Reliability method and system for IED (Intelligent Electronic Device) of transformer substation under intrusion intention

Abstract

The invention relates to a reliability method for an IED (Intelligent Electronic Device) of a transformer substation under an intrusion intention, which is characterized by comprising the following steps of: constructing a Petri diagram by taking a firewall state, an isolation state of IPS on IED equipment and an IED equipment state as positions and taking state change of a safety system of the transformer substation in an intrusion process as conversion; simulating the Petri diagram to obtain the intrusion success probability of the substation safety system, and constructing a Markov state transition matrix of the substation safety system in combination with the natural failure rate of the system; and solving the steady-state probability of each state in the state transition matrix when the substation safety system reaches a steady state, and constructing a reliability index of the substation safety system by using the steady-state probability of each state so as to evaluate whether the substation safety system reaches a system safety requirement or not.

Description

Technical Field

[0001] The present invention relates to the field of power systems, and more specifically, to a reliability method and system for an IED in a transformer substation under intrusion intent. Background Art

[0002] The safety and reliability assessment technology of power systems is a technology used to analyze and quantify the operational stability and resilience of power systems in the face of various faults, cyber attacks and other abnormal situations. This technology mainly includes modeling and evaluating the protection measures of key equipment and networks in power systems to determine their response capabilities when threatened. By using mathematical models and simulation tools, safety and reliability assessment technology can predict the performance of power systems under abnormal conditions and provide a basis for formulating improved security strategies and reliability enhancement measures. In recent years, with the widespread application of information and communication technology (ICT) in power systems, the complexity and interconnectivity of power networks have been greatly improved, which has also significantly increased the cyber security threats faced by power systems. In particular, the widespread deployment of intelligent electronic devices (IEDs) has made the protection devices of power systems a potential target for cyber attacks. It is becoming increasingly important to study the safety and reliability assessment technology of power systems because it can help power companies identify vulnerabilities in the system, formulate effective protection measures, ensure the continuity and stability of power supply, and thus avoid large-scale power outages caused by cyber attacks or system failures.

[0003] Relevant technologies focus on power grid reliability assessment methods, microgrid reliability assessment methods, power system data processing methods and other aspects.

[0004] In terms of power grid reliability assessment methods, the invention patent with patent number CN202410281462.9 discloses a power grid reliability assessment method based on improved non-parametric estimation of important sampling functions. The method effectively improves the efficiency and accuracy of large power grid reliability assessment by constructing a power grid simulation model and iteratively calculating the system state probability density function; the invention patent with patent number CN202410281461.4 discloses a power grid reliability assessment method based on direct and indirect cross entropy optimization of a non-parametric kernel density estimation model. The method uses a two-stage composite sampling algorithm to optimize the probability density distribution of system state variables, solving the technical problems that are difficult to optimize with traditional methods; the invention patent with patent number CN202410374990.9 discloses a fusion power grid A reliability assessment method for dispatching and operation data. The method analyzes the failure rate of power grid equipment by constructing a knowledge graph, calculates the overall reliability of the power grid, and improves the accuracy of the assessment. The invention patent with patent number CN202310099132.3 proposes a precise equivalence method and system for distribution network in power grid reliability assessment. The method obtains the expected load of the distribution network by calculating the probability distribution of the load demand level, thereby improving the efficiency of the reliability assessment of the transmission system operation. The invention patent with patent number CN202310080716.6 discloses a reliability assessment method and device for a power grid DICP system. The method combines the power data transmission model and uses the channel model to analyze the impact of channel interference terms on system reliability, thereby improving the reliability assessment accuracy of the power grid DICP system.

[0005] In terms of microgrid reliability assessment methods, the invention patent with patent number CN202310896339.3 discloses a reliability assessment method and system for a microgrid distribution system. The method adopts a three-stage system reliability state analysis algorithm to achieve hierarchical assessment of microgrids and distribution systems, ensuring the comprehensiveness of system assessment; the invention patent with patent number CN202010775791.0 discloses a microgrid reliability assessment method based on load changes, which improves the accuracy of the assessment results through a two-way search method and calculation of load power failure rate; the invention patent with patent number CN201610863896.5 provides a method and system for taking load demand response into account. A reliability assessment method for a grid-connected microgrid, which optimizes the reliability assessment results of the microgrid by establishing a load demand response model; the invention patent with patent number CN201610866322.3 discloses a reliability assessment method for a grid-connected microgrid taking into account peak shaving and valley filling, and adopts fuzzy membership and dynamic clustering methods to ensure the reliability assessment after the load curve is corrected; the invention patent with patent number CN202310055092.2 proposes a grid reliability assessment method based on Latin hypercube importance sampling, which establishes reliability models of wind turbines, energy storage batteries, etc., performs system state sampling and probabilistic flow calculation, and significantly improves the assessment accuracy and convergence speed.

[0006] In terms of power system data processing methods, the invention patent with patent number CN201110459328.6 provides a static reliability assessment method suitable for complex power grids. By establishing a topology analysis model and substation classification, it quantitatively analyzes system performance indicators, thereby discovering weak links in the power grid and improving the level of power grid planning.

[0007] At present, the research on the safety and reliability assessment of power systems has the following deficiencies:

[0008] First, existing assessment methods lack refined modeling of attacker strategies and defense mechanisms when facing complex cyber attack scenarios, resulting in insufficient accuracy and pertinence of assessment results. Although some patents propose the use of sampling and kernel density estimation methods for reliability assessment, these methods are lacking in simulating the complexity of cyber attacks and are unable to fully reflect the actual impact of attacks on power systems.

[0009] Second, the existing assessment framework lacks effective response strategies and analysis tools when dealing with various types of network attacks, especially internal attacks and intelligent attacks. Most patents still focus on traditional external attacks and fail to fully consider the various means that attackers may use and their different effects on power grid protection equipment, resulting in the inability to provide targeted protection recommendations.

[0010] Third, in the reliability assessment of large-scale power systems, the existing methods have a heavy computational burden and are difficult to promote in practical applications. Although some patents have proposed methods to simplify the calculations, these methods still have limitations in terms of efficiency and operability in practical applications, and fail to fully solve the problem of balancing assessment efficiency and computing resources.

[0011] In view of the above problems, a reliability method and system for substation IED under intrusion intention is urgently needed. Summary of the invention

[0012] In order to solve the deficiencies in the prior art, the present invention provides a reliability method and system for substation IED under intrusion intention, aiming to achieve quantitative analysis and evaluation of the reliability of the power system in the face of network attacks. By combining the network intrusion process with the fault model of the power system protection equipment, the method can simulate the impact of different network attack strategies on the power system, help the power system formulate more effective defense measures, and ensure the stable operation of the power system.

[0013] The present invention adopts the following technical solution.

[0014] The first aspect of the present invention relates to a reliability method for a substation IED under an intrusion intention, the method comprising the following steps: constructing a Petri diagram with the firewall status, the isolation status of the IPS to the IED device, and the IED device status as positions, and the state change of the substation safety system during the intrusion process as a transition; simulating the Petri diagram to obtain the probability of successful intrusion of the substation safety system, and constructing a Markov state transfer matrix of the substation safety system in combination with the natural failure rate of the system; solving the steady-state probability of each state in the state transfer matrix when the substation safety system reaches a steady state, and using the steady-state probability of each state to construct a reliability index of the substation safety system to evaluate whether the substation safety system meets the system safety requirements.

[0015] Preferably, a Petri diagram is constructed with the firewall status, the IPS isolation status of the IED device, and the IED device status as positions, and the change of the substation safety system status during the intrusion process as a transition, including: taking the normal state of the substation safety system, the firewall failure state, the IPS failure state, the failure state of the security isolation rule between the IPS and the IED, the failure state of the IED device indirectly connected to the IPS, and the failure state of the IED device directly connected to the IPS as positions; constructing a firewall rule set, each rule corresponding to a position of a firewall failure state; constructing an IED device set, each IED device corresponding to an IED failure state.

[0016] Preferably, the firewall status, the IPS isolation status of the IED device, and the IED device status are used as positions, and the substation safety system status change during the intrusion process is used as a transition to construct a Petri diagram, including: firewall rejects intrusion attempts, firewall passes intrusion attempts, IPS rejects intrusion attempts, IPS passes intrusion attempts, security isolation rejects intrusion attempts, security isolation passes intrusion attempts, IED passes intrusion attempts, IED attacks security isolation, security isolation attacks IPS, and IED attacks IPS as transitions.

