protection equipment, such as differential protection and overvoltage protection; functional units used to represent control equipment, such as automated control devices and remote control devices; functional units used to represent monitoring equipment, such as status monitoring devices and fault recording devices; and functional units used to represent data transmission and communication equipment, such as communication interfaces and Ethernet switches.

[0079] The data link path defines the sender and receiver of the data stream, the data transmission method and transmission rules. The data transmission method includes, but is not limited to, TCP / IP, UDP, etc., and the data transmission rules include, but are not limited to, the GOOSE communication protocol based on the IEC61850 standard, the transmission of sampled values ​​based on the IEC61850-9-2LE and IEC61850-9-2HSR standards, the message transmission based on MQTT, and the data interaction based on Web services, etc.

[0080] Preferably, the process by which the decoy caching module 5 acquires target logical devices that conform to the decoy caching node deployment standard in the logical device layer of the integrated business data model includes:

[0081] Based on the historical business data stored in data storage module 3, obtain the safety event data of each device in the substation;

[0082] Evaluation indicators are selected based on safety event data of various equipment in the substation. The indicator weights and safety importance levels of the evaluation indicators are set. The membership matrix of each equipment in the substation to the safety importance level is determined by fuzzy comprehensive evaluation.

[0083] The safety importance level of each piece of equipment in the substation is obtained based on the membership matrix and index weights;

[0084] Determine whether the corresponding logical device in the substation is the target logical device based on the safety importance level of each device in the substation.

[0085] Preferably, determining whether the logical device corresponding to each piece of equipment in the substation is the target logical device is based on the safety importance level of each piece of equipment in the substation, including:

[0086] Set a preset security importance level;

[0087] Set the logic devices corresponding to the equipment in the substation whose safety importance level is higher than the preset safety importance level as the target logic devices.

[0088] Preferably, the security incident data includes the attack data stream type, the number of data attacks, and the frequency of data attacks.

[0089] Understandably, the data attack frequency changes in real time. First, the historical data attack frequency is generated based on the data attack timestamp and the number of data attacks in the attack data stream in data storage module 3. Then, the time elapsed between the last data attack timestamp and the current data attack time is obtained, the data attack timestamp of the attack data stream is updated, and the updated data attack frequency is generated based on the updated data attack timestamp and the number of data attacks.

[0090] Preferably, the process by which the non-intrusive security detection module 7 generates hardware layer processing information for the logic device based on successfully read business data includes:

[0091] Based on the substation-wide SCD configuration file, a device-level safety monitoring rule configuration file is generated, and the standard parameter indicators of each logical device in the integrated business data model are determined according to the device-level safety monitoring rule configuration file.

[0092] When the non-intrusive security detection module 7 successfully reads the business data of the logical device in the decoy cache node, it obtains the operating parameter value of the logical device based on the business data and compares the operating parameter value with the standard parameter index.

[0093] When the operating parameter value does not meet the standard parameter index, the non-intrusive security detection module 7 generates the hardware layer processing information of the logic device and sends it to the exception handling module 8.

[0094] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0095] It should be noted that in the description of this invention, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this invention, unless otherwise stated, "a plurality of" means at least two.

[0096] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0097] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0098] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0099] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0100] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.

[0101] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0102] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A substation data security monitoring system based on SCD modeling, comprising a monitoring center, characterized in that, The monitoring center is connected to a data acquisition module, a data storage module, an SCD modeling module, a decoy caching module, a business data transmission module, a non-intrusive security detection module, and an anomaly handling module. The data acquisition module is used to collect business data from various devices in the substation and send it to the database for storage, while recording the sending timestamp and receiving timestamp of the business data. The data storage module is used to store historical business data of each device in the substation; The SCD modeling module is used to generate the logical device layer, grid model layer and time data layer of the substation based on the SCD description file of the entire substation, and to build an integrated business data model. The decoy caching module is used to obtain target logical devices that meet the decoy caching node deployment standards in the logical device layer of the integrated business data model, and to obtain the data link path of the target logical devices in the network model layer of the integrated business data model. It then sets up decoy caching nodes on the data link path between the target logical devices and the database, and constructs a traffic splitting link between the decoy caching nodes and the non-intrusive security detection module. The decoy caching node includes a one-way read link and a one-way write link. The one-way write link includes a time verification unit, and the one-way read link includes a data synchronization unit, a read record unit, an automatic deletion unit, and a real-time data unit. The business data transmission module is used to transmit business data from the integrated business data model to the database through the decoy cache node. Through a time verification unit set within the one-way write link, when the business data in the integrated business data model is sent to the database via the one-way write link, the time verification unit obtains the sending timestamp of the business data based on the time data layer in the integrated business data model and sends the sending timestamp to the database. It also obtains the receiving timestamp of the existing business data in the database and compares it with the sending timestamp sent to the database. If the sending timestamp is greater than the receiving timestamp, the one-way write link allows the business data to be stored in the database. Simultaneously, the business data and its sending timestamp are synchronously copied to the one-way read link and sent to the non-intrusive... The security detection module sends security detection information. When the sending timestamp is less than or equal to the receiving timestamp, the one-way write link marks the service data as abnormal delayed data and refuses to store the abnormal delayed data in the database. When the one-way write link receives the abnormal delayed data three times consecutively, it generates network layer abnormal information for the corresponding logical device and sends it to the abnormal handling module. It is also used to store the service data synchronously copied from the one-way write link to the one-way read link through a data synchronization unit set within the one-way read link; to record read records of completed access read operations of service data in the data synchronization unit through the read record unit; and to determine whether a read record of the service data exists in the read record unit through the automatic deletion unit. When a read record of the service data exists in the read record unit, the automatic deletion unit deletes the service data stored in the data synchronization unit. The non-intrusive security detection module is used to determine the transmission timestamp of the service data based on the received security detection information, and to compare the transmission timestamp of the service data stored in the real-time data unit with the transmission timestamp of the service data determined by the security detection information. When the transmission timestamp of the service data stored in the real-time data unit is consistent with the transmission timestamp of the service data determined by the security detection information, the non-intrusive security detection module reads the service data stored in the real-time data unit of the unidirectional read link through the split link. When there is no service data in the real-time data unit that is consistent with the transmission timestamp of the service data determined by the security detection information, the non-intrusive security detection module generates network layer anomaly information of the logical device corresponding to the service data and sends it to the anomaly handling module; it is also used to generate hardware layer processing information of the corresponding logical device based on the successfully read service data. The exception handling module includes a hardware layer exception handling unit and a network layer exception handling unit. The hardware layer exception handling unit is used to execute corresponding hardware exception handling measures based on the received hardware layer processing information of the logical device. The network layer exception handling unit is used to execute corresponding software exception handling measures based on the received network layer exception information of the logical device.

