Tripwire generation method and system based on light load data simulation in power system network

Abstract

The invention provides a trip wire generation method and system based on light-load data simulation in an electric power system network, and belongs to the technical field of intelligent power grid safety, and the method comprises the steps: capturing electric power dedicated protocol data through passive monitoring, and carrying out the analysis and storage; constructing a false data packet according to a power protocol, and simulating real traffic characteristics, addresses and contents; designing a plurality of tripwire types, deploying and controlling flow in a key area, and realizing dynamic adjustment; cooperating with a honeypot, guiding an attacker to the honeypot and capturing behaviors; an interface and a configuration file are provided for management control, and an optimization strategy is monitored in real time. The defense capability of the power system network is improved.

Description

Technical Field

[0001] The present invention relates to the field of smart grid security technology, and in particular to a tripwire generation method and system based on light-load data simulation in a power system network. Background Art

[0002] The network security of power system networks, especially critical infrastructure such as smart grids, is facing increasingly severe threats. Attackers obtain sensitive information such as device addresses, communication modes, and business data through passive monitoring or active detection, thereby threatening the stable operation of the power system. Traditional security defense measures (such as firewalls and intrusion detection systems) mainly rely on feature matching of known threats and are difficult to deal with unknown or zero-day attacks. Honeypot technology, as an active defense method, attracts attackers and captures their behavior by simulating real systems, which to some extent makes up for the shortcomings of traditional technology. However, when traditional honeypot technology is applied in power system networks, it has problems such as high resource consumption, easy identification by attackers, and limited perception capabilities, making it difficult to meet the power system's requirements for high real-time performance and high security. Therefore, there is an urgent need for an efficient, low-consumption, and highly concealed security protection method to enhance the defense capabilities of power system networks.

[0003] The above problems become technical problems that need to be solved. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a method and system for generating a tripwire based on light-load data simulation in a power system network, which at least partially solve the problems existing in the prior art.

[0005] In a first aspect, an embodiment of the present invention provides a method for generating a tripwire based on light-load data simulation in a power system network, comprising the following steps:

[0006] Environmental sensing step S1: Through passive monitoring, traffic monitoring devices deployed at key network nodes capture communication data, parse it according to the IEC61850 and DNP3 power-specific protocols, and obtain analysis results including device identification, communication mode, and traffic characteristics. The analysis results are stored in a local database.

[0007] Step S2 of tripwire data packet construction: constructing a fake data packet according to the power protocol standard, simulating the characteristics of real business traffic, including packet size, transmission frequency, and transmission direction, using fake source and destination addresses so that the addresses are within the range of real device addresses, disguising the data content, and generating power parameters, control instructions, or alarm information similar to real business;

[0008] Tripwire generation and deployment step S3: Design multiple tripwire types, including control command tripwires, data collection tripwires, and alarm information tripwires. Deploy tripwire generators in key network areas. Use flow control mechanisms to ensure that tripwire traffic does not occupy excessive bandwidth. Optimize the dynamic adjustment strategy for tripwire generation based on network load and security status.

[0009] Step S4: Deploy a honeypot simulating power equipment in the network. The tripwire traffic is directed to the honeypot to guide the attacker away from the real assets. The tripwire generator and the honeypot work together to simulate the real communication process and capture the interaction between the attacker and the honeypot.

[0010] Management and control step S5: Through the API interface, remote on / off control of the tripwire generation system is realized, and tripwire parameters, including generation interval and traffic type, are adjusted through the configuration file. The tripwire traffic effect is monitored in real time, and the generation strategy is optimized regularly.

[0011] According to a specific implementation of an embodiment of the present invention, the environment perception step includes:

[0012] Based on network topology and traffic analysis, identify key nodes in the network with dense traffic and security-sensitive features, and select nodes covering the main communication paths, including substation switches, SCADA system boundaries, control network and monitoring network interfaces, and transmission and distribution line nodes;

[0013] According to the high real-time and reliability requirements of the power system, network TAP, SPAN or sniffing tool software wireshark, tcpdump traffic capture technology is selected;

[0014] Analyze traffic to extract device identification, communication patterns, and traffic characteristics, refer to standard documentation and open source implementations, and use multithreading or asynchronous I / O to handle high-throughput traffic;

[0015] The parsing results are saved in an efficient storage system. The time series data in the parsing results uses InfluxDB or TimescaleDB, the structured data in the parsing results uses PostgreSQL, and the unstructured data in the parsing results uses MongoDB.

