Method and system for intelligent substation to resist counterfeit MAC attack

Abstract

The invention discloses a method and system for an intelligent substation to resist counterfeit MAC attacks, and belongs to the technical field of communication network security of intelligent substations. The method comprises the following steps: recording a source MAC (Media Access Control) address and an access port after the intelligent equipment is accessed to a switch, generating a unique timestamp and initializing a message counter; judging whether a binding condition is met or not in the statistical time window; when a binding condition is met, dynamically binding the source MAC address with the access port; intercepting a data frame of the forged MAC address received from the non-binding port in real time in the binding state; and monitoring the state of the bound port, and unbinding and recovering the dynamic learning function when the state of the port changes. The method can accurately intercept the forged MAC address data frame, prevents the address table from being abnormal, guarantees the safety and stability of the communication network of the intelligent substation, and is suitable for the application scene of the intelligent substation in a complex network environment through the characteristics of dynamic adaptability, automatic management and efficient utilization of resources.

Description

Technical Field

[0001] The present invention relates to the technical field of intelligent substation communication network security, and in particular to a method and system for an intelligent substation to resist forged MAC attacks. Background Art

[0002] With the rapid development of smart grids, smart substations have gradually adopted the IEC61850 standard to achieve unified management and control of the station control layer, bay layer and process layer through network communication. In the network of smart substations, Ethernet switches, as core communication devices, establish a mapping relationship between MAC addresses and ports through a dynamic learning mechanism to complete the reception, forwarding and management of data packets. However, the existing technology has significant deficiencies in dealing with forged MAC address attacks: forged MAC address attacks interfere with the normal MAC address learning mechanism of the switch by sending false Ethernet data frames, thereby causing MAC address table abnormalities. For example, an attacker forges the MAC address of a legitimate device to send a data frame, causing the switch to mistakenly forward the traffic of the real device to the port of the forged device, and may even cause the address table to crash, resulting in network communication interruption, seriously affecting the operational stability of the smart substation. Although static MAC binding can defend against forged MAC attacks, its configuration is complex and cannot dynamically adapt to the frequently changing field access requirements. Especially in process layer networks with large amounts of data, static binding is difficult to meet business needs and is prone to device communication abnormalities due to configuration errors. The existing dynamic learning mechanism lacks the ability to detect forged data frames and can only update the MAC address table in real time, but cannot identify and intercept forged data frames. In addition, existing technologies lack automation and flexible adjustment capabilities, making it difficult to cope with complex network threats in multiple business scenarios.

[0003] Therefore, how to design a solution that can effectively defend against forged MAC attacks while achieving dynamic binding, automated management and flexible adaptation is an urgent problem to be solved in the security of smart substation communication network. Summary of the invention

[0004] The purpose of the present invention is to provide a method and system for intelligent substations to resist forged MAC attacks. By dynamically binding MAC addresses and switch ports, the forged MAC address attacks can be detected and intercepted, while the automation and adaptability of network management can be enhanced to ensure the security and stability of the communication network of the intelligent substation.

[0005] In order to achieve the above object, the present invention is implemented by the following technical solutions:

[0006] A method for a smart substation to defend against a forged MAC attack comprises the following steps:

[0007] After the smart device is connected to the switch, when the switch receives the data frame from the smart device for the first time, it records the source MAC address and access port, generates a unique timestamp to mark the start time of data frame statistics, and initializes the message counter count to 1 to record the number of data frames from the smart device;

[0008] Count the number of statistical frames and determine whether the binding condition is met within the statistical time window;

[0009] When the binding conditions are met, the source MAC address is dynamically bound to the access port;

[0010] In the binding state, intercept the data frames with forged MAC addresses;

[0011] Monitor the port status of the bound port, unbind it and resume dynamic learning when the port status changes.

