A security identification method, device and terminal equipment

Abstract

The application is suitable for the network security technical field, and provides a security identification method, device and terminal equipment, which comprises the following steps: collecting current communication messages of a substation monitoring system; performing protocol analysis on the current communication messages to obtain protocol information of the current communication messages, wherein the protocol information at least comprises communication protocol data and message types; determining target protocol data corresponding to the current communication messages by using the communication protocol data according to whether the message types are to-be-associated message types; and performing security identification on the target protocol data by using a preset security rule library to obtain a security identification result of the current communication messages. According to whether the message types of the current communication messages are to-be-associated message types, the target protocol data of the current communication messages can be accurately determined, and the target protocol data is identified in a targeted manner by using the preset security rule library, so that the effective identification of risk messages in the substation monitoring system is realized, and the security of the substation monitoring system is improved.

Images