Substation network message intelligent analysis method and system based on protocol identification

Abstract

The invention discloses a transformer substation network message intelligent analysis method and system based on protocol identification, and relates to the technical field of communication networks. Analyzing the header of the message; feature matching and protocol identification; analyzing the content of the message; and integrating and displaying analysis results. According to the transformer substation network message intelligent analysis method based on protocol identification, coexistence of multiple protocols in domestic intelligent transformer substation network communication is taken as a background, and a message flowing through an intelligent transformer substation network and captured by a network monitoring tool or a network flow data packet capturing tool is taken as an object; a DPI technology is used for analyzing a message to obtain head feature information, the head feature information is matched with a network protocol information record in a protocol identification library, a specific protocol of the message is determined, and a corresponding data frame structure is obtained, so that analysis of message content is realized, and support is provided for next processing and decision making of the message.

Description

Technical Field

[0001] The present invention relates to the technical field of communication networks, and in particular to a method and system for intelligently analyzing substation network messages based on protocol identification. Background Art

[0002] Smart substations are gradually formed with the development of smart grid technology. Smart grid technology realizes intelligent monitoring, control and management of power systems by integrating advanced communication, information and control technologies. As an important part of smart grid, smart substations realize intelligent monitoring, automatic operation and optimized operation of substations by integrating intelligent devices, information platforms and advanced application functions. In the construction of smart substations, the existence of various standards and protocols has led to the inconsistency of network protocols. For example, although the IEC 61850 standard is widely adopted, there are still many different protocols such as GOOSE, SV, MMS, and some manufacturers' private protocols. These protocols have their own characteristics in functions and applications, but they also bring challenges in compatibility and integration.

[0003] Commonly used network protocols for domestic smart substations include GOOSE of DL / T860 (IEC61850), MMS message protocol, IEC60870-5-104, Nanrui Relay Protection Network 103 Protocol, Beijing Sifang Network 103 Protocol, etc. The IEC 61850 standard is a global standard in the field of power system automation, mainly used to achieve the standardization of engineering operations of smart substations. Through the implementation of standards, it makes the engineering implementation of smart substations standardized, unified and transparent. The IEC 61850 standard divides the substation communication system into three layers: station control layer, interval layer and process layer, and defines the communication interface between layers. It uses object-oriented data modeling technology and defines a data model based on a client / server structure, so that devices can exchange information more flexibly.

[0004] GOOSE (Generic Object Oriented Substation Event) is a communication service for substation automation system defined in IEC 61850 standard. It is based on publish / subscribe model and supports fast and reliable data exchange. MMS (Manufacturing Message Specification) is a protocol used in IEC 61850 standard to implement mapping from special communication service interface (ACSI) to manufacturing message specification (MMS). It is mainly used for communication between devices in peer-to-peer real-time communication network. IEC60870-5-104 protocol is a protocol for communication between plant station and distribution network master station. It uses Ethernet as carrier and the service mode is balanced mode. In power system, common equipment such as dispatching end (control station, master station, client) and service end (controlled station, substation, typical equipment includes TTU, RTU, etc.) communicate and transmit data through 104 protocol. NARI Relay Protection Network 103 Protocol and Beijing Sifang Network 103 Protocol are communication protocols customized by NARI Relay Protection and Beijing Sifang for specific application scenarios, and are used to achieve communication with equipment in the power system.

[0005] Deep Packet Inspection (DPI) technology is a traffic detection and control technology based on the application layer. The so-called "depth" is compared with the ordinary message analysis level. Ordinary message detection only analyzes the content below the 4th layer of the IP packet, including the source address, destination address, source port, destination port and protocol type. In addition to the previous layer analysis, DPI also adds application layer analysis to identify various applications and their contents. DPI technology deeply reads the content of the IP packet payload to reorganize the application layer information in the OSI seven-layer protocol to obtain the content of the entire application.

