A network security detection method and system during virtual power plant operation and maintenance

Abstract

The present application relates to the field of network security detection technology, and specifically to a network security detection method and system during the operation and maintenance of a virtual power plant, the method comprising: collecting network traffic data of the electric power Internet of Things where the virtual power plant is located; constructing an IP anomaly coefficient based on the distribution characteristics of the source IP address and the destination IP address in different network environments of the electric power Internet of Things where the virtual power plant is located; and constructing an abnormal traffic confidence level based on the time distribution differences between abnormal IP address pattern changes; extracting multi-dimensional statistical feature data of all data streams in a pcap format file, obtaining the anomaly score of each data stream and making corrections, and detecting network security during the operation and maintenance of the virtual power plant based on the corrected value of the anomaly score. The present application aims to consider the pattern changes of IP addresses between network traffic data in the electric power Internet of Things where the virtual power plant is located, and improve the accuracy of network security detection results.

Description

Technical Field

[0001] The present application relates to the field of network security detection technology, and specifically to a network security detection method and system during the operation and maintenance of a virtual power plant. Background Art

[0002] A virtual power plant (VPP) is an IoT-based system that integrates and collaboratively manages distributed power resources (such as distributed power sources, energy storage devices, and controllable loads) within the power grid, forming a unified, controllable power energy management system. As an advanced form of the power IoT, VPPs require network security testing during their operation and maintenance, which is crucial for ensuring the stable operation of the VPP. Network traffic anomaly detection, as part of VPP network security testing, helps promptly detect and respond to potential cyberattacks or system failures, enabling appropriate security measures to ensure the secure operation of the power IoT within which the VPP resides.

[0003] Traditional network traffic anomaly detection methods usually extract multidimensional statistical feature data of network traffic data and use anomaly data detection algorithms, such as the local outlier factor algorithm, to identify abnormal network traffic data. However, this method only considers the numerical distribution characteristics of the multidimensional statistical feature data of network traffic data, but does not consider the pattern changes of IP addresses between network traffic data. This will cause the network traffic anomaly detection method to be unable to distinguish between occasional fluctuations in normal network traffic and abnormal traffic generated by malicious traffic attacks, thereby increasing the risk of underreporting and false alarms of abnormal network traffic, resulting in the inability to accurately detect and respond to potential network attacks or system failures during the operation and maintenance of virtual power plants, and unable to achieve effective security management of the power Internet of Things where virtual power plants are located. Summary of the Invention

[0004] In view of the above, it is necessary to provide a network security detection method and system during the operation and maintenance of a virtual power plant to solve the above problems.

[0005] In a first aspect, the present application provides a network security detection method during the operation and maintenance of a virtual power plant, the method comprising:

[0006] Use a packet capture tool to capture the flow data packets of the virtual power plant and save them as pcap format files; use the pcap format files of each detection moment and a preset number of detection moments as pcap format files AT; extract the timestamp and quintuple information of each data packet in the pcap format file AT, use the quintuple as a key to divide the data packets to obtain each data stream; wherein the quintuple information includes at least the source IP address and the destination IP address;

[0007] In the pcap format file, the IP anomaly coefficient of each data flow is obtained based on the distribution characteristics of the destination IP addresses and source IP addresses of all data flows; the time period corresponding to the pcap format file AT is evenly divided into a preset number of timestamp intervals; based on the distribution of the source IP addresses and destination IP addresses of the data packets of each data flow in the pcap format file AT in any timestamp interval, the local IP anomaly coefficient of each data flow in the said any timestamp interval is obtained; based on the IP anomaly coefficient of each data flow and the local IP anomaly coefficient in all timestamp intervals, the abnormal traffic confidence of each data flow is obtained;

[0008] The multi-dimensional statistical feature data of each data flow in the pcap format file AT is extracted and combined with the anomaly detection algorithm to obtain the anomaly score of each data flow; the anomaly score is corrected based on the abnormal traffic confidence of each data flow; and network security detection is performed on all data flows in the pcap format file AT based on the corrected anomaly score.

