Power system network attack simulation and security evaluation system and method

Abstract

The invention discloses a power system network attack simulation and security evaluation system and system, and relates to the technical field of power system security and simulation, and the system comprises a management system, a communication network, a physical power system simulator and a performance and security test function. The management system comprises a client, a database, a human-computer interface and a server. The communication network comprises a wireless communication technology and a network intrusion detection system; the physical power system simulator comprises a power load balancing module, a power grid simulator and power system analysis software. By integrating a management system, a communication network and a physical power system simulator, dynamic response and stability simulation of a power system under network attack are realized; according to the invention, by adopting a distributed network protocol DNP3 and an international electrical communication standard IEC-61850, the security and reliability of data transmission are ensured, and the defense capability of a power system to network attacks such as DoS and FDI attacks is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of power system security and simulation technology, and in particular to a power system network attack simulation and security assessment system and method. Background Art

[0002] Power system security and simulation technology is an interdisciplinary technology that integrates information technology and power engineering. It aims to enhance the power system's defense capabilities against cyber attacks through simulation and emulation. This field not only includes traditional protection of physical components of the power system, but also involves security measures for network communication protocols, data transmission, and system operations. Simulation technology enables researchers to reproduce and analyze various cyber attack scenarios such as denial of service (DoS) and false data injection (FDI) in a virtual environment, thereby testing and optimizing the power system's cyber security strategy without affecting the actual power grid operation. In recent years, as power systems have increasingly adopted digital and networked technologies, the cyber security threats they face are also increasing. The significance of studying power system security and simulation technology has become increasingly important. Research in this field helps to discover and patch potential security vulnerabilities in the system in advance, ensuring that the power grid can maintain stable and safe operation in the face of complex cyber attacks.

[0003] At present, there are some shortcomings in power system security and simulation technology. The power system simulation platform in the existing technology focuses on static data processing, lacks the ability to adapt to real-time dynamic environments, and cannot perform efficient real-time hybrid simulation of complex power systems; the protection measures for firmware security are not perfect, and the existing power system firmware operation simulation technology fails to fully consider the needs of firmware security analysis and vulnerability mining, resulting in the power system terminal equipment being vulnerable to network attacks; the simulation processing of large-scale power information-physical systems usually involves a large amount of data interaction, which not only consumes a lot of computing resources, but also may lead to low simulation efficiency and insufficient accuracy. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is to achieve a comprehensive simulation and analysis of network attacks, as well as a detailed evaluation of the impact of the attacks.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a power system network attack simulation and security assessment system, which comprises the following steps:

[0007] Management system, communication network, physical power system simulator and performance and safety testing functions; the management system includes a client, a database, a human-machine interface and a server; the communication network includes wireless communication technology and a network intrusion detection system; the physical power system simulator includes a power load balancing module, a power grid simulator and a power system analysis software.

[0008] As a preferred solution of the power system network attack simulation and security assessment system described in the present invention, the management system is responsible for real-time monitoring and control of the power network.

[0009] The communication network is responsible for connecting the management system and the physical power system simulator, simulating data transmission through the network simulator, and evaluating network delay and communication efficiency, specifically including calculating data transmission time and transmission efficiency through network delay simulation technology.

[0010] The physical power system simulator simulates the operation of an actual power grid in a control environment, supports the simulation of cyber attacks, observes the impact of cyber attacks on power balance through the power system load balance formula, and evaluates the impact of cyber attacks on the stability and security of the power system.

[0011] The performance and security testing function evaluates the performance loss and system resilience caused by network attacks by calculating the throughput loss and system frequency change, and monitors and analyzes the data packets of the communication network in real time through the network intrusion detection system to identify malicious activities or abnormal data flows.

[0012] As a preferred solution of the power system network attack simulation and security assessment system described in the present invention, the management system calculates the response time and stability of the power system, the communication network simulates data transmission between local area network nodes through a network simulator, the power load balancing module simulates and analyzes network attacks, the power grid simulator generates operating data and sends it to the management system through the communication network, and after the management system processes the received data, it uses the IEC-61850 standard protocol to perform system analysis and power generation control decisions.