[0006] The Protocol Identification Library (PIL) is a database used to assist in identifying various protocols used in network traffic. PIL stores records of known commonly used network protocol information. The content of each record includes the network protocol name, version, data frame characteristics, data frame structure, used ports, traffic type, etc., such as IPv4 protocol information and IPv6 protocol information. By using the existing network protocol information in PIL, the protocol used by the messages in the network traffic can be identified. In addition, for protocols that do not exist in PIL, users can use relevant tools (algorithms, etc.) to automatically or manually add unknown network protocol information records to PIL as needed, thereby expanding PIL's protocol identification capabilities. Summary of the invention

[0007] In view of the above-mentioned problems, the present invention is proposed.

[0008] Therefore, the technical problem solved by the present invention is: in view of the coexistence of multiple protocols in the domestic smart substation network, these protocols have their own characteristics in function and application, resulting in poor compatibility, low processing efficiency, and complex message content parsing in the message data integration in the network traffic. At the same time, in order to improve the accuracy and scalability of network protocol identification and content parsing, the present invention proposes a substation network message intelligent analysis method based on protocol identification, which is used to realize protocol identification and message analysis of the current smart substation network traffic. The present invention takes the data packets captured in the network traffic as the object, uses the deep packet inspection (DPI) technology to parse the data packets layer by layer, combines the network protocol information in the protocol identification library (PIL) to record and identify the protocol of the data packet, and uses the corresponding protocol specification and data frame format to analyze the content of the data packet.

[0009] In order to solve the above technical problems, the present invention provides the following technical solutions: a substation network message intelligent analysis method based on protocol identification, comprising:

[0010] Capture data packets for processing; parse the information features of message headers; match features and identify protocols; analyze message content; integrate analysis results for display.

[0011] As a preferred solution of the substation network message intelligent analysis method based on protocol identification described in the present invention, the method of capturing data packets for processing includes using a network monitoring tool or a network traffic data packet capture tool to capture messages flowing through the smart substation network, preprocessing the captured messages, and obtaining messages M that can be used for subsequent processing.

[0012] As a preferred solution of the substation network message intelligent analysis method based on protocol identification described in the present invention, wherein: the analysis of message header information features includes parsing message M, obtaining header information in the message, and determining the payload content of the message.

[0013] As a preferred solution of the substation network message intelligent analysis method based on protocol identification described in the present invention, wherein: the determining the payload content of the message includes extracting the header of each layer of the message M layer by layer in hierarchical order by using DPI technology according to the OSI seven-layer model and 802.3, 8802-3 standard specifications, and saving the header content as header feature information H;

[0014] The content in the header feature information H is mapped into a feature set HC.

[0015] As a preferred solution of the substation network message intelligent analysis method based on protocol identification described in the present invention, the feature matching and protocol identification include matching the header feature set HC with the network protocol information record set in the protocol identification library PIL to form a candidate protocol set for the message, determine the message protocol, and obtain detailed structure information of the data frame.

[0016] As a preferred solution of the substation network message intelligent analysis method based on protocol identification described in the present invention, wherein: the acquisition of detailed structure information of the data frame includes comparing each item in the header feature set HC with the content in each information record in the PIL library one by one based on the OSI specification, and if there is a match, adding the record to the protocol candidate set to complete the traversal of the PIL library;

[0017] If the number of records in the protocol candidate set is 1, the protocol in the record is a message protocol; if the number of records in the protocol candidate set is greater than 1, it is necessary to match other information in the header feature information H with the important features of each record in the protocol candidate set to determine the message protocol;

[0018] Determine the protocol and version in the matching network protocol information record, and obtain the corresponding data frame detailed structure information F.

[0019] As a preferred solution of the substation network message intelligent analysis method based on protocol identification described in the present invention, wherein: the analysis of message content includes parsing the message header according to the order and specification of each field in the data frame detailed structure information F, and obtaining the value of each field in the header of each level in the OSI seven-layer model;

[0020] Determine whether the payload content of the message is encoded, encrypted or compressed according to the protocol. If it is encoded, encrypted or compressed, perform data conversion, decryption or decompression according to the data encoding, encryption method or compression method in the protocol information; otherwise, keep the original payload content unchanged;

[0021] Based on the protocol specification, obtain user data content C.

