Power system network attack-oriented substation defense method and related device

Abstract

The invention discloses a power system network attack-oriented substation defense method and a related device, which are applied to the field of power. According to the invention, the network security risk of each transformer substation can be evaluated, and the corresponding network security resources are configured for the high-risk transformer substation; based on the network security resources, deploying corresponding defense measures for the transformer substation to monitor network attacks, and generating a corresponding transformer substation health index based on a monitoring result of the network attacks; and based on the transformer substation health index, optimizing and dispatching a generator set of the transformer substation so as to avoid power failure of the power grid caused by network attack. Therefore, the network attack can be deeply prevented from three levels (risk assessment and network security resource configuration, attack monitoring and health index generation, and power generator set optimization and scheduling), the power grid fault caused by the network attack is avoided, and the defense effect is good.

Description

Technical Field

[0001] The present invention relates to the electric power field, and in particular to a substation defense method and related devices facing power system network attacks. Background Art

[0002] As the power system transforms to a smart grid, the application of information and communication technology (ICT) in power infrastructure is becoming more and more widespread. Although this integration improves the efficiency and flexibility of the system, it also significantly expands the attack surface of the power system, making it face unprecedented network security challenges. In particular, substations, as key nodes in the power transmission system, their security is directly related to the stable operation of the entire power grid.

[0003] In recent years, cyber attacks on power infrastructure have occurred frequently, highlighting the urgency of power system network security. Traditional single defense measures are no longer sufficient to cope with increasingly complex and diverse cyber threats. In this context, how to defend against cyber attacks in depth and at multiple levels to ensure the stable operation of the power grid has become an urgent problem to be solved by people in this field. Summary of the invention

[0004] In view of the above problems, the present invention provides a substation defense method and related devices against power system network attacks, which overcome the above problems or at least partially solve the above problems.

[0005] First, a substation defense method against power system network attacks includes:

[0006] Assess the cybersecurity risks of each substation and configure corresponding cybersecurity resources for high-risk substations;

[0007] Based on the network security resources, deploy corresponding defense measures for the substation to monitor network attacks, and generate a corresponding substation health index based on the monitoring results of the network attacks;

[0008] Based on the substation health index, the generator sets of the substation are optimally dispatched to avoid power outages of the power grid caused by cyber attacks.

[0009] Optionally, in some optional implementations, the step of evaluating the network security risk of each substation and configuring corresponding network security resources for high-risk substations includes:

[0010] For any substation, the following steps are performed: calculating the cybersecurity risk of the substation based on potential threats to the substation, the likelihood of occurrence of the potential threats, and the consequences of the occurrence of the potential threats;

[0011] Based on the calculated network security risks of each substation, high-risk substations are screened out, and corresponding network security resources are configured for high-risk substations.

[0012] Optionally, in some optional implementations, there is a functional relationship between the possibility of occurrence of the potential threat and the network security resources of the corresponding substation as shown in Formula 1, Formula 1: ,in, is the probability of a potential threat occurring. It is the network security resource of the corresponding substation.

[0013] Optionally, in certain optional embodiments, the consequences of the potential threat are obtained by calculating the elasticity score based on the line traffic, line capacity and total load in the corresponding stage, wherein the stages include: the stage before the network attack, the stage after the network attack and the stage after system optimization scheduling.

[0014] Optionally, in some optional implementations, the deploying corresponding defense measures on the substation based on the network security resources to monitor network attacks, and generating a corresponding substation health index based on the monitoring results of the network attacks, includes:

[0015] Based on the network security resources, deploy corresponding defense measures for the substation, wherein the defense measures include: intrusion monitoring system, network firewall, vulnerability scanning, traffic monitoring, behavior analysis and anomaly monitoring;

[0016] Based on the defense measures, network attacks are monitored to obtain corresponding monitoring results;

[0017] Based on the monitoring results, a corresponding substation health index is generated.

[0018] Optionally, in certain optional implementations, optimizing the scheduling of generator sets of a substation based on the substation health index to avoid power outages of the power grid caused by cyber attacks includes:

[0019] Based on the substation health index, determine the line flow limit of the substation and the power configuration constraint of the substation, wherein the line flow limit refers to the flow limit through the substation line when the substation is in a power outage, and the power configuration constraint refers to the power that other substations in the power grid reallocate to maintain power supply when the substation is in a power outage;

[0020] Based on the line flow restriction and power configuration constraint, the generator sets of the substation are optimally dispatched.