[0013] As a preferred solution of the power system network attack simulation and security assessment system described in the present invention, the communication network is further used to simulate the simulation function of communication protocol efficiency and network delay, and the simulation function of network delay is responsible for implementing the communication protocols DNP3 and IEC-61850, and calculating the protocol efficiency and data transmission delay.

[0014] As a preferred solution of the power system network attack simulation and security assessment system described in the present invention, the power system analysis software includes simulation tools OPAL-RT and MATPOWER, which are used to simulate the performance of the power system in normal and attacked states; the OPAL-RT supports high-performance real-time simulation of the dynamic response of the power system, including changes in voltage, current and power, and is used to observe the physical response of the power system under network attacks such as FDI and DoS; the MATPOWER is used to perform steady-state analysis, including power flow calculation and system optimization.

[0015] As a preferred solution of the power system network attack simulation and security assessment system described in the present invention, the network intrusion detection system is deployed on a network physical test platform of the power system, and the network intrusion detection system monitors and analyzes data packets of the communication network in real time to identify malicious activities or abnormal data flows.

[0016] The performance and security testing function is responsible for simulating different types of network attacks, observing the response speed of the power system when facing high-frequency requests and the data processing capabilities when abnormal data flows in, and further evaluating the behavior of the power system under attack and the effectiveness of related security strategies.

[0017] Another object of the present invention is to provide a method for simulating and assessing the security of a power system network attack, which can solve the problems of slow response speed and low recovery efficiency in existing methods through an automated response mechanism.

[0018] In order to solve the above technical problems, the present invention provides the following technical solutions: a method for simulating and assessing the security of a power system network attack, comprising: initializing the system, starting the management system, initializing the communication network, and deploying the communication protocol.

[0019] The management system is connected to the physical power system simulator through the communication network, and the network delay and communication efficiency are evaluated.

[0020] Cyber ​​attacks are simulated through a physical power system simulator, and the impact of cyber attacks on power system balance is analyzed through performance and security testing functions.

[0021] The management system receives simulation data from the physical power system simulator, calculates system response time and stability indicators, and performs system analysis and power generation control decisions.

[0022] As a preferred scheme for the power system network attack simulation and security assessment method described in the present invention, the evaluation of network delay and communication efficiency includes simulating data transmission between local area network nodes through a network simulator to obtain transmission efficiency, protocol efficiency, network delay and data transmission delay.

[0023] The transmission efficiency is expressed as,

[0024]

[0025] The network delay is expressed as,

[0026]

[0027] The protocol efficiency is expressed as,

[0028]

[0029] The data transmission delay is expressed as,

[0030]

[0031] Among them, g e Indicates lost data packets, g h Indicates the total number of packets sent, τ 0 Indicates the basic network delay, d i and v i are the transmission distance and network speed of the i-th segment, L 有效 Indicates the amount of data effectively transmitted, L 总 represents the total amount of data transmitted, L represents the length of the data packet, R represents the transmission efficiency of the link, and T 传播 Represents the propagation delay of the signal in the medium.

[0032] The physical power system simulator simulates network attacks based on the power system load balance formula, evaluates the recovery capability of the power system after a network attack based on the recovery time model, and performs steady-state analysis based on MATPOWER.

[0033] The power system load balance formula is expressed as:

[0034]

[0035] Among them, P G,i represents the power generation of the ith node, P D,i represents the power consumption of the ith node, T ij represents the power transmission loss from node i to node j.

[0036] The recovery time model is expressed as,

[0037]

[0038] Among them, T 恢复 It represents the time it takes for the power system to recover from an attack to normal operation, C 恢复 represents the number of control operations required for power system restoration, S恢复能力 Represents the number of control operations performed by the power system per unit time.

[0039] The steady-state analysis includes power flow calculation and system optimization.

[0040] The power flow calculation is expressed as,

[0041]

[0042] Among them, Y ik represents the admittance matrix element, V i represents the voltage at node i, V k represents the voltage at node k, θ i ,θ k are the phase angles of nodes i and k respectively.

[0043] The analysis of the impact of cyber attacks on power system balance is expressed as,

[0044] L 吞吐量 =T 正常 -T 攻击

[0045] Among them, L 吞吐量 represents the throughput loss, T 正常 represents the throughput of the power system when it is not attacked, T 攻击 Represents the throughput of the power system when it is under attack.