[0012] As a preferred solution of the present invention, the step of collecting the number of statistical frames includes:

[0013] Set the statistical time window T and the trigger threshold COUNT of the number of data frames, which are used to limit the statistical duration of data frame statistics and the number of data frames that trigger dynamic binding respectively;

[0014] According to the business cycle of smart devices cycle and the number of data frames n in each service cycle frame , dynamically adjust T and COUNT, the formula is:

[0015] T=N×t cycle , COUNT = N × n frame ;

[0016] Among them, t cycle nf is the service cycle of the smart device, which indicates the time required for the smart device to complete a service, in seconds; rame is the number of data frames in each service cycle; N is the safety factor;

[0017] In each service cycle, the statistical time window T and the trigger threshold COUNT of the number of data frames are updated to adapt to the message sending characteristics of the current smart device.

[0018] As a preferred solution of the present invention, the binding conditions specifically include the following two items:

[0019] Within the statistical time window T, the value of the message counter count reaches the trigger threshold COUNT of the number of data frames;

[0020] The port status of the access port remains UP, and through real-time comparison, it is found that no data frame corresponding to the source MAC address is received and entered from other ports.

[0021] As a preferred solution of the present invention, in the step of intercepting the data frame with a forged MAC address, the switch operates through the following steps:

[0022] In the binding state, the MAC address of the received data frame is compared with the source MAC address bound in the MAC address table in real time;

[0023] If the MAC address of the data frame received on the non-bound port is the same as the source MAC address, the MAC address is a forged MAC address and the data frame is discarded immediately. At the same time, the access port and receiving time of the data frame with the forged MAC address are recorded to track the source of the attack, and normal communication of the newly received data frame is restored first.

[0024] As a preferred solution of the present invention, in the step of monitoring the port status of the bound port, when the port status of the bound port becomes DOWN, the switch releases the dynamic binding relationship between the source MAC address and the access port, and then performs the following steps:

[0025] Clear the bound source MAC address record and release the corresponding address table resources;

[0026] The source MAC address and access port of the newly received data frame are recorded in real time, and the statistical time window is initialized at the same time.

[0027] A method and system for intelligent substation to resist forged MAC attack, comprising:

[0028] A switch module, used for accessing the smart device and receiving data frames from the smart device;

[0029] A recording module is used to record the source MAC address and access port when the switch receives a data frame from an intelligent device for the first time, and to generate a unique timestamp to mark the start time of data frame statistics;

[0030] The counter module is used to initialize the message counter count to 1 and record the number of data frames from the smart device;

[0031] The statistics module is used to determine whether the binding conditions are met within the statistical time window;

[0032] Dynamic binding module, used to dynamically bind the source MAC address to the access port when the binding conditions are met;

[0033] Defense module, used to intercept data frames with forged MAC addresses in the binding state;

[0034] The monitoring module is used to monitor the port status of the bound port and unbind and resume dynamic learning when the port status changes.

[0035] As a preferred solution of the present invention, the statistical module includes:

[0036] A threshold setting unit, used to set a trigger threshold COUNT of a statistical time window T and a number of data frames;

[0037] A dynamic adjustment unit is used to adjust the service cycle t of the smart device according to the service cycle t of the smart device. cycle and the number of data frames n in each service cycle frame , dynamically adjust T and COUNT, the formula is:

[0038] T=N×t cycle , COUNT = N × n frame ;

[0039] Where N is the safety factor.

[0040] As a preferred solution of the present invention, the dynamic binding module includes:

[0041] The port status monitoring unit is used to monitor in real time whether the access port status is continuously UP;

[0042] The source address verification unit is used to confirm that the corresponding data frame is not received from other ports by comparing the source MAC address in real time, and trigger dynamic binding when the value of the message counter reaches the trigger threshold within the statistical time window.

[0043] As a preferred solution of the present invention, the defense module includes:

[0044] A forged MAC address identification unit is used to compare the MAC address of the received data frame with the bound source MAC address in real time in the binding state. If the MAC address of the data frame received by the non-bound port is the same as the source MAC address, the MAC address is a forged MAC address;

[0045] A data frame discarding unit, used for discarding data frames with forged MAC addresses;

[0046] The attack recording unit is used to record the access port and receiving time of the forged MAC address data frame and perform tracking processing.

