Security protection system of electric power engineering information communication network

Abstract

The invention relates to the technical field of electric power engineering information communication, and discloses a safety protection system of an electric power engineering information communication network, which comprises a network partition module, a regional data acquisition module, a regional data analysis module and a regional alarm module, the network partition module divides a network into a plurality of areas according to a production control area of the electric power engineering, and the area data acquisition module is used for respectively acquiring flow use data, data packet load data, network connection frequency and equipment and memory use data of each area in the plurality of areas; the regional data analysis module calculates a flow use anomaly index, a data packet invalid load index, a connection anomaly frequency and an equipment and memory use anomaly index according to the collected data, then comprehensively calculates a network safety coefficient, and judges whether the network environment is abnormal from multiple aspects; and when the network environment is judged to be in an abnormal state, an abnormal signal is sent to the regional alarm module for alarming, so that the network security is effectively improved.

Description

Technical Field

[0001] The present invention relates to the technical field of electric power engineering information communication, and in particular to a safety protection system for an electric power engineering information communication network. Background Art

[0002] Power engineering is one of the indispensable infrastructures in modern society. It involves the design, construction, operation and maintenance of power systems. The core goal of power engineering is to provide stable, reliable and efficient power supply to meet the needs of people's daily life and industrial production. Power information communication is an indispensable and important part of the power system, the basis for the realization of dispatching automation and management modernization of the power grid, and an important technical means to ensure the safety and economic dispatch of the power grid. Due to the uninterrupted production of the power system and the suddenness of the change of the operating status, the power dispatching communication is required to be highly reliable and the transmission time is very fast. Therefore, it is necessary to establish a dedicated communication network that is compatible with the safe operation of the power system. The content of information in the power system is diverse. The information that is often transmitted includes telephone, dispatching telephone and management telephone, telecontrol and data signals, remote protection signals, fax, computer communication, system operation status image information, hydropower station reservoir, water conditions, industrial and mining information, etc. With the continuous improvement of dispatching automation and enterprise production management level, the content of information that needs to be transmitted is still increasing.

[0003] Malware attacks on the network may have serious impacts on the power system. Some power companies have not established a comprehensive network security management system and lack effective security strategies and emergency response plans, making it difficult to monitor and respond to security threats in real time. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] In view of the deficiencies in the prior art, the present invention provides a security protection system for an electric power engineering information communication network, which has the advantages of multi-faceted monitoring of the communication network, thereby timely discovering various abnormal situations during network operation, and realizing comprehensive security protection of the electric power engineering information communication network.

[0006] (II) Technical solution

[0007] To achieve the above-mentioned object, the present invention provides the following technical solutions: A safety protection system for an electric power engineering information communication network, comprising a network partitioning module, a regional data acquisition module, a regional data analysis module and a regional alarm module;

[0008] The network partitioning module divides the network into multiple areas according to the production control area of ​​the power project, and marks them as network data area sets and sends them to the area data acquisition module;

[0009] The regional data collection module is used to collect the flow usage data LLsj, data packet load data SBsj, network connection frequency LJpl and device CPU and memory usage data SZsj of each area in multiple areas, and number and mark them as flow usage data set, data packet load data set, network connection frequency set and device CPU and memory usage data set, and send them to the regional data analysis module;

[0010] The regional data analysis module calculates the traffic usage anomaly index LLyc, the data packet invalid load index SByc, the connection anomaly frequency LJyc and the device CPU, memory usage anomaly index SZzs according to the traffic usage data set, the data packet load data set, the network connection frequency set and the device CPU, memory usage data set. The regional data analysis module calculates the network security coefficient WLaq according to the above values, and compares it with the network security coefficient threshold to determine whether there is an abnormality in the network environment. If the network environment is judged to be in an abnormal state, an abnormal signal is sent to the regional alarm module;

[0011] The regional alarm module issues a corresponding alarm according to the abnormal signal.

[0012] Preferably, the expression of the network data area set is: in, and They respectively represent the first network data area and the last network data area in the network data area set, n represents that there are n network data areas in the network data area set, and w represents the specific control area of ​​the corresponding network data area.

