Power system industrial control communication protocol message anomaly detection method and related device

Abstract

The invention belongs to the technical field of power system industrial control network security, and particularly relates to an LSTM-based power system industrial control communication protocol message anomaly detection method and a related device. According to the scheme, aiming at an IEC 60870-5-104 protocol, communication protocol specifications and actual message transmission logic are analyzed, multiple types of typical service logic abnormal messages are constructed, an LSTM algorithm is adopted to carry out abnormal detection model training, and an optimal model is obtained to be used for abnormal detection of power system industrial control communication protocol message service logic. The method overcomes the defect that an existing artificial intelligence-based algorithm focuses on only normal or abnormal dichotomy of a single-frame message, lacks consideration of message service logic, makes up for the defect that a rule-based design class method cannot identify unknown abnormity, improves the reliability and efficiency of a power system, and improves the reliability and reliability of the power system. And the capability of protecting various network security threats is enhanced.

Description

Technical Field

[0001] The present invention belongs to the technical field of power system industrial control network security, and in particular to a method and related device for detecting abnormality of power system industrial control communication protocol messages based on LSTM. Background Art

[0002] The power system industrial control network traffic is the core data for information transmission and business interaction between the dispatching master station and the transformer substation. Through network traffic data, various communication activities and behaviors of users on the power industrial control network can be analyzed in real time. Network traffic anomaly detection is a key technology in digital and intelligent power industrial control systems. This technology uses massive network data packets to record the operating status of power grid equipment and uses the collected historical traffic data packets to extract features for building various abnormal behavior benchmark models. By comparing real-time traffic with these benchmark models, it is convenient for operation and maintenance personnel to promptly determine whether there is an abnormality. The power system industrial control communication protocol message is an application layer message of network traffic data, including IEC 60870 series messages, IEC 61850 series messages, and IEC 62351 series messages. These messages are used to transmit key operation data and commands of the power industrial control system. Once errors or anomalies occur, they may lead to serious consequences, such as operational errors, service interruptions, and even safety accidents. Since these messages widely use standardized communication protocols, and the openness and predictability of the protocols make it easier for attackers to understand and tamper with the application layer messages of network traffic, and then launch customized network attacks. Therefore, it is of great significance to monitor these protocol messages in real time and detect anomalies.

[0003] The existing power system industrial control communication protocol message anomaly detection methods are mainly divided into two categories: one is a message anomaly detection method based on rule design, which has the problem of poor unknown anomaly recognition effect; the other is a message anomaly detection method based on artificial intelligence algorithm, which has the problem of focusing on single-frame message detection and less anomaly classification. Summary of the invention

[0004] The purpose of the present invention is to provide a method and related device for detecting anomaly of power system industrial control communication protocol message based on LSTM, so as to solve the problem of poor unknown anomaly recognition effect in the message anomaly detection method based on rule design in the prior art; and the problem of focusing on single-frame message detection and less anomaly classification in the message anomaly detection method based on artificial intelligence algorithm.

[0005] In order to achieve the above object, the present invention adopts the following technical solution:

[0006] In a first aspect, the present invention provides a method for detecting abnormality of industrial control communication protocol messages in a power system, comprising the following steps:

[0007] Get the IEC 60870-5-104 protocol message in the pacp package of real-time power system industrial control flow data;

[0008] The IEC 60870-5-104 protocol message is input into a pre-trained anomaly detection model, and the anomaly detection model outputs an anomaly detection result of the message; wherein the anomaly detection model is constructed and trained based on an LSTM network, and the training data set of the anomaly detection model includes normal messages and various typical business logic anomaly messages constructed from normal messages.

[0009] Furthermore, the IEC 60870-5-104 protocol message in the pacp package of real-time power system industrial control flow data is obtained, including:

[0010] The switch mirror port is used to collect the real-time power system industrial control flow data pacp package, and each frame of the real-time power system industrial control flow data pacp package is stripped and extracted layer by layer to obtain the application layer message;

[0011] According to the IEC 60870-5-104 protocol message format, the IEC 60870-5-104 protocol message is screened out from the application layer message.