[0047] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention can accurately identify forged MAC address data frames through the mechanism of dynamically binding the source MAC address and the switch port, intercept and discard forged data frames entering from the non-bound port in real time in the binding state, thereby preventing the address table from being disordered or abnormally updated, and ensuring the security of the intelligent substation communication network. By judging the binding conditions by the number of data frames in the statistical time window, the automatic binding of the MAC address and the access port is realized without manual intervention, and the binding conditions can be adjusted according to the communication characteristics and business cycle of the device to adapt to the network environment with frequent device access and dynamic business changes. When the state of the binding port changes, the present invention can timely unbind the binding relationship and restore the dynamic learning function, support the re-access of the device, and avoid communication problems caused by port abnormalities. The present invention simplifies the traditional static binding operation through the automated dynamic binding and unbinding mechanism, reduces the risk of configuration errors, and timely releases the address table resources to ensure the efficient use of switch resources, which is suitable for intelligent substation networks with high business traffic. The present invention can flexibly adapt to multi-business scenarios, support the access requirements of devices at different levels such as the station control layer, the interval layer and the process layer, and provide a safe and stable guarantee for the expansion of the intelligent substation network, and has important practical application value. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0049] in:

[0050] Figure 1 is a flow chart of the method of the present invention;

[0051] Figure 2 It is a schematic diagram of the modular structure of the system of the present invention;

[0052] Figure 3 A schematic diagram of a network hierarchical structure according to an embodiment of the present invention;

[0053] Figure 4 The figure is a schematic diagram of the change of the MAC address table of a switch according to an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the embodiment of the present invention clearer, the technical solution of the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings of the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all of the embodiments. Based on the described embodiment of the present invention, all other embodiments obtained by ordinary technicians in this field belong to the scope of protection of the present invention.

[0055] like Figure 1 As shown in FIG. 1 , an embodiment of the present invention is provided, which provides a method for a smart substation to resist a forged MAC attack, including:

[0056] Step S1: After the smart device is connected to the switch, when the switch receives a data frame from the smart device for the first time, it records the source MAC address and access port, generates a unique timestamp to mark the start time of data frame statistics, and initializes the message counter count to 1 to record the number of data frames from the smart device;

[0057] After the smart device is connected to the switch, when the switch receives the first frame of data from the smart device, it records the source MAC address and access port of the data frame as the unique identifier of the device. At the same time, a unique timestamp is generated to mark the start time of the data frame statistics. The switch also initializes a message counter count and sets it to 1 to record the number of data frames received from the device. This process ensures that the switch can accurately identify and manage the communication information of each access device.

[0058] Step S2: Count the number of statistical frames and determine whether the binding condition is met within the statistical time window;

[0059] The step of calculating the number of statistical frames comprises:

[0060] Set the statistical time window T and the trigger threshold COUNT of the number of data frames, which are used to limit the statistical duration of data frame statistics and the number of data frames that trigger dynamic binding respectively;

[0061] According to the business cycle of smart devices cycle and the number of data frames n in each service cycle frame , dynamically adjust T and COUNT, the formula is:

[0062] T=N×t cycle , COUNT = N × n frame ;

[0063] Among them, t cycle nf is the service cycle of the smart device, which indicates the time required for the smart device to complete a service, in seconds; rameis the number of data frames in each service cycle; N is the safety factor;

[0064] In each service cycle, the statistical time window T and the trigger threshold COUNT of the number of data frames are updated to adapt to the message sending characteristics of the current smart device.