[0009] The IP anomaly coefficient of each data stream is obtained as follows:

[0010] In the pcap format file AT, the source IP characteristic value of each data flow is obtained based on the distribution uniformity of the source IP addresses of all data flows with the same destination IP address as each data flow;

[0011] Obtaining a destination IP characteristic value for each data flow based on the distribution uniformity of the destination IP addresses of all data flows having the same source IP address as the data flow;

[0012] The ratio of the source IP characteristic value to the destination IP characteristic value of each data flow is used as the IP anomaly coefficient of each data flow.

[0013] The source IP characteristic value of each data stream is obtained as follows:

[0014] In the pcap format file AT, the set consisting of all data flows with the same destination IP address as each data flow is recorded as the first data flow set; the information entropy of the source IP addresses of all data flows in the first data flow set is used as the source IP characteristic value of each data flow.

[0015] The destination IP characteristic value of each data stream is obtained as follows:

[0016] In the pcap format file AT, the set consisting of all data flows with the same source IP address as each data flow is recorded as the second data flow set; the information entropy of the destination IP addresses of all data flows in the second data flow set is used as the destination IP feature value of each data flow.

[0017] The method of obtaining the local IP anomaly coefficient of each data flow in any of the timestamp intervals is as follows:

[0018] The set of all data packets of each data flow in any timestamp interval is used as the local data flow of each data flow in any timestamp interval;

[0019] The data packets of all local data flows of all data flows in any timestamp interval in the pcap format file are combined into a data packet set of any timestamp interval;

[0020] The same calculation method as that of the IP anomaly coefficient is adopted to obtain the local IP anomaly coefficient of each data flow in any timestamp interval based on the local data flow and the data packet set.

[0021] The abnormal traffic confidence of each data flow is obtained as follows:

[0022] Obtain the negative correlation mapping result of the discrete degree of the local IP anomaly coefficient of each data flow in all time stamp intervals, and use the fusion result of the negative correlation mapping result and the IP anomaly coefficient of each data flow as the abnormal traffic confidence of each data flow.

[0023] The abnormality score of each data stream is obtained as follows:

[0024] After the multidimensional statistical feature data extracted from each data stream is normalized, it is mapped into data points in the multidimensional space. All data points are used as input to the anomaly detection algorithm to obtain the anomaly score of each data stream.

[0025] The correction of the anomaly score is specifically performed by taking the product of the anomaly score of each data flow and the confidence level of the anomaly flow as the correction value of the anomaly score of each data flow.

[0026] The network security detection is performed on all data streams in the pcap format file AT, specifically:

[0027] The correction values ​​of the anomaly scores of all data flows in the pcap format file AT are used to obtain a segmentation threshold using a threshold segmentation algorithm; all data flows whose correction values ​​of the anomaly scores are greater than the segmentation threshold are screened out;

[0028] When the ratio of the number of data packets in all filtered data streams to the number of all data packets in the pcap format file AT is greater than or equal to a preset threshold, it is determined that there is a network security problem with the destination IP addresses of all data streams; otherwise, it is determined that there is no network security problem.

[0029] In the second aspect, an embodiment of the present application also provides a network security detection system for the operation and maintenance process of a virtual power plant, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements the steps of any one of the above methods when executing the computer program.