[0012] Furthermore, the anomaly detection model is constructed and trained based on the LSTM network, including:

[0013] Obtain normal IEC 60870-5-104 protocol messages, and extract typical business logic features of the messages from the normal IEC 60870-5-104 protocol messages;

[0014] Determine the abnormal type of typical business logic abnormal message based on the typical business logic characteristics of the message; the abnormal types include data total call abnormality, telemetry value dead zone sending, telesignal opening and closing state abnormality, remote control business execution abnormality and remote signal and remote control business association abnormality;

[0015] According to the abnormal type, the normal IEC 60870-5-104 protocol message is designed to obtain abnormal messages of different abnormal types;

[0016] Construct LSTM network structure;

[0017] A data set is constructed based on normal IEC 60870-5-104 protocol messages and abnormal messages. The LSTM network is trained based on the data set, and a trained anomaly detection model is obtained after the model converges.

[0018] Furthermore, the normal IEC 60870-5-104 protocol message is designed according to the abnormal type, and abnormal messages of different abnormal types are obtained, including:

[0019] Obtaining a normal IEC 60870-5-104 protocol message, and determining a service type of the normal IEC 60870-5-104 protocol message; wherein the service type of the normal IEC 60870-5-104 protocol message includes a data general call service message, a telemetry service message, a telesignaling service message, a remote control service message, and an abnormal message associated with the remote signaling and remote control services;

[0020] For the data general call service message, some normal message service fields are modified to construct the data general call abnormal message;

[0021] For telemetry service messages, some normal message service fields are modified to construct telemetry value dead zone abnormal messages for sending;

[0022] For the telesignaling service message, some normal message service fields are modified to construct the telesignaling opening and closing status abnormal message;

[0023] For remote control service messages, some normal message service fields are modified to construct remote control service execution abnormal messages;

[0024] For the abnormal message associated with the telesignaling and remote control services, some normal message service fields are modified to construct the abnormal message associated with the telesignaling and remote control services.

[0025] Furthermore, in the step of constructing the LSTM network structure, the LSTM network structure includes 1 input layer, 10 LSTM layers, 10 Dropout layers, 1 fully connected layer, and 1 output layer;

[0026] Furthermore, the LSTM network is trained based on the data set, including:

[0027] The data set includes a training data set and a test data set, and the ratio of the training data set to the test data set is 80%:20%; the training data set is input into the constructed LSTM network for training, and after the training is completed, an anomaly detection model of the power system industrial control communication protocol message based on LSTM is obtained; the test data set is input into the trained LSTM model, and the effectiveness of the anomaly detection model for multi-classification of known business logic anomalies of the power system industrial control communication protocol message is verified according to the test accuracy, precision, and F1-score indicators.

[0028] Furthermore, the LSTM network is trained based on the data set, including:

[0029] A part of the business logic abnormal messages of known categories are taken out from the data set as the test data set; the rest of the data set is used as the training data set; the LSTM network is trained using the training data set; wherein the training labels of the normal IEC 60870-5-104 protocol messages in the training data set are all 1, and the training labels of the abnormal messages are all 2; after the training is completed, a power system industrial control communication protocol message business logic unknown anomaly detection model is obtained;

[0030] The test data set is input into the unknown anomaly detection model of the business logic of the power system industrial control communication protocol message to carry out generalization experiments to verify the feasibility of the model in accurately identifying unknown message business logic anomalies.

[0031] In a second aspect of the present invention, a device for detecting abnormality of industrial control communication protocol messages in a power system is provided, comprising:

[0032] The data acquisition module is used to obtain the IEC 60870-5-104 protocol message in the pacp package of the real-time power system industrial control flow data;

[0033] The anomaly detection module is used to input the IEC 60870-5-104 protocol message into a pre-trained anomaly detection model, and the anomaly detection model outputs an anomaly detection result of the message; wherein the anomaly detection model is constructed and trained based on an LSTM network, and the training data set of the anomaly detection model includes normal messages and various typical business logic anomaly messages constructed from normal messages.

[0034] According to a third aspect of the present invention, there is provided an electronic device, comprising a processor and a memory, wherein the processor is configured to execute a computer program stored in the memory to implement the above-mentioned method for detecting anomalies in power system industrial control communication protocol messages.

[0035] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, the method for detecting anomalies in industrial control communication protocol messages of a power system as described above is implemented.