[0016] According to a specific implementation of an embodiment of the present invention, the tripwire data packet construction step includes:

[0017] Constructing data packets according to protocol standards to ensure that the structure is compatible with legitimate traffic while embedding forged content;

[0018] Forge credible power data based on the device identification and communication mode extracted by protocol analysis;

[0019] Based on the network address pool information obtained by passive monitoring, a source / destination address that is within the legal device address range but not actually occupied is generated. Traffic targeting the virtual address will be redirected to the honeypot system.

[0020] Traffic features extracted based on protocol parsing are used to make tripwire packet behavior realistic, including GOOSE as small and periodic packets and SV as large and high-frequency packets;

[0021] The configuration information of the tripwire data package is entered into the relational database in a structured form for use in the next step of tripwire generation.

[0022] According to a specific implementation of an embodiment of the present invention, the tripwire generation and deployment steps include:

[0023] Based on common attack scenarios in power system networks, three types of tripwires are designed: control command tripwire, data acquisition tripwire, and alarm tripwire.

[0024] Utilize tripwire data to construct spoofed packets as the basis for tripwire traffic and dynamically populate the content;

[0025] Adjust the type and frequency of tripwire traffic based on real-time threat intelligence and network status;

[0026] Deploy tripwire generators at strategic locations across the network to maximize coverage of potential attack paths and protect critical assets;

[0027] According to the protocol characteristics and network capacity, the bandwidth upper limit of the tripwire traffic is set, the rate limit parameters are configured in the generator, and the tripwire traffic is dynamically adjusted according to the real-time network load data. The "token bucket algorithm" or "leaky bucket algorithm" is used for flow control.

[0028] Use high-precision timers to ensure that tripwire flow meets the time delay requirements of the power system.

[0029] According to a specific implementation of an embodiment of the present invention, the step of coordinating with the honeypot system includes:

[0030] Select virtual IED, virtual RTU, and virtual SCADA server, referencing the device identification data in the environment perception step, to make the honeypot type close to the real network;

[0031] A mixed deployment of low-interaction honeypots simulating basic protocol responses and high-interaction honeypots running full device simulators;

[0032] Configure IEC61850 response to forged events, support SCADA query and control, and configure DNP3 support object groups and response function codes;

[0033] Simulate equipment operating status and forge equipment alarm information;

[0034] By utilizing the network interaction technology of tripwire generation and flow control to generate tripwire traffic and virtual addresses, attackers are lured into the honeypot system, and the captured attack behavior is recorded in the NoSQL database in Json format to provide feedback for dynamic adjustment of the tripwire strategy.

[0035] According to a specific implementation of an embodiment of the present invention, the management and control step includes:

[0036] Develop a RESTful or gRPC-based API to implement the core functionality of the remote tripwire system. Use YAML or JSON configuration files to update the configuration at runtime, reducing the need to restart the system.

[0037] Visualize tripwire status, display network security situation in real time, and graphically display system environment configuration and operation;

[0038] By utilizing the attack behavior data captured in collaboration with the honeypot, the tripwire generation strategy is dynamically optimized, and a decision algorithm based on support vector machine (SVM) is used to adjust the priorities of different types of tripwires.

[0039] In a second aspect, an embodiment of the present invention further provides a tripwire generation system based on light-load data simulation in a power system network, comprising:

[0040] Environmental perception module: This module uses traffic monitoring devices deployed at key network nodes to capture communication data through passive monitoring. It then parses the IEC61850 and DNP3 power-specific protocols to obtain analysis results, including device identification, communication mode, and traffic characteristics. The analysis results are then stored in a local database.

[0041] Tripwire Data Packet Construction Module: This module is used to construct fake data packets based on power protocol standards, simulating the characteristics of real business traffic, including packet size, transmission frequency, and transmission direction. It uses fake source and destination addresses to ensure that the addresses are within the range of real device addresses, disguises the data content, and generates power parameters, control instructions, or alarm information similar to real business.