[0021] In the second aspect, a substation defense device against power system cyber attacks includes: a reinforcement layer, a monitoring layer and a recovery layer;

[0022] The reinforcement layer is used to evaluate the network security risk of each substation and configure corresponding network security resources for high-risk substations;

[0023] The monitoring layer is used to deploy corresponding defense measures for the substation based on the network security resources to monitor network attacks, and generate a corresponding substation health index based on the monitoring results of the network attacks;

[0024] The recovery layer is used to optimize the scheduling of the generator sets of the substation based on the substation health index to avoid power outages of the power grid caused by network attacks.

[0025] In a third aspect, a computer-readable storage medium stores a program thereon, wherein the program, when executed by a processor, implements any of the above-mentioned methods for defending a substation against a network attack on a power system.

[0026] In a fourth aspect, an electronic device comprises at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other via the bus; and the processor is used to call program instructions in the memory to execute any of the above-mentioned substation defense methods against power system network attacks.

[0027] By means of the above technical scheme, the present invention provides a substation defense method and related devices for power system network attacks, which can evaluate the network security risks of each substation and configure corresponding network security resources for high-risk substations; based on the network security resources, deploy corresponding defense measures for the substation to monitor network attacks, and generate corresponding substation health indexes based on the monitoring results of network attacks; based on the substation health index, optimize the scheduling of the generator sets of the substation to avoid network attacks causing power outages in the power grid. It can be seen from this that the present invention can deeply prevent network attacks from three levels (risk assessment and configuration of network security resources, attack monitoring and generation of health indexes, and optimization of scheduling of generator sets), avoid power grid failures caused by network attacks, and have a good defense effect.

[0028] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0030] Figure 1 The present invention shows a flow chart of a substation defense method against power system network attacks;

[0031] Figure 2 The present invention provides a resiliency curve diagram of a substation network attack;

[0032] Figure 3 The present invention provides a schematic diagram of impact assessment of a substation network attack;

[0033] Figure 4 The present invention provides a schematic diagram of an optimized investment solution;

[0034] Figure 5 The present invention shows a schematic diagram of the structure of a substation defense device against power system network attacks;

[0035] Figure 6 A schematic structural diagram of an electronic device provided by the present invention is shown. DETAILED DESCRIPTION

[0036] As the power system transforms to a smart grid, the application of information and communication technology (ICT) in power infrastructure is becoming more and more widespread. Although this integration improves the efficiency and flexibility of the system, it also significantly expands the attack surface of the power system, making it face unprecedented network security challenges. In particular, substations, as key nodes in the power transmission system, their security is directly related to the stable operation of the entire power grid.

[0037] In recent years, cyber attacks on power infrastructure have occurred frequently, highlighting the urgency of power system network security. These incidents show that traditional single defense measures are no longer sufficient to cope with increasingly complex and diverse cyber threats.

[0038] In this context, the defense-in-depth strategy has gradually attracted attention due to its multi-level and multi-dimensional protection characteristics. Although with the development of technology, the development of real-time monitoring and situational awareness technology has provided new tools for the safe operation of power systems, and in terms of dispatching and control, there is also the Security Constrained Economic Dispatch (SCED) method, but it mainly considers the N-1 safety criterion and lacks a unified perspective to solve the network security problem of substations.

[0039] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0040] like Figure 1 As shown, the present invention provides a substation defense method for power system network attacks, including: S100, S200 and S300;

[0041] S100, assess the network security risk of each substation and configure corresponding network security resources for high-risk substations;

[0042] Optionally, the present invention proposes a three-layer vertical defense method for substations against power system cyber attacks, combining the triple defense strategies of reinforcement, monitoring and recovery. This method combines the network vulnerabilities and physical impacts of substations to more comprehensively assess the cyber-physical risks faced by substations, and is used to determine the optimal network security investment allocation for each substation. This helps to maximize security benefits under a limited budget, dynamically adjust power generation scheduling according to real-time network security status, and improve the overall security and reliability of the system.

