Network security detection method and system in operation and maintenance process of virtual power plant

Abstract

The invention relates to the technical field of network security detection, in particular to a network security detection method and system in the operation and maintenance process of a virtual power plant, and the method comprises the steps: collecting the network flow data of an electric power Internet of Things where the virtual power plant is located; according to the distribution characteristics of the source IP address and the destination IP address of the power Internet of Things where the virtual power plant is located in different network environments, constructing an IP anomaly coefficient; the time distribution difference between the abnormal IP address mode changes is combined to construct the abnormal traffic confidence; and extracting multi-dimensional statistical feature data of all data streams in the pcap format file, obtaining and correcting an abnormal score of each data stream, and detecting the network security in the operation and maintenance process of the virtual power plant according to a corrected value of the abnormal score. The invention aims to consider the mode change of the IP address between the network traffic data in the power Internet of Things where the virtual power plant is located, and improve the accuracy of the network security detection result.

Description

Technical Field

[0001] The present application relates to the field of network security detection technology, and specifically to a network security detection method and system during the operation and maintenance of a virtual power plant. Background Art

[0002] A virtual power plant is a system based on the Internet of Things that integrates and collaboratively manages dispersed power resources in the power grid (such as distributed power sources, energy storage equipment, controllable loads, etc.) to form a unified and controllable power energy management system. As an advanced form of the power Internet of Things, network security detection during the operation and maintenance of virtual power plants is part of the security management of the power Internet of Things. Network security detection is crucial to ensure the stable operation of virtual power plants. Network traffic anomaly detection is part of the network security detection of virtual power plants. It helps to promptly detect and respond to potential network attacks or system failures, so as to take corresponding security measures to ensure the safe operation of the power Internet of Things where the virtual power plant is located.

[0003] The traditional method of detecting anomalies in network traffic usually extracts multidimensional statistical feature data of network traffic data and uses anomaly data detection algorithms, such as the local outlier factor algorithm, to identify abnormal network traffic data. However, this method only considers the numerical distribution characteristics of the multidimensional statistical feature data of network traffic data, but does not consider the pattern changes of IP addresses between network traffic data. This will cause the network traffic anomaly detection method to be unable to distinguish between occasional fluctuations in normal network traffic and abnormal traffic generated by malicious traffic attacks, thereby increasing the risk of underreporting and false alarms of abnormal network traffic, resulting in the inability to accurately detect and respond to potential network attacks or system failures during the operation and maintenance of virtual power plants, and unable to achieve effective security management of the power Internet of Things where virtual power plants are located. Summary of the invention

[0004] In view of the above, it is necessary to provide a network security detection method and system during the operation and maintenance of a virtual power plant to solve the above problems.

[0005] The first aspect of the present application provides a network security detection method during the operation and maintenance of a virtual power plant, the method comprising:

[0006] Use a packet capture tool to obtain the flow data packets of the virtual power plant and save them as pcap format files; use the pcap format files of each detection moment and a preset number of detection moments as pcap format files AT; extract the timestamp and five-tuple information of each data packet in the pcap format file AT, use the five-tuple as a key to divide the data packets to obtain each data stream; wherein the five-tuple information includes at least the source IP address and the destination IP address;

[0007] In the pcap format file, according to the distribution characteristics of the destination IP addresses and source IP addresses of all data flows, the IP anomaly coefficient of each data flow is obtained; the time period corresponding to the pcap format file AT is evenly divided into a preset number of timestamp intervals; according to the distribution of the source IP addresses and destination IP addresses of the data packets of each data flow in the pcap format file AT in any timestamp interval, the local IP anomaly coefficient of each data flow in the said any timestamp interval is obtained; based on the IP anomaly coefficient of each data flow and the local IP anomaly coefficient in all timestamp intervals, the abnormal traffic confidence of each data flow is obtained;

[0008] The multi-dimensional statistical feature data of each data flow in the pcap format file AT is extracted, and the anomaly score of each data flow is obtained by combining the anomaly detection algorithm; the anomaly score is corrected in combination with the abnormal traffic confidence of each data flow; and network security detection is performed on all data flows in the pcap format file AT based on the corrected value of the anomaly score.