[0036] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] 1) In view of the shortcomings of the existing evaluation methods, the embodiment of the present invention provides an LSTM-based power system industrial control communication protocol message anomaly detection method. Taking the IEC 60870-5-104 protocol as an example, by analyzing the communication protocol specification and the actual message transmission logic, multiple types of typical business logic anomaly messages are constructed, and the LSTM algorithm is used to train the anomaly detection model to obtain the optimal model for the anomaly detection of the business logic of the power system industrial control communication protocol message. The present invention overcomes the shortcomings of the existing artificial intelligence algorithm that focuses on the single-frame message and can only be classified as normal or abnormal, lacks consideration of the message business logic, and at the same time makes up for the shortcomings of the rule-based design method that cannot identify unknown anomalies. Compared with traditional technologies, the power system industrial control communication protocol message anomaly detection method of this scheme improves the reliability and efficiency of the power system, enhances the protection capability against various network security threats, and improves the security and reliability of the power industrial control system communication protocol message transmission. A power system industrial control communication protocol message anomaly detection device, electronic device and computer-readable storage medium provided by the present invention also solve the problems raised in the background technology section.

[0039] 2) The present invention designs multiple types of typical power system industrial control core business logic abnormal messages, and assigns corresponding numerical labels to each business logic abnormal type. With normal message data and abnormal message data as input, the LSTM algorithm is used for training and testing to construct an LSTM-based power system industrial control communication protocol message abnormality detection model, which overcomes the existing power system industrial control communication protocol message abnormality detection method based on artificial intelligence algorithm, which focuses on identifying the format of single-frame messages, field thresholds and other abnormalities, and lacks consideration of message business logic.

[0040] 3) The present invention shuffles normal messages and the designed multiple types of business logic abnormal messages respectively, takes 80% as the training data set and 20% as the test data set, and outputs the multi-classification test results of the abnormal messages after training with the LSTM algorithm, thereby overcoming the deficiency that the existing power system industrial control communication protocol message anomaly detection method based on artificial intelligence algorithm focuses on the binary classification of messages, that is, it can only identify normal or abnormal, and it is difficult to give a specific abnormal category.

[0041] 4) The present invention adopts the business logic abnormal message type that is not involved in the training to test the proposed LSTM-based power system industrial control communication protocol message anomaly detection model, which realizes the effective identification of multiple types of unknown business logic abnormal messages, makes up for the deficiency that the existing rule-based design power system industrial control communication protocol message anomaly detection method can only identify known anomalies, and improves the ability of the power industrial control system to actively defend against unknown network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The drawings constituting a part of the present application are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0043] Figure 1 This is a flow chart of a method for detecting abnormality of an industrial control communication protocol message in a power system according to an embodiment of the present invention;

[0044] Figure 2 is a training flow chart of an anomaly detection model in an embodiment of the present invention;

[0045] Figure 3 This is a structural block diagram of a device for detecting abnormality of industrial control communication protocol messages in a power system according to an embodiment of the present invention;

[0046] Figure 4 The present invention is a structural block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The present invention will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0048] The following detailed description is an exemplary description, which is intended to provide further detailed description of the present invention. Unless otherwise specified, all technical terms used in the present invention have the same meaning as those generally understood by those skilled in the art to which the present application belongs. The terms used in the present invention are only for describing specific embodiments, and are not intended to limit exemplary embodiments according to the present invention.

[0049] Example 1

[0050] The present invention provides a method for detecting anomalies in industrial control communication protocol messages of an electric power system, the purpose of which is to meet the needs of detecting anomalies in the business logic of application layer communication protocol messages in the industrial control flow data of the electric power system, and proposes to improve the existing method for detecting anomalies in industrial control communication protocol messages of an electric power system, so as to realize the multi-classification output of business logic anomalies of communication protocol messages and the effective identification of unknown business logic anomalies. The patent of the present invention can effectively overcome the shortcomings of the existing artificial intelligence-based algorithms that focus on the binary classification of single-frame messages as normal or abnormal, and lack consideration of the business logic of the messages, and at the same time make up for the shortcomings of the rule-based design method that cannot identify unknown anomalies, and improve the security and reliability of the transmission of communication protocol messages of the electric power industrial control system.

[0051] Figure 1 A flowchart of a method for detecting abnormality of an industrial control communication protocol message in a power system provided by an embodiment of the present invention, and the specific implementation steps are as follows:

[0052] S1. Obtain the IEC 60870-5-104 protocol message in the pacp package of real-time power system industrial control flow data.