[0022] Another problem to be solved by the present invention is how to provide a substation network message intelligent analysis system based on protocol identification.

[0023] To solve the above technical problems, the present invention provides the following technical solutions: a substation network message intelligent analysis system based on protocol identification, comprising: a data capture module, a header parsing module, a protocol identification module, a message analysis module and a result display module; the data capture module is used to capture data packets for processing; the header parsing module is used to parse the message header information features; the protocol identification module is used to match the features and identify the protocols; the message analysis module is used to analyze the message content; the result display module is used to integrate the analysis results for display.

[0024] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the above-mentioned method for intelligent analysis of substation network messages based on protocol identification are implemented.

[0025] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned method for intelligent analysis of substation network messages based on protocol identification.

[0026] Beneficial effects of the invention: The intelligent analysis method of substation network messages based on protocol identification provided by the invention is based on the characteristics of multiple protocols coexisting in the network traffic of smart substations, and proposes an intelligent analysis method of substation network messages based on protocol identification. The method cuts the captured data packets into two parts: header information and payload content, and parses the header information through DPI technology to obtain protocol features to determine the protocol used by the message, and then analyzes the message content.

[0027] By using the protocol identification library (PIL), the protocol of the message can be quickly identified and the corresponding data frame structure can be determined. Although multiple protocols coexist in the network traffic of smart substations, the number or type of protocols is small. This method can improve the feature matching performance and accuracy of known network protocols through the protocol identification library (PIL), and considers the extensibility of the protocol identification library (PIL), allowing users to add new network protocol information to the library. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0029] Figure 1 An OSI seven-layer model and structure diagram of each layer of a substation network message intelligent analysis method based on protocol identification provided by an embodiment of the present invention.

[0030] Figure 2 An overall flow chart of a substation network message intelligent analysis method based on protocol identification provided by one embodiment of the present invention.

[0031] Figure 3 A data frame structure hierarchy diagram of the GOOSE protocol of a substation network message intelligent analysis method based on protocol identification provided by an embodiment of the present invention.

[0032] Figure 4 A GOOSE message data frame structure diagram of a substation network message intelligent analysis method based on protocol identification provided by an embodiment of the present invention.

[0033] Figure 5 A diagram of messages M flowing through a smart substation network captured by a method for intelligent analysis of substation network messages based on protocol identification provided by an embodiment of the present invention.

[0034] Figure 6 A hierarchical diagram of the data frame structure of each protocol in the IEC 61850 standard of a substation network message intelligent analysis method based on protocol identification provided by an embodiment of the present invention.

[0035] Figure 7 An APDU structure diagram of the GOOSE protocol of a substation network message intelligent analysis method based on protocol identification provided by an embodiment of the present invention.

[0036] Figure 8 A diagram showing the parsing results of the APDU encoding portion in a message M of a substation network message intelligent analysis method based on protocol identification provided by an embodiment of the present invention.

[0037] Fig. 9 An overall structural diagram of a substation network message intelligent analysis system based on protocol identification provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0039] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0040] Example 1

[0041] Reference Figure 1-Figure 2 , is an embodiment of the present invention, and provides a substation network message intelligent analysis method based on protocol identification, comprising:

[0042] A network message using the OSI model is represented as a tuple, i.e., M = (Head, Data), where Head is the header of the message, including headers of all layers from the data link layer (the tail DT of the link layer is only used for verification) to the application layer except user data, i.e., Head = (DH, NH, TH, SH, PH, AH), where DH, NH, TH, SH, PH, AH are the data link layer header, network layer header, transport layer header, session layer header, presentation layer header, and application layer header, respectively; Data is the user data portion of the message.