[0030] This application has at least the following beneficial effects:

[0031] In the above scheme, a packet capture tool is used to obtain the flow data packets of the virtual power plant and save them as a pcap format file. Then, the pcap format file is intercepted, and the source IP address and destination IP address of the data packet of the intercepted pcap format file are obtained, which is helpful for judging the network status according to the distribution characteristics of the source IP address and the destination IP address in the future; according to the distribution characteristics of the destination IP address and the source IP address of all data flows, the IP anomaly coefficient of each data flow is obtained, which has the beneficial effect of being able to effectively detect abnormal traffic and quantify the distribution characteristics of the source IP address and destination IP address in the network traffic generated by the power Internet of Things where the virtual power plant is located under normal circumstances and the abnormal network traffic generated when it is attacked by DDoS; according to the distribution of the source IP address and destination IP address of the data packet of each data flow in the pcap format file AT in any timestamp interval, the local IP address of each data flow in the said any timestamp interval is obtained. The P anomaly coefficient has the beneficial effect of analyzing the time distribution difference between the IP address pattern changes of normal network traffic and the abnormal IP address pattern changes of abnormal network traffic generated when it is attacked by a network; constructing the abnormal traffic confidence, has the beneficial effect of improving the distinction between the normal data flow in the intercepted pcap format file and the abnormal data flow generated by the DDoS attack; extracting the multi-dimensional statistical feature data of each data flow in the pcap format file AT, combining with the anomaly detection algorithm, obtaining the anomaly score of each data flow and making corrections, has the beneficial effect of taking into account the pattern changes of IP addresses between the network traffic data in the power Internet of Things where the virtual power plant is located, improving the detection accuracy of the anomaly detection method for the abnormal network traffic generated by the power Internet of Things where the virtual power plant is located when it is attacked by a network, reducing the risk of missed reports and false alarms of abnormal network traffic, and thus better realizing the network security management of the power Internet of Things where the virtual power plant is located. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 A flowchart of a method for detecting network security during the operation and maintenance of a virtual power plant according to an embodiment of the present application;

[0033] Figure 2 A flowchart for obtaining abnormal traffic confidence is provided in one embodiment of the present application. DETAILED DESCRIPTION

[0034] In the description of the embodiments of this application, words such as "exemplary," "or," and "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary," "or," and "for example" is intended to present the relevant concepts in a concrete manner.

[0035] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art in the art of this application. The terms used in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application.

[0036] It should also be noted that the terms "first" and "second" in this application and the accompanying drawings are used to distinguish similar objects, rather than to describe a specific order or sequence. The methods disclosed in the embodiments of this application or the methods shown in the flowcharts include one or more steps for implementing the methods. Without departing from the scope of protection of this application, the order of executing multiple steps can be interchanged with each other, and some steps can also be deleted.

[0037] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

[0038] The following describes in detail a specific scheme of a network security detection method and system during the operation and maintenance of a virtual power plant provided by this application with reference to the accompanying drawings.

[0039] See also Figure 1 , which shows a flowchart of a network security detection method in a virtual power plant operation and maintenance process provided by an embodiment of the present application, the method comprising the following steps:

[0040] The first step is to use a packet capture tool to obtain the flow data packets of the virtual power plant and save them as pcap format files; the pcap format files of each detection moment and a preset number of detection moments are used as pcap format files AT; the timestamp and five-tuple information of each data packet in the pcap format file AT are extracted, and the five-tuple information is used as the key to divide the data packets to obtain each data stream.

[0041] By deploying the Wireshark packet capture tool on all network devices or network nodes of the power Internet of Things where the virtual power plant is located, the Wireshark packet capture tool is used to capture the passing traffic data packets, and the captured traffic data packets are saved as pcap format files to complete the collection of network traffic data of the power Internet of Things where the virtual power plant is located.

[0042] When conducting network security testing on a virtual power plant, taking the Tth detection moment as an example, in the pcap format file, extract the time period of 10 minutes starting from the Tth detection moment and forward to generate a new pcap format file, recorded as pcap format file AT, where the length of the time period can be set by the implementer.

[0043] The Wireshark packet capture tool is used to extract the timestamp and five-tuple information of each data packet in the pcap format file AT. The five-tuple information includes the source IP address, destination IP address, source IP port, destination IP port, and protocol type of the data packet.