[0065] Step S3: When the binding condition is met, the source MAC address is dynamically bound to the access port;

[0066] In this embodiment, the binding conditions specifically include the following two items:

[0067] Within the statistical time window T, the value of the message counter count reaches the trigger threshold COUNT of the number of data frames;

[0068] The port status of the access port remains UP, and through real-time comparison, it is found that no data frame corresponding to the source MAC address is received and entered from other ports.

[0069] The switch enters the statistical mode and counts the data frames from the smart device within the preset statistical time window. Each time a data frame is received, the counter count is incremented by 1. At the same time, the switch checks in real time whether the statistical time exceeds the statistical time window. When the statistical time reaches the set window and the value of the counter count reaches the preset binding condition (for example, the number of data frames exceeds a specific threshold), it is determined that the communication behavior of the device complies with the binding rule. The statistical time window and counting threshold in this step can be dynamically adjusted according to the business characteristics of the smart device to adapt to different business scenarios.

[0070] Step S4: In the binding state, intercepting the data frame with the forged MAC address;

[0071] Specifically, in the step of intercepting a data frame with a forged MAC address, the switch operates through the following steps:

[0072] In the binding state, the MAC address of the received data frame is compared with the source MAC address bound in the MAC address table in real time;

[0073] If the MAC address of the data frame received on the non-bound port is the same as the source MAC address, the MAC address is a forged MAC address and the data frame is discarded immediately. At the same time, the access port and receiving time of the data frame with the forged MAC address are recorded to track the source of the attack, and normal communication of the newly received data frame is restored first.

[0074] When the switch determines that the binding condition is met, it will dynamically bind the source MAC address of the smart device to the access port, and record the binding relationship as static MAC address information and store it in the switch's address table. In the binding state, the source MAC address can only send and receive data through the bound port, and other ports will not be able to learn or forward data frames related to the source MAC address, thereby ensuring the security of device communication and the uniqueness of data flow.

[0075] In the dynamic binding state, the switch detects the source MAC address of all received data frames in real time. If a forged MAC address is detected (i.e., a data frame with the same bound MAC address is received from a non-bound port), the switch will immediately discard the forged data frame and record relevant information (such as the source port and reception time of the forged data frame). This process can effectively defend against forged MAC address attacks and prevent forged data frames from causing disorder to the switch's address table, thereby ensuring the stability of the smart substation network.

[0076] Step S5: monitor the port status of the bound port, unbind the port when the port status changes, and resume dynamic learning.

[0077] Specifically, in the step of monitoring the port status of the bound port, when the port status of the bound port becomes DOWN, the switch releases the dynamic binding relationship between the source MAC address and the access port, and then performs the following steps:

[0078] Clear the bound source MAC address record and release the corresponding address table resources;

[0079] The source MAC address and access port of the newly received data frame are recorded in real time, and the statistical time window is initialized at the same time.

[0080] The switch continuously monitors the status of bound ports. When the status of a bound port changes (for example, from UP to DOWN), the switch promptly unbinds the source MAC address from the port and deletes the source MAC address from the static address table. After the binding is unbinded, the switch resumes dynamic learning mode, allowing other ports to relearn the source MAC address. This process ensures that the device can flexibly reconnect to the network while releasing switch resources to avoid communication interruptions caused by binding restrictions.

[0081] In practical applications, the service characteristics of smart devices may differ, such as data frame transmission frequency or service cycle. To this end, the present invention provides a dynamic adjustment mechanism for statistical time windows and binding condition thresholds. For example, the statistical time window can be set to an integer multiple of the smart device service cycle, and the trigger threshold of the number of data frames can be dynamically set according to the average number of frames in each service cycle to ensure that the binding conditions can flexibly adapt to different service requirements.

[0082] Through the above embodiments, the dynamic binding method of the present invention can effectively defend against forged MAC address attacks, improve the security and stability of the smart substation communication network, and realize the automation and efficiency of device access management.