[0017] Preferably, the Petri diagram is simulated to obtain the probability of successful intrusion of the substation safety system, including: the total probability of successful intrusion is:

[0018] α s,h =α fw ×(1-α ips )×α pw

[0019] In the formula,

[0020]

[0021] Among them, α fw,j is the filtering probability of each rule j,

[0022] is the i-th intrusion attempt for each firewall fp rule j,

[0023] n is the number of rules in the firewall rule set,

[0024] α fw The total probability of the firewall failing to detect intrusion intentions;

[0025] α ips is the success probability of IPS detection;

[0026] α pw,k is the success probability of cracking the password policy,

[0027] α encoding,k is the success rate of codec cracking,

[0028] α key_trans,k is the probability of successful cracking of key transmission,

[0029] α pw is the comprehensive success probability of password cracking.

[0030] Preferably, the Markov state transfer matrix of the substation safety system is constructed in combination with the natural failure rate of the system, including: extracting the total probability α of successful intrusion from the Petri diagram simulation result s,h, combined with the probability η that the attacker chooses to directly trigger the misoperation after the attack is successful, and the probability μ that the system operating conditions change and cause the IED to misoperate mis and the probability μ of system repair R , the probability of repair failure μ P Six states of the substation safety system are distinguished; the six states are normal state, potential misoperation state, misoperation state, operation failure state, protection system repair state and complete shutdown state.

[0031] Preferably, solving the steady-state probability of each state in the state transfer matrix when the substation safety system reaches a steady state includes: solving

[0032]

[0033] To obtain the probabilities π1, π2, π3, π4, π5, π6 of states 1 to 6 when the system is stable;

[0034] Among them, λ 1→2 , 1→3 , 2→3 , 2→4 , 3→5 , 4→6 is the possible transition probability between states 1 to 6, based on the total probability of successful intrusion α s,h And the system natural failure rate is calculated;

[0035] A 0 in the matrix means that there is no state transition between two states;

[0036] μ R is the system recovery rate, whose value is μ R =λ 3→5 .

[0037] Preferably, the reliability index of the substation safety system is constructed using the steady-state probability of each state to evaluate whether the substation safety system meets the system safety requirements; including: using the probabilities π1, π2, π3, π4, π5, π6 of states 1 to 6 when the system is stable to describe the mean downtime MDT, system availability A, mean failure interval time MTBF, mean repair time MTTR, average failure frequency F, expected unsupplied energy EENS, and load loss probability LOLP; using the mean downtime MDT, system availability A, mean failure interval time MTBF, mean repair time MTTR, average failure frequency F, expected unsupplied energy EENS, and load loss probability LOLP to describe basic stability, risk resistance and resilience; based on the indicators described by the preset system safety requirements analysis, evaluate the reliability of the substation safety system in the simulation Petri diagram, and improve the reliability of the substation safety system by adjusting the Petri parameters.

[0038] The second aspect of the present invention relates to a reliability system of a substation IED under an intrusion intention, and the system is implemented using a reliability method of a substation IED under an intrusion intention described in the first aspect of the present invention; wherein the system includes a construction module, a calculation module and an evaluation module; the construction module is used to construct a Petri diagram using the firewall status, the isolation status of the IPS to the IED device, and the IED device status as positions, and the state changes of the substation safety system during the intrusion process as transitions; the calculation module is used to simulate the Petri diagram to obtain the probability of successful intrusion of the substation safety system, and to construct a Markov state transfer matrix of the substation safety system in combination with the natural failure rate of the system; the evaluation module is used to solve the steady-state probability of each state in the state transfer matrix when the substation safety system reaches a steady state, and use the steady-state probability of each state to construct a reliability index of the substation safety system to evaluate whether the substation safety system meets the system safety requirements.

[0039] A third aspect of the present invention relates to a terminal, comprising a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the method described in the first aspect of the present invention.

[0040] A fourth aspect of the present invention relates to a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect of the present invention.

[0041] The beneficial effect of the present invention is that, compared with the prior art, the reliability method and system of a substation IED under intrusion intention in the present invention is intended to achieve quantitative analysis and evaluation of the reliability of the power system in the face of network attacks. By combining the network intrusion process with the fault model of the power system protection equipment, this method can simulate the impact of different network attack strategies on the power system, help power companies formulate more effective defense measures, and ensure the stable operation of the power system. The present invention significantly improves the reliability, flexibility and adaptability of the power system in the face of network attacks by innovatively introducing Petri nets and six-state Markov models, combining multi-level protection models with real-time comprehensive evaluation indicators.

[0042] The beneficial effects of the present invention also include:

[0043] 1. The Petri net models in the present invention correspond to different defense mechanisms, reflecting a high degree of restoration of the actual network defense environment. Among them, the firewall model refines multiple rule sets, and each rule set simulates its filtering effect through independent probability parameters, accurately depicting the dynamic behavior of complex network traffic during firewall filtering; the password protection model adds different password box encoding and decoding methods and diversified key transmission protocols, which can simulate the impact of multi-factor authentication and key management strategies on the difficulty of intrusion. This multi-level specialized design ensures the flexibility and accuracy of the model in dealing with different intrusion paths and defense combinations.

[0044] 2. The present invention can monitor the dynamic reliability of the system in a variety of intrusion scenarios in real time through comprehensive evaluation indicators in three dimensions: basic stability, risk resistance, and recovery performance. This indicator system is not only suitable for the simulation and evaluation of various network attacks, but also can provide intuitive reliability feedback, provide a scientific basis for the improvement and precise optimization of the protection strategy of the power system, and realize the dynamic response and optimization of system reliability under different network threat conditions. Compared with the existing single-dimensional indicator evaluation method, the multi-dimensional evaluation system of the present invention significantly enhances the reliability of the system in dealing with complex attack scenarios.

[0045] 3. The innovative design of the firewall model enables each rule set to have independent filtering probability parameters, accurately simulating the dynamic filtering effect of different network traffic in the firewall. By introducing the refined management of multiple rule sets, the present invention can more accurately intercept complex malicious network traffic, especially when dealing with different types of intrusions (such as external access, internal access, etc.), it shows higher filtering accuracy and protection flexibility. Compared with traditional single-rule firewalls, this technology improves the firewall's ability to respond to multi-level threats and significantly enhances the depth and defense effect of the network defense system.

[0046] 4. The present invention constructs a multi-level encryption and key transmission protection in the password protection model, and effectively simulates the comprehensive defense effect of multi-factor authentication and key management by introducing a variety of encryption strategies and key exchange protocols (such as AES, RSA, and Diffie-Hellman protocols). This design can adapt to a variety of intrusion attempts, provides a more flexible and efficient password protection system, and significantly improves the system's defense capabilities in a variety of attack scenarios. Compared with the traditional single password strategy, this multi-level design can effectively increase the difficulty of cracking by intruders and strengthen the system's password protection level.

[0047] 5. The six-state Markov model based on the probability of successful intrusion provides an accurate probabilistic assessment mechanism for the state transition of protection equipment in the power system, covering multi-state transitions from normal operation to potential misoperation, misoperation, operation failure, repair state, and shutdown state. The introduction of this model enables the system to more accurately assess the impact of network attacks and natural failures on the operating state of protection equipment, and realizes long-term steady-state analysis of each state. Compared with existing static models, the dynamic state transition model of the present invention has stronger predictability and adaptability when dealing with different intrusion scenarios and failure modes, thereby greatly improving the overall reliability and dynamic recovery capabilities of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A Petri diagram established for a reliability method of a substation IED under an intrusion intention according to the present invention;

[0049] Figure 2 A Markov state transition diagram established for a reliability method of a substation IED under an intrusion intention of the present invention;

[0050] Figure 3 It is a reliability analysis schematic diagram of a first embodiment of a reliability method of a substation IED under intrusion intention of the present invention;

[0051] Figure 4 This is a schematic diagram of reliability analysis in a second embodiment of a reliability method for a substation IED under intrusion intention according to the present invention. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present invention clearer and more correct, the technical solution of the present invention is described in detail through multiple specific implementations below. It is worth noting that the embodiments adopted in the present invention are only used to explain the present invention and are not used to limit the content of the present invention.

[0053] A first aspect of the present invention relates to a reliability method for a substation IED under intrusion intention, the method comprising steps 1 to 3.

[0054] Step 1: Construct a Petri diagram with the firewall status, IPS isolation status of IED devices, and IED device status as locations and the substation security system status changes during the intrusion process as transitions.