[0042] Tripwire Generation and Deployment Module: This module is used to design various tripwire types, including control command tripwires, data collection tripwires, and alarm information tripwires. Tripwire generators are deployed in key network areas. Traffic control mechanisms are used to ensure that tripwire traffic does not occupy excessive bandwidth. Dynamic adjustment strategies for tripwire generation are optimized based on network load and security status.

[0043] Honeypot system collaboration module: This module is used to deploy honeypots that simulate power equipment on the network. Tripwire traffic is directed to the honeypots, diverting attackers away from real assets. The tripwire generator and honeypot work together to simulate real communication processes and capture the attacker's interaction with the honeypot.

[0044] Management and control module: Used to achieve remote on / off control of the tripwire generation system through the API interface, adjust tripwire parameters through configuration files, including generation interval and traffic type, monitor tripwire traffic effects in real time, and regularly optimize generation strategies.

[0045] According to a specific implementation of an embodiment of the present invention, the environment perception module further includes:

[0046] Listening location determination unit: used to identify key nodes with dense traffic and security-sensitive in the network based on network topology and traffic analysis, and select nodes covering the main communication paths;

[0047] Monitoring technology selection unit: used to select network TAP, SPAN or sniffing tool software wireshark, tcpdump traffic capture technology according to the high real-time and reliability requirements of the power system;

[0048] Protocol parsing unit: This unit analyzes traffic to extract device identification, communication patterns, and traffic characteristics. It references standard documentation and open-source implementations, uses multi-threading or asynchronous I / O to handle high-throughput traffic, and caches common message templates to reduce repeated parsing overhead.

[0049] Data storage unit: used to save parsed data to an efficient storage system. Time series data uses InfluxDB or TimescaleDB, structured data uses PostgreSQL, and unstructured data uses MongoDB. Message queues including Kafka are used to buffer high-throughput parsed data.

[0050] According to a specific implementation of an embodiment of the present invention, the tripwire data packet construction module further includes:

[0051] Data packet design unit: used to construct data packets according to protocol standards, ensure the structure is compatible with legitimate traffic, and embed forged content;

[0052] Content camouflage unit: used to forge credible power data based on the device identification and communication mode extracted by protocol parsing;

[0053] Address virtual unit: used to generate source / destination addresses that are within the legal device address range but not actually occupied based on the network address pool information obtained through passive monitoring. Traffic targeting the virtual addresses will be redirected to the honeypot system.

[0054] Statistical feature simulation unit: used to make tripwire data packets behave realistically based on traffic features extracted by protocol analysis;

[0055] Data storage unit: used to enter the configuration information of the tripwire data package into the relational database in a structured form for use in the next step of tripwire generation.

[0056] According to a specific implementation of the embodiment of the present invention, the management and control module further includes:

[0057] Interface and Configuration File Management Unit: This unit is used to develop RESTful or gRPC-based APIs to support remote control of the core functions of the tripwire system. It uses YAML or JSON format configuration files to support runtime configuration updates, reducing the need to restart the system.

[0058] Management interface display unit: used to visualize tripwire status, display network security situation in real time, and graphically configure and operate the system environment;

[0059] Strategy Adjustment Unit: This unit is used to dynamically optimize the tripwire generation strategy by utilizing the attack behavior data captured in collaboration with the honeypot, and to adjust the priority of different types of tripwires using a decision algorithm based on a support vector machine (SVM).

[0060] The present invention has the following beneficial effects: The present invention has many significant beneficial effects in terms of power system network security protection:

[0061] Passive monitoring is used instead of active scanning to avoid network delays and security alerts caused by active scanning, ensuring zero delay, meeting the real-time requirements of the power system, and protecting real-time business from interference.

[0062] Tripwire data packets are highly similar to real traffic in terms of protocol, behavior, and content. By simulating real business traffic characteristics, disguising data content, and using virtual addresses within the legal range, they greatly improve their concealment, making them difficult for attackers to identify and effectively confusing them.

[0063] It is specifically designed to parse and construct data packets for specialized protocols such as IEC 61850 and DNP3 commonly used in power systems, ensuring applicability in power system network environments and solving the problem of incompatibility of existing technical protocols.