[0043] The Protocol Identification Library (PIL) is a database that stores various known network protocol information. PIL can be expressed as a collection of network protocol information records, that is, PIL = {R 1 ,R 2 ,…,R n}, where R i (i=1,2,…,n) is the i-th network protocol information record in PIL. The content of each record includes the network protocol name, version, data frame characteristics, transport layer protocol, used port, data frame detailed structure, etc., that is, each network protocol information record R can be expressed as:

[0044] R={pName,ver,hfs,tProtocol,port,fStruc,[character]}

[0045] Among them, pName is the protocol name, ver is the protocol version, hfs is the hierarchy of frame structure, tProtocol is the transport layer protocol, port is the port used, fStruc is the detailed structure information of the data frame, and character is an optional item used to describe the important feature set of the protocol to help distinguish other protocols with similar information. For example, the protocol information record of the IEC 61850MMS protocol in PIL is represented as:

[0046] R MMS ={MMS,1,1+11111,1,102,fStruc MSS}

[0047] Among them, MMS is the protocol name; the default version number is 1; the value of the data frame structure layer hfs indicates that MMS uses all the layers of the OSI seven-layer model. Since the physical layer must be used, it does not need to be specially marked (ignored) here. In addition, the header format of the session layer and the presentation layer is not specifically specified in the OSI model, but depends on the implementation of the specific protocol used by the upper layer. If there is obvious synchronization and processing of dialogue control information in the message header, the session layer can be considered to exist. Similarly, if there is information such as data representation (encoding), encryption and compression in the message header, the presentation layer can be considered to exist. The value of hfs "1+11111" from left to right: "1+" means that the data link layer is used, including the MAC sublayer and the LLC sublayer. If the LLC sublayer is not used, it is represented by "1-"; the value of each subsequent bit corresponds to whether the layer is used. If the value is 1, it means that the layer is used, if it is 0, it is not used; the value of tProtocol is 1, indicating that the TCP protocol is used, if it is 0, it means that UDP is used. If the value of the corresponding position in the data frame feature tfs is 0, that is, the transport layer protocol is not used, the value of tProtocol is set to NULL; the port number 102 refers to the port used by the MMS server. Under normal circumstances, different protocols use different port numbers. If the value of tProtocol is set to NULL, the value of port is also set to NULL, fStruc MMS Indicates the detailed structure information of the MMS data frame, that is, the fields of the frame and their meanings; the optional character is not filled in here. The protocol information record of the IEC61850 GOOSE protocol can be expressed as:

[0048] R GOOSE ={GOOSE,1,1-00011,NULL,NULL,fStruc GOOSE ,{B17B18

[0049] =0x88B8,B19B20=0x0000~0x3FFF}}

[0050] The GOOSE protocol only uses four layers of the OSI seven-layer model, namely the physical layer, data link layer, presentation layer and application layer, and the data link layer does not use the LLC sublayer, so its hfs value is not "1-00011"; in addition, in order to distinguish it from other protocols with the same frame structure layer, the important characteristics of the GOOSE protocol are filled in the optional character {B17B18=0x88B8, B19B20=0x0000~0x3FFF}, that is, the Ethernet type field Ethertype represented by the 17th and 18th bytes of the data frame has a value of hexadecimal 88B8, and the value range of the APPID field of the 19th and 20th bytes is between hexadecimal 0000 and 3FFF.

[0051] The present invention identifies and analyzes the commonly used protocols in the domestic smart substation network communication. The main network protocols include GOOSE of DL / T860 (IEC61850), MMS message protocol, IEC60870-5-104, NARI relay protection network 103 protocol and Beijing Sifang network 103 protocol.

[0052] The method for intelligent analysis of substation network messages based on protocol identification provided by the present invention is based on the coexistence of multiple protocols in domestic intelligent substation network communications, and takes messages flowing through the intelligent substation network captured by network monitoring tools or network traffic data packet capture tools as the object. It uses DPI technology to parse the messages to obtain header feature information, and by matching the header feature information with the network protocol information record in the protocol identification library (PIL), the specific protocol of the message is determined and the corresponding data frame structure is obtained, thereby realizing the analysis of the message content (including all levels of headers and user data).