[0055] An equivalent defense model based on generalized random Petri nets is constructed to simulate the intrusion scenario of substation network in power system. The Petri net model includes firewall model, intrusion prevention system (IPS) model and password protection model.

[0056] The firewall model is used to simulate the filtering process of network traffic in the power system substation. The model consists of multiple firewall rule sets that independently set filtering rules, and multiple filtering rules are combined to reflect the role of the firewall in actual operation. Each rule is simulated by a separate transition in the petri net. Therefore, the rule set can be deployed according to the firewall function actually set in the power system substation network. Usually, different rules in the power system substation network are used to filter different network packets, including but not limited to rules such as external access requests, internal access requests, and sensitive data transmission.

[0057] Assuming there are n rules in the firewall model rule set, each rule j can be assigned a filtering probability α fw,j When firewall rule j fails to detect an intrusion attempt, the intrusion attempt can pass through the rule with a probability of α fw,j On the contrary, when the detection is successful, the intrusion is blocked with a probability of 1-α fw,j .

[0058] For each rule j, define the corresponding transition T in the Petri net fw,j When the rule is successfully detected, the mark is moved from position P in Move to position P blocked , indicating that the intrusion is blocked by the firewall. If the detection fails, the mark is changed from P in Move to the next defense layer location, simulating an intrusion into a deeper level through the firewall.

[0059] If the system contains n firewall rules, the i-th intrusion attempt for each firewall fp rule j is The overall detection failure probability is:

[0060]

[0061] The password protection model is used to simulate the process of an intruder trying to crack the password. Considering the main risks of the password protection process in the substation, the Petri diagram considers two different password protection methods: IED password direct connection and password login in the user interface. This model takes into account different password strategies, encoding and decoding methods, and key transmission methods, reflecting the role of different security mechanisms in intrusion prevention.

[0062] The password policy process in the password protection model includes multiple password complexity settings, which may be used to encrypt the substation information itself and the key of the information to be transmitted. The password policy can be a simple password such as a 4-digit password, a complex password such as a password containing uppercase letters and symbols, and one or more strategies such as multi-factor authentication such as dynamic passwords or biometrics. Simply put, only one password policy is used in each transmission process, and each password policy corresponds to a crack success probability α pw,k , where k represents the number of the password policy. To improve the realism of the model, the password protection model introduces different encoding and decoding methods, including symmetric encryption, such as AES, and asymmetric encryption, such as RSA. Different encoding and decoding methods have an impact on the difficulty of password cracking. For example, if the probability of successful cracking of symmetric encryption is set to α sym , and the probability of successful cracking of asymmetric encryption is α asym In practical applications, according to the number of encryption layers, we can multiply the probabilities of multiple password strategies to get the probability of successful cracking α pw,k .

[0063] During the key transmission process, the communication protocol may further encrypt the key. In order to simulate the security of the key transmission method, different key exchange protocols are set in the model, including the Diffie-Hellman protocol and the direct key transmission method. The probability of successful cracking of the Diffie-Hellman protocol is α dh , the probability of successful cracking of direct key transmission is α direct The comprehensive probability of successful cracking of this part of the key transmission process is recorded as α key_trans,k In addition, the computer protocols at different layers also encode and decode the keys and the information to be transmitted. The comprehensive probability of successful cracking is α encoding,k .

[0064] Considering that the information in the substation is encrypted layer by layer before communication is implemented, the comprehensive success probability of password cracking t is t pw for:

[0065]

[0066] Where m is the number of password policies.

[0067] Define the corresponding transformations in the Petri net for the password cracking process. Position P pw Indicates the initial state of password protection; if the intruder successfully cracks the password, it switches to position P intruded , indicating that an intruder has gained access.

[0068] The intrusion prevention system IPS is the path from the firewall attack to the IED. If the intrusion is successful through different methods such as firewall, password, etc., it will be converted to the corresponding position in the Petri diagram. In actual applications, the intrusion attempt may also first access the IPS through the firewall, then log in to the interface through the IPS, and then implement the intrusion through the password model; or directly implement the intrusion through the user interface.

[0069] Taking the firewall status, IPS isolation status of IED devices, and IED device status as positions, and the change of the substation security system status during the intrusion process as the transition, a Petri diagram is constructed, including: taking the normal state of the substation security system, the firewall failure state, the IPS failure state, the failure state of the security isolation rule between IPS and IED, the failure state of IED devices indirectly connected to IPS, and the failure state of IED devices directly connected to IPS as positions; constructing a firewall rule set, each rule corresponds to a position of a firewall failure state; constructing an IED device set, each IED device corresponds to an IED failure state.

[0070] In the Petri net model, positions are used to represent nodes in different states of the power system. Each position state contains one or more tokens to indicate the current state of the power system component. The following positions are defined:

[0071] P1: The substation safety system is in normal state;

[0072] P2: Firewall failure state, which includes the rejection state where the firewall successfully detects the attack, and the detection failure state where the firewall uses rules 1-n to allow the intrusion attempt to pass through the firewall;

[0073] P3: IPS failure state. At this time, IPS is attacked by intrusion intentions that have passed through the firewall, and IPS interception fails;

[0074] P4: Failure of the security isolation rules between IPS and IED, including isolation failure under password attacks;

[0075] P5: Failure state of the IED device indirectly connected to the IPS;

[0076] P6: Failure state of the IED device directly connected to the IPS.

[0077] Among the above six states, the state of the firewall is described in a split manner, one firewall rule, one split manner. P3, P4, P5 and P6 describe the mutual attack after the failure of IPS, security isolation, IED and other devices in a transfer manner in the Petri diagram.

[0078] Taking the firewall status, IPS isolation status of IED equipment, and IED equipment status as positions, and the change of substation safety system status during the intrusion process as transitions, a Petri diagram is constructed, including: firewall rejects intrusion attempt, firewall passes intrusion attempt, IPS rejects intrusion attempt, IPS passes intrusion attempt, security isolation rejects intrusion attempt, security isolation passes intrusion attempt, IED passes intrusion attempt, IED attacks security isolation, security isolation attacks IPS, and IED attacks IPS as transitions.

[0079] Transitions represent the transition conditions between different states, simulating the triggering conditions of network intrusion and defense mechanisms. After confirming the position, the transition process between the associated positions of the firewall and password stages is performed separately. Each rule set of the firewall model is controlled by an independent transition in order to simulate the filtering of different network packets. The transitions detected by the firewall include the following:

[0080] Between P1 and P2, when the system is in a normal state, based on the intrusion intention, the firewall may issue different types of feedback; i fr This transition indicates that the firewall has rejected the intrusion attempt. Indicates that the firewall passed the intrusion attempt through rule n;

[0081] When the firewall rejects the intrusion attempt, P2 returns to P1. Further, if the intrusion attempt through rules 1-n attempts to further invade the IPS, the conversion of the IPS rejecting the intrusion attempt is If the IPS does not intercept the intrusion attempt, the state transition of the intrusion attempt successfully intruding the IPS occurs between P2 and P3, and is converted to

[0082] After the IPS is attacked, the intruder attempts to access the security isolation or directly invade the IED through a password attack. At this time, the security isolation successfully intercepts the password attack, and there is a conversion To return from IPS failure state P3 to P1, if the security isolation is to intercept the password attack, there is a transition At this time, security isolation fails and the state transfers from P3 to P4.

[0083] After the security isolation fails, the intruder intends to further attack the IED device indirectly connected to the IPS and cause the IED to fail. At this time, the attack on the hth IED device is converted into After the attack is successful, the system state transfers from P4 to P5. Similarly, if the IPS fails and the IED is attacked directly, the system state transfers from P4 to P6 after the attack is successful.

[0084] After the IED fails, it will affect the operation status of the IPS and other systems. At this time, the attack on the IPS system or security isolation of the hth IED device is If the security isolation fails due to the IED side, the security isolation will attack the IPS.

[0085] Step 2: Simulate the Petri diagram to obtain the probability of successful intrusion into the substation safety system, and construct the Markov state transfer matrix of the substation safety system in combination with the natural failure rate of the system.

[0086] Based on the above conversion definition, the total probability formula for successful intrusion is:

[0087] α s,h =α fw ×(1-α ips )×α pw

[0088] Among them, α s,h represents the probability of successful network intrusion on the relevant IEDh at substation s, α fw is the probability of firewall detection failure; α ips is the probability that IPS successfully detects an intrusion, 1-α ips Represents the probability of IPS detection failure, that is, the possibility of an intruder successfully bypassing the IPS; α pw is the probability of successful password cracking. This formula represents the probability of an intrusion attempt reaching the IED after passing the firewall, evading IPS detection (i.e., IPS detection failure), and successfully cracking the password.