[0053] Specifically, step S1, obtaining the IEC 60870-5-104 protocol message in the pacp package of real-time power system industrial control flow data includes:

[0054] The real-time power system industrial control flow data pacp packets are collected by using the switch mirror port, and each frame of flow data of the real-time power system industrial control flow data pacp packets is stripped and extracted layer by layer to obtain application layer messages; according to the IEC60870-5-104 protocol message format, the IEC 60870-5-104 protocol message is filtered out from the application layer messages.

[0055] S2. Input the IEC 60870-5-104 protocol message into a pre-trained anomaly detection model, and the anomaly detection model outputs an anomaly detection result of the message; wherein the anomaly detection model is constructed and trained based on an LSTM network, and the training data set of the anomaly detection model includes normal messages and various typical business logic anomaly messages constructed from normal messages.

[0056] In step S2, the anomaly detection model is constructed and trained based on the LSTM network, such as Figure 2 As shown, including:

[0057] S21. Obtain normal IEC 60870-5-104 protocol messages and abnormal messages, and construct a data set based on the normal IEC 60870-5-104 protocol messages and the abnormal messages; wherein the data set includes a training data set and a test data set, and the ratio of the training data set to the test data set is 80%:20%.

[0058] In an optional embodiment, the normal message data set and the five types of abnormal message data sets are divided respectively, 80% of the data are used as the training data set, and 20% of the data are used as the test data set.

[0059] Specifically, obtaining normal IEC 60870-5-104 protocol messages and abnormal messages includes:

[0060] Normal IEC 60870-5-104 protocol messages are obtained, and typical business logic features of the messages are extracted from the normal IEC 60870-5-104 protocol messages; the abnormal types of typical business logic abnormal messages are determined based on the typical business logic features of the messages; among them, the abnormal types include data total call abnormality, telemetry value dead zone transmission, telesignal opening and closing state abnormality, remote control business execution abnormality and telesignal and remote control business association abnormality; normal IEC 60870-5-104 protocol messages are designed according to the abnormal types, and abnormal messages of different abnormal types are obtained respectively.

[0061] In an optional embodiment, for the IEC 60870-5-104 protocol, by analyzing the protocol specifications and the scheduling information interaction mode, typical business logic features of the message are extracted, including typical business logic features such as message telemetry, telesignaling, remote control, and total call; five types of typical business logic abnormality messages are designed, including data total call abnormality, telemetry value dead zone upload, telesignaling opening and closing state abnormality, remote control business execution abnormality, and telesignaling and remote control business association abnormality.

[0062] The data general call exception message, the specific explanation of the exception is: the general call business of the IEC 60870-5-104 message is divided into three frames. The first frame is the general call instruction issued by the dispatching master station, the second frame is the general call response of the substation, that is, the general call confirmation, and the third frame is the end of the general call. If it does not conform to the business logic, it is judged as an exception.

[0063] The telemetry value dead zone sends an abnormal message. The specific explanation of the abnormality is: the telemetry service value in the IEC 60870-5-104 message will not be sent if the frame change rate before and after is within 0.2%. If the frame change rate before and after is less than 0.2%, it is considered abnormal.

[0064] Abnormal telesignaling opening and closing status message. The specific explanation of the abnormality is: the telesignaling business frames before and after the IEC 60870-5-104 message should be a fixed cycle mode of one open (00) and one closed (01). If two adjacent telesignaling messages with the same information body address appear to be both open (00) or both closed (01), it is judged to be abnormal.

[0065] Remote control service execution logic exception message. The specific explanation of the exception is: the remote control service execution logic of the IEC 60870-5-104 message is a 4-frame message, namely remote control selection, selection confirmation, remote control execution, and execution confirmation. If it does not conform to this logic, it is judged as an exception.

[0066] The logic association between telesignaling and remote control business is abnormal. The specific explanation of the abnormality is: if a change of telesignaling occurs during the execution of the remote control command, that is, the opening and closing of equipment such as circuit breakers and disconnectors, the remote control command needs to be revoked. If the actual message does not conform to the logic, it needs to be judged as an abnormality.

[0067] Specifically, the normal IEC 60870-5-104 protocol message is designed according to the abnormal type, and abnormal messages of different abnormal types are obtained, including:

[0068] A normal IEC 60870-5-104 protocol message is obtained, and a service type of the normal IEC 60870-5-104 protocol message is determined; and according to the service type of the normal IEC 60870-5-104 protocol message, a field of the normal IEC 60870-5-104 protocol message is correspondingly modified to obtain an abnormal message.