[0009] The IP anomaly coefficient of each data stream is obtained as follows:

[0010] In the pcap format file AT, the source IP characteristic value of each data stream is obtained according to the distribution uniformity of the source IP addresses of all data streams having the same destination IP address as each data stream;

[0011] According to the distribution uniformity of the destination IP addresses of all data flows having the same source IP address as each data flow, a destination IP characteristic value of each data flow is obtained;

[0012] The ratio of the source IP characteristic value to the destination IP characteristic value of each data flow is used as the IP anomaly coefficient of each data flow.

[0013] The source IP characteristic value of each data stream is obtained as follows:

[0014] In the pcap format file AT, the set consisting of all data flows having the same destination IP address as each data flow is recorded as the first data flow set; the information entropy of the source IP addresses of all data flows in the first data flow set is used as the source IP characteristic value of each data flow.

[0015] The destination IP characteristic value of each data stream is obtained as follows:

[0016] In the pcap format file AT, the set consisting of all data flows having the same source IP address as each data flow is recorded as the second data flow set; the information entropy of the destination IP addresses of all data flows in the second data flow set is used as the destination IP characteristic value of each data flow.

[0017] The method of obtaining the local IP anomaly coefficient of each data stream in any timestamp interval is specifically:

[0018] A set consisting of all data packets of each data flow in any timestamp interval is used as a local data flow of each data flow in any timestamp interval;

[0019] The data packets of all local data flows of all data flows in the pcap format file in any timestamp interval form a data packet set of the said any timestamp interval;

[0020] The same calculation method as that of the IP anomaly coefficient is adopted to obtain the local IP anomaly coefficient of each data flow in any timestamp interval based on the local data flow and the data packet set.

[0021] The abnormal traffic confidence of each data flow is obtained as follows:

[0022] Obtain the negative correlation mapping result of the discrete degree of the local IP anomaly coefficient of each data flow in all time stamp intervals, and use the fusion result of the negative correlation mapping result and the IP anomaly coefficient of each data flow as the abnormal traffic confidence of each data flow.

[0023] The abnormality score of each data stream is obtained as follows:

[0024] After the multidimensional statistical feature data extracted from each data stream is normalized, it is mapped into data points in the multidimensional space. All data points are used as input of the anomaly detection algorithm to obtain the anomaly score of each data stream.

[0025] The correction of the abnormal score is specifically: taking the product of the abnormal score of each data flow and the abnormal flow confidence as the correction value of the abnormal score of each data flow.

[0026] The network security detection of all data streams in the pcap format file AT is specifically as follows:

[0027] The correction values ​​of the abnormality scores of all data flows in the pcap format file AT are used to obtain a segmentation threshold using a threshold segmentation algorithm; all data flows whose correction values ​​of the abnormality scores are greater than the segmentation threshold are screened out;

[0028] When the ratio of the number of data packets in all filtered data streams to the number of all data packets in the pcap format file AT is greater than or equal to a preset threshold, it is determined that there is a network security problem in the destination IP addresses of all data streams; otherwise, it is determined that there is no network security problem.

[0029] In the second aspect, an embodiment of the present application also provides a network security detection system for the operation and maintenance of a virtual power plant, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements the steps of any one of the above methods when executing the computer program.