[0089] Generalized random Petri nets simulate the dynamic behavior of the system by adding immediate transitions and timed transitions. Immediate transitions are triggered instantly, while timed transitions have a waiting time. In the generalized random Petri net, each location and transition are connected to form an intrusion path to simulate the entire process of an intruder entering the IED from the outside. This path includes the effects of firewalls, IPS, and password protection mechanisms.

[0090] In GSPN, a marker is used to represent the current state, and the movement of the marker simulates the change of the system state. The number of markers at each position determines whether the system will undergo a state transition. Initial setting: The initial marker is set at position P6, indicating that the IED is operating normally and has not been invaded. As the simulation proceeds, the marker flows according to the triggering conditions of each transition, showing that the system transitions from one state to another. The probability of each transition being triggered depends on the system's defense mechanism. By controlling the probability of each transition, the effects of various defense mechanisms can be flexibly simulated. By simulating the established Petri net model, the probability of each substation IED being successfully invaded by the network can be obtained. The purpose of this step is to quantify the possibility of a successful IED attack under different defense mechanism configurations.

[0091] After multiple simulations, the Petri net reaches a steady-state distribution, and the occupancy probability of each state remains stable. At this point, a steady-state analysis can be performed on the probability of each state to derive the final intrusion probability of the IED. The steady-state probability distribution is the long-term average occupancy probability of each state obtained through multiple simulations.

[0092] For the successful intrusion state P2, the steady-state probability represents the probability that the IED is successfully intruded under all defense mechanisms, that is, α s,h α s,h It can be used to compare the impact of different defense configurations on the probability of successful intrusion, thereby quantifying the contribution of each defense mechanism to system security.

[0093] Combined with the natural failure rate of the system, the Markov state transition matrix of the substation safety system is constructed, including: extracting the total probability of successful intrusion α from the Petri diagram simulation results s,h , combined with the probability η that the attacker chooses to directly trigger the misoperation after the attack is successful, and the probability μ that the system operating conditions change and cause the IED to misoperate mis and the probability μ of system repair R , the probability of repair failure μ P Six states of the substation safety system are distinguished; the six states are normal state, potential misoperation state, misoperation state, operation failure state, protection system repair state and complete shutdown state.

[0094] Based on the network intrusion success probability calculated by the Petri net model in the previous step, this step establishes a six-state Markov model to further evaluate the impact of network intrusion events on power system protection equipment. The Petri net model simulates the combination of different defense mechanisms and obtains the probability α of IED being successfully breached in various intrusion scenarios. s,h, this probability represents the possibility of the device being attacked by a network under a specific defense configuration. The six-state Markov model uses this intrusion probability as one of the key parameters for state transition, combined with the natural failure probability of the system, to provide a quantitative basis for the transition between states. Through this combined relationship, the intrusion probability calculated by the Petri net not only reflects the possibility of a successful attack, but also provides a basis for the probability distribution of each state flow path in the subsequent Markov model, enabling the model to accurately simulate the dynamic behavior of the protection device and the overall reliability of the system under different network threat conditions.

[0095] Six states are defined to represent different operating conditions of the protection device. Each state is divided based on the functional analysis of the protection system and combined with different types of network attack scenarios, including different failure modes such as maloperation and misoperation. The transition rules between states are triggered by different failures or attack events that the system may experience in actual operation.

[0096] State 1: Normal state, the system operates normally and has not been invaded. State 2: Potential misoperation state, the IED is at risk because the settings are changed by the attacker, but no actual operation occurs. State 3: Misoperation state, the IED sends an erroneous trip signal due to the attacker's operation or internal failure. State 4: Operation failure state, the IED fails to respond normally due to the attacker's interference or natural failure, resulting in protection failure. State 5: Protection system repair state, the IED is isolated due to a fault and is being repaired. State 6: Complete outage state, the IED and its related protection system are faulty and stop operating.

[0097] The above state is based on the simulation petri diagram, taking into account the probability η that the attacker chooses to directly trigger the misoperation after the attack is successful, and the probability μ that the system operating conditions change and cause the IED to misoperate. mis and the probability μ of system repair R , the probability of repair failure μ P .

[0098]

[0099] Where M is the number of time windows set for historical monitoring data, The weight set for the i-th time window, is the number of times the attacker directly triggers misoperation in the i-th time window, is the total number of successful attacks in the i-th time window.

[0100]

[0101] in The weight set for the i-th time window, is the number of IED misoperations caused by changes in system operating conditions in the i-th time window, is the total number of IED operations in the i-th time window.

[0102]

[0103] in The weight set for the i-th time window,

[0104] is the number of successful repairs in the i-th time window,

[0105] is the total number of successful and failed repairs in the i-th time window.

[0106] μ P =1-μ R ,

[0107] The probability of natural failure is obtained based on the long-term operation statistics of IEDs. Based on the impact of network intrusion and the probability of natural failure of components, the transition probability formula of the six-state Markov model is as follows:

[0108] From state 1 to state 2: The probability that the attacker successfully changes the IED settings but does not actually trigger an action:

[0109] λ 1→2 =α s,h ×(1-η)

[0110] Among them, α s,h is the probability of successful IED intrusion, and η is the probability that the attacker chooses to directly trigger a misoperation or an operation failure.

[0111] From state 1 to state 3: The probability that the attacker successfully triggers a false operation and causes the IED to mistakenly send a trip command is:

[0112] λ 1→3 =α s,h ×η

[0113] From state 2 to state 3: The probability of IED misoperation caused by changes in system operating conditions:

[0114] λ 2→3 =μ mis

[0115] Among them, μ mis is the probability of erroneous operation due to system changes or protection settings.

[0116] From state 2 to state 4: The probability that the attacker's operation causes the IED to fail to operate normally:

[0117] λ 2→4 =α s,h ×(1-η)

[0118] From state 3 to state 5: the probability of entering the protection and repair state after an erroneous operation:

[0119] λ 3→5 =μ R

[0120] Among them, μ R is the system recovery rate, that is, the probability of recovery after an erroneous operation occurs.

[0121] From state 4 to state 6: Probability of repair failure after an operation failure occurs on the protection device:

[0122] λ 4→6 =μ P

[0123] Among them, μ P To protect the system's repair rate.

[0124] According to the network intrusion probability and component reliability data, the conversion rate calculation formula is further defined to evaluate the system reliability under different intrusion scenarios. The attack rate of the substation IED is calculated based on the intrusion simulation results:

[0125]

[0126] in, is the number of attack attempts in the substation network, α s,h is the probability of successful IED intrusion.

[0127] Misoperation rate and operation failure rate caused by natural failures

[0128]

[0129] Where λ is the natural failure rate of the protection device.

[0130] Based on the above transformation definition, the state transfer matrix of the six-state Markov model is established for system steady-state analysis.

[0131]

[0132] In the six-state Markov model, solving the steady-state probability of each state helps determine the reliability of the system under long-term operation. The steady-state probability represents the possibility of the system being in a certain state after a long period of operation.

[0133] Step 3, solve the steady-state probability of each state in the state transfer matrix when the substation safety system reaches a steady state, and use the steady-state probability of each state to construct the reliability index of the substation safety system to evaluate whether the substation safety system meets the system safety requirements.

[0134] The steady-state equations are used to describe the conditions when a Markov process reaches a steady state, that is, the probability of the system flowing out of any state is equal to the probability of flowing into it. For the six-state model, the equations for these steady-state probabilities are expressed as:

[0135] πQ=0

[0136] Where: π is the steady-state probability vector of each state, indicating the probability of the system being in each state in long-term operation, π=[π1,π2,π3,π4,π5,π6], satisfying the normalization condition Q is the state transfer matrix, which is used to represent the exit rate and entry rate of each state.

[0137] If the system is stable, then for each state, the probability of the current state transitioning to other states or returning to the current state from other states is balanced. Taking the possible recovery into account in the normal state, the equilibrium equations of each state are listed according to the state transfer matrix Q, as follows:

[0138] The equilibrium equation of state 1 (normal state): -(λ 1→2 +λ 1→3 )π1+λ 3→5 π3+μ R π5=0

[0139] Balance equation for state 2 (potential misoperation state): 1→2 π1-(λ 2→3 +λ 2→4 )π2=0

[0140] Balance equation for state 3 (error operation state): 1→3 π1+λ 2→3 π2-λ 3→5 π3=0

[0141] Balance equation for state 4 (operation failure state): 2→4 π2-λ 4→6 π4=0

[0142] Balance equation for state 5 (protection system repair state): 3→5 π3-μ R π5=0

[0143] The equilibrium equation of state 6 (complete shutdown state): 4→6 π4=0

[0144] In addition, the normalization condition is added After reorganizing the above equations, we can use linear algebra to solve π i The value of can be used to obtain the steady-state probability of each state of the system, that is: π=[π1,π2,π3,π4,π5,π6].