[0053] To achieve the above objectives, the present invention adopts the following technical solutions:

[0054] Packet capture and processing. Use network monitoring tools or network traffic packet capture tools to capture messages flowing through the smart substation network, and perform pre-processing such as denoising and filtering on the captured messages. The denoising operation is mainly to remove message errors caused by channel noise; the filtering operation is mainly to filter out messages that do not meet the specifications or have errors, and remove the tail DT that is only used to verify the link layer, and obtain the message M that can be used for subsequent processing.

[0055] Analyze the characteristics of the message header information. Figure 1The OSI seven-layer model specification shown in the figure uses the DPI technology to extract the header of each layer of the message M layer by layer in hierarchical order. First, the data link layer header DH is extracted, the MAC address is obtained from DH, and it is determined whether the LLC sublayer is included; the network layer header NH is extracted, if NH exists, the network address is obtained from NH, otherwise NH=NULL; the transport layer header TH is extracted, if TH exists, the transport layer protocol used is determined according to TH and the port number is obtained, otherwise TH=NULL; the session layer header SH is extracted, if SH exists, SH is saved, otherwise SH=NULL; the presentation layer header PH is extracted, if PH exists, the data encoding, encryption method or compression method, etc. are obtained from PH, otherwise PH=NULL; the application layer header AH is extracted, if AH exists, AH is saved, otherwise AH=NULL; finally, the above content is saved as the header feature information H.

[0056] Construct a message header information feature set. Map the content in the header feature information H to a feature set HC, HC = {new_hfs, new_tProtocol, new_port}, where new_hfs represents the data frame structure layer of the message M, that is, which layers of the OSI seven-layer model M uses. If the data link layer contains the LLC sublayer, it is represented as "1+", otherwise it is "1-", and the other layers are "1" or "0" depending on whether they are used. The representation method is consistent with hfs in the protocol information record R in PIL; new_tProtocol and new_port represent the protocol and port number of the transport layer respectively, and their meanings are also consistent with tProtocol and port in the protocol information record R in PIL.

[0057] Match the header information feature set to determine the candidate protocol set. Record R with each protocol information in HC and PIL i (i=1,2,…,n) to match, the matching rules are: ① If new_hfs in HC matches the current record R i If the hfs in the table is consistent, that is, new_hfs = hfs, then continue to step ②, otherwise skip record R i , R i+1 As the current record, re-execute step ①; ② If the new_tProtocol in HC is the same as the current record R i If the tProtocol in is consistent, that is, new_tProtocol = tProtocol, then continue to step ③, otherwise skip record R i , R i+1 As the current record, return to step ① and execute again; ③ If the new_port in HC is the same as the current record R iIf the port in is consistent, that is, new_port = port, it means the match is successful, and R i Add to the candidate protocol set CPS (Candidate Protocol Sets) and continue to match the next record, otherwise skip record R i , R i+1 As the current record, return to step ① and execute again.

[0058] Identify the message protocol. After completing the traversal of the protocol information record set in PIL, if there is only one record Rr in the candidate protocol set CPS, the protocol of the message is determined to be the protocol in the record; if the number of records in the selected protocol set CPS is greater than 1, it is necessary to match the other information in the header feature information H obtained in step (2) with the important feature character in each record in CPS to determine the final protocol Rr; if the number of records in the selected protocol set CPS is 0, it means that the protocol is an unknown protocol and can be identified by expanding PIL.

[0059] Determine the detailed data frame structure of the message. According to Rr obtained in step (5), obtain the detailed data frame structure fStruc of Rr, and expand each field in fStruc; if the value of hfs corresponding to the presentation layer in Rr is "1", then according to the header feature information H obtained in step (2), obtain the data encoding, encryption method or compression method information of PH therein, otherwise omit this process.

[0060] Message content analysis. First, parse the message header Head according to the order and specification of each field in fStruc to obtain the value of each field in the header of each layer in the OSI seven-layer model; then analyze the user data Data. If the value of the presentation layer is "0", that is, the message does not use the presentation layer, the actual user data content can be directly obtained from the Data; otherwise, according to the data encoding, encryption method or compression method information obtained in step (6), encode and convert (decode), decrypt or decompress the Data to obtain the actual user data content.