[0030] This application has at least the following beneficial effects:

[0031] In the above scheme, a packet capture tool is used to obtain the flow data packet of the virtual power plant and save it as a pcap format file. Then, the pcap format file is intercepted, and the source IP address and destination IP address of the data packet of the intercepted pcap format file are obtained, which is helpful for subsequent judgment of the network status according to the distribution characteristics of the source IP address and the destination IP address; according to the distribution characteristics of the destination IP address and the source IP address of all data flows, the IP anomaly coefficient of each data flow is obtained, which has the beneficial effect of being able to effectively detect abnormal traffic, and quantify the distribution characteristics of the source IP address and the destination IP address in the network traffic generated by the power Internet of Things where the virtual power plant is located under normal circumstances and the abnormal network traffic generated when it is attacked by DDoS; according to the distribution of the source IP address and the destination IP address of the data packet of each data flow in the pcap format file AT in any timestamp interval, the local IP address of each data flow in the said any timestamp interval is obtained. P anomaly coefficient, its beneficial effect is to analyze the time distribution difference between the IP address pattern change of normal network traffic and the abnormal IP address pattern change of abnormal network traffic generated when it is attacked by network; construct abnormal traffic confidence, its beneficial effect is to improve the distinction between normal data flow and abnormal data flow generated by DDoS attack in the intercepted pcap format file; extract multi-dimensional statistical feature data of each data flow in the pcap format file AT, combine with the anomaly detection algorithm, obtain the anomaly score of each data flow and make corrections, its beneficial effect is to consider the pattern change of IP address between network traffic data in the power Internet of Things where the virtual power plant is located, improve the detection accuracy of the anomaly detection method for abnormal network traffic generated by the power Internet of Things where the virtual power plant is located when it is attacked by network, reduce the risk of underreporting and false alarm of abnormal network traffic, and thus better realize the network security management of the power Internet of Things where the virtual power plant is located. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A flowchart of the steps of a network security detection method in the operation and maintenance process of a virtual power plant provided by an embodiment of the present application;

[0033] Figure 2 A flowchart for obtaining abnormal traffic confidence is provided for one embodiment of the present application. DETAILED DESCRIPTION

[0034] In the description of the embodiments of the present application, words such as "exemplary", "or", "for example" and the like are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "or", "for example" and the like is intended to present related concepts in a concrete manner.

[0035] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art in the present application. The terms used in the specification of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application.

[0036] It should also be noted that the terms "first" and "second" in this application and the accompanying drawings are used to distinguish similar objects, rather than to describe a specific order or sequence. The method disclosed in the embodiments of the present application or the method shown in the flow chart includes one or more steps for implementing the method. Without departing from the scope of protection of the present application, the execution order of multiple steps can be interchanged with each other, and some steps can also be deleted.

[0037] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

[0038] The following is a detailed description of a specific scheme of a network security detection method and system in the operation and maintenance process of a virtual power plant provided by the present application in conjunction with the accompanying drawings.

[0039] See also Figure 1 , which shows a flowchart of a method for network security detection in a virtual power plant operation and maintenance process provided by an embodiment of the present application, the method comprising the following steps:

[0040] The first step: use the packet capture tool to obtain the flow data packets of the virtual power plant and save them as pcap format files; use the pcap format files of each detection moment and the previously preset number of detection moments as pcap format files AT; extract the timestamp and five-tuple information of each data packet in the pcap format file AT, use the five-tuple as the key to divide the data packets to obtain each data stream.

[0041] By deploying the Wireshark packet capture tool on all network devices or network nodes of the power Internet of Things where the virtual power plant is located, the Wireshark packet capture tool is used to capture the passing traffic data packets, and the captured traffic data packets are saved as pcap format files to complete the collection of network traffic data of the power Internet of Things where the virtual power plant is located.

[0042] When conducting network security testing on the virtual power plant, taking the Tth detection moment as an example, in the pcap format file, extract the time period of 10 minutes starting from the Tth detection moment and generate a new pcap format file, recorded as pcap format file AT, where the length of the time period can be set by the implementer.

[0043] The Wireshark packet capture tool is used to extract the timestamp and five-tuple information of each data packet in the pcap format file AT. The five-tuple information is the source IP address, destination IP address, source IP port, destination IP port, and protocol type of the data packet.

[0044] The data packets in the pcap format file AT are divided according to the five-tuple information of the data packets, and the data packets in the pcap format file AT are classified into corresponding data flows. Each data flow represents a specific communication session, which contains all data exchanges between two endpoints using a specific protocol and port within a period of time, and all data flows of the pcap format file AT are obtained. It should be noted that all data packets in the same data flow have the same source IP address and destination IP address.