[0145] The reliability index of the substation safety system is constructed using the steady-state probability of each state to evaluate whether the substation safety system meets the system safety requirements; including: using the probabilities π1, π2, π3, π4, π5, π6 of states 1 to 6 when the system is stable to describe the mean downtime MDT, system availability A, mean time between failures MTBF, mean time to repair MTTR, average failure frequency F, expected energy shortage EENS, and load loss probability LOLP; using the mean downtime MDT, system availability A, mean time between failures MTBF, mean time to repair MTTR, average failure frequency F, expected energy shortage EENS, and load loss probability LOLP to describe basic stability, risk resistance and recovery; based on the indicators described by the preset system safety requirements analysis, evaluate the reliability of the substation safety system in the simulation Petri diagram, and improve the reliability of the substation safety system by adjusting the Petri parameters.

[0146] The solved stability probabilities of each state can be used to quantify the overall impact of cyber attacks on the power grid. This step quantifies the overall impact of cyber attacks on the power grid by calculating the key reliability indicators of the power system, and further provides decision-making basis and improvement direction. These reliability indicators include mean downtime (MDT), system availability (A), mean time between failures (MTBF), mean time to repair (MTTR), average failure frequency (F), expected energy not supplied (EENS), and load loss probability (LOLP).

[0147] A measure of the time the system is in an outage state, expressed as the product of the probability of the system being in an outage state and the total operating time.

[0148] MDT=π6×T total

[0149] Among them, π6 is the steady-state probability of the system being completely shut down, T total is the total running time.

[0150] Different types of power systems or different levels of critical equipment have different allowable outage times. For systems with high reliability requirements (such as critical transmission networks and important industrial electricity), MDT is usually expected to be <1 hour / year to ensure that the system operates most of the time. For systems with medium reliability requirements (such as general distribution networks and some commercial electricity), MDT is <10 hours / year. In this case, although a longer outage time is allowed, it is also hoped to minimize the impact on users. For systems with low reliability requirements (such as non-critical loads and general civil facilities), MDT is <24 hours / year, and the impact of system outage is relatively small, but excessive outage time should still be avoided. If the MDT value of a system exceeds the preset standard, it can be considered that the outage time is too long. At this time, the following measures can be taken: increase redundancy and backup equipment to shorten the repair time; increase maintenance frequency to reduce equipment failure rate; optimize protection strategies to reduce outages caused by cyber attacks.

[0151] System availability (A) indicates the probability that the system is in an available state, which is calculated as the sum of the steady-state probabilities of normal operation and non-outage states (states 1, 2, 3, and 5):

[0152] A=π1+π2+π3+π5

[0153] Among them, π1, π2, π3 and π5 are the steady-state probabilities of the system being in normal, potential misoperation, misoperation and repair states, respectively. For systems with high reliability requirements (such as critical infrastructure and power transmission backbone networks), the availability requirement is usually 99.99% or higher, and the threshold is usually set at 99.99%. This means that the system allows about 52.6 minutes of unavailability per year. For systems with medium reliability requirements (such as distribution networks and commercial power supply), the availability requirement is 99.9% or higher, and the threshold is usually set at 99.9%. This corresponds to about 8.76 hours of downtime per year. For systems with general reliability requirements (such as some commercial and civil facilities): the availability requirement is 99% or higher, and the threshold is set at 99%. This level corresponds to about 87.6 hours of downtime per year. If A is lower than the set threshold, it is recommended to take the following measures to improve system availability: implement redundant protection to ensure that the system can continue to operate when the main equipment fails by adding backup equipment; improve automatic recovery capabilities and add automated rapid repair mechanisms to shorten fault recovery time; increase real-time monitoring and early warning to quickly respond to potential failures and perform maintenance in advance.

[0154] MTBF represents the average time that the system continues to operate normally, and is calculated as the normal state (state 1) steady-state probability divided by the sum of the failure to repair state transition rates:

[0155]

[0156] Among them, λ 1-iIt is the conversion rate from state 1 to each fault state (state 2 to state 6). For mission-critical systems (such as power main grids, data centers, and aviation control systems), MTBF usually needs to reach 100,000 hours or more to ensure long-term operation under high load. The threshold of such systems can be set between 50,000 hours and 100,000 hours to ensure high reliability. For medium-reliability systems (such as commercial power facilities and hospital equipment), the MTBF threshold is generally set between 10,000 hours and 20,000 hours to balance system stability and maintenance costs. For general industrial and civilian equipment, for general equipment and facilities, the MTBF threshold is usually set between 1,000 hours and 5,000 hours. Although the failure interval is relatively short, overall availability can be guaranteed through rapid repairs and spare parts management. When the MTBF is lower than the set threshold, the following improvement measures can be taken: optimize protection and detection strategies, increase the strictness of firewall rules and optimize password protection and intrusion prevention system (IPS) strategies; upgrade key hardware to extend the normal operation time of equipment by replacing more reliable hardware or increasing redundancy; improve the operating environment and reduce interference factors in the environment, such as lowering temperature, humidity or electromagnetic interference, to extend the life of the equipment.

[0157] MTTR represents the average time for a system to recover from a fault state to a normal state, and is calculated as the sum of the steady-state probabilities of the fault state divided by the sum of the conversion rates of recovery to the normal state:

[0158]

[0159] Among them, π2, π3, π4 and π5 are the steady-state probabilities of each fault state, μ R is the recovery rate, μ PIs the repair rate. Mission-critical systems (such as power transmission and distribution networks, medical equipment, and financial trading systems): MTTR is usually required to be no more than 1 hour to ensure that the fault can be repaired in the shortest time possible and to avoid the impact of long-term downtime on system operation. Generally speaking, 1 hour can be used as the MTTR upper limit for mission-critical systems. High-reliability systems (such as important industrial facilities and communication networks): MTTR thresholds are usually set within the range of 1 to 4 hours to ensure rapid response and recovery after a fault and avoid long-term impact on the business. For such systems, 4 hours is a reasonable threshold standard. General industrial or civilian equipment: For non-critical systems and equipment, MTTR can be relaxed to 8 to 24 hours, especially when there is redundancy or spare parts support, so that there is still enough time to repair in the event of a fault without affecting normal use. 24 hours is the acceptable MTTR upper limit for general systems. When MTTR exceeds the set threshold, the following improvement measures are recommended: enhance fault diagnosis capabilities, use advanced fault detection and analysis technologies to improve the accuracy and speed of fault location; speed up the maintenance process, improve the response speed of the maintenance team through process optimization, automated operation and maintenance methods, and training; optimize spare parts management, ensure sufficient spare parts for key equipment, and set up a quick replacement mechanism to shorten the time it takes for spare parts to arrive.

[0160] The average failure frequency represents the number of failures per unit time of the system and is calculated as the sum of the steady-state probabilities of states 2 to 6 multiplied by the corresponding failure rate:

[0161]

[0162] Among them, π i is the steady-state probability of the fault state, λ i is the failure rate. Critical systems (such as power transmission grids and emergency communication systems): For critical systems with high reliability and continuous operation requirements, the failure frequency should be as low as possible. Generally speaking, the failure frequency should be less than 1 time per year, that is, F < 1 time / year, to avoid serious consequences caused by frequent failures. High-reliability industrial systems (such as manufacturing assembly lines and petrochemical equipment): For industrial systems with high reliability, the failure frequency is usually required to be no more than 3 times per year, that is, F < 3 times / year. This ensures that the system will not be shut down frequently during production. General industrial or civil systems: For systems with general reliability requirements, such as auxiliary systems such as air conditioning and lighting, the failure frequency can be appropriately relaxed, and it is usually accepted that it does not exceed 5 times per year, that is, F < 5 times / year. When F exceeds the set threshold, it is recommended to take the following measures: Improve intrusion defense and fault prevention capabilities, install multi-layer firewalls and intrusion prevention systems (IPS), and improve the system's ability to respond to network attacks; strengthen regular maintenance, increase the frequency of regular inspections and preventive maintenance, and promptly discover and handle potential faults; optimize fault detection mechanisms, install highly sensitive fault detection equipment, and warn of potential problems in advance to avoid failures.