[0044] The data packets in the pcap format file AT are divided according to their five-tuple information and classified into corresponding data flows. Each data flow represents a specific communication session and includes all data exchanges between two endpoints using a specific protocol and port over a period of time. All data flows in the pcap format file AT are obtained. It should be noted that all data packets in the same data flow have the same source IP address and destination IP address.

[0045] The second step: in the pcap format file, according to the distribution characteristics of the destination IP addresses and source IP addresses of all data flows, the IP anomaly coefficient of each data flow is obtained; the time period corresponding to the pcap format file AT is evenly divided into a preset number of timestamp intervals; according to the distribution of the source IP addresses and destination IP addresses of the data packets of each data flow in the pcap format file AT in any timestamp interval, the local IP anomaly coefficient of each data flow in the said any timestamp interval is obtained; based on the IP anomaly coefficient of each data flow and the local IP anomaly coefficient in all timestamp intervals, the abnormal traffic confidence of each data flow is obtained.

[0046] Under normal circumstances, the devices and systems in the power Internet of Things are usually designed to perform specific monitoring and control tasks. Each device may initiate communication at any time. This means that the source IP addresses in the network traffic of the power Internet of Things where the virtual power plant is located tend to be randomly distributed. At the same time, these network traffic will be evenly distributed to different devices and services according to the business needs of the virtual power plant, and will not be concentrated on a few destination IP addresses. However, when the power Internet of Things where the virtual power plant is located is attacked by a distributed denial of service (DDoS), since DDoS attacks usually use a large number of controlled hosts (botnets) or IP forging technology to send massive traffic from a large number of source IP addresses to a small number of destination IP addresses, in this case, the abnormal network traffic generated by the DDoS attack will have a relatively uniform distribution of source IP addresses, while the number of destination IP addresses is small and concentrated, thus forming an abnormal IP address pattern change. In the security management process of the power Internet of Things where the virtual power plant is located, in order to timely and accurately discover and respond to potential DDoS network attacks in the power Internet of Things, the following processing is performed.

[0047] Specifically, taking the i-th data stream AT(i) of the pcap format file AT as an example, all data streams with the same destination IP address as the data stream AT(i) are obtained from all data streams of the pcap format file AT to form a first data stream set B1(i); all data streams with the same source IP address as the data stream AT(i) are obtained to form a second data stream set B2(i).

[0048] The source IP address of each data stream in the first data stream set B1(i) is regarded as an event, and the ratio of the number of data packets in the data stream where the source IP address is located to the number of all data packets in all data streams in the first data stream set B1(i) is regarded as the probability of occurrence of the event corresponding to the source IP address of each data stream. The first information entropy H1(i) of the source IP address of the data stream in the first data stream set B1(i) is calculated based on the probability of occurrence of the event. The calculation of information entropy is a well-known technology and the specific process is not repeated here. The obtained first information entropy is used as the source IP characteristic value P1(i) of the data stream AT(i), which is used to characterize the relative uniformity of the distribution of the source IP addresses in all data packets with the same destination IP address as the data stream AT(i) in all data packets in the pcap format file AT. The larger the first information entropy, the greater the relative uniformity, that is, the larger the source IP characteristic value P1(i).

[0049] Using the same method as the first information entropy H1(i), calculate the second information entropy H2(i) of the destination IP address of the data flow in the second data flow set B2(i). Simply replace the first data flow set B1(i) and the source IP address with the second data flow set B2(i) and the destination IP address to obtain the second information entropy H2(i), which is recorded as the destination IP characteristic value P2(i) of the data flow AT(i). It is used to characterize the relative uniformity of the distribution of the destination IP addresses in all data packets in the pcap format file AT and in all data packets with the same source IP address as the data flow AT(i). The larger the information entropy, the greater the relative uniformity, that is, the larger the destination IP characteristic value P2(i).