[0013] Preferably, the expression of the traffic usage data set is: {LLsj1, LLsj2, LLsj3, . . . , LLsj n}, where LLsj1 and LLsj n They represent the first traffic usage data and the last traffic usage data in the traffic usage data set, respectively. n represents that there are n traffic usage data in the traffic usage data set.

[0014] The expression of the data packet payload data set is: {SBsj1, SBsj2, SBsj3, . . . , SBsj n}, where SBsj1 and SBsj n They respectively represent the first data packet payload data and the last data packet payload data in the data packet payload data set, and n represents that there are n data packet payload data in the data packet payload data set.

[0015] Preferably, the network connection frequency set is expressed as: {LJpl1, LJpl2, LJpl3, . . . , LJpln}, where the network connection frequency is collected once every 10 minutes, LJpl1 and LJpl n They represent the network connection frequency collected in the first 10 minutes and the network connection frequency collected in the last 10 minutes in the network connection frequency, respectively. n represents that there are n network connection frequency data in the network connection frequency set.

[0016] The expression of the device CPU and memory usage data set is: {SZsj1, SZsj2, SZsj3, . . . , SZsj n}, where the device CPU and memory usage data are collected every 10 minutes, SZsj1 and SZsj n They represent the device CPU and memory usage data collected in the first 10 minutes and the device CPU and memory usage data collected in the last 10 minutes in the device CPU and memory usage data set respectively. n represents that there are n device CPU and memory usage data in the device CPU and memory usage data set.

[0017] Preferably, the calculation formula of the flow usage abnormality index LLyc is as follows:

[0018]

[0019] In the above formula, is the mean of the three traffic usage data before the last traffic usage data in the traffic usage dataset. It is the difference between the last traffic usage data and the average of the first three traffic usage data in the traffic usage data set.

[0020] Preferably, the calculation formula of the data packet invalid load index SByc is:

[0021]

[0022] In the above formula, SBsj c This is the invalid payload of the data packet under normal circumstances. This value can be queried in the historical data. v It is the invalid payload of any data packet in the data packet payload data set. This value can be obtained through a network packet capture tool.

[0023] Preferably, the connection abnormality frequency LJyc is calculated as follows:

[0024]

[0025] In the above formula, Represents the regular frequency of the network connection frequency within the i-th 10 minutes in the network connection frequency set, is the connection frequency of the network connection frequency within the i-th 10 minutes in the network connection frequency set, is the disconnection frequency of the network connection frequency within the i-th 10 minutes in the network connection frequency set.

[0026] Preferably, the calculation method of the device CPU and memory usage abnormality index SZzs is:

[0027]

[0028] In the above formula, SZsj is the average of the last device CPU and memory usage data before the three device CPU and memory usage data in the device CPU and memory usage data set. n It is the difference between the last device CPU and memory usage data and the average of the three devices CPU and memory usage data before the last device CPU and memory usage data. CZ is the operation load of the current device, which can be obtained from the device.

[0029] Preferably, the calculation formula of the network security coefficient WLaq is:

[0030] WLaq=(LLyc*α)*(SByc*β)*(LJyc*γ)*(SZzs*δ)

[0031] In the above formula, α is the weight coefficient in the traffic usage anomaly index LLyc, β is the weight coefficient in the packet invalid load index SByc, γ is the weight coefficient in the connection anomaly frequency LJyc, and δ is the weight coefficient in the device CPU and memory usage anomaly index SZzs.

[0032] Preferably, when the network security coefficient WLaq is greater than the network security threshold, it means that the current network environment is in an abnormal state, and a network abnormality signal is sent to the corresponding area alarm module for alarm.

[0033] Compared with the prior art, the present invention provides a safety protection system for an electric power engineering information communication network, which has the following beneficial effects:

[0034] 1. The present invention can effectively restrict the movement of attackers within the network by dividing the network into different areas. Even if attackers successfully invade one area, it is difficult for them to further penetrate into other areas due to the isolation measures between the areas.