[0045] The second step: in the pcap format file, according to the distribution characteristics of the destination IP addresses and source IP addresses of all data flows, the IP anomaly coefficient of each data flow is obtained; the time period corresponding to the pcap format file AT is evenly divided into a preset number of timestamp intervals; according to the distribution of the source IP addresses and destination IP addresses of the data packets of each data flow in the pcap format file AT in any timestamp interval, the local IP anomaly coefficient of each data flow in the said any timestamp interval is obtained; based on the IP anomaly coefficient of each data flow and the local IP anomaly coefficient in all timestamp intervals, the abnormal traffic confidence of each data flow is obtained.

[0046] Under normal circumstances, the devices and systems in the power Internet of Things are usually designed to perform specific monitoring and control tasks, and each device may initiate communication at any time, which means that the source IP addresses in the network traffic of the power Internet of Things where the virtual power plant is located tend to be randomly distributed. At the same time, these network traffic will be evenly distributed to different devices and services according to the business needs of the virtual power plant, and will not be concentrated on a few destination IP addresses. However, when the power Internet of Things where the virtual power plant is located is attacked by a distributed denial of service (DDoS), since DDoS attacks usually use a large number of controlled hosts (botnets) or IP forgery technology to send massive traffic from a large number of source IP addresses to a small number of destination IP addresses, in this case, the abnormal network traffic generated by the DDoS attack will have a relatively uniform distribution of source IP addresses, while the number of destination IP addresses is small and concentrated, thereby forming an abnormal IP address pattern change. In the security management process of the power Internet of Things where the virtual power plant is located, in order to timely and accurately discover and respond to potential DDoS network attacks in the power Internet of Things, the following processing is performed.

[0047] Specifically, taking the i-th data stream AT(i) of the pcap format file AT as an example, all data streams with the same destination IP address as the data stream AT(i) are obtained from all data streams of the pcap format file AT to form a first data stream set B1(i); all data streams with the same source IP address as the data stream AT(i) are obtained to form a second data stream set B2(i).

[0048] The source IP address of each data stream in the first data stream set B1(i) is taken as an event, and the ratio of the number of data packets in the data stream where the source IP address is located to the number of all data packets of all data streams in the first data stream set B1(i) is taken as the probability of occurrence of the event corresponding to the source IP address of each data stream. The first information entropy H1(i) of the source IP address of the data stream in the first data stream set B1(i) is calculated according to the probability of occurrence of the event. The calculation of the information entropy is a well-known technology and the specific process is not repeated here. The obtained first information entropy is taken as the source IP characteristic value P1(i) of the data stream AT(i), which is used to characterize the relative uniformity of the distribution of the source IP addresses in all data packets with the same destination IP address as the data stream AT(i) in all data packets of the pcap format file AT. The larger the first information entropy, the greater the relative uniformity, that is, the larger the source IP characteristic value P1(i).

[0049] The same method as the first information entropy H1(i) is used to calculate the second information entropy H2(i) of the destination IP address of the data flow in the second data flow set B2(i). The second information entropy H2(i) is obtained by replacing the first data flow set B1(i) and the source IP address with the second data flow set B2(i) and the destination IP address respectively. It is recorded as the destination IP characteristic value P2(i) of the data flow AT(i), which is used to characterize the relative uniformity of the distribution of the destination IP addresses in all data packets with the same source IP address as the data flow AT(i) in all data packets of the pcap format file AT. The larger the information entropy, the greater the relative uniformity, that is, the larger the destination IP characteristic value P2(i).