[0050] Furthermore, the IP anomaly coefficient P(i) of the data stream AT(i) is calculated to characterize the IP address pattern changes of the source IP addresses and destination IP addresses corresponding to the data packets in the data stream AT(i) in all the data packets in the pcap format file AT, and the possibility that the abnormal IP address pattern changes are caused by abnormal network traffic generated by DDoS attacks. The formula is: Where P1(i) and P2(i) represent the source IP characteristic value and destination IP characteristic value of data stream AT(i), respectively; α represents a preset constant greater than zero. To prevent the denominator from being 0, α is set to 0.01. Implementers can adjust it according to actual conditions.

[0051] It should be understood that, among all the data packets in the pcap format file AT, the more uniform the distribution of the source IP addresses in all the data packets with the same destination IP address as the data stream AT(i), that is, the larger P1(i), and the more concentrated the distribution of the destination IP addresses in all the data packets with the same source IP address as the data stream AT(i), that is, the smaller P2(i), then the IP address pattern changes of the source IP addresses and destination IP addresses corresponding to the data packets in the data stream AT(i) in all the data packets in the pcap format file AT are more likely to have the same IP address pattern changes as the abnormal network traffic generated by the DDoS attack, that is, the larger the IP anomaly coefficient P(i).

[0052] When the power Internet of Things where the virtual power grid is located suffers a DDoS attack, it usually lasts for a period of time to ensure the effectiveness of the attack. This causes the abnormal IP address pattern changes caused by the DDoS attack to last for a long time. Under normal circumstances, the network traffic in the power Internet of Things where the virtual power plant is located usually does not have such continuous abnormal pattern changes.

[0053] Get the minimum and maximum timestamps of the data packets in the pcap format file AT, and divide the interval formed by the minimum and maximum timestamps into K timestamp intervals, where K is 100 and can be set by the implementer.

[0054] Taking the jth timestamp interval Q(j) and data stream AT(i) as an example, the set consisting of all packets in data stream AT(i) whose timestamps fall within timestamp interval Q(j) is recorded as the local data stream AT(i,j) of data stream AT(i) in timestamp interval Q(j). This is used to represent the communication session formed by the partial data packets of data stream AT(i) within the time period of timestamp interval Q(j). Furthermore, the packet set AT[j] consisting of all packets in all partial data streams of all data streams in the timestamp interval Q(j) of the pcap format file AT is obtained. This is used to represent the communication session formed by the partial data packets corresponding to all packets in the pcap format file AT within the time period of timestamp interval Q(j).

[0055] The same calculation method as the IP anomaly coefficient P(i) is used to obtain the local IP anomaly coefficient P(i,j) of the local data flow AT(i,j). This coefficient is used to characterize the IP address pattern changes of the source IP addresses and destination IP addresses corresponding to the data packets in the local data flow AT(i,j) in all data packets of the pcap format file AT during the time period of the timestamp interval Q(j). This coefficient is used to characterize the possibility of abnormal IP address pattern changes caused by abnormal network traffic generated by DDoS attacks. The pcap format file AT and data flow AT(i) only need to be replaced by the data packet set AT[j] and the local data flow AT(i,j) respectively.

[0056] Calculate the local IP anomaly coefficient of the local data flow of data flow AT(i) in each timestamp interval; according to the dispersion degree of the local IP anomaly coefficient of data flow AT(i) in all timestamp intervals, combined with the IP anomaly coefficient of data flow AT(i), obtain the abnormal traffic confidence D(i) of data flow AT(i), which is used to characterize the possibility that data flow AT(i) is abnormal network traffic generated by a DDoS attack. In this embodiment, the standard deviation is used to measure the dispersion degree between data, that is: Where P(i) represents the IP anomaly coefficient of data stream AT(i); ΔP(i) represents the standard deviation of the local IP anomaly coefficient of data stream AT(i) across all timestamp intervals; α represents a constant greater than zero. To prevent the denominator from being zero, α is set to 0.01; and norm() represents the Min-Max normalization function. In some other embodiments, the interquartile range can be used to measure the degree of dispersion between data; in still other embodiments, the standard deviation can be replaced by the variance.