[0061] The analysis results are collated and displayed. The analysis results of step (7) are saved as M'=(Head', Data'). According to user needs, relevant data is taken from the corresponding protocol information record Rr and displayed as required to provide support for the next step of processing or decision-making. The implementation idea of ​​the whole method is as follows: Figure 2 The specific description is shown in Table 1:

[0062] Table 1 Experimental steps description

[0063]

[0064]

[0065] Example 2

[0066] Reference Figure 3-Figure 7 , is an embodiment of the present invention, and provides a substation network message intelligent analysis method based on protocol identification, comprising:

[0067] This embodiment simulates capturing a GOOSE protocol message in the smart substation network traffic as a sample. Since the present invention does not focus on incomplete or erroneous messages, denoising and filtering in data preprocessing are not the focus of the present invention. A normally usable message is taken as an example to verify each step of the present invention.

[0068] When GOOSE messages are transmitted on the network, the OSI model is used, but only four of the seven layers of the OSI model are used, including the application layer, presentation layer, data link layer, and physical layer. The transport layer and network layer are empty. The application layer defines the protocol data unit APDU. After being encoded by the presentation layer, it does not use the TCP / IP protocol, but is directly mapped to the data link layer and physical layer. For example, Figure 3 As shown. In the presentation layer, the application layer defines the protocol data unit APDU using ASN.1 encoding. The encoding structure adopted by the ASN.1 basic encoding rules consists of three parts: tag, length, and content. The GOOSE message data frame structure is as follows Figure 4 As shown, it includes: destination address, source address, 4-byte Tag (TPID and TCI), Ethernet frame type, APPID, APDU length, 4-byte reserved 1 and reserved 2, and GOOSE PDU (APDU). Here, the preamble, frame start symbol, and frame check FCS do not belong to the data frame content. In addition, it is assumed that the PIL library stores GOOSE, SV, MMS and other protocols in the IEC 61850 standard, IEC60870-5-104, NARI relay protection network 103 protocol, Beijing Sifang network 103 protocol, etc.

[0069] Follow the instructions above, the specific steps are as follows:

[0070] The first step is to use network traffic packet capture tools (such as MMS-Ethereal, Wireshark or Netfilter, which can automatically implement noise removal, filtering operations and remove preamble, frame start symbol and frame check FCS) to capture the messages flowing through the smart substation network and obtain available message M. Figure 5 shown.

[0071] The second step is to analyze the characteristics of the message header information. According to the OSI seven-layer model and the EtherCAT standard specification, the DPI technology is used to extract the header of each layer of the message M layer by layer in hierarchical order. First, the data link layer header DH is extracted, and the destination address "A1012D 1121BF" and the source address "A21C 2A 013560" are obtained from DH. The LLC sublayer is not found; there is no network layer header, transport layer header, or session layer header; it is found that the message is encoded, that is, there is a presentation layer; APDU is found, and there is an application layer; the above information is saved as H.

[0072] The third step is to construct a message header information feature set. According to the usage of the data frame structure layer, the transport layer protocol and the port number information stored in H, the feature set HC = {1-00011, NULL, NULL} is mapped.

[0073] Step 4: Match the header information feature set to determine the candidate protocol set. Match HC = {1-00011, NULL, NULL} with each protocol information record R in PIL. i (i=1,2,…,n) According to the matching rules, we can get the candidate protocol set CPS={R SV ,R GOOSE}, because {hfs,tProtocol,port} in the SV protocol information record in PIL and the GOOSE protocol information record are all {1-00011,NULL,NULL}, the data frame structure hierarchy of the SV protocol and the GOOSE protocol is as follows Figure 6 shown.

[0074] Step 5: Identify the message protocol. SV ,R GOOSE}, it is necessary to obtain the head feature information H and R SV and R GOOSE The important feature information described by the character can be found Figure 5 The values ​​of the 17th and 18th bytes are "88B8", and the values ​​of the 19th and 20th bytes are "03F2" in the range of 0000 to 3FFF. Therefore, it can be determined that the protocol of the message is GOOSE.