[0163] EENS is used to measure the amount of unsupplied energy caused by a system failure or cyber attack, expressed as the amount of power lost per unit time. The calculation steps are as follows:

[0164]

[0165] Where i∈F represents all fault states that may cause load shedding (e.g., state 3 and state 6); π i is the steady-state probability of state i; LC i is the load reduction value under state i; T is the unit time (usually one year, i.e. 8760 hours).

[0166] Among them, LC i It is calculated through optimized power flow analysis, and the formula is as follows:

[0167] LC i =DS i

[0168] Where D is the total power demand of the system in a specific time period; S i is the power that can actually be supplied in state i.

[0169] Critical systems (such as power transmission grids), for critical systems, the annual average value of EENS should generally be controlled at a low level, such as less than 0.001% of total power demand. When EENS exceeds this threshold in certain intrusion scenarios, it is necessary to immediately review and optimize the defense strategy, including increasing network redundancy, strengthening intrusion protection measures (such as adding firewall rules, improving IPS configuration), etc. General industrial systems, in general industrial or large commercial systems, the tolerance range of EENS may be more relaxed. For example, an annual demand of less than 0.01% is generally considered an acceptable value. When EENS is higher than this value, consideration should be given to enhancing security measures, such as upgrading password protection policies or introducing multi-factor authentication. Tolerable service interruption systems: For systems with lower reliability requirements (such as some civilian systems), the acceptable range of EENS is generally below 0.05%. When the actual EENS exceeds this value, the basic protection can be appropriately improved, but no major upgrade measures are necessary. In actual operation, when the EENS value shows significant changes in the following scenarios, further policy optimization should be considered: EENS increases significantly when the attack intensity increases, when a specific type of network attack causes a significant increase in EENS, such as changing from a single firewall protection to a multi-layer protection, and adding additional detection mechanisms. The EENS of a certain type of equipment frequently exceeds the standard. If the EENS value of certain key equipment increases significantly when it is attacked by a specific attack, you can consider adding redundancy to these devices or adjusting their topological position in the network. The impact of prolonged attack time on EENS. When the prolonged intrusion time causes a significant increase in EENS, you can consider shortening the detection and response time and using real-time monitoring and rapid response mechanisms to reduce EENS.

[0170] LOLP is used to characterize the probability of load supply failure in a system within a specific period of time. It is calculated based on the steady-state probability and load reduction in each state:

[0171]

[0172] Where i∈F represents all fault states that will cause load shedding (e.g., state 3 and state 6). For critical power systems with high reliability requirements, such as hospitals, data centers, or industrial plants, the LOLP threshold is usually set at 0.01%-0.1% (i.e., there is a risk of load loss of 8.76 hours or less throughout the year). For ordinary residential or commercial power supply systems, the LOLP threshold can be set at around 1%, i.e., there is a risk of load loss of about 87.6 hours throughout the year. When LOLP is higher than the set threshold, it is necessary to enhance the redundancy of the system, such as increasing standby power generation capacity, redundant lines, or backup of key equipment. When LOLP is close to the set threshold, the possibility of load loss can be reduced by means of system maintenance optimization, dynamic adjustment of power supply load, or adding local energy storage systems.

[0173] The comprehensive evaluation index based on the Petri net six-state Markov model is designed to evaluate the operating status of the power system in different scenarios in multiple dimensions. This evaluation integrates three levels of indicators: basic stability, risk resistance, and recovery performance, to achieve a comprehensive analysis of the system's long-term operation, sudden failures, and recovery capabilities. The following is a detailed definition of the comprehensive evaluation index formula.

[0174] I comp =W BS ·S BS +W RR ·S RR +W RRc ·S RRc

[0175] Among them, W BS ,W RR ,W RRc are the weight parameters of basic stability, risk resistance and recovery performance, satisfying W BS +W RR +W RRc = 1. For systems that prioritize basic stability (such as power grid trunk lines), the continuity of their power supply is crucial, so it can be used as the basic stability parameter W BS Assign a higher weight, usually in the range of 0.5-0.6, while risk resistance W RR and recovery performance W RRc The distribution is between 0.2 and 0.25 respectively. This type of distribution ensures that the system can maintain a stable state when subjected to a small disturbance, and is suitable for systems with high reliability requirements. For systems that prioritize risk resistance (such as data centers and military communication networks), the system must be able to withstand external attacks or emergencies, so W RR The weight is set to 0.5-0.6, the basic stability W BS and recovery performance W RRc Each accounts for 0.2-0.25. This weight setting helps to enhance the emergency response and fault tolerance of the system. For systems that prioritize recovery performance (such as distribution networks and industrial facilities), the focus is on rapid recovery after a fault, so the recovery performance W can be RRc A higher weight is given, and it is recommended to be set at 0.5-0.6, while basic stability and risk resistance are each assigned a weight ratio of 0.2-0.25. This setting helps the system to quickly restore service after a failure, reducing downtime and impact on business.

[0176] S BS ,S RR ,S RRc They represent the comprehensive evaluation values ​​of the basic stability layer, risk resistance layer and recovery performance layer respectively, and are specifically defined as follows.

[0177] The basic stability layer measures the reliability and stability of the system in steady state, including the average downtime, system availability, and the rate of change of the mean time between failures. The formula is:

[0178]

[0179] Wherein, MDT(t) represents the mean downtime; It is the inverse of system availability A(t), emphasizing the availability requirement of the system; It indicates the rate of change of the mean time between failures, reflecting the stability of the system under long-term operation. Basic stability layer S BS Reflects the operational stability of the system in steady state. The evaluation criteria can be divided into four levels: S BS When the value is lower than 0.2, the system is in the high stability area, indicating that the operation is highly stable with minimal fluctuations, and only the existing maintenance strategy needs to be maintained; BS When S is between 0.2 and 0.5, the system is in the medium stability area, showing some fluctuations but still stable. The maintenance frequency of key equipment can be appropriately increased to prevent minor failures. BS When it reaches between 0.5 and 0.8, the system enters a low stability zone, with frequent fluctuations and increasing amplitudes. It is necessary to strengthen comprehensive maintenance, detection, and even upgrade core equipment to prevent further deterioration. BS When the value reaches 0.8 or above, the system is in an unstable area, showing extremely poor stability, and emergency measures must be taken immediately, including comprehensive maintenance, equipment replacement, optimization of protection strategies, or temporary shutdown of part of the load to ensure safety.

[0180] The risk resistance layer measures the system's responsiveness and risk resistance under emergencies. The product of the rate of change of the fault frequency and the expected unsupplied energy (EENS) and the second-order derivative of the load loss probability (LOLP) represents the disturbance resistance, and the formula is:

[0181]

[0182] in, is the time rate of change of the fault frequency, reflecting the immediate response of the system in the event of a fault; EENS(t) is the expected amount of unsupplied energy, which amplifies the impact of sudden faults on the system by multiplying it with the rate of change of the fault frequency; It is the second-order derivative of the load loss probability, which is used to evaluate the system's risk resistance under extreme events. α is the adjustment coefficient, which is used to balance the impact of the second-order derivative.

[0183] The integral result S of the risk resistance layer RR Indicates the system's ability to resist external disturbances, and different numerical ranges correspond to the level of system anti-disturbance. RRThe lower the value, the stronger the system's anti-disturbance capability is; conversely, the higher the value, the more susceptible the system is to external interference. The usual criteria are as follows: RR <0.3, the system exhibits extremely high anti-disturbance and is almost unaffected by the outside world. The existing protection strategy can be maintained without additional adjustments. When 0.3≤S RR <0.6, the system has good anti-disturbance performance, but may be affected by moderate interference. In this case, it is recommended to monitor the system regularly and strengthen protective measures appropriately; if 0.6≤S RR <0.8, the system's anti-disturbance capability is low, and the protection level needs to be enhanced, such as increasing the fault tolerance and redundancy of key equipment; when S RR When ≥0.8, the system can hardly effectively resist external interference and there is a high risk. Measures should be taken immediately to improve the protection level, such as adding protective equipment, optimizing load distribution, or redesigning the network structure to enhance the system's anti-disturbance capabilities.