[0057] Among them, the flow chart for obtaining the confidence level of abnormal traffic is as follows: Figure 2 shown.

[0058] The greater the possibility that the IP address pattern change of the source IP address and the destination IP address corresponding to the data packets in the data stream AT(i) in all the data packets in the pcap format file AT is an abnormal IP address pattern change formed by abnormal network traffic generated by a DDoS attack, that is, the larger P(i) is, and the higher the degree of consistency of the IP address pattern change of the source IP address and the destination IP address corresponding to the data packets in the data stream AT(i) in all the data packets in the pcap format file AT in each timestamp interval, that is, the smaller ΔP(i), the longer the abnormal IP address pattern change of the data packets in the data stream AT(i) lasts, the more likely that the data stream AT(i) is abnormal network traffic generated by a DDoS attack, that is, the greater the abnormal traffic confidence D(i).

[0059] The third step is to extract the multi-dimensional statistical feature data of each data flow in the pcap format file AT, and combine it with the anomaly detection algorithm to obtain the anomaly score of each data flow; correct the anomaly score based on the abnormal traffic confidence of each data flow; and perform network security detection on all data flows in the pcap format file AT based on the corrected anomaly score.

[0060] Multi-dimensional statistical feature data of each data stream of the pcap format file AT is extracted separately. In this embodiment, the multi-dimensional statistical feature data include the connection time, outgoing traffic size, outgoing traffic peak value, outgoing traffic mean, outgoing packet size, outgoing packet peak value, outgoing packet mean, ingoing traffic size, ingoing traffic peak value, ingoing traffic mean, incoming packet size, incoming packet peak value, and incoming packet mean of the data stream; it can be selected by the implementer, wherein the extraction of the multi-dimensional statistical feature data is a well-known technology, and the specific process will not be repeated here.

[0061] The Min-Max normalization method is used to normalize each type of multidimensional statistical feature data of each data stream of the pcap format file AT to eliminate the influence of the data dimension, and the multidimensional statistical feature data of all data streams of the pcap format file AT after normalization are mapped in the multidimensional space, wherein each type of statistical feature data in the multidimensional statistical feature data is used as a dimension in the multidimensional space, and the data points in the mapped multidimensional space are used as the input of the local outlier factor (LOF) algorithm. Each data point in the multidimensional space corresponds to a data stream in the pcap format file AT, and the anomaly score of each data point in the multidimensional space is output respectively, thereby obtaining the anomaly score of each data stream corresponding to each data point in the multidimensional space in the pcap format file AT. The Min-Max normalization method and the LOF algorithm are well-known technologies, and the specific process will not be repeated here.

[0062] The product of the normalized anomaly score for each data flow in the pcap format file AT and the abnormal traffic confidence level of each data flow is used as the correction value for the anomaly score of each data flow, where the normalization adopts the Min-Max normalization method. The greater the confidence level of the abnormal traffic of a data flow, the more likely the data flow is abnormal network traffic generated by a DDoS attack. To improve the detection accuracy of abnormal network traffic generated by DDoS attacks during the security management of the power Internet of Things (IoT) where the virtual power plant is located, the correction value of the data flow's anomaly score should be larger.

[0063] The corrected values ​​of the anomaly scores of all data streams in the pcap format file AT are used as the input of the maximum inter-class variance algorithm, and the segmentation threshold L is output. All data streams whose corrected values ​​of the anomaly scores are greater than the segmentation threshold L are screened out. The ratio of the number of all data packets in all screened data streams to the number of all data packets in the pcap format file AT is calculated. If the ratio is greater than the ratio threshold (in this embodiment, the ratio threshold is 0.3 and can be set by the implementer), the target IP addresses of all screened data streams are marked, and an alarm is issued using the communication module to remind the operation and maintenance personnel of the virtual power plant to perform network security maintenance. The maximum inter-class variance algorithm is a well-known technology, and the specific process will not be repeated here. The network security detection during the operation and maintenance process of the virtual power plant is completed.