[0046] When the throughput loss is greater than the acceptable loss threshold, it means that the simulated attack exceeds the tolerance of the power system.

[0047] The system response time is expressed as,

[0048] T=T 处理 +T 传输 +T 执行

[0049] The stability index is expressed as,

[0050]

[0051] Among them, T 处理 Represents the data processing time, T 传输 Indicates the data transmission time, T 执行 represents the data execution time, n represents the number of failures, and m represents the total number of operations.

[0052] The system analysis and power generation control decision includes, when the throughput loss is greater than the acceptable loss threshold, if the system response time does not exceed the response time threshold and the stability does not exceed the stability threshold, then strengthening monitoring and data analysis, implementing regular security audits and network traffic analysis.

[0053] When the throughput loss is greater than the acceptable loss threshold, if the system response time exceeds the response time threshold and the stability does not exceed the stability threshold, the rapid response protocol is updated, including clear role responsibilities and action steps.

[0054] When the throughput loss is greater than the acceptable loss threshold, if the system response time does not exceed the response time threshold and the stability exceeds the stability threshold, review and optimize the existing recovery process, including increasing the number of backup servers.

[0055] When the throughput loss is greater than the acceptable loss threshold, if the system response time exceeds the response time threshold and the stability exceeds the stability threshold, upgrade the firewall rules and signature library, perform security reinforcement on existing hardware devices, and increase the frequency of data backup.

[0056] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned power system network attack simulation and security assessment system when executing the computer program.

[0057] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a power system network attack simulation and security assessment system as described above.

[0058] The beneficial effects of the present invention are as follows: by integrating the management system, communication network and physical power system simulator, an efficient simulation of the dynamic response and stability of the power system under network attacks is achieved; the present invention ensures the security and reliability of data transmission by adopting the distributed network protocol DNP3 and the international electrical communication standard IEC-61850, and effectively improves the defense capability of the power system against network attacks such as DoS and FDI attacks; in addition, through various simulation and testing functions within the simulator, such as the real-time simulation tools OPAL-RT and MATPOWER, the platform can evaluate the impact of network attacks in detail, and provide theoretical support and experimental data for the formulation of future security strategies and system optimization; the comprehensive application of these technical features not only solves the deficiencies of real-time hybrid simulation and firmware security protection in the prior art, but also significantly improves the simulation efficiency and accuracy, and ensures the stable operation of the power system in the face of complex network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0060] Figure 1 An overall framework diagram of a power system network attack simulation and security assessment system provided for the first embodiment of the present invention.

[0061] Figure 2 A schematic diagram of the structure of power system data interaction and control flow in a power system network attack simulation and security assessment system provided in the first embodiment of the present invention.

[0062] Figure 3 An overall flow chart of a power system network attack simulation and security assessment method provided for the second embodiment of the present invention.

[0063] Figure 4 A schematic diagram of the structure of a physical model of an IEEE-14 bus system for a power system network attack simulation and security assessment method provided in a third embodiment of the present invention.

[0064] Figure 5 A comparison chart of FDI attack power generation of an IEEE-14 bus system according to a power system network attack simulation and security assessment method provided in the third embodiment of the present invention.

[0065] Figure 6 A graph of network performance changes under DoS attacks of a power system network attack simulation and security assessment method provided in the third embodiment of the present invention. DETAILED DESCRIPTION

[0066] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0067] Example 1, reference Figure 1-2 , is an embodiment of the present invention, and provides a power system network attack simulation and security assessment system, which is characterized by:

[0068] S1: Management systems, communication networks, physical power system simulators, and performance and safety testing capabilities.

[0069] The management system is responsible for real-time monitoring and control of the power network.

[0070] The communication network is responsible for connecting the management system and the physical power system simulator, simulating data transmission through the network simulator, and evaluating network delay and communication efficiency. Specifically, it calculates data transmission time and transmission efficiency through network delay simulation technology.

[0071] The physical power system simulator simulates the operation of the actual power grid in a control environment, supports the simulation of cyber attacks, and observes the impact of cyber attacks on power balance through the power system load balance formula, and evaluates the impact of cyber attacks on the stability and security of the power system.