[0069] In an optional embodiment, the real-time power system industrial control flow data pacc package can be collected, the IEC60870-5-104 protocol message can be screened out, and the message can be deeply parsed at the instruction level to obtain the specific business to which the message belongs. According to the specific business type of the parsed message, some normal messages are modified into the designed 5 types of business logic abnormal messages, thereby obtaining normal message data and 5 types of abnormal message data;

[0070] Further specifically, the service types of the normal IEC 60870-5-104 protocol message include data general call service message, telemetry service message, telesignaling service message, remote control service message, and telesignaling and remote control service association abnormal message;

[0071] For the data general call service message, some normal message service fields are modified to construct the data general call abnormal message;

[0072] For telemetry service messages, some normal message service fields are modified to construct telemetry value dead zone abnormal messages for sending;

[0073] For the telesignaling service message, some normal message service fields are modified to construct the telesignaling opening and closing status abnormal message;

[0074] For remote control service messages, some normal message service fields are modified to construct remote control service execution abnormal messages;

[0075] For the abnormal message associated with the telesignaling and remote control services, some normal message service fields are modified to construct the abnormal message associated with the telesignaling and remote control services.

[0076] S22. Build an LSTM network structure, train the LSTM network based on the training data set, and obtain a trained anomaly detection model after the model converges; after the model is trained, test the trained anomaly detection model based on the test data set.

[0077] Specifically, step S22 includes: constructing an LSTM network structure, including 1 input layer, 10 LSTM layers, 10 Dropout layers, 1 fully connected layer, and 1 output layer, setting the number of network training cycles to 100, and the data batch unit size to 256; inputting the training data set into the constructed LSTM network for training to obtain an anomaly detection model for power system industrial control communication protocol messages based on LSTM; inputting the test data set into the trained LSTM model, and verifying the effectiveness of the anomaly detection model for multi-classification of known business logic anomalies of power system industrial control communication protocol messages according to the test accuracy, precision, and F1-score indicators.

[0078] In an optional embodiment, some business logic exception messages of known categories are taken out from the data set as the test data set, and the rest of the data set is used as the training data set; the LSTM network is trained using the training data set; wherein the training labels of normal IEC 60870-5-104 protocol messages in the training data set are all 1, and the training labels of abnormal messages are all 2; after the training is completed, an unknown anomaly detection model for the business logic of the power system industrial control communication protocol message is obtained; the test data set is input into the unknown anomaly detection model for the business logic of the power system industrial control communication protocol message to perform a generalization experiment to verify the feasibility of the model for accurately identifying unknown message business logic anomalies.

[0079] Specifically, two types of abnormal messages, namely abnormal telesignal opening and closing status and abnormal remote control business execution, can be taken out and put into the test data set. They are not involved in the training of the LSTM model. These two types of abnormal messages are used as unknown abnormalities for model generalization experiments.

[0080] Since the model needs to identify unknown anomalies, the anomaly classification is no longer specific. The training label of normal messages is 1, and the training labels of the three types of abnormal messages, namely, data total call anomaly, telemetry value dead zone uploading, and telesignal and telecontrol business association anomaly, are all 2. The training data set is input into the LSTM network for training, and the LSTM-based power system industrial control communication protocol message business logic unknown anomaly detection model is obtained. The test data set is input into the trained model, and the feasibility of the power system industrial control communication protocol message anomaly detection model for unknown message business logic anomaly recognition is verified based on test accuracy, precision, F1-score and other indicators.

[0081] The power system industrial control communication protocol message anomaly detection method provided in this scheme first takes the IEC 60870-5-104 protocol as an example, and extracts the business logic characteristics of typical messages such as telemetry, telesignaling, and remote control by analyzing the protocol specifications and the dispatch information interaction mode, and designs five types of business logic anomaly messages, including data total call anomaly, telemetry value dead zone uploading, telesignaling opening and closing state anomaly, remote control business execution anomaly, and telesignaling and remote control business association anomaly; secondly, collect the real-time power system industrial control flow data pacc package, filter out the IEC 60870-5-104 protocol message, and parse the specific business to which the message belongs. According to the specific business type, some normal messages are modified into the above five types of business logic anomaly messages as five types of abnormal data, and the rest of the data remains normal; then divide the normal messages and the five types of abnormal messages respectively, use 80% as the training data set and 20% as the test data set, and input the training data set into the constructed long short-term memory (Long Short-Term Memory, LSTM) neural network, thus constructing an LSTM-based power system industrial control communication protocol message anomaly detection model, and verifying the effectiveness of the proposed model for multi-classification of known business logic anomalies of power system industrial control communication protocol messages according to the accuracy, precision, F1-score and other indicators of the message test data set; finally, two types of abnormal messages, namely, abnormal remote signal opening and closing status and abnormal remote control business execution, are put into the test data set and do not participate in the training of the LSTM model, thereby verifying the feasibility of the power system industrial control communication protocol message anomaly detection model proposed in this scheme for identifying unknown message business logic anomalies.