[0050] Furthermore, the IP anomaly coefficient P(i) of the data stream AT(i) is calculated to characterize the IP address pattern changes of the source IP address and the destination IP address corresponding to the data packets in the data stream AT(i) in all the data packets in the pcap format file AT, and the possibility of abnormal IP address pattern changes caused by abnormal network traffic generated by DDoS attacks. The formula is: Wherein, P1(i) and P2(i) represent the source IP characteristic value and destination IP characteristic value of the data flow AT(i) respectively; α represents a preset constant greater than zero. In order to prevent the denominator from being 0, α is taken as 0.01. The implementer can adjust it according to the actual situation.

[0051] It should be understood that, among all the data packets in the pcap format file AT, the more uniform the distribution of the source IP addresses in all the data packets with the same destination IP address as the data stream AT(i), that is, the larger P1(i), and the more concentrated the distribution of the destination IP addresses in all the data packets with the same source IP address as the data stream AT(i), that is, the smaller P2(i), then the IP address pattern changes of the source IP addresses and destination IP addresses corresponding to the data packets in the data stream AT(i) in all the data packets in the pcap format file AT are more likely to have the same IP address pattern changes as the abnormal network traffic generated by the DDoS attack, that is, the larger the IP anomaly coefficient P(i).

[0052] When the power Internet of Things where the virtual power grid is located suffers a DDoS attack, it usually lasts for a period of time to ensure the effectiveness of the attack, which makes the abnormal IP address pattern changes caused by the DDoS attack last for a long time. Under normal circumstances, the network traffic in the power Internet of Things where the virtual power plant is located usually does not have such continuous abnormal pattern changes.

[0053] Get the minimum timestamp and maximum timestamp of the data packet in the pcap format file AT, and divide the interval formed by the minimum timestamp and the maximum timestamp into K timestamp intervals, where K is 100 and can be set by the implementer.

[0054] Taking the jth timestamp interval Q(j) as an example, and taking the data stream AT(i) as an example, the set consisting of all data packets whose timestamps in the data stream AT(i) belong to the timestamp interval Q(j) is recorded as the local data stream AT(i,j) of the data stream AT(i) in the timestamp interval Q(j), which is used to characterize the communication session formed by the partial data packets of the data stream AT(i) in the time period of the timestamp interval Q(j). And obtain the data packet set AT[j] consisting of all data packets in all local data streams of all data streams of the pcap format file AT in the timestamp interval Q(j), which is used to characterize the communication session formed by the partial data packets corresponding to all data packets in the pcap format file AT in the time period of the timestamp interval Q(j).

[0055] The same calculation method as the IP anomaly coefficient P(i) is used to obtain the local IP anomaly coefficient P(i,j) of the local data stream AT(i,j), which is used to characterize the IP address pattern changes of the source IP addresses and destination IP addresses corresponding to the data packets in the local data stream AT(i,j) in all data packets of the pcap format file AT during the time period of the timestamp interval Q(j), and the possibility of abnormal IP address pattern changes caused by abnormal network traffic generated by DDoS attacks. It is only necessary to replace the pcap format file AT and the data stream AT(i) with the data packet set AT[j] and the local data stream AT(i,j) respectively.

[0056] Calculate the local IP anomaly coefficient of the local data flow of the data flow AT(i) in each timestamp interval; according to the degree of dispersion of the local IP anomaly coefficient of the data flow AT(i) in all timestamp intervals, combined with the IP anomaly coefficient of the data flow AT(i), obtain the abnormal traffic confidence D(i) of the data flow AT(i), which is used to characterize the possibility that the data flow AT(i) is an abnormal network traffic generated by a DDoS attack. In this embodiment, the standard deviation is used to measure the degree of dispersion between the data, that is: Wherein, P(i) represents the IP anomaly coefficient of data stream AT(i); ΔP(i) represents the standard deviation of the local IP anomaly coefficient of data stream AT(i) in all time stamp intervals; α represents a constant greater than zero, and in order to prevent the denominator from being 0, α is taken as 0.01; norm() is the Min-Max normalization function. In some other embodiments, the interquartile range can be used to measure the degree of dispersion between data; in some other embodiments, the standard deviation can be replaced by the variance.