[0072] The performance and security testing function evaluates the performance loss and system resilience caused by network attacks by calculating the throughput loss and system frequency changes, and monitors and analyzes the data packets of the communication network in real time through the network intrusion detection system to identify malicious activities or abnormal data flows.

[0073] The management system calculates the response time and stability of the power system. The communication network simulates data transmission between local area network nodes through a network simulator. The power load balancing module simulates and analyzes network attacks. The power grid simulator generates operating data and sends it to the management system through the communication network. After the management system processes the received data, it uses the IEC-61850 standard protocol to perform system analysis and power generation control decisions.

[0074] The communication network is further used to simulate the communication protocol efficiency and network delay simulation function, which is responsible for implementing the communication protocols DNP3 and IEC-61850 and calculating the protocol efficiency and data transmission delay, such as Figure 2 As shown, Figure 2 This is a schematic diagram of the power system data interaction and control process structure, showing the server-side and client-side components and their interaction methods; on the server side, it includes power system analysis software and power grid simulator, and these components generate and process data through the server process; on the client side, it also includes power system analysis software and power grid simulator, and the client execution program is responsible for processing the data sent from the server side; the entire system exchanges data through the IEC-61850 standard protocol to ensure the reliability of data transmission.

[0075] S2: The management system includes client, database, human-computer interface and server.

[0076] S3: Communication network includes wireless communication technology and network intrusion detection system.

[0077] The network intrusion detection system is deployed on the network physical test platform of the power system. It monitors and analyzes the data packets of the communication network in real time and identifies malicious activities or abnormal data flows.

[0078] The performance and security testing function is responsible for simulating different types of network attacks, observing the response speed of the power system when facing high-frequency requests and its data processing capabilities when abnormal data flows in, and further evaluating the behavior of the power system under attack and the effectiveness of related security policies.

[0079] S4: Physical power system simulator includes power load balancing module, power grid simulator and power system analysis software.

[0080] The power system analysis software includes the simulation tools OPAL-RT and MATPOWER, which are used to simulate the performance of the power system in normal and attacked states; the OPAL-RT supports high-performance real-time simulation of the dynamic response of the power system, including changes in voltage, current and power, and is used to observe the physical response of the power system under network attacks such as FDI and DoS, and the MATPOWER is used to perform steady-state analysis, including power flow calculation and system optimization.

[0081] Example 2, reference Figure 3 , as an embodiment of the present invention, provides a method for simulating network attacks on a power system and a security assessment system, characterized in that: it includes:

[0082] Initialize the system, start the management system, initialize the communication network, and deploy the communication protocol.

[0083] The management system is connected to the physical power system simulator through the communication network, and the network delay and communication efficiency are evaluated.

[0084] Cyber ​​attacks are simulated through a physical power system simulator, and the impact of cyber attacks on power system balance is analyzed through performance and security testing functions.

[0085] The management system receives simulation data from the physical power system simulator, calculates system response time and stability indicators, and performs system analysis and power generation control decisions.

[0086] Evaluating network delay and communication efficiency includes simulating data transmission between LAN nodes through a network simulator to obtain transmission efficiency, protocol efficiency, network delay, and data transmission delay.

[0087] The transmission efficiency is expressed as,

[0088]

[0089] The network delay is expressed as,

[0090]

[0091] The protocol efficiency is expressed as,

[0092]

[0093] The data transmission delay is expressed as,

[0094]

[0095] Among them, g e Indicates lost data packets, g h Indicates the total number of packets sent, τ 0 Indicates the basic network delay, d i and v i are the transmission distance and network speed of the i-th segment, L 有效 Indicates the amount of data effectively transmitted, L 总 represents the total amount of data transmitted, L represents the length of the data packet, R represents the transmission efficiency of the link, and T 传播 Represents the propagation delay of the signal in the medium.

[0096] The physical power system simulator simulates cyber attacks based on the power system load balance formula, evaluates the power system's recovery capability after a cyber attack based on the recovery time model, and performs steady-state analysis based on MATPOWER.

[0097] The load balance formula of the power system is expressed as:

[0098]

[0099] Among them, P G,i represents the power generation of the ith node, P D,i represents the power consumption of the ith node, T ij represents the power transmission loss from node i to node j.