[0075] Step 6: Determine the detailed structure of the data frame of the message. According to the protocol GOOSE determined in the previous step, record R from PIL GOOSE Take out the corresponding data frame detailed structure fStruc GOOSE ,The detailed structure of GOOSE data frame includes Figure 4 and Figure 7 The two parts of the exhibition Figure 7It is the APDU structure of the GOOSE protocol used for parsing the message data content.

[0076] Step 7: Analyze the message content. Figure 4 Parse the values ​​of the fields before APDU. In addition to the destination address and source address, Ethernet frame type and APPID already obtained in the previous step, there are also TPID, TCI, APDU length and two reserved fields; then combine Figure 7 As shown in the APDU structure, GOOSE uses ASN.1 encoding, which needs to be parsed according to the basic encoding rules of ASN.1, namely, tag, length, and value. Tools or programs can be used to automatically parse the encoding content. The parsing result of the APDU encoding part in message M is as follows: Figure 8 In addition, since the value of "GOOSE data TL" (marked 0xAB) in APDU is empty, the message does not contain allData content.

[0077] Step 8: Arrange and display the analysis results. Save the analysis results of the previous step as a readable message M'=(Head', Data'), extract relevant data from the GOOSE protocol information record according to user needs and display them as required.

[0078] Example 3

[0079] Reference Figure 8 , is an embodiment of the present invention, and provides a substation network message intelligent analysis system based on protocol identification, including:

[0080] Data capture module 100, header parsing module 200, protocol identification module 300, message analysis module 400 and result display module 500;

[0081] The data capture module 100 is used to capture data packets for processing;

[0082] The header parsing module 200 is used to parse the message header information features;

[0083] The protocol identification module 300 is used to match features and identify protocols;

[0084] The message analysis module 400 is used to analyze message content;

[0085] The result display module 500 is used to integrate the analysis results for display.

[0086] Step 1: Data packet capture and processing:

[0087] Use a network monitoring tool or a network traffic data packet capture tool to capture the messages flowing through the smart substation network, and pre-process the captured messages, including denoising and filtering, to obtain messages M that can be used for subsequent processing.

[0088] Step 2: Analyze the characteristics of the message header information:

[0089] For message M, combine the OSI seven-layer model and 802.3, 8802-3 Ethernet standards to parse each layer from the physical layer to the application layer, obtain detailed information in the message header, such as source address, destination address, port number, protocol type, etc., and determine the payload content of the message. The specific steps are as follows:

[0090] Step 201: According to the OSI seven-layer model and 802.3 and 8802-3 standard specifications, the DPI technology is used to extract the header of each layer of the message M layer by layer in hierarchical order, and the MAC address, network layer address, transport layer port number, protocol type and other characteristic information are obtained, and the above content is saved as header characteristic information H;

[0091] Step 202: Map the content in the header feature information H into a feature set HC, where the HC includes the layer used by the message, the transport layer protocol, the used port, etc.;

[0092] Step 3: Feature matching and protocol identification:

[0093] The header feature set HC constructed in step 2 is matched with the network protocol information record set in the protocol identification library (PIL) to form a candidate protocol set for the message, determine the message protocol, and then obtain the detailed structure information of the data frame. The specific steps are as follows:

[0094] Step 301: Based on the OSI specification, compare the contents of each item in the header feature set HC with the contents of each information record in the PIL library one by one. If they match, add the record to the protocol candidate set to complete the traversal of the PIL library.

[0095] Step 302: If the number of records in the protocol candidate set is 1, the protocol in the record is a message protocol; if the number of records in the protocol candidate set is greater than 1, it is necessary to match other information in the header feature information H with important features in each record in the protocol candidate set to determine the message protocol;

[0096] Step 303: Determine the protocol and version in the matching network protocol information record, and obtain the corresponding data frame detailed structure information F.

[0097] Step 4: Message content analysis:

[0098] Analyze the message M according to the detailed structure information F of the protocol data frame to obtain the complete header information and specific data content in the message. The specific steps are as follows:

[0099] Step 401: Parse the message header according to the order and specification of each field in the data frame detailed structure information F to obtain the value of each field in the header of each layer in the OSI seven-layer model.