[0043] Optionally, the risk assessment and configuration of security resources (or immediately: network security investment planning) of the present invention can be based on resilience drive, that is, taking into account all potential threat scenarios, and then determining the priority of corrective measures for risk management, developing accurate models and focusing on vulnerabilities and consequences at the same time.

[0044] For example, in some optional embodiments, the S100 includes: step 1.1 and step 1.2;

[0045] Step 1.1: For any substation, the following steps are performed: calculating the network security risk of the substation based on the potential threats to the substation, the possibility of the potential threats occurring, and the consequences of the potential threats occurring;

[0046] Step 1.2: According to the calculated network security risk of each substation, select the high-risk substations, and configure the corresponding network security resources for the high-risk substations.

[0047] Optionally, in some optional implementations, there is a functional relationship between the possibility of occurrence of the potential threat and the network security resources of the corresponding substation as shown in Formula 1. Formula 1: ,in, is the probability of a potential threat occurring. It is the network security resource of the corresponding substation.

[0048] Optionally, in a resilience-driven risk assessment and cybersecurity investment planning approach, a risk-based strategy is first used to apply an appropriate level of security to reduce risk without overloading the system to the point of being unusable. The risk of any asset is the product of its known vulnerabilities, perceived threats, and the consequences of removing it from the infrastructure. The risk assessment approach is shown in the following formula:

[0049] ,in, Indicates danger to the substation, Indicates the possibility of a negative event occurring. Indicates the corresponding consequences.

[0050] Optionally, due to the unpredictable and random nature of attacker activities, Threat assessment is extremely challenging. Threat assessment has a direct impact on risk analysis and management. Therefore, risk assessment must consider all potential threat scenarios before prioritizing risk management corrective actions. Given the diversity of threat sources and adversary motivations, it is challenging to develop accurate models. However, in situations where threats and adversaries are less obvious, it is critical to focus risk management on vulnerabilities (i.e., the likelihood of a negative event occurring) and consequences.

[0051] The vulnerability Described as the likelihood of a negative event occurring. In other words, it refers to any “weakness” in the infrastructure, operations, or design of a target (asset). The effectiveness of any cyber-physical system against a cyberattack depends on the adversary’s ability to identify and exploit the target’s cyber weaknesses. The general level of vulnerability of any asset or target is directly related to how the system engineers implement and manage the cybersecurity program for that target, which is directly related to the amount of money set aside for cyber defense. Therefore, by carefully investing the cyber defense budget to support investments in cybersecurity measures, the cyber vulnerability of substations can be reduced. The probability of successfully preventing an attack may be significantly reduced. Can be defined as cybersecurity investment The function is expressed as Therefore, the vulnerability of the substation is Analyzing the resilience of the system before and after the event is necessary to quantify the impact of such extreme events. The present invention measures the impact of a successful attack on a substation by estimating the drop in the resilience of the connected power system before and after the event.

[0052] Optionally, in certain optional embodiments, the consequences of the potential threat are obtained by calculating the elasticity score based on the line traffic, line capacity and total load in the corresponding stage, wherein the stages include: the stage before the network attack, the stage after the network attack and the stage after system optimization scheduling.

[0053] Optionally, the resilience score describes how the transport system responds to such disruptive events, At this moment, the resilience of the system will be increased from the resilience score before the attack to Resilience score after the drop to attack The system operator then re-dispatches generators and loads to achieve a new N-1 safety state with a resilience score of , until the system is restored to the N-1 security state before the attack. Figure 2 The resilience curve of the substation cyber attack is shown.

[0054] Optional, resilience score for each stage, i.e. pre-attack stage , N-1 unsafe phase after attack , and the N-1 security phase after the attack , by calculating the total load satisfied at each stage And the transmission line flow To quantify.