[0100] The recovery time model is expressed as,

[0101]

[0102] Among them, T 恢复 It represents the time it takes for the power system to recover from an attack to normal operation, C 恢复 represents the number of control operations required for power system restoration, S 恢复能力 Represents the number of control operations performed by the power system per unit time.

[0103] Steady-state analysis includes power flow calculation and system optimization.

[0104] The power flow calculation is expressed as,

[0105]

[0106] Among them, Y ik represents the admittance matrix element, Vi represents the voltage at node i, V k represents the voltage at node k, θ i ,θ k are the phase angles of nodes i and k respectively;

[0107] The impact of cyber attacks on power system balance is expressed as:

[0108] L 吞吐量 =T 正常 -T 攻击

[0109] Among them, L 吞吐量 represents the throughput loss, T 正常 represents the throughput of the power system when it is not attacked, T 攻击 Represents the throughput of the power system when it is under attack.

[0110] When the throughput loss is greater than the acceptable loss threshold, it means that the simulated attack exceeds the tolerance of the power system.

[0111] In addition, in order to quantitatively analyze the impact of DoS attacks on power system stability, the following model is used to calculate the system frequency drop during the attack: Where Δf represents the system frequency change, P loss is the power lost due to the attack, R is the total frequency modulation response capability of the system, D is the damping coefficient, P total is the total power requirement of the system.

[0112] The system response time is expressed as,

[0113] T=T 处理 +T 传输 +T 执行

[0114] The stability index is expressed as,

[0115]

[0116] Among them, T 处理 Represents the data processing time, T 传输 Indicates the data transmission time, T 执行 represents the data execution time, n represents the number of failures, and m represents the total number of operations.

[0117] System analysis and power generation control decisions include enhanced monitoring and data analysis, and implementation of regular security audits and network traffic analysis when the throughput loss is greater than the acceptable loss threshold, provided that the system response time does not exceed the response time threshold and the stability does not exceed the stability threshold.

[0118] When the throughput loss is greater than the acceptable loss threshold, if the system response time exceeds the response time threshold and the stability does not exceed the stability threshold, the rapid response protocol is updated, including clear role responsibilities and action steps.

[0119] When the throughput loss is greater than the acceptable loss threshold, if the system response time does not exceed the response time threshold and the stability exceeds the stability threshold, review and optimize the existing recovery process, including increasing the number of backup servers.

[0120] When the throughput loss is greater than the acceptable loss threshold, if the system response time exceeds the response time threshold and the stability exceeds the stability threshold, upgrade the firewall rules and signature library, perform security reinforcement on existing hardware devices, and increase the frequency of data backup.

[0121] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program code.

[0122] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0123] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0124] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0125] Example 3, reference Figure 4-Figure 6 In this embodiment, in order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0126] Figure 4 This is a schematic diagram of the physical model structure of the IEEE-14 bus system, showing a complex network structure consisting of five generators and multiple transmission lines. In this model, the generator, as the energy provider of the power system, transmits electricity to each bus through the transmission line, and the bus, as the key node of power distribution, ensures that power can be effectively distributed to the entire system. This structure shows the interactive logic of the three main components of the generator, bus, and transmission line, forming a mesh structure to enhance the reliability of the system. Even if some lines fail, power supply can be maintained through other paths.

[0127] Figure 5This is a comparison chart of the power generation of the IEEE-14 bus system under FDI attack, which shows the actual power generation of each generator under normal operation and FDI attack conditions; the figure clearly indicates the power output of different generators under normal and FDI attack conditions, as well as the initial power; it can be seen from the figure that under the FDI attack, the power generation of most generators has increased significantly, especially the power generation of generators 3, 6, and 8 has increased significantly from zero, reflecting the overload operation of the power system and increased system instability that may be caused by the FDI attack; in addition, the chart also reveals the impact of FDI attacks on power dispatching decisions, showing how the attack misleads the power system to issue incorrect operating instructions, which may cause system overload or even imbalance.