[0064] Based on the same inventive concept as the above method, an embodiment of the present application also provides a network security detection system during the operation and maintenance of a virtual power plant, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the steps of any one of the above-mentioned network security detection methods during the operation and maintenance of a virtual power plant.

[0065] In summary, the embodiment of the present application uses a packet capture tool to obtain the flow data packets of the virtual power plant, saves it as a pcap format file, and then intercepts the pcap format file, and obtains the source IP address and destination IP address of the data packet of the intercepted pcap format file, which helps to judge the network status according to the distribution characteristics of the source IP address and the destination IP address in the future; according to the distribution characteristics of the destination IP address and the source IP address of all data flows, the IP anomaly coefficient of each data flow is obtained, which has the beneficial effect of being able to effectively detect abnormal traffic, and quantify the distribution characteristics of the source IP address and destination IP address in the network traffic generated by the power Internet of Things where the virtual power plant is located under normal circumstances and the abnormal network traffic generated when it is attacked by DDoS; according to the distribution of the source IP address and destination IP address of the data packet of each data flow in the pcap format file AT in any timestamp interval, the local distribution of each data flow in the said any timestamp interval is obtained. The IP anomaly coefficient is beneficial in that it analyzes the time distribution difference between the IP address pattern changes of normal network traffic and the abnormal IP address pattern changes of abnormal network traffic generated when it is attacked by a network; the abnormal traffic confidence is constructed, which has the beneficial effect of improving the distinction between normal data flows in the intercepted pcap format file and abnormal data flows generated by DDoS attacks; the multi-dimensional statistical feature data of each data flow in the pcap format file AT is extracted, and combined with the anomaly detection algorithm, the anomaly score of each data flow is obtained and corrected, which has the beneficial effect of taking into account the pattern changes of IP addresses between the network traffic data in the power Internet of Things where the virtual power plant is located, improving the detection accuracy of the anomaly detection method for abnormal network traffic generated by the power Internet of Things where the virtual power plant is located when it is attacked by a network, reducing the risk of missed reports and false alarms of abnormal network traffic, and thus better realizing the network security management of the power Internet of Things where the virtual power plant is located.

[0066] The flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the systems, methods and computer program products according to the embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the part of the module, program segment or code contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. In the description corresponding to the flowcharts and block diagrams in the accompanying drawings, the operations or steps corresponding to different boxes can also occur in an order different from that disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified function or action, or may be implemented by a combination of dedicated hardware and computer instructions.

[0067] It is obvious to those skilled in the art that the present application is not limited to the details of the above exemplary embodiments, and that the present application can be implemented in other specific forms without departing from the basic features of the present application. Therefore, from any point of view, the above embodiments of the present application should be regarded as exemplary and non-restrictive; modifications to the technical solutions described in the above embodiments, or equivalent replacement of some of the technical features therein, do not deviate from the essence of the corresponding technical solutions within the scope of the technical solutions of the embodiments of the present application, and should be included in the scope of protection of the present application.