[0057] Among them, the flow chart for obtaining the confidence of abnormal traffic is as follows: Figure 2 shown.

[0058] The greater the possibility that the IP address pattern change of the source IP address and the destination IP address corresponding to the data packets in the data stream AT(i) in all the data packets in the pcap format file AT is an abnormal IP address pattern change formed by abnormal network traffic generated by a DDoS attack, that is, the larger P(i) is, and the higher the consistency of the IP address pattern change of the source IP address and the destination IP address corresponding to the data packets in the data stream AT(i) in all the data packets in the pcap format file AT in each timestamp interval, that is, the smaller ΔP(i), the longer the abnormal IP address pattern change of the data packets in the data stream AT(i) lasts, the more likely that the data stream AT(i) is abnormal network traffic generated by a DDoS attack, that is, the larger the abnormal traffic confidence D(i) is.

[0059] The third step: extract the multi-dimensional statistical feature data of each data flow in the pcap format file AT, and combine it with the anomaly detection algorithm to obtain the anomaly score of each data flow; correct the anomaly score based on the abnormal traffic confidence of each data flow; and perform network security detection on all data flows in the pcap format file AT based on the corrected value of the anomaly score.

[0060] The multi-dimensional statistical feature data of each data stream of the pcap format file AT are extracted respectively. In the present embodiment, the multi-dimensional statistical feature data include the connection time, outgoing flow size, outgoing flow peak value, outgoing flow mean value, outgoing packet size, outgoing packet peak value, outgoing packet mean value, incoming flow size, ingoing flow peak value, ingoing flow mean value, incoming packet size, incoming packet peak value, and incoming packet mean value of the data stream; the implementation can choose by itself, wherein the extraction of the multi-dimensional statistical feature data is a well-known technology, and the specific process will not be repeated here.

[0061] The Min-Max normalization method is used to normalize each type of multidimensional statistical feature data of each data stream of the pcap format file AT respectively to eliminate the influence of the data dimension, and the normalized multidimensional statistical feature data of all data streams of the pcap format file AT are mapped in the multidimensional space, wherein each type of statistical feature data in the multidimensional statistical feature data is used as a dimension in the multidimensional space, and the mapped data points in the multidimensional space are used as the input of the Local Outlier Factor (LOF) algorithm, each data point in the multidimensional space corresponds to a data stream in the pcap format file AT, and the abnormality score of each data point in the multidimensional space is output respectively, so as to obtain the abnormality score of each data stream corresponding to each data point in the multidimensional space in the pcap format file AT, wherein the Min-Max normalization method and the LOF algorithm are well-known technologies, and the specific process will not be repeated here.

[0062] The product of the normalized result of the abnormal score of each data flow in the pcap format file AT and the abnormal traffic confidence of each data flow is used as the correction value of the abnormal score of each data flow, wherein the normalization adopts the Min-Max normalization method. The greater the abnormal traffic confidence of the data flow, the more likely the data flow is abnormal network traffic generated by DDoS attacks. In order to improve the detection accuracy of abnormal network traffic generated by DDoS attacks in the security management process of the power Internet of Things where the virtual power plant is located, the correction value of the abnormal score of the data flow should be larger.

[0063] The corrected value of the anomaly score of all data streams in the pcap format file AT is used as the input of the maximum inter-class variance algorithm, and the segmentation threshold L is output. All data streams whose corrected value of the anomaly score is greater than the segmentation threshold L are screened out. The ratio of the number of all data packets in all screened data streams to the number of all data packets in the pcap format file AT is calculated. If the ratio is greater than the ratio threshold, the ratio threshold in this embodiment is 0.3, which can be set by the implementer. Then, the target IP address of all screened data streams is marked, and an alarm is issued using the communication module to remind the operation and maintenance personnel of the virtual power plant to perform network security maintenance. The maximum inter-class variance algorithm is a well-known technology, and the specific process will not be repeated. The network security detection during the operation and maintenance of the virtual power plant is completed.