[0128] Figure 6 This is a graph of network performance changes under DoS attacks, which is divided into two parts. Figure 6 (a) shows the changes in packet input and output under normal operation and DoS attack conditions. The X-axis represents time, extending from 0 seconds to 60 seconds, while the Y-axis records the number of packets processed per second. The red line in the figure represents the number of packets during the DoS attack, and the purple line shows the number of packets under normal operation conditions. Under normal operating conditions, the packet flow remains at a low and stable level, while during the DoS attack, the number of packets is significantly higher than normal and relatively stable throughout the observation period. The high traffic caused by the attack continued until the final stage and then suddenly dropped. This sharp drop may indicate the end of the attack or a change in the attack strategy. Figure 6(b) shows how a network attack affects server performance by showing the change in server response time before and after a DoS attack. The X-axis represents the number of samples, ranging from 0 to 50, with each point representing a measurement of the server response time. The Y-axis shows the response time in milliseconds, extending from 0 to about 250 milliseconds. As can be seen from the figure, the 20th sample point marks the moment when the DoS attack begins. Before the attack, the curve is stable and the response time remains at a low level. However, once the attack begins, the response time rises rapidly and shows significant fluctuations in subsequent samples, reflecting the difficulty of the server in processing requests under high pressure. The attack may cause the master station to fail, thereby compromising the control and monitoring capabilities of the power network. DoS attacks prevent the provision of normal services by consuming target resources. In power systems, such attacks may cause a serious decline in the responsiveness of key operating equipment (such as remote terminal units in substations), affecting their ability to process normal operating requests. By simulating attacks, it is observed that the communication delay of the system increases significantly and the efficiency of data processing and transmission decreases. Experiments on the IEEE-14 bus system showed that the system's packet throughput dropped significantly during the DoS attack, and the system response time increased from less than 1 millisecond to about 164 milliseconds, seriously affecting the performance and stability of the power system. Simulation results show that the performance of the attacked system in data transmission and real-time monitoring is significantly degraded, proving that in actual power systems, such attacks can cause widespread power outages and system operation interruptions.

[0129] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A power system network attack simulation and security assessment system, characterized in that: include, management systems, communications networks, physical power system simulators, and performance and safety testing capabilities; The management system includes a client, a database, a human-computer interface and a server; The communication network includes wireless communication technology and a network intrusion detection system; The physical power system simulator includes a power load balancing module, a power grid simulator and power system analysis software.

2. A power system network attack simulation and security assessment system as claimed in claim 1, characterized in that: The management system is responsible for real-time monitoring and control of the power network; The communication network is responsible for connecting the management system and the physical power system simulator, simulating data transmission through the network simulator, and evaluating network delay and communication efficiency, specifically including calculating data transmission time and transmission efficiency through network delay simulation technology; The physical power system simulator simulates the operation of the actual power grid in a control environment, supports the simulation of cyber attacks, and observes the impact of cyber attacks on power balance through the power system load balance formula, and evaluates the impact of cyber attacks on the stability and security of the power system; The performance and security testing function evaluates the performance loss and system resilience caused by network attacks by calculating the throughput loss and system frequency change, and monitors and analyzes the data packets of the communication network in real time through the network intrusion detection system to identify malicious activities or abnormal data flows.

3. A power system network attack simulation and security assessment system as claimed in claim 2, characterized in that: The management system calculates the response time and stability of the power system, the communication network simulates data transmission between local area network nodes through a network simulator, the power load balancing module simulates and analyzes network attacks, the power grid simulator generates operating data and sends it to the management system through the communication network, and after the management system processes the received data, it uses the IEC-61850 standard protocol to perform system analysis and power generation control decisions.

4. A power system network attack simulation and security assessment system as claimed in claim 3, characterized in that: The communication network is further used for simulating a simulation function of communication protocol efficiency and network delay, wherein the simulation function of network delay is responsible for implementing communication protocols DNP3 and IEC-61850 and calculating protocol efficiency and data transmission delay.

5. A power system network attack simulation and security assessment system as claimed in claim 4, characterized in that: The power system analysis software includes simulation tools OPAL-RT and MATPOWER, which are used to simulate the performance of the power system in normal and attacked states; the OPAL-RT supports high-performance real-time simulation of the dynamic response of the power system, including changes in voltage, current and power, and is used to observe the physical response of the power system under network attacks such as FDI and DoS, and the MATPOWER is used to perform steady-state analysis, including power flow calculation and system optimization.