[0035] 2. The present invention analyzes the abnormal usage of traffic, the abnormal situation of data packet data, the abnormal connection or disconnection during the connection process, and the abnormal occupancy of CPU and memory through the abnormal traffic usage index LLyc, the invalid load index of data packet SByc, the abnormal connection frequency LJyc, and the abnormal usage index of device CPU and memory SZzs, and then comprehensively calculates the network security coefficient WLaq to realize multi-faceted monitoring of the communication network, thereby timely discovering various abnormal situations during the operation of the network and realizing comprehensive security protection of the information communication network of the power engineering project. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a schematic diagram of the structural system of the present invention; DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] See also Figure 1 , a security protection system for an electric power engineering information communication network, comprising a network partitioning module, a regional data acquisition module, a regional data analysis module and a regional alarm module;

[0039] The network partitioning module divides the network into multiple areas according to the production control area of ​​the power project, and marks them as network data area sets and sends them to the regional data acquisition module. By dividing the network into different areas, the movement of attackers within the network can be effectively restricted. Even if attackers successfully invade one area, it is difficult for them to further penetrate into other areas due to the isolation measures between areas.

[0040] The expression for the network data region set is: in, and They represent the first network data area and the last network data area in the network data area set, respectively; n represents that there are n network data areas in the network data area set; and w represents the specific control area of ​​the corresponding network data area;

[0041] The regional data collection module is used to collect the traffic usage data LLsj, data packet load data SBsj, network connection frequency LJpl and device CPU and memory usage data SZsj of each area in multiple areas, and number and mark them as traffic usage data set, data packet load data set, network connection frequency set and device CPU and memory usage data set and send them to the regional data analysis module;

[0042] By real-time monitoring of network traffic, we can quickly understand the operating status of each part of the network, which helps to promptly discover abnormal behaviors or potential security threats in the network. The expression of the traffic usage data set is {LLsj1, LLsj2, LLsj3, ···, LLsj n}, where LLsj1 and LLsj n They represent the first traffic usage data and the last traffic usage data in the traffic usage data set, respectively. n represents that there are n traffic usage data in the traffic usage data set.

[0043] Monitoring the packet payload can timely detect and prevent the intrusion of malicious traffic, which helps to enhance the network's defense capabilities and prevent malicious attackers from exploiting vulnerabilities to attack. The expression of the packet payload data set is: {SBsj1, SBsj2, SBsj3, ···, SBsj n}, where SBsj1 and SBsj n They respectively represent the first data packet payload data and the last data packet payload data in the data packet payload data set, and n represents that there are n data packet payload data in the data packet payload data set;

[0044] Real-time monitoring of network connection frequency can identify abnormal connection frequency in the network. When subjected to brute force attacks, monitoring network connection frequency, especially a large number of failed login attempts in a short period of time, can effectively identify and prevent such attacks. The expression of the network connection frequency set is: {LJpl1, LJpl2, LJpl3, ···, LJpl n}, where the network connection frequency is collected once every 10 minutes, LJpl1 and LJpl n They represent the network connection frequency collected in the first 10 minutes and the network connection frequency collected in the last 10 minutes in the network connection frequency, respectively. n represents that there are n network connection frequency data in the network connection frequency set.

[0045] High CPU and memory usage is usually an indicator of malware or attack activities. By monitoring the device CPU and memory usage data, abnormal high usage can be discovered in time, thereby identifying potential threats. The expression of the device CPU and memory usage data set is: {SZsj1, SZsj2, SZsj3, ···, SZsj n}, where the device CPU and memory usage data are collected every 10 minutes, SZsj1 and SZsj n They represent the device CPU and memory usage data collected in the first 10 minutes and the device CPU and memory usage data collected in the last 10 minutes in the device CPU and memory usage data set, respectively. n represents that there are n device CPU and memory usage data in the device CPU and memory usage data set.

[0046] The regional data analysis module calculates the traffic usage anomaly index LLyc, the data packet invalid load index SByc, the connection anomaly frequency LJyc, and the device CPU and memory usage anomaly index SZzs according to the traffic usage data set, the data packet load data set, the network connection frequency set, and the device CPU and memory usage data set. The regional data analysis module calculates the network security coefficient WLaq according to the above values, and compares it with the network security coefficient threshold to determine whether there is an anomaly in the network environment. If the network environment is determined to be in an abnormal state, an abnormal signal is sent to the regional alarm module;

[0047] The traffic usage anomaly index is an important indicator for analyzing the operation of network traffic. It can clearly reflect the abnormal usage of traffic. The calculation formula of the traffic usage anomaly index LLyc is as follows:

[0048]

[0049] In the above formula, is the mean of the three traffic usage data before the last traffic usage data in the traffic usage dataset. It is the difference between the last traffic usage data and the mean of the first three traffic usage data in the traffic usage data set;

[0050] The data packet invalid load index is an important indicator of the data packet load, which can clearly reflect the abnormal situation in the data packet. The calculation formula of the data packet invalid load index SByc is:

[0051]

[0052] In the above formula, SBsjc is the invalid load of the data packet under normal circumstances. This value can be queried in the historical data. SBsjv is the invalid load of any data packet in the data packet load data set. This value can be obtained through the network packet capture tool.

[0053] The abnormal connection frequency can monitor the network connection frequency and clearly reflect the frequency of abnormal connection or disconnection. The calculation method of the abnormal connection frequency LJyc is as follows:

[0054]

[0055] In the above formula, Represents the regular frequency of the network connection frequency within the i-th 10 minutes in the network connection frequency set, is the connection frequency of the network connection frequency within the i-th 10 minutes in the network connection frequency set, is the disconnection frequency of the network connection frequency within the i-th 10 minutes in the network connection frequency set;

[0056] Device CPU and memory usage anomalies are important indicators for monitoring high CPU and memory usage, which can clearly reflect abnormal CPU and memory usage. The calculation method of device CPU and memory usage anomaly index SZzs is as follows:

[0057]

[0058] In the above formula, SZsjn is the average of the last device CPU and memory usage data before the three device CPU and memory usage data in the device CPU and memory usage data set. is the difference between the last device CPU and memory usage data and the average of the three devices CPU and memory usage data before the last device CPU and memory usage data. CZ is the operation load of the current device, which can be obtained from the device.

[0059] Combined with the traffic usage anomaly index LLyc, the data packet invalid load index SByc, the connection anomaly frequency LJyc, and the device CPU and memory usage anomaly index SZzs, the network security coefficient WLaq is calculated comprehensively to achieve multi-faceted monitoring of the communication network, so as to timely discover various abnormal situations in the network operation process and achieve comprehensive security protection for the power engineering information communication network. The network security coefficient WLa q The calculation formula is:

[0060] WLaq=(LLyc*α)*(SByc*β)*(LJyc*γ)*(SZzs*δ)

[0061] In the above formula, α is the weight coefficient in the traffic usage anomaly index LLyc, β is the weight coefficient in the packet invalid load index SByc, γ is the weight coefficient in the connection anomaly frequency LJyc, and δ is the weight coefficient in the device CPU and memory usage anomaly index SZzs;

[0062] When the network security coefficient WLaq is greater than the network security threshold, it means that the current network environment is abnormal, and a network abnormality signal is sent to the corresponding area alarm module for alarm;

[0063] The regional alarm module issues corresponding alarms based on abnormal signals.

[0064] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A security protection system for an electric power engineering information communication network, characterized in that: It includes a network partitioning module, a regional data collection module, a regional data analysis module and a regional alarm module; The network partitioning module divides the network into multiple areas according to the production control area of ​​the power project, and marks them as network data area sets and sends them to the area data acquisition module; The regional data collection module is used to collect the flow usage data LLsj, data packet load data SBsj, network connection frequency LJpl and device CPU and memory usage data SZsj of each area in multiple areas, and number and mark them as flow usage data set, data packet load data set, network connection frequency set and device CPU and memory usage data set, and send them to the regional data analysis module; The regional data analysis module calculates the traffic usage anomaly index LLyc, the data packet invalid load index SByc, the connection anomaly frequency LJyc and the device CPU, memory usage anomaly index SZzs according to the traffic usage data set, the data packet load data set, the network connection frequency set and the device CPU, memory usage data set. The regional data analysis module calculates the network security coefficient WLaq according to the above values, and compares it with the network security coefficient threshold to determine whether there is an abnormality in the network environment. If the network environment is judged to be in an abnormal state, an abnormal signal is sent to the regional alarm module; The regional alarm module issues a corresponding alarm according to the abnormal signal.