[0064] Based on the same inventive concept as the above method, an embodiment of the present application also provides a network security detection system during the operation and maintenance of a virtual power plant, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the steps of any one of the above-mentioned network security detection methods during the operation and maintenance of a virtual power plant.

[0065] In summary, the embodiment of the present application uses a packet capture tool to obtain the flow data packet of the virtual power plant, saves it as a pcap format file, then intercepts the pcap format file, and obtains the source IP address and destination IP address of the data packet of the intercepted pcap format file, which is helpful for subsequent judgment of the network status according to the distribution characteristics of the source IP address and the destination IP address; according to the distribution characteristics of the destination IP address and the source IP address of all data flows, the IP anomaly coefficient of each data flow is obtained, which has the beneficial effect of being able to effectively detect abnormal traffic, and quantify the distribution characteristics of the source IP address and the destination IP address in the network traffic generated by the power Internet of Things where the virtual power plant is located under normal circumstances and the abnormal network traffic generated when it is attacked by DDoS; according to the distribution of the source IP address and the destination IP address of the data packet of each data flow in the pcap format file AT in any timestamp interval, the local anomaly coefficient of each data flow in the said any timestamp interval is obtained. The IP anomaly coefficient is beneficial in that it analyzes the time distribution difference between the IP address pattern changes of normal network traffic and the abnormal IP address pattern changes of abnormal network traffic generated when it is attacked by a network; the abnormal traffic confidence is constructed, which has the beneficial effect of improving the distinction between the normal data flow in the intercepted pcap format file and the abnormal data flow generated by the DDoS attack; the multi-dimensional statistical feature data of each data flow in the pcap format file AT is extracted, and the anomaly score of each data flow is obtained and corrected in combination with the anomaly detection algorithm, which has the beneficial effect of considering the pattern changes of IP addresses between the network traffic data in the power Internet of Things where the virtual power plant is located, improving the detection accuracy of the anomaly detection method for the abnormal network traffic generated by the power Internet of Things where the virtual power plant is located when it is attacked by a network, reducing the risk of underreporting and false alarm of abnormal network traffic, and thus better realizing the network security management of the power Internet of Things where the virtual power plant is located.

[0066] The flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to the embodiment of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two continuous boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. In the description corresponding to the flowchart and the block diagram in the accompanying drawings, the operations or steps corresponding to different boxes can also occur in a different order from the order disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two continuous operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or may be implemented by a combination of dedicated hardware and computer instructions.

[0067] For those skilled in the art, it is obvious that the present application is not limited to the details of the above exemplary embodiments, and the present application can be implemented in other specific forms without departing from the basic features of the present application. Therefore, no matter from which point of view, the above embodiments of the present application should be regarded as exemplary and non-restrictive; the technical solutions recorded in the above embodiments are modified, or some of the technical features are replaced by equivalents, which does not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A network security detection method in the operation and maintenance process of a virtual power plant, characterized in that: The method comprises the following steps: Use a packet capture tool to obtain the flow data packets of the virtual power plant and save them as pcap format files; use the pcap format files of each detection moment and a preset number of detection moments as pcap format files AT; extract the timestamp and five-tuple information of each data packet in the pcap format file AT, use the five-tuple as a key to divide the data packets to obtain each data stream; wherein the five-tuple information includes at least the source IP address and the destination IP address; In the pcap format file, according to the distribution characteristics of the destination IP addresses and source IP addresses of all data flows, the IP anomaly coefficient of each data flow is obtained; the time period corresponding to the pcap format file AT is evenly divided into a preset number of timestamp intervals; according to the distribution of the source IP addresses and destination IP addresses of the data packets of each data flow in the pcap format file AT in any timestamp interval, the local IP anomaly coefficient of each data flow in the said any timestamp interval is obtained; based on the IP anomaly coefficient of each data flow and the local IP anomaly coefficient in all timestamp intervals, the abnormal traffic confidence of each data flow is obtained; The multi-dimensional statistical feature data of each data flow in the pcap format file AT is extracted, and the anomaly score of each data flow is obtained by combining the anomaly detection algorithm; the anomaly score is corrected in combination with the abnormal traffic confidence of each data flow; and network security detection is performed on all data flows in the pcap format file AT based on the corrected value of the anomaly score.