[0083] like Figure 2 As shown in FIG. 1 , another embodiment of the present invention is provided, which provides a system for a smart substation to resist a forged MAC attack, including:

[0084] A switch module, used for accessing the smart device and receiving data frames from the smart device;

[0085] A recording module is used to record the source MAC address and access port when the switch receives a data frame from an intelligent device for the first time, and to generate a unique timestamp to mark the start time of data frame statistics;

[0086] The counter module is used to initialize the message counter count to 1 and record the number of data frames from the smart device;

[0087] The statistics module is used to determine whether the binding conditions are met within the statistical time window;

[0088] Dynamic binding module, used to dynamically bind the source MAC address to the access port when the binding conditions are met;

[0089] Defense module, used to intercept data frames with forged MAC addresses in the binding state;

[0090] The monitoring module is used to monitor the port status of the bound port and unbind and resume dynamic learning when the port status changes.

[0091] In this embodiment, the statistics module includes:

[0092] A threshold setting unit, used to set a trigger threshold COUNT of a statistical time window T and a number of data frames;

[0093] A dynamic adjustment unit is used to adjust the service cycle t of the smart device according to the service cycle t of the smart device. cycle and the number of data frames n in each service cycle frame , dynamically adjust T and COUNT, the formula is:

[0094] T=N×t cycle , COUNT = N × n frame ;

[0095] Where N is the safety factor.

[0096] Preferably, the dynamic binding module includes:

[0097] The port status monitoring unit is used to monitor in real time whether the access port status is continuously UP;

[0098] The source address verification unit is used to confirm that the corresponding data frame is not received from other ports by comparing the source MAC address in real time, and trigger dynamic binding when the value of the message counter reaches the trigger threshold within the statistical time window.

[0099] Preferably, the defense module includes:

[0100] A forged MAC address identification unit is used to compare the MAC address of the received data frame with the bound source MAC address in real time in the binding state. If the MAC address of the data frame received by the non-bound port is the same as the source MAC address, the MAC address is a forged MAC address;

[0101] A data frame discarding unit, used for discarding data frames with forged MAC addresses;

[0102] The attack recording unit is used to record the access port and receiving time of the forged MAC address data frame and perform tracking processing.

[0103] like Figure 3 As shown in the figure, the network structure of the smart substation is divided into station control layer, bay layer and process layer, and each layer realizes data communication and management through switches.

[0104] Station control layer: The station control layer includes the monitoring background and application server, which is responsible for data monitoring and management of the entire station, and usually communicates with the interval layer and process layer through switches.

[0105] Interval layer: The interval layer includes protection equipment and measurement and control equipment, which are used for data aggregation, equipment protection and sending control instructions to the process layer. The interval layer exchanges data with the station control layer and the process layer through switches.

[0106] Process layer: The process layer includes intelligent terminals and merging units, which are mainly responsible for data interaction with primary equipment, such as collecting analog and digital signals and issuing control instructions.

[0107] In the present invention, in order to defend against forged MAC attacks in the communication network of the smart substation, the switch plays a key role in communication data forwarding and defense between layers. The method and system for resisting forged MAC attacks of the present invention are mainly applied to the security management of the switch in this network structure.

[0108] like Figure 4 As shown in the figure, the corresponding relationship between the MAC address and the port of the switch in the initial state, dynamic binding state and unbinding state is shown.

[0109] PORT1~PORT7 represent the ports of the switch;

[0110] MAC1 to MACn represent the MAC addresses of the access devices.

[0111] Initial state:

[0112] In the initial state, the switch is in dynamic learning mode, and dynamically records the corresponding relationship between the source MAC address and the access port through the received data frame. For example, when a smart device is connected to the switch's PORT1 port, the switch records the device's source MAC address MAC1 and associates it with PORT1. When other devices are connected to different ports (such as PORT7), the switch also records the mapping relationship between the source MAC addresses of these devices (such as MACn) and the corresponding ports.