[0082] Example 2

[0083] like Figure 3 As shown, based on the same inventive concept as the above embodiment, the present invention also provides a power system industrial control communication protocol message anomaly detection device, comprising:

[0084] The data acquisition module is used to obtain the IEC 60870-5-104 protocol message in the pacp package of real-time power system industrial control flow data;

[0085] The anomaly detection module is used to input the IEC 60870-5-104 protocol message into a pre-trained anomaly detection model, and the anomaly detection model outputs an anomaly detection result of the message; wherein the anomaly detection model is constructed and trained based on an LSTM network, and the training data set of the anomaly detection model includes normal messages and various typical business logic anomaly messages constructed from normal messages.

[0086] Example 3

[0087] like Figure 4As shown, the present invention also provides an electronic device 100 for implementing a method for detecting abnormality of an industrial control communication protocol message in a power system according to the above embodiment;

[0088] The electronic device 100 includes a memory 101 , at least one processor 102 , a computer program 103 stored in the memory 101 and executable on the at least one processor 102 , and at least one communication bus 104 .

[0089] The memory 101 can be used to store a computer program 103. The processor 102 implements the steps of a method for detecting anomalies in an industrial control communication protocol message of a power system in Example 1 by running or executing the computer program stored in the memory 101 and calling data stored in the memory 101.

[0090] The memory 101 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data (such as audio data) created according to the use of the electronic device 100, etc. In addition, the memory 101 may include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other non-volatile solid-state storage devices.

[0091] At least one processor 102 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 102 may be a microprocessor or any conventional processor, etc. The processor 102 is the control center of the electronic device 100, and uses various interfaces and lines to connect various parts of the entire electronic device 100.

[0092] The memory 101 in the electronic device 100 stores a plurality of instructions to implement a method for detecting abnormality of an industrial control communication protocol message in a power system. The processor 102 can execute a plurality of instructions to implement:

[0093] Get the IEC 60870-5-104 protocol message in the pacp package of real-time power system industrial control flow data;

[0094] The IEC 60870-5-104 protocol message is input into a pre-trained anomaly detection model, and the anomaly detection model outputs an anomaly detection result of the message; wherein the anomaly detection model is constructed and trained based on an LSTM network, and the training data set of the anomaly detection model includes normal messages and various typical business logic anomaly messages constructed from normal messages.

[0095] Example 4

[0096] If the module / unit integrated in the electronic device 100 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. Computer-readable media may include: any entity or device capable of carrying computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory and read-only memory (ROM, Read-Only Memory).

[0097] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0101] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for detecting abnormality of power system industrial control communication protocol messages, characterized in that: The steps include: Get the IEC 60870-5-104 protocol message in the pacp package of real-time power system industrial control flow data; The IEC 60870-5-104 protocol message is input into a pre-trained anomaly detection model, and the anomaly detection model outputs an anomaly detection result of the message; wherein the anomaly detection model is constructed and trained based on an LSTM network, and the training data set of the anomaly detection model includes normal messages and various typical business logic anomaly messages constructed from normal messages.

2. The method for detecting abnormality of power system industrial control communication protocol messages according to claim 1, characterized in that: Get the IEC 60870-5-104 protocol message in the pacp package of real-time power system industrial control flow data, including: The switch mirror port is used to collect the real-time power system industrial control flow data pacp package, and each frame of the real-time power system industrial control flow data pacp package is stripped and extracted layer by layer to obtain the application layer message; According to the IEC 60870-5-104 protocol message format, the IEC 60870-5-104 protocol message is screened out from the application layer message.