2. A network security detection method in the operation and maintenance process of a virtual power plant according to claim 1, characterized in that: The IP anomaly coefficient of each data stream is obtained as follows: In the pcap format file AT, the source IP characteristic value of each data stream is obtained according to the distribution uniformity of the source IP addresses of all data streams having the same destination IP address as each data stream; According to the distribution uniformity of the destination IP addresses of all data flows having the same source IP address as each data flow, a destination IP characteristic value of each data flow is obtained; The ratio of the source IP characteristic value to the destination IP characteristic value of each data flow is used as the IP anomaly coefficient of each data flow.

3. A network security detection method in the operation and maintenance process of a virtual power plant according to claim 2, characterized in that: The source IP characteristic value of each data stream is obtained as follows: In the pcap format file AT, the set consisting of all data flows having the same destination IP address as each data flow is recorded as the first data flow set; the information entropy of the source IP addresses of all data flows in the first data flow set is used as the source IP characteristic value of each data flow.

4. A network security detection method in the operation and maintenance process of a virtual power plant according to claim 2, characterized in that: The destination IP characteristic value of each data stream is obtained as follows: In the pcap format file AT, the set consisting of all data flows having the same source IP address as each data flow is recorded as the second data flow set; the information entropy of the destination IP addresses of all data flows in the second data flow set is used as the destination IP characteristic value of each data flow.

5. A network security detection method in the operation and maintenance process of a virtual power plant according to claim 1, characterized in that: The method of obtaining the local IP anomaly coefficient of each data flow in any time stamp interval is specifically: A set consisting of all data packets of each data flow in any timestamp interval is used as a local data flow of each data flow in any timestamp interval; The data packets of all local data flows of all data flows in the pcap format file in any timestamp interval form a data packet set of the said any timestamp interval; The same calculation method as that of the IP anomaly coefficient is adopted to obtain the local IP anomaly coefficient of each data flow in any timestamp interval based on the local data flow and the data packet set.

6. A network security detection method in the operation and maintenance process of a virtual power plant according to claim 1, characterized in that: The abnormal traffic confidence of each data flow is obtained as follows: Obtain the negative correlation mapping result of the discrete degree of the local IP anomaly coefficient of each data flow in all time stamp intervals, and use the fusion result of the negative correlation mapping result and the IP anomaly coefficient of each data flow as the abnormal traffic confidence of each data flow.

7. A network security detection method in the operation and maintenance process of a virtual power plant according to claim 1, characterized in that: The abnormal score of each data stream is obtained as follows: After the multidimensional statistical feature data extracted from each data stream is normalized, it is mapped into data points in the multidimensional space. All data points are used as input of the anomaly detection algorithm to obtain the anomaly score of each data stream.

8. A network security detection method in the operation and maintenance process of a virtual power plant according to claim 1, characterized in that: The correction of the abnormal score is specifically: the product of the abnormal score of each data flow and the abnormal flow confidence is used as the correction value of the abnormal score of each data flow.

9. A network security detection method in the operation and maintenance process of a virtual power plant according to claim 1, characterized in that: The network security detection of all data streams in the pcap format file AT is specifically as follows: The correction values ​​of the abnormality scores of all data flows in the pcap format file AT are used to obtain a segmentation threshold using a threshold segmentation algorithm; all data flows whose correction values ​​of the abnormality scores are greater than the segmentation threshold are screened out; When the ratio of the number of data packets in all filtered data streams to the number of all data packets in the pcap format file AT is greater than or equal to a preset threshold, it is determined that there is a network security problem in the destination IP addresses of all data streams; otherwise, it is determined that there is no network security problem.

10. A network security detection system in the operation and maintenance process of a virtual power plant, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 are implemented.

Images