Claims

1. A network security detection method during the operation and maintenance of a virtual power plant, characterized in that: The method comprises the following steps: Use a packet capture tool to capture the flow data packets of the virtual power plant and save them as pcap format files; use the pcap format files of each detection moment and a preset number of detection moments as pcap format files AT; extract the timestamp and quintuple information of each data packet in the pcap format file AT, use the quintuple as a key to divide the data packets to obtain each data stream; wherein the quintuple information includes at least the source IP address and the destination IP address; In the pcap format file AT, the source IP characteristic value of each data flow is obtained based on the uniformity of distribution of the source IP addresses of all data flows with the same destination IP address as each data flow; the destination IP characteristic value of each data flow is obtained based on the uniformity of distribution of the destination IP addresses of all data flows with the same source IP address as each data flow; the ratio of the source IP characteristic value to the destination IP characteristic value of each data flow is used as the IP anomaly coefficient of each data flow; the time period corresponding to the pcap format file AT is evenly divided into a preset number of timestamp intervals; the local IP anomaly coefficient of each data flow in any timestamp interval is obtained based on the distribution of the source IP addresses and destination IP addresses of the data packets of each data flow in the pcap format file AT; based on the IP anomaly coefficient of each data flow and the local IP anomaly coefficient in all timestamp intervals, the abnormal traffic confidence of each data flow is obtained; The multi-dimensional statistical feature data of each data flow in the pcap format file AT is extracted and combined with the anomaly detection algorithm to obtain the anomaly score of each data flow; the anomaly score is corrected based on the abnormal traffic confidence of each data flow; and network security detection is performed on all data flows in the pcap format file AT based on the corrected anomaly score.

2. A network security detection method during the operation and maintenance of a virtual power plant according to claim 1, characterized in that: The source IP characteristic value of each data stream is obtained as follows: In the pcap format file AT, the set consisting of all data flows with the same destination IP address as each data flow is recorded as the first data flow set; the information entropy of the source IP addresses of all data flows in the first data flow set is used as the source IP characteristic value of each data flow.

3. The network security detection method during the operation and maintenance of a virtual power plant according to claim 1, characterized in that: The destination IP characteristic value of each data stream is obtained as follows: In the pcap format file AT, the set consisting of all data flows with the same source IP address as each data flow is recorded as the second data flow set; the information entropy of the destination IP addresses of all data flows in the second data flow set is used as the destination IP feature value of each data flow.

4. The network security detection method during the operation and maintenance of a virtual power plant according to claim 1, characterized in that: The local IP anomaly coefficient of each data flow in any of the timestamp intervals is obtained as follows: The set of all data packets of each data flow in any timestamp interval is used as the local data flow of each data flow in any timestamp interval; The data packets of all local data flows of all data flows in any timestamp interval in the pcap format file are combined into a data packet set of any timestamp interval; The same calculation method as that of the IP anomaly coefficient is adopted to obtain the local IP anomaly coefficient of each data flow in any timestamp interval based on the local data flow and the data packet set.

5. The network security detection method during the operation and maintenance of a virtual power plant according to claim 1, characterized in that: The abnormal traffic confidence of each data flow is obtained as follows: Obtain the negative correlation mapping result of the discrete degree of the local IP anomaly coefficient of each data flow in all time stamp intervals, and use the fusion result of the negative correlation mapping result and the IP anomaly coefficient of each data flow as the abnormal traffic confidence of each data flow.

6. A network security detection method during the operation and maintenance of a virtual power plant according to claim 1, characterized in that: The abnormality score of each data stream is obtained as follows: After the multidimensional statistical feature data extracted from each data stream is normalized, it is mapped into data points in the multidimensional space. All data points are used as input to the anomaly detection algorithm to obtain the anomaly score of each data stream.

7. The network security detection method during the operation and maintenance of a virtual power plant according to claim 1, characterized in that: The correction of the anomaly score is specifically as follows: the product of the anomaly score of each data flow and the confidence level of the anomaly flow is used as the correction value of the anomaly score of each data flow.

8. The network security detection method during the operation and maintenance of a virtual power plant according to claim 1, characterized in that: The network security detection is performed on all data streams in the pcap format file AT, specifically: The correction values ​​of the anomaly scores of all data flows in the pcap format file AT are used to obtain a segmentation threshold using a threshold segmentation algorithm; all data flows whose correction values ​​of the anomaly scores are greater than the segmentation threshold are screened out; When the ratio of the number of data packets in all filtered data streams to the number of all data packets in the pcap format file AT is greater than or equal to a preset threshold, it is determined that there is a network security problem with the destination IP addresses of all data streams; otherwise, it is determined that there is no network security problem.

9. A network security detection system for a virtual power plant during operation and maintenance, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images