[0100] Step 402: Determine whether the payload content of the message is encoded, encrypted or compressed according to the protocol. If it is encoded, encrypted or compressed, perform data conversion (decoding), decryption or decompression according to the data encoding, encryption method or compression method in the protocol information; otherwise, keep the original payload content unchanged;

[0101] Step 403: According to the result of the previous step and based on the protocol specification, obtain the user data content C.

[0102] Step 5: Integrate the analysis results and present:

[0103] Integrate the contents obtained from the above steps to form a readable result M' and display it to the target users to help them make decisions.

[0104] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0105] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0106] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0107] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0108] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A substation network message intelligent analysis method based on protocol identification, characterized in that: include: Capture data packets for processing; Analyze the characteristics of message header information; Match features and identify protocols; Analyze the message content; The integrated analysis results are presented.

2. The method for intelligent analysis of substation network messages based on protocol identification according to claim 1, characterized in that: The capturing of data packets for processing includes using a network monitoring tool or a network traffic data packet capturing tool to capture messages flowing through the smart substation network, and preprocessing the captured messages to obtain messages M that can be used for subsequent processing.

3. The method for intelligent analysis of substation network messages based on protocol identification according to claim 2, characterized in that: The analyzing of the message header information features includes analyzing the message M, obtaining the header information in the message, and determining the payload content of the message.

4. The method for intelligent analysis of substation network messages based on protocol identification according to claim 3 is characterized in that: Determining the payload content of the message includes extracting the header of each layer of the message M layer by layer in hierarchical order using DPI technology according to the OSI seven-layer model and 802.3 and 8802-3 standard specifications, and saving the header content as header feature information H; The content in the header feature information H is mapped into a feature set HC.

5. The method for intelligent analysis of substation network messages based on protocol identification according to claim 4, characterized in that: The feature matching and protocol identification includes matching the header feature set HC with the network protocol information record set in the protocol identification library PIL to form a candidate protocol set for the message, determine the message protocol, and obtain detailed structure information of the data frame.

6. The method for intelligent analysis of substation network messages based on protocol identification according to claim 5, characterized in that: The obtaining of detailed structural information of the data frame includes comparing each item in the header feature set HC with the content in each information record in the PIL library one by one based on the OSI specification, and if there is a match, adding the record to the protocol candidate set to complete the traversal of the PIL library; If the number of records in the protocol candidate set is 1, the protocol in the record is a message protocol; if the number of records in the protocol candidate set is greater than 1, it is necessary to match other information in the header feature information H with the important features of each record in the protocol candidate set to determine the message protocol; Determine the protocol and version in the matching network protocol information record, and obtain the corresponding data frame detailed structure information F.

7. The method for intelligent analysis of substation network messages based on protocol identification according to claim 6, characterized in that: The analyzing message content includes parsing the message header according to the order and specification of each field in the data frame detailed structure information F, and obtaining the value of each field in the header of each layer in the OSI seven-layer model; Determine whether the payload content of the message is encoded, encrypted or compressed according to the protocol. If it is encoded, encrypted or compressed, perform data conversion, decryption or decompression according to the data encoding, encryption method or compression method in the protocol information; otherwise, keep the original payload content unchanged; Based on the protocol specification, obtain user data content C.

8. A system using the substation network message intelligent analysis method based on protocol identification as claimed in any one of claims 1 to 7, characterized in that: include: A data capture module (100), a header parsing module (200), a protocol identification module (300), a message analysis module (400) and a result display module (500); The data capture module (100) is used to capture data packets for processing; The header parsing module (200) is used to parse information features of the message header; The protocol identification module (300) is used to match features and identify protocols; The message analysis module (400) is used to analyze message content; The result display module (500) is used to integrate the analysis results for display.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the substation network message intelligent analysis method based on protocol identification described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the substation network message intelligent analysis method based on protocol identification described in any one of claims 1 to 7 are implemented.

Images