[0064] Light-load data simulation technology and lightweight data packet construction process occupy less computing and storage resources, making them suitable for resource-constrained devices in power systems and avoiding excessive occupation of system resources.

[0065] It can dynamically adjust tripwire strategies based on network load and security situation. For example, it can intelligently adjust the type and frequency of tripwire traffic based on real-time threat intelligence and network status. It can also optimize tripwire generation strategies based on attack behavior data captured in collaboration with honeypots, thereby improving the pertinence and effectiveness of defense.

[0066] Working in conjunction with the honeypot system, it guides attackers to the honeypot, captures their interactive behaviors, and provides early warning and tracing support for security personnel, making it easier to detect potential threats and track attackers in a timely manner, thereby enhancing network security defense capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0067] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0068] Figure 1 A schematic flow chart of a tripwire generation method based on light-load data simulation in a power system network provided by an embodiment of the present invention;

[0069] Figure 2 A schematic diagram of the structure of a tripwire generation system based on light-load data simulation in a power system network provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0070] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0071] See also Figure 1 and Figure 2 , an embodiment of the present invention provides a tripwire generation method based on light-load data simulation in a power system network, comprising the following steps:

[0072] Environmental sensing step S1: Through passive monitoring, traffic monitoring devices deployed at key network nodes capture communication data, parse it according to the IEC61850 and DNP3 power-specific protocols, and obtain analysis results including device identification, communication mode, and traffic characteristics. The analysis results are stored in a local database.

[0073] Step S2 of tripwire data packet construction: constructing a fake data packet according to the power protocol standard, simulating the characteristics of real business traffic, including packet size, transmission frequency, and transmission direction, using fake source and destination addresses so that the addresses are within the range of real device addresses, disguising the data content, and generating power parameters, control instructions, or alarm information similar to real business;

[0074] Tripwire generation and deployment step S3: Design multiple tripwire types, including control command tripwires, data collection tripwires, and alarm information tripwires. Deploy tripwire generators in key network areas. Use flow control mechanisms to ensure that tripwire traffic does not occupy excessive bandwidth. Optimize the dynamic adjustment strategy for tripwire generation based on network load and security status.

[0075] Step S4: Deploy a honeypot simulating power equipment in the network. The tripwire traffic is directed to the honeypot to guide the attacker away from the real assets. The tripwire generator and the honeypot work together to simulate the real communication process and capture the interaction between the attacker and the honeypot.

[0076] Management and control step S5: Through the API interface, remote on / off control of the tripwire generation system is realized, and tripwire parameters, including generation interval and traffic type, are adjusted through the configuration file. The tripwire traffic effect is monitored in real time, and the generation strategy is optimized regularly.

[0077] Corresponding to the above method, see Figure 2 The present invention provides a tripwire generation system based on light-load data simulation in a power system network, comprising:

[0078] Environmental perception module

[0079] Through passive monitoring, communication data is captured using traffic monitoring devices deployed at key network nodes.

[0080] Parse power-specific protocols such as IEC 61850 and DNP3 to extract information such as device identification, communication mode, and traffic characteristics.

[0081] The parsing results are stored in a local database and updated regularly to reflect dynamic changes in the network.

[0082] Tripwire packet construction module:

[0083] Construct false data packets according to power protocol standards (such as GOOSE, SV, and DNP3).

[0084] Simulate the characteristics of real business traffic, including packet size, sending frequency, transmission direction, etc.

[0085] Use fake source and destination addresses to ensure that the addresses are within the real device address range.

[0086] Disguise data content to generate power parameters, control instructions or alarm information similar to real business.

[0087] Tripwire generation and deployment module:

[0088] Design various types of tripwires, such as control command tripwires, data collection tripwires, and alarm information tripwires.

[0089] Deploy tripwire generators in key areas of the network (such as the boundary between the control network and the monitoring network, and near the SCADA server).

[0090] Through the flow control mechanism, it is ensured that the tripwire traffic does not occupy too much bandwidth. For example, the GOOSE tripwire generates 5-10 small packets per second.

[0091] Supports dynamic adjustment to optimize tripwire generation strategy based on network load