2. The system according to claim 1, characterized in that, The SCD modeling module is used to generate logical device layers, grid model layers, and time data layers for the substation based on the SCD description file of the entire substation, and the process of constructing an integrated business data model includes: Based on the SCD description file of the entire substation, obtain the data exchange relationships between various devices in the substation, the data exchange relationships between various devices and other functional modules, the data types of various devices, and the functional units of various devices. Establish a logical device layer for the substation based on the functional units of each device in the substation; A network structure model layer of the substation is established based on the data exchange relationships between various devices in the substation and the data exchange relationships between various devices and other functional modules. Obtain the service data, transmission timestamp, and reception timestamp of each logical device in the logical device layer, and construct a timestamp data list of the service data based on the transmission timestamp and reception timestamp to obtain the time data layer; The integrated business data model is obtained by overlaying the network structure model layer and the time data layer on the logical device layer.

3. The system according to claim 2, characterized in that, The step of establishing a logical device layer for the substation based on the functional units of each device in the substation includes: Building digital spaces; Obtain the physical entities of the substation equipment in the physical space during the operation of the substation; Based on the SCD description file, each functional unit in the substation equipment is represented as a logical node, and the physical entity of the substation equipment is represented as a logical device composed of several logical nodes and mapped to the digital space to obtain a logical device layer.

4. The system according to claim 3, characterized in that, The step of establishing the substation grid model layer based on the data exchange relationships between various devices in the substation and the data exchange relationships between various devices and other functional modules includes: Based on the data exchange relationships between various devices in the substation and the data exchange relationships between various devices and other functional modules, the data link paths of various logical devices in the digital space are constructed to obtain the grid model layer.

5. The system according to claim 4, characterized in that, The process by which the decoy caching module acquires target logical devices that meet the decoy caching node deployment standards in the logical device layer of the integrated business data model includes: The safety event data of each device in the substation is obtained based on the historical business data stored in the data storage module. Evaluation indicators are selected based on the safety event data of each device in the substation. The indicator weights and safety importance levels of the evaluation indicators are set. The membership matrix of each device in the substation to the safety importance level is determined by fuzzy comprehensive evaluation. The safety importance level of each piece of equipment in the substation is obtained based on the membership matrix and the index weights. Based on the safety importance level of each device in the substation, determine whether the corresponding logical device in the substation is the target logical device.

6. The system according to claim 5, characterized in that, The step of determining whether the logical device corresponding to each piece of equipment in the substation is the target logical device based on the safety importance level of each piece of equipment in the substation includes: Set a preset security importance level; The logic devices corresponding to the devices in the substation whose safety importance level is higher than the preset safety importance level are set as the target logic devices.

7. The system according to claim 6, characterized in that, The process by which the non-intrusive security detection module generates hardware layer processing information for the logical device based on successfully read business data includes: Based on the substation-wide SCD configuration file, a device-level safety monitoring rule configuration file is generated, and the standard parameter indicators of each logical device in the integrated business data model are determined according to the device-level safety monitoring rule configuration file. When the non-intrusive security detection module successfully reads the business data of the logical device in the decoy cache node, it obtains the operating parameter value of the logical device based on the business data and compares the operating parameter value with the standard parameter index. When the operating parameter value does not meet the standard parameter index, the non-intrusive security detection module generates the hardware layer processing information of the logic device and sends it to the exception handling module.

8. The system according to claim 7, characterized in that, The security event data includes the attack data stream type, the number of data attacks, and the frequency of data attacks.

9. The system according to claim 8, characterized in that, The business data includes at least: transformer data, circuit breaker data, busbar data, relay data, and control system data.

10. The system according to claim 9, characterized in that, The functional unit includes at least: a functional unit representing a switching device, a functional unit representing a measuring device, a functional unit representing a protection device, a functional unit representing a control device, a functional unit representing a monitoring device, and a functional unit representing a data transmission and communication device.

Images