[0113] In this state, the switch allows all ports to learn new MAC addresses. However, at this time, if the attacker sends a forged data frame with the same MAC address (such as MAC1) through other ports (such as PORT2), the switch will update the MAC address table and mistakenly associate MAC1 with PORT2, causing data traffic to be forwarded incorrectly.

[0114] Dynamic binding status:

[0115] When the dynamic binding conditions are met, the switch binds the source MAC address to the access port as a static MAC address. For example, when device MAC1 is connected through PORT1 and the binding conditions are met, the switch binds MAC1 to PORT1, and other ports can no longer learn MAC1 information. At this time, the information in the switch address table becomes: source MAC address MAC1 can only be forwarded through PORT1, and other ports cannot associate MAC1 with themselves.

[0116] In the dynamic binding state, if an attacker sends a forged data frame with MAC1 through an unbound port (such as PORT2), the switch can detect and determine in real time that the data frame is forged, and then discard the data frame, effectively preventing abnormal updates of the address table and ensuring the security and stability of data communication.

[0117] Unbind status:

[0118] When the switch detects that the status of a bound port (such as PORT1) changes (for example, from UP to DOWN), the switch automatically unbinds the source MAC address from the port and releases the static MAC address record. After unbinding, the switch returns to dynamic learning mode, allowing other ports to relearn new MAC addresses. For example, after MAC1 previously bound to PORT1 is unbound, device MAC1 can access the switch through other ports, and the switch will re-record the association between MAC1 and the new access port.

[0119] By unbinding, the switch can quickly adapt to changes in the status of network devices, ensuring normal communication when the device reconnects to the network, while achieving efficient management and utilization of address table resources.

[0120] The present invention effectively defends against forged MAC address attacks through a dynamic binding mechanism, ensures the communication security and stability of the smart substation network, and at the same time has the ability to flexibly adapt to changes in device access, thereby improving the efficient utilization of switch resources.

[0121] In summary, the present invention can effectively defend against forged MAC address attacks and ensure the security and stability of the smart substation communication network by recording the source MAC address and access port of the smart device, counting the number of statistical frames and judging the binding conditions, realizing dynamic binding, intercepting forged MAC address data frames, and monitoring the port status and unbinding. The present invention combines dynamic binding with forged data frame detection technology, which can not only accurately identify and intercept forged MAC address attacks, but also flexibly adjust binding conditions and statistical parameters according to the business characteristics of the device, and adapt to the complex network environment of multiple levels and multiple devices in the smart substation. The present invention is simple to operate and can achieve automated management without manual intervention. At the same time, it releases switch resources and improves network operation efficiency, significantly improving the adaptability and security of the smart substation communication network, and has broad application prospects and important practical value.

[0122] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0123] Any process or method description in the flow chart or otherwise described herein can be understood to represent a module, fragment or portion of a code including one or more executable instructions for implementing the steps of a specific logical function or process. And the scope of the preferred embodiment of the present application includes other implementations, in which the functions may not be performed in the order shown or discussed, including in a substantially simultaneous manner or in a reverse order according to the functions involved.

[0124] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for intelligent substation to resist forged MAC attack, characterized in that: The following steps are involved: After the smart device is connected to the switch, when the switch receives the data frame from the smart device for the first time, it records the source MAC address and access port, generates a unique timestamp to mark the start time of data frame statistics, and initializes the message counter count to 1 to record the number of data frames from the smart device; Count the number of statistical frames and determine whether the binding condition is met within the statistical time window; When the binding conditions are met, the source MAC address is dynamically bound to the access port; In the binding state, intercept the data frames with forged MAC addresses; Monitor the port status of the bound port, unbind it and resume dynamic learning when the port status changes.