[0184] The setting standard of parameter α depends on the system operating environment and external interference characteristics. For systems that require high security (such as power transmission backbone networks or critical infrastructure), a smaller α value (such as α = 0.1-0.2) should be selected to make the system more sensitive to disturbances, thereby effectively avoiding the risks that may be caused by small disturbances. For general industrial systems (such as manufacturing equipment and industrial control systems), a medium α value (such as α = 0.3-0.5) can be set to balance the requirements of disturbance resistance and economy. For civil systems with strong fault tolerance (such as general commercial building facilities), α can be set in a higher range (such as α = 0.6-0.8) to avoid false alarms or unnecessary protective responses due to excessive sensitivity.

[0185] The recovery performance layer describes the system's ability to recover from a faulty state to a normal state, including the negative rate of change of the recovery speed and the square term of the acceleration of the recovery process. The specific formula is:

[0186]

[0187] in, Indicates the rate of change of the mean repair time (a negative sign indicates that faster recovery is better); is the square term of the acceleration of the repair process, which is used to measure the smoothness of the recovery. β is the adjustment coefficient, which is used to control the influence of the recovery acceleration.

[0188] System recovery performance layer index S RRc It reflects the system's ability to recover after a failure. The lower the value, the stronger the system's ability to recover, and the faster and smoother it can recover from a failure to a normal operating state. The specific evaluation criteria are as follows: RRc<0.3, the system exhibits extremely high recovery performance and can quickly and stably recover to normal operation after a fault occurs. This type of performance is usually suitable for critical application scenarios, such as power dispatching systems or emergency communication networks, and there is no need to further adjust the system's recovery mechanism. RRc <0.6, the system has good recovery performance and can meet the needs of industrial control systems or important manufacturing equipment that have high requirements for recovery speed and stability. Systems within this range should regularly check the backup status and repair process of key components, and appropriately strengthen recovery guarantees when necessary to ensure effective recovery when a fault occurs. RRc When S<0.8, the system has average recovery capability and is suitable for commercial applications. When a critical failure occurs, there may be a certain delay in recovery. It is recommended to upgrade the system to a certain extent, such as adding an automatic recovery function or setting up an additional alarm mechanism to improve the overall recovery performance. RRc ≥0.8, the system recovery performance is poor, and the system may remain in an abnormal state for a long time or experience large fluctuations after a failure occurs. Such systems should consider upgrading the recovery process, improving the automatic repair capabilities of key equipment, or introducing an efficient spare parts management system to shorten the recovery time and enhance system stability.

[0189] The weight coefficient β of the recovery performance should be adjusted according to the sensitivity of the system to fault recovery. For critical systems with high demand for rapid recovery, it is recommended to set β to a lower value (such as β = 0.1 ~ 0.3) to make the system more sensitive to the recovery performance index. For systems such as industrial equipment that have high but relatively loose requirements for recovery performance, β can be set to a medium value (such as β = 0.4 ~ 0.6). For general non-critical systems or ordinary commercial facilities, the demand for recovery speed is lower, and β can be set in a higher range (such as β = 0.7 ~ 0.9) to avoid unnecessary system adjustments due to excessive sensitivity.

[0190] Under normal system conditions, the ideal comprehensive evaluation index I comp The value should be kept in a low range. At this time, the performance of each sub-indicator is usually: Basic stability layer S BS Remain stable with small fluctuations, indicating that the system is in a steady state; Risk resistance level S RR The second-order derivatives of the fault frequency change and load loss probability in are both low, indicating that the system has a certain resistance to interference or external shocks; while the recovery performance layer S RRc The recovery time and acceleration change in are also small, indicating that the system can quickly and smoothly recover to normal state in the event of an occasional failure. comp The value remains stable in a low range, indicating that the system is running smoothly, and the current protection strategy and redundancy configuration are reasonable and do not need to be adjusted.comp When it starts to rise and gradually approaches the preset risk threshold, it indicates that the system may be experiencing one or more abnormal states. Specifically, if the basic stability layer S BS A significant increase may be due to an increase in mean downtime (MDT), a decrease in system availability, or a decrease in mean time between failures (MTBF), which means that the system equipment is aging or some components frequently have minor failures, and preventive maintenance is needed; if the risk resistance level S RR The increase in the value fluctuation of may be due to the increase in the failure frequency or the increase in the fluctuation of the load loss probability, indicating that the system may face the risk of external attacks or emergencies, and it is necessary to pay attention to whether the configuration of the intrusion prevention system is sufficient; the recovery performance layer S RRc An increase in the value indicates that the mean repair time has increased or the recovery acceleration fluctuates greatly, indicating that the troubleshooting and recovery process is delayed or unstable, and the spare parts management and response speed should be checked. At this time, the system enters the early warning state, and further monitoring and protection are recommended, such as strengthening network monitoring, increasing the frequency of equipment maintenance, or adjusting the protection strategy. comp Exceeding the preset risk threshold and entering the high-risk state interval indicates that the system operation status no longer meets the security and stability requirements. The following anomalies may exist: BS If the risk resistance level S is significantly increased, it may be due to the poor performance of multiple key indicators (such as a sharp drop in MTBF and A significantly lower than the normal level). At this time, it may be necessary to shut down and update some equipment or conduct a comprehensive overhaul. RR If the system rises significantly, it means that the system may be threatened by strong external impact or frequent intrusions. It is necessary to upgrade the intrusion prevention system or even consider isolating the attacked network segment. If the performance layer S is restored, RR A significant increase indicates that the system performs poorly in terms of recovery time and stability after a fault. It is recommended to optimize the repair process, increase the number of spare parts for key equipment, and deploy redundant spare parts when necessary. In a high-risk state, the system's operating status is judged to be unsafe, and effective intervention measures must be taken immediately to prevent large-scale load loss or system shutdown.

[0191] The setting of risk thresholds is generally based on the importance of the system, stability requirements, and the allowable frequency of failures. For different types of power systems, the threshold standards will be different to distinguish whether the system is in a normal state, a warning state, or a high-risk state. For example, for mission-critical systems (such as power backbone networks and data centers), the tolerance for outages is extremely low, so the risk threshold is It is usually set to 0.2 or below to ensure that the system is always in a highly stable operating state. comp If it exceeds 0.2, an early warning or emergency measures will be triggered. For high-reliability systems (such as important industrial facilities or critical transmission and distribution grids), the risk threshold It can be appropriately relaxed to the range of 0.3-0.5. Once the threshold is exceeded, preventive maintenance or adjustment of protection configuration is required immediately. For general industrial and civil systems, a certain degree of shutdown is allowed. It is usually set in the range of 0.5-0.7. This means that when I comp When it exceeds 0.7, the system enters a high-risk state and needs to arrange maintenance or enable redundancy strategies.

[0192] like Figure 3

[0193] In the first embodiment, the impact of substation defense mechanism on grid reliability indicators was studied, and three different scenarios were set to evaluate the performance of the power system when it was attacked by a network, and each scenario was compared with a baseline situation without an attack. In scenario 1, each substation network is protected by a firewall and each IED is protected by a password. Assuming that the attacker has limited capabilities and cannot easily break through these defense measures, in this scenario, EENS and LOLP increased by 13.62% and 13.54% respectively when attacked. Scenario 2 adds IPS as an additional protection measure on the basis of scenario 1, assuming that the number of rules and parameters of IPS are the same as the firewall model, which further improves network security. The results show that the reliability of the power system has been significantly enhanced due to the addition of IPS, and the increase in EENS and LOLP has dropped to 2.62% and 2.67% respectively. Scenario 3 is the same as scenario 1, but assuming that the attacker's capabilities have been improved, the probability of password cracking has increased to 0.15. The results show that although the defense mechanism has not changed, the increase in EENS and LOLP has reached 17.28% and 16.88% respectively due to the improvement of the attacker's capabilities.

[0194] In scenario 1, despite the presence of firewalls and password protection, the reliability of the power system is still greatly affected when attacked, with both EENS and LOLP increasing by more than 13%, indicating that the existing defense mechanism has certain vulnerabilities; scenario 2 significantly improves the reliability of the system by adding IPS, with the increase in EENS and LOLP dropping to less than 3%, indicating that IPS plays a significant role in enhancing network security and can effectively reduce the impact of attacks on power grid reliability; in scenario 3, the improvement in attacker capabilities leads to a more serious impact than scenario 1, with the increase in EENS and LOLP reaching 17.28% and 16.88% respectively. This shows that even with the existence of defense mechanisms, if the attacker's capabilities are improved, the reliability of the power grid will still be under greater threat.