6. A power system network attack simulation and security assessment system as claimed in claim 5, characterized in that: The network intrusion detection system is deployed on the network physical test platform of the power system, and the network intrusion detection system monitors and analyzes the data packets of the communication network in real time to identify malicious activities or abnormal data flows; The performance and security testing function is responsible for simulating different types of network attacks, observing the response speed of the power system when facing high-frequency requests and the data processing capability when abnormal data flows in, and further evaluating the behavior of the power system under attack and the effectiveness of related security strategies.

7. A method using a power system network attack simulation and security assessment system as claimed in any one of claims 1 to 6, characterized in that: include, System initialization, start the management system, initialize the communication network, and deploy the communication protocol; Establish communication connection between the management system and the physical power system simulator through the communication network and evaluate the network delay and communication efficiency; Simulate cyber attacks through physical power system simulators and analyze the impact of cyber attacks on power system balance through performance and security testing functions; The management system receives simulation data from the physical power system simulator, calculates system response time and stability indicators, and performs system analysis and power generation control decisions.

8. A method for simulating and assessing the security of a power system network attack according to any one of claim 7, characterized in that: The evaluating of network delay and communication efficiency includes simulating data transmission between local area network nodes through a network simulator to obtain transmission efficiency, protocol efficiency, network delay and data transmission delay; The transmission efficiency is expressed as, The network delay is expressed as, The protocol efficiency is expressed as, The data transmission delay is expressed as, Among them, g e Indicates lost data packets, g h represents the total number of packets sent, τ0 represents the basic network delay, and d i and v i are the transmission distance and network speed of the i-th segment, L 有效 Indicates the amount of data effectively transmitted, L 总 represents the total amount of data transmitted, L represents the length of the data packet, R represents the transmission efficiency of the link, and T 传播 It represents the propagation delay of the signal in the medium; The physical power system simulator simulates cyber attacks based on the power system load balance formula, evaluates the recovery capability of the power system after cyber attacks based on the recovery time model, and performs steady-state analysis based on MATPOWER; The power system load balance formula is expressed as: Among them, P G,i represents the power generation of the ith node, P D,i represents the power consumption of the ith node, T ij represents the power transmission loss from node i to node j; The recovery time model is expressed as, Among them, T 恢复 It represents the time it takes for the power system to recover from an attack to normal operation, C 恢复 represents the number of control operations required for power system restoration, S 恢复能力 It represents the number of control operations performed by the power system per unit time; The steady-state analysis includes power flow calculation and system optimization; The power flow calculation is expressed as, Among them, Y ik represents the admittance matrix element, V i represents the voltage at node i, V k represents the voltage at node k, θ i ,θ k are the phase angles of nodes i and k respectively; The analysis of the impact of cyber attacks on power system balance is expressed as, L 吞吐量 =T 正常 -T 攻击 Among them, L 吞吐量 represents the throughput loss, T 正常 represents the throughput of the power system when it is not attacked, T 攻击 represents the throughput of the power system when it is under attack; When the throughput loss is greater than the acceptable loss threshold, it means that the simulated attack exceeds the tolerance of the power system; The system response time is expressed as, T=T 处理 +T 传输 +T 执行 The stability index is expressed as, Among them, T 处理 Represents the data processing time, T 传输 Indicates the data transmission time, T 执行 represents the data execution time, n represents the number of failures, and m represents the total number of operations; The system analysis and power generation control decision includes, when the throughput loss is greater than the acceptable loss threshold, if the system response time does not exceed the response time threshold and the stability does not exceed the stability threshold, then strengthening monitoring and data analysis, implementing regular security audits and network traffic analysis; When the throughput loss is greater than the acceptable loss threshold, if the system response time exceeds the response time threshold and the stability does not exceed the stability threshold, update the rapid response protocol, including clarifying the role responsibilities and action steps; When the throughput loss is greater than the acceptable loss threshold, if the system response time does not exceed the response time threshold and the stability exceeds the stability threshold, review and optimize the existing recovery process, including increasing the number of backup servers; When the throughput loss is greater than the acceptable loss threshold, if the system response time exceeds the response time threshold and the stability exceeds the stability threshold, upgrade the firewall rules and signature library, perform security reinforcement on existing hardware devices, and increase the frequency of data backup.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of a power system network attack simulation and security assessment system as described in any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a power system network attack simulation and security assessment system as described in any one of claims 1 to 6 are implemented.

Images