[0055]

[0056] Alternatively, the result can be obtained by calculating Area I + Area II. These areas can be estimated as follows:

[0057]

[0058]

[0059] In the above formula: is the time interval (the time interval for restoring the system to the N-1 safe state); is the resilience score before the attack, based on the initial load satisfaction and line flow ; is the resilience score of the N-1 unsafe state after the attack. Based on the load satisfaction and line flow, the above formula can minimize the overall risk. The optimization problem is subject to the following constraints:

[0060]

[0061] Optional, cybersecurity investments in substations is a function of the substation recovery time. However, the recovery time cannot be reduced below the physical time required to re-energize the substation, which is calculated only after the root cause analysis of the event (substation disconnection) is completed. Therefore, it is reasonable to assume that for substation "i", there is a constant recovery time This restoration time may vary depending on the network physical infrastructure of each substation.

[0062] S200, deploying corresponding defense measures for the substation based on the network security resources to monitor network attacks, and generating a corresponding substation health index based on the monitoring results of the network attacks;

[0063] Optionally, the intrusion monitoring and health index monitoring strategies for network attacks are as follows: a substation health index is defined to represent the real-time health status of the attacked substation, and based on the network security investment allocated to the substation, the vulnerability of the substation can be significantly reduced by deploying defense measures against network intrusions.

[0064] For example, in some optional embodiments, the S200 includes: step 2.1, step 2.2 and step 2.3;

[0065] Step 2.1: Based on the network security resources, deploy corresponding defense measures for the substation, wherein the defense measures include: intrusion monitoring system, network firewall, vulnerability scanning, traffic monitoring, behavior analysis and anomaly monitoring;

[0066] Step 2.2: Based on the defense measures, the network attack is monitored to obtain corresponding monitoring results;

[0067] Step 2.3: Based on the monitoring results, generate a corresponding substation health index.

[0068] Optionally, in the monitoring strategy of network attack intrusion monitoring and health index, depending on the network security investment allocated to the substation, the vulnerability of the substation can be significantly reduced by deploying defense measures against network intrusion. These defense measures can be intrusion monitoring systems, network firewalls, vulnerability scanning and traffic monitoring.

[0069] Optionally, the present invention may deploy behavioral analysis, anomaly monitoring methods, and other heuristic monitoring methods to monitor and prevent the spread of attacks.

[0070] Optionally, the present invention can estimate the penetration of the attack in the physical infrastructure of the substation network by monitoring the progress of the attack. The present invention can also find loopholes by implanting traps.

[0071] S300. Based on the substation health index, optimize and dispatch the generator sets of the substation to avoid power outage of the power grid caused by a network attack.

[0072] Optionally, the present invention can perceive network physical risks in real time and perform emergency analysis and scheduling, combining the safety-constrained economic scheduling problem to economically optimize power generation scheduling, while maintaining the N-1 safety standard to ensure that the failure of one component (transmission line or generator) does not affect the reliability of the interconnected power system. Network-induced substation outages may cause the disconnection of Nk transmission lines and generator sets. Unlike the N-1 formula, low-frequency, high-impact events such as substation emergencies cannot be directly incorporated into SCED constraints. However, the present invention can directly calculate the probability of a successful attack on a substation from the substation health index, that is, calculate 1-SHI.

[0073] Optionally, a substation health index (SHI) is defined as an indicator to represent the real-time health status of the attacked substation.

[0074]

[0075] Optionally, the present invention may modify the security constrained economic dispatch problem to include the probability of occurrence of substation outages.

[0076]

[0077] Optionally, when 1-SHI is “0”, the modified SCED scheme provides the same solution as the traditional N-1 security dispatch problem; however, as 1-SHI increases, the scheme imposes stricter restrictions on the constraints, thereby incorporating substation emergencies into the problem.

[0078] Optionally, the health index used in the present invention needs to be standardized to between 0 and 1, where 1 indicates that the substation is not under attack and all defense measures are in a healthy state; 0 indicates that the substation is under attack and all defense measures are destroyed.

[0079] For example, in some optional embodiments, the S300 includes: step 3.1 and step 3.2;

[0080] Step 3.1, based on the substation health index, determining the line flow limit of the substation and the power configuration constraint of the substation, wherein the line flow limit refers to the flow limit through the substation line when the substation is in a power outage, and the power configuration constraint refers to the power that other substations in the power grid redistribute to maintain power supply when the substation is in a power outage;

[0081] Step 3.2: Based on the line flow restriction and power configuration constraint, optimize the dispatching of the generator sets of the substation.