2. A method for defending a smart substation against forged MAC attacks according to claim 1, characterized in that: The step of counting the number of statistical frames comprises: Set the statistical time window T and the trigger threshold COUNT of the number of data frames, which are used to limit the statistical duration of data frame statistics and the number of data frames that trigger dynamic binding respectively; According to the business cycle of smart devices cycle and the number of data frames n in each service cycle frame , dynamically adjust T and COUNT, the formula is: T=N×t cycle ,COUNT=N×n frame ; Among them, t cycle is the service cycle of the smart device, which indicates the time required for the smart device to complete a service, in seconds; n frame is the number of data frames in each service cycle; N is the safety factor; In each service cycle, the statistical time window T and the trigger threshold COUNT of the number of data frames are updated to adapt to the message sending characteristics of the current smart device.

3. The method for defending a smart substation against a forged MAC attack according to claim 2, characterized in that: The binding conditions specifically include the following two items: Within the statistical time window T, the value of the message counter count reaches the trigger threshold COUNT of the number of data frames; The port status of the access port remains UP, and through real-time comparison, it is found that no data frame corresponding to the source MAC address is received and entered from other ports.

4. The method for defending a smart substation against a forged MAC attack according to claim 1, characterized in that: In the step of intercepting the data frame with forged MAC address, the switch operates through the following steps: In the binding state, the MAC address of the received data frame is compared with the source MAC address bound in the MAC address table in real time; if the MAC address of the data frame received on the non-bound port is the same as the source MAC address, the MAC address is a forged MAC address and the data frame is discarded immediately. At the same time, the access port and receiving time of the data frame with the forged MAC address are recorded to track the source of the attack, and normal communication of the newly received data frame is restored first.

5. The method for defending a smart substation against forged MAC attacks according to claim 1, characterized in that: In the step of monitoring the port status of the bound port, when the port status of the bound port becomes DOWN, the switch releases the dynamic binding relationship between the source MAC address and the access port, and then performs the following steps: Clear the bound source MAC address record and release the corresponding address table resources; The source MAC address and access port of the newly received data frame are recorded in real time, and the statistical time window is initialized at the same time.

6. A system for defending a smart substation against forged MAC attacks, characterized in that: include: A switch module, used for accessing the smart device and receiving data frames from the smart device; A recording module is used to record the source MAC address and access port when the switch receives a data frame from an intelligent device for the first time, and to generate a unique timestamp to mark the start time of data frame statistics; The counter module is used to initialize the message counter count to 1 and record the number of data frames from the smart device; The statistics module is used to determine whether the binding conditions are met within the statistical time window; Dynamic binding module, used to dynamically bind the source MAC address to the access port when the binding conditions are met; Defense module, used to intercept data frames with forged MAC addresses in the binding state; The monitoring module is used to monitor the port status of the bound port and unbind and resume dynamic learning when the port status changes.

7. A system for defending a smart substation against forged MAC attacks according to claim 6, characterized in that: The statistics module includes: A threshold setting unit, used to set a trigger threshold COUNT of a statistical time window T and a number of data frames; A dynamic adjustment unit is used to adjust the service cycle t of the smart device according to the service cycle t of the smart device. cycle and the number of data frames n in each service cycle frame , dynamically adjust T and COUNT, the formula is: T=N×t cycle ,COUNT=N×n frame ; Where N is the safety factor.

8. The system for defending a smart substation against forged MAC attacks according to claim 6, characterized in that: The dynamic binding module includes: The port status monitoring unit is used to monitor in real time whether the access port status is continuously UP; The source address verification unit is used to confirm that the corresponding data frame is not received from other ports by comparing the source MAC address in real time, and trigger dynamic binding when the value of the message counter reaches the trigger threshold within the statistical time window.

9. The system for defending a smart substation against forged MAC attacks according to claim 6, characterized in that: The defense module includes: A forged MAC address identification unit is used to compare the MAC address of the received data frame with the bound source MAC address in real time in the binding state. If the MAC address of the data frame received by the non-bound port is the same as the source MAC address, the MAC address is a forged MAC address; A data frame discarding unit, used for discarding data frames with forged MAC addresses; The attack recording unit is used to record the access port and receiving time of the forged MAC address data frame and perform tracking processing.

Images