3. The method for detecting abnormality of power system industrial control communication protocol messages according to claim 1, characterized in that: The anomaly detection model is constructed and trained based on the LSTM network, including: Obtain normal IEC 60870-5-104 protocol messages, and extract typical business logic features of the messages from the normal IEC 60870-5-104 protocol messages; Determine the abnormal type of typical business logic abnormal message based on the typical business logic characteristics of the message; the abnormal types include data total call abnormality, telemetry value dead zone sending, telesignal opening and closing state abnormality, remote control business execution abnormality and remote signal and remote control business association abnormality; According to the abnormal type, the normal IEC 60870-5-104 protocol message is designed to obtain abnormal messages of different abnormal types; Construct LSTM network structure; A data set is constructed based on normal IEC 60870-5-104 protocol messages and abnormal messages. The LSTM network is trained based on the data set, and a trained anomaly detection model is obtained after the model converges.

4. The method for detecting abnormality of power system industrial control communication protocol messages according to claim 3 is characterized in that: According to the abnormal type, the normal IEC 60870-5-104 protocol message is designed to obtain abnormal messages of different abnormal types, including: Obtaining a normal IEC 60870-5-104 protocol message, and determining a service type of the normal IEC 60870-5-104 protocol message; wherein the service type of the normal IEC 60870-5-104 protocol message includes a data general call service message, a telemetry service message, a telesignaling service message, a remote control service message, and an abnormal message associated with the remote signaling and remote control services; For the data general call service message, some normal message service fields are modified to construct the data general call abnormal message; For telemetry service messages, some normal message service fields are modified to construct telemetry value dead zone abnormal messages for sending; For the telesignaling service message, some normal message service fields are modified to construct the telesignaling opening and closing status abnormal message; For remote control service messages, some normal message service fields are modified to construct remote control service execution abnormal messages; For the abnormal message associated with the telesignaling and remote control services, some normal message service fields are modified to construct the abnormal message associated with the telesignaling and remote control services.

5. The method for detecting abnormality of power system industrial control communication protocol messages according to claim 3, characterized in that: In the step of building the LSTM network structure, the LSTM network structure includes 1 input layer, 10 LSTM layers, 10 Dropout layers, 1 fully connected layer, and 1 output layer.

6. The method for detecting abnormality of power system industrial control communication protocol messages according to claim 5, characterized in that: The LSTM network is trained based on the data set, including: The data set includes a training data set and a test data set, and the ratio of the training data set to the test data set is 80%:20%; The training data set is input into the constructed LSTM network for training. After the training is completed, an anomaly detection model of the power system industrial control communication protocol message based on LSTM is obtained; the test data set is input into the trained LSTM model, and the effectiveness of the anomaly detection model for multi-classification of known business logic anomalies of the power system industrial control communication protocol message is verified according to the test accuracy, precision, and F1-score indicators.

7. The method for detecting abnormality of power system industrial control communication protocol messages according to claim 5, characterized in that: The LSTM network is trained based on the data set, including: A part of the business logic abnormal messages of known categories are taken out from the data set as the test data set; the rest of the data set is used as the training data set; the LSTM network is trained using the training data set; wherein the training labels of the normal IEC 60870-5-104 protocol messages in the training data set are all 1, and the training labels of the abnormal messages are all 2; after the training is completed, a power system industrial control communication protocol message business logic unknown anomaly detection model is obtained; The test data set is input into the unknown anomaly detection model of the business logic of the power system industrial control communication protocol message to carry out generalization experiments to verify the feasibility of the model in accurately identifying unknown message business logic anomalies.

8. A device for detecting abnormality of messages in industrial control communication protocols of a power system, characterized in that: include: The data acquisition module is used to obtain the IEC 60870-5-104 protocol message in the pacp package of the real-time power system industrial control flow data; The anomaly detection module is used to input the IEC 60870-5-104 protocol message into a pre-trained anomaly detection model, and the anomaly detection model outputs an anomaly detection result of the message; wherein the anomaly detection model is constructed and trained based on an LSTM network, and the training data set of the anomaly detection model includes normal messages and various typical business logic anomaly messages constructed from normal messages.

9. An electronic device, characterized in that: It comprises a processor and a memory, wherein the processor is used to execute a computer program stored in the memory to implement the power system industrial control communication protocol message anomaly detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by the processor, the method for detecting anomalies in the power system industrial control communication protocol message according to any one of claims 1 to 7 is implemented.

Images