[0195] The second embodiment studies the impact of intelligent attacks on the reliability of the power system. In scenario 1, the impact of increasing the number of intrusion attempts during peak hours on system reliability is studied. Specifically, each day is divided into peak load and low load levels. It is assumed that the load demand during the off-peak period is 75% of the peak load and is at the peak level for 30% of the time. The number of intrusion attempts during the peak period doubles to 80 times. The results show that the increase in EENS and LOLP is 10.36% and 9.8% respectively, indicating that increasing the number of intrusion attempts during the peak period has a significant negative impact on system reliability. In scenario 2, the impact of intelligent attacks on critical substations on the reliability of the power system is analyzed. It is assumed that the intruder has a detailed understanding of the power grid and important substations and launches more attacks on key equipment. In the RTS system studied, 24 substations are divided into different groups according to their contribution to the load reduction. Although the total number of intrusion attempts is the same as that of the non-intelligent attack scenario, in the intelligent attack scenario, the attacker prioritizes the attack on substation components with higher importance. The results show that the increase in EENS and LOLP is 6.41% and 6.39% respectively. Although the increase is smaller than that in scenario 1, the attacks on key substation components are more precise, which further increases the vulnerability of the system at these key nodes.

[0196] Smart attacks have a significant negative impact on the reliability of the power system. In the scenario where the number of intrusion attempts increases during peak hours, the system reliability decreases more significantly. In the targeted attack scenario, although the increase is smaller, the vulnerability of the system at key nodes is more obvious, indicating that smart attacks pose a serious threat to the power system.

[0197] The second aspect of the present invention relates to a reliability system of a substation IED under an intrusion intention, and the system is implemented using a reliability method of a substation IED under an intrusion intention in the first aspect of the present invention; wherein the system includes a construction module, a calculation module and an evaluation module; the construction module is used to construct a Petri diagram using the firewall status, the isolation status of the IPS to the IED device, and the IED device status as positions, and the state changes of the substation safety system during the intrusion process as transitions; the calculation module is used to simulate the Petri diagram to obtain the probability of successful intrusion of the substation safety system, and to construct a Markov state transfer matrix of the substation safety system in combination with the natural failure rate of the system; the evaluation module is used to solve the steady-state probability of each state in the state transfer matrix when the substation safety system reaches a steady state, and use the steady-state probability of each state to construct a reliability index of the substation safety system to evaluate whether the substation safety system meets the system safety requirements.

[0198] A third aspect of the present invention relates to a terminal, comprising a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the method described in the first aspect of the present invention.

[0199] A fourth aspect of the present invention relates to a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect of the present invention.

[0200] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit them. Although the present invention is described in detail with reference to the above embodiments, it should be understood by those skilled in the art that the technical solutions of the present invention still include contents that can modify or replace the specific embodiments of the present invention. Any modification or replacement that does not depart from the spirit and scope of the present invention shall be included in the protection scope of the claims of the present invention.

Claims

1. A reliability method for substation IED under intrusion intention, characterized in that: The method comprises the following steps: The Petri diagram is constructed by taking the firewall status, IPS isolation status of IED equipment and IED equipment status as the location and the substation security system status change during the intrusion process as the transition; The Petri diagram is simulated to obtain the probability of successful intrusion into the substation safety system, and the Markov state transition matrix of the substation safety system is constructed in combination with the natural failure rate of the system; The steady-state probability of each state in the state transfer matrix is ​​solved when the substation safety system reaches a steady state, and the reliability index of the substation safety system is constructed using the steady-state probability of each state to evaluate whether the substation safety system meets the system safety requirements.

2. The reliability method of a substation IED under intrusion intention according to claim 1 is characterized in that: The method comprises the following steps: The Petri diagram is constructed by taking the firewall status, the IPS isolation status of the IED device, and the IED device status as the position, and taking the substation security system status change during the intrusion process as the transition, including: The positions are the normal state of the substation security system, the failure state of the firewall, the failure state of the IPS, the failure state of the security isolation rule between the IPS and the IED, the failure state of the IED device indirectly connected to the IPS, and the failure state of the IED device directly connected to the IPS; Construct a firewall rule set, where each rule corresponds to a location where the firewall is in an invalid state; Construct an IED device set, each IED device corresponds to an IED failure state.

3. The reliability method of a substation IED under intrusion intention according to claim 2 is characterized in that: The method comprises the following steps: The Petri diagram is constructed by taking the firewall status, the IPS isolation status of the IED device, and the IED device status as the position, and taking the substation security system status change during the intrusion process as the transition, including: The conversion is firewall denies intrusion attempt, firewall passes intrusion attempt, IPS denies intrusion attempt, IPS passes intrusion attempt, security isolation denies intrusion attempt, security isolation passes intrusion attempt, IED passes intrusion attempt, IED attacks security isolation, security isolation attacks IPS, and IED attacks IPS.

4. The reliability method of a substation IED under intrusion intention according to claim 3 is characterized in that: The method comprises the following steps: The simulating of the Petri diagram to obtain the probability of successful intrusion of the substation safety system includes: The total probability of successful intrusion is: α s,h ＝α fw ×(1-α ips )×α pw In the formula, Among them, α fw,j is the filtering probability of each rule j, is the i-th intrusion attempt for each firewall fp rule j, n is the number of rules in the firewall rule set, α fw The total probability of the firewall failing to detect intrusion intentions; α ips is the success probability of IPS detection; α pw,k is the success probability of cracking the password policy, α encoding,k is the success probability of codec cracking, α key_trans,k is the probability of successful cracking of key transmission, α pw is the comprehensive success probability of password cracking.

5. The reliability method of a substation IED under intrusion intention according to claim 4 is characterized in that: The method comprises the following steps: The Markov state transfer matrix of the substation safety system is constructed by combining the natural failure rate of the system, including: Extract the total probability α of successful intrusion from the Petri diagram simulation results s,h , combined with the probability η that the attacker chooses to directly trigger the misoperation after the attack is successful, and the probability μ that the system operating conditions change and cause the IED to misoperate mis and the probability μ of system repair R , the probability of repair failure μ P Distinguish the six states of the substation safety system; The six states are respectively a normal state, a potential misoperation state, a misoperation state, an operation failure state, a protection system repair state and a complete shutdown state.

6. The reliability method of a substation IED under intrusion intention according to claim 5 is characterized in that: The method comprises the following steps: The method of solving the steady-state probability of each state in the state transfer matrix when the substation safety system reaches a steady state includes: Solution To obtain the probabilities π1, π2, π3, π4, π5, π6 of states 1 to 6 when the system is stable; Among them, λ 1→2 , 1→3 , 2→3 , 2→4 , 3→5 , 4→6 is the possible transition probability between states 1 to 6, based on the total probability of successful intrusion α s,h And the system natural failure rate is calculated; A 0 in the matrix means that there is no state transition between two states; μ R is the system recovery rate, whose value is μ R =λ 3→5 .

7. The reliability method of a substation IED under intrusion intention according to claim 5 is characterized in that: The method comprises the following steps: The method of constructing a reliability index of a substation safety system by using the steady-state probability of each state to evaluate whether the substation safety system meets the system safety requirements includes: The probabilities π1, π2, π3, π4, π5, π6 of states 1 to 6 when the system is stable are used to describe the mean downtime MDT, system availability A, mean time between failures MTBF, mean time to repair MTTR, mean failure frequency F, expected unsupplied energy EENS, and load loss probability LOLP; The basic stability, risk resistance and recovery are described by using mean downtime MDT, system availability A, mean time between failures MTBF, mean time to repair MTTR, mean failure frequency F, expected unsupplied energy EENS, and load loss probability LOLP; Based on the indicators described in the preset system safety requirements analysis, the reliability of the substation safety system in the simulation Petri diagram is evaluated, and the reliability of the substation safety system is improved by adjusting the Petri parameters.

8. A reliability system for IEDs in a substation under intrusion intention, characterized by: The system is implemented by using a reliability method of a substation IED under intrusion intention as described in any one of claims 1 to 7; wherein, The system includes a construction module, a calculation module and an evaluation module; The construction module is used to construct a Petri diagram using the firewall status, the IPS isolation status of the IED device, and the IED device status as positions and the substation safety system status change during the intrusion process as a transition; The calculation module is used to simulate the Petri diagram to obtain the probability of successful intrusion of the substation safety system, and to construct the Markov state transfer matrix of the substation safety system in combination with the natural failure rate of the system; The evaluation module is used to solve the steady-state probability of each state in the state transfer matrix when the substation safety system reaches a steady state, and use the steady-state probability of each state to construct a reliability index of the substation safety system to evaluate whether the substation safety system meets the system safety requirements.

9. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is configured to operate according to the instructions to execute the steps of the method according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images