[0082] Alternatively, the goal of the security constrained economic dispatch problem is to optimize generation dispatch economically while ensuring the N-1 security criterion of the power grid. The N-1 security criterion ensures that the failure of a single component (transmission line or generator) does not affect the reliability of the interconnected power system. However, network-induced substation outages may result in the disconnection of Nk transmission lines and generators. Unlike the N-1 formulation, the unexpected situation of the substation, as a low-frequency and high-impact event, cannot be directly incorporated into the constraints of the SCED. However, the probability of a successful attack on a substation can be directly calculated from the Substation Health Index (SHI), expressed as (1-SHI i ). Therefore, the security constrained economic dispatch problem can be modified to include the probabilistic event of substation outages.

[0083]

[0084] The constraints of the above formula are:

[0085]

[0086] At the same time, in the above formula, in order to add the substation outage constraint based on the substation health index (SHI) and the physical impact of the disconnection of substation "k", we need to add some additional constraints based on the traditional N-1 compatible SCED constraints. These new constraints will be adjusted and specified for possible substation outages. Substation outage probability constraint: For each bus located at substation "k", a probability constraint is introduced to simulate the situation where a substation outage occurs. The present invention can use (1- ) as the probability of power outage at substation "k", and adjust the power supply and demand plans of the relevant buses accordingly. Power reconfiguration constraint: In the event of a possible power outage at substation "k", it must be ensured that the rest of the grid can safely reconfigure the required power to maintain power supply. This may involve adjusting the output of other substations or activating backup power supply schemes. Emergency line flow restrictions: A power outage at substation "k" may cause overload of transmission lines passing through the station. Therefore, additional flow restrictions need to be imposed on these lines to ensure that their safe operating limits are not exceeded in the event of a power outage. Reserve capacity requirements: Increase the requirements for reserve capacity to ensure that the system has sufficient reserve generation capacity to compensate for the lost power supply when substation "k" is disconnected, as shown in the following equation:

[0087]

[0088]

[0089] Optionally, in order to further clearly illustrate the solution of the present invention, the present invention provides the following simulation embodiment, and the simulation process is as follows:

[0090] Step 1: Use the case file of the standard case "Case 14" of MATPOWER, set the power flow limit of the first 5 transmission lines to 80MW and the rest to 60MW, and use MATLAB 2019a and GAMS for simulation.

[0091] Step 2: Map each bus to a substation, simulate individual failures at each substation, calculate resilience scores for the three phases, assume a total system load of 259 MW, calculate the impact of each substation failure, solve the optimization problem, obtain the optimized cybersecurity investment for critical or high-risk substations, and calculate the overall risk before and after the investment.

[0092] Step 3: Introduce the concept of substation health index (SHI) and simulate the changes in network security status of substations 1 to 5 by changing vk (i.e., 1-SHI), observe the impact of vk changes on generator scheduling, and verify the performance of the defense-in-depth framework against network-induced substation failures.

[0093] In the risk assessment phase, the proposed strategy is used to simulate the case and simulate the power outage of each substation one by one to calculate the resilience scores of all three stages. The total load of the system (base case) is assumed to be 259MW, which is used to calculate the resilience scores before and after the power outage. When calculating the resilience of each stage, γ, and They are equal to 6, 0.5, and 0.183 respectively. Before the attack (Phase 1), the system is in the N-1 security state, and the resilience score (R1) calculated according to the formula is defined as the baseline resilience score. After the attack, the R2 and R3 scores are displayed in units relative to the baseline resilience score R1. For example, Figure 3 The outage score for each substation is shown. It is worth noting that for Figure 3 For some substations in the 3rd stage, the total load is less than that of the 2nd stage. This is because in order to make the reduced system meet the N-1 standard, a certain amount of load reduction is required to meet the N-1 system constraint.

[0094] Optionally, once the resilience score is calculated, an optimization problem is solved to obtain an optimized cybersecurity investment for critical or high-risk substations. Each substation can have a cybersecurity budget of up to 100 units to ensure a 99% probability of successfully preventing a cyberattack. However, the security budget for ten substations is limited to 600 units. Figure 4The optimized investment for all substations is shown. It is worth noting that since the outage impact of substations 1 to 5 is significantly greater than that of other substations, the largest budget is allocated to these substations. It shows that the overall risk is reduced from 0.1303 before investment to 1.989×10 after investment. -3 (i.e., 10 to the power of -3). It should be noted that if Figure 4 The optimized investment plan is shown: the budget limit is 600.