2. A security protection system for an electric power engineering information communication network according to claim 1, characterized in that: The expression of the network data area set is: in, and They respectively represent the first network data area and the last network data area in the network data area set, n represents that there are n network data areas in the network data area set, and w represents the specific control area of ​​the corresponding network data area.

3. The security protection system for an electric power engineering information communication network according to claim 1, characterized in that: The expression of the traffic usage data set is: {LLsj1, LLsj2, LLsj3, . . . , LLsj n }, where LLsj1 and LLsj n They represent the first traffic usage data and the last traffic usage data in the traffic usage data set, respectively. n represents that there are n traffic usage data in the traffic usage data set. The expression of the data packet payload data set is: {SBsj1, SBsj2, SBsj3, . . . , SBsj n }, where SBsj1 and SBsj n They respectively represent the first data packet payload data and the last data packet payload data in the data packet payload data set, and n represents that there are n data packet payload data in the data packet payload data set.

4. The security protection system for an electric power engineering information communication network according to claim 1, characterized in that: The expression of the network connection frequency set is: {LJpl1, LJpl2, LJpl3, . . . , LJpl n }, where the network connection frequency is collected once every 10 minutes, LJpl1 and LJpl n They represent the network connection frequency collected in the first 10 minutes and the network connection frequency collected in the last 10 minutes in the network connection frequency, respectively. n represents that there are n network connection frequency data in the network connection frequency set. The expression of the device CPU and memory usage data set is: {SZsj1, SZsj2, SZsj3, . . . , SZsj n }, where the device CPU and memory usage data are collected every 10 minutes, SZsj1 and SZsj n They represent the device CPU and memory usage data collected in the first 10 minutes and the device CPU and memory usage data collected in the last 10 minutes in the device CPU and memory usage data set respectively. n represents that there are n device CPU and memory usage data in the device CPU and memory usage data set.

5. A safety protection system for an electric power engineering information communication network according to claim 3, characterized in that: The calculation formula of the traffic usage abnormality index LLyc is as follows: In the above formula, is the mean of the three traffic usage data before the last traffic usage data in the traffic usage dataset. It is the difference between the last traffic usage data and the average of the first three traffic usage data in the traffic usage data set.

6. A safety protection system for an electric power engineering information communication network according to claim 3, characterized in that: The calculation formula of the data packet invalid load index SByc is: In the above formula, SBsj c This is the invalid payload of the data packet under normal circumstances. This value can be queried in the historical data. v It is the invalid payload of any data packet in the data packet payload data set. This value can be obtained through a network packet capture tool.

7. A safety protection system for an electric power engineering information communication network according to claim 4, characterized in that: The calculation method of the connection abnormality frequency LJyc is as follows: In the above formula, Represents the regular frequency of the network connection frequency within the i-th 10 minutes in the network connection frequency set, is the connection frequency of the network connection frequency within the i-th 10 minutes in the network connection frequency set, is the disconnection frequency of the network connection frequency within the i-th 10 minutes in the network connection frequency set.

8. A safety protection system for an electric power engineering information communication network according to claim 4, characterized in that: The device CPU and memory usage abnormality index SZ zs The calculation method is: In the above formula, is the average of the last device CPU and memory usage data of the device CPU and memory usage data before the three device CPU and memory usage data in the device CPU and memory usage data set. It is the difference between the last device CPU and memory usage data and the average of the three devices CPU and memory usage data before the last device CPU and memory usage data. CZ is the operation load of the current device, which can be obtained from the device.

9. A safety protection system for an electric power engineering information communication network according to claim 8, characterized in that: The calculation formula of the network security coefficient WLaq is: WLaq=(LLyc*α)*(SByc*β)*(LJyc*γ)*(SZzs*δ) In the above formula, α is the weight coefficient of the traffic usage anomaly index LLyc, β is the weight coefficient of the packet invalid load index SByc, γ is the weight coefficient of the connection anomaly frequency LJyc, and δ is the device CPU and memory usage anomaly index SZ zs The weight coefficient in .

10. A safety protection system for an electric power engineering information communication network according to claim 9, characterized in that: When the network security coefficient WLaq is greater than the network security threshold, it means that the current network environment is in an abnormal state, and a network abnormality signal is sent to the corresponding area alarm module for alarm.

Images