[0095] In the risk perception phase, after taking appropriate cybersecurity practices and measures for each substation, the cyber-physical assets of the substation are monitored and controlled in real time, and real-time cyber-physical emergency analysis and sorting are achieved through the substation health index of each substation. SHI can be transmitted to the control center through a secure communication protocol for emergency sorting. The present invention does not involve the actual mathematical quantification of SHI; however, it can be changed from "1" to "0" to visualize how to include substation emergencies in real-time SCED problems. For example, the present invention tests 14 nodes (numbered from 1 to 14), the system contains 5 generators (G1 to G5), and there are 11 loads in the system (indicated by arrows). When changing vk, that is, the impact of (1-SHI) of substation "k" (substation 1 to substation 5) on the generator scheduling plan. As vk approaches "1", the SCED problem gradually unloads the generator connected to substation "k", while other generators take over the load as expected. The results verify the performance of the defense-in-depth framework against network-induced substation outages.

[0096] Optionally, the present invention can protect the most undervalued asset, the substation, and strengthen the transmission system from the negative impact of network interruptions. The substation is the most important component of the power system, enabling communication between the actual part and the control center. However, from a security perspective, the substation is also the most overlooked asset of the power physical information system. In order to accurately predict the status of network security vulnerabilities and promote real-time network physical emergency analysis, the present invention also emphasizes the importance of real-time network health monitoring of network physical assets within the substation. The present invention can be further explored to develop a mechanism to mathematically quantify the network health status of different assets.

[0097] like Figure 5 As shown, the present invention provides a substation defense device for power system network attacks, including: a reinforcement layer 100, a monitoring layer 200 and a recovery layer 300;

[0098] The reinforcement layer 100 is used to evaluate the network security risk of each substation and configure corresponding network security resources for high-risk substations;

[0099] The monitoring layer 200 is used to deploy corresponding defense measures for the substation based on the network security resources to monitor network attacks, and generate a corresponding substation health index based on the monitoring results of the network attacks;

[0100] The recovery layer 300 is used to optimize the scheduling of the generator sets of the substation based on the substation health index to avoid power outages of the power grid caused by network attacks.

[0101] Optionally, in some optional embodiments, the reinforcement layer 100 includes: a risk calculation unit and a resource allocation unit;

[0102] The method is used to perform, for any substation, the following steps: calculating the network security risk of the substation based on potential threats to the substation, the possibility of occurrence of the potential threats, and the consequences of occurrence of the potential threats;

[0103] The method is used to obtain the network security risk of each substation according to the calculation, screen out the substations with high risks, and configure corresponding network security resources for the substations with high risks.

[0104] Optionally, in some optional implementations, there is a functional relationship between the possibility of occurrence of the potential threat and the network security resources of the corresponding substation as shown in Formula 1, Formula 1: ,in, is the probability of a potential threat occurring. It is the network security resource of the corresponding substation.

[0105] Optionally, in some optional implementations, the monitoring layer 200 includes: a defense deployment unit, an attack monitoring unit, and a result generation unit;

[0106] The defense deployment unit is used to deploy corresponding defense measures for the substation based on the network security resources, wherein the defense measures include: intrusion monitoring system, network firewall, vulnerability scanning, traffic monitoring, behavior analysis and anomaly monitoring;

[0107] The attack monitoring unit is used to monitor the network attack based on the defense measures and obtain corresponding monitoring results;

[0108] The result generating unit is used to generate a corresponding substation health index based on the monitoring result.

[0109] Optionally, in some optional implementations, the recovery layer 300 includes: a restriction determination unit and an optimization scheduling unit;

[0110] The restriction determination unit is used to determine the line flow limit of the substation and the power configuration constraint of the substation based on the substation health index, wherein the line flow limit refers to the flow limit through the substation line when the substation is in a power outage, and the power configuration constraint refers to the power that other substations in the power grid reallocate to maintain power supply when the substation is in a power outage;

[0111] The optimization scheduling unit is used to optimize the scheduling of the generator sets of the substation based on the line flow limit and power configuration constraint.

[0112] The present invention provides a computer-readable storage medium having a program stored thereon, wherein when the program is executed by a processor, the substation defense method against power system network attacks described in any one of the above items is implemented.

[0113] like Figure 6 As shown, the present invention provides an electronic device 70, which includes at least one processor 701, and at least one memory 702 and a bus 703 connected to the processor 701; wherein the processor 701 and the memory 702 communicate with each other through the bus 703; the processor 701 is used to call the program instructions in the memory 702 to execute any of the above-mentioned substation defense methods for power system network attacks.

[0114] In the present invention, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0115] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0116] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined in the present invention may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown in the present invention, but will conform to the widest scope consistent with the principles and novel features disclosed in the present invention.

[0117] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A substation defense method for power system network attacks, characterized in that: include: Assess the cybersecurity risks of each substation and configure corresponding cybersecurity resources for high-risk substations; Based on the network security resources, deploy corresponding defense measures for the substation to monitor network attacks, and generate a corresponding substation health index based on the monitoring results of the network attacks; Based on the substation health index, the generator sets of the substation are optimally dispatched to avoid power outages of the power grid caused by cyber attacks.

2. The method according to claim 1, characterized in that The network security risk of each substation is assessed, and corresponding network security resources are configured for high-risk substations, including: For any substation, the following steps are performed: calculating the cybersecurity risk of the substation based on potential threats to the substation, the likelihood of occurrence of the potential threats, and the consequences of the occurrence of the potential threats; Based on the calculated network security risks of each substation, high-risk substations are screened out, and corresponding network security resources are configured for high-risk substations.

3. The method according to claim 2, characterized in that There is a functional relationship between the possibility of occurrence of the potential threat and the network security resources of the corresponding substation as shown in Formula 1, Formula 1: ,in, is the probability of a potential threat occurring. It is the network security resource of the corresponding substation.

4. The method according to claim 2, characterized in that: The consequences caused by the occurrence of the potential threat are obtained by calculating the elasticity score based on the line traffic, line capacity and total load in the corresponding stage, wherein the stages include: the stage before the network attack, the stage after the network attack and the stage after system optimization and scheduling.

5. The method according to claim 1, characterized in that: The deploying corresponding defense measures on the substation based on the network security resources to monitor network attacks, and generating corresponding substation health index based on the monitoring results of network attacks, includes: Based on the network security resources, deploy corresponding defense measures for the substation, wherein the defense measures include: intrusion monitoring system, network firewall, vulnerability scanning, traffic monitoring, behavior analysis and anomaly monitoring; Based on the defense measures, network attacks are monitored to obtain corresponding monitoring results; Based on the monitoring results, a corresponding substation health index is generated.

6. The method according to claim 1, characterized in that The optimizing and dispatching of the generator sets of the substation based on the substation health index to avoid power outage of the power grid caused by a cyber attack includes: Based on the substation health index, determine the line flow limit of the substation and the power configuration constraint of the substation, wherein the line flow limit refers to the flow limit through the substation line when the substation is in a power outage, and the power configuration constraint refers to the power that other substations in the power grid reallocate to maintain power supply when the substation is in a power outage; Based on the line flow restriction and power configuration constraint, the generator sets of the substation are optimally dispatched.

7. A substation defense device for power system network attacks, characterized in that: include: reinforcement layer, monitoring layer and restoration layer; The reinforcement layer is used to evaluate the network security risk of each substation and configure corresponding network security resources for high-risk substations; The monitoring layer is used to deploy corresponding defense measures for the substation based on the network security resources to monitor network attacks, and generate a corresponding substation health index based on the monitoring results of the network attacks; The recovery layer is used to optimize the scheduling of the generator sets of the substation based on the substation health index to avoid power outages of the power grid caused by network attacks.

8. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, the substation defense method against power system network attacks as described in any one of claims 1 to 6 is implemented.

9. An electronic device, characterized in that: The electronic device includes at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other through the bus; the processor is used to call program instructions in the memory to execute the substation defense method against power system network attacks as described in any one of claims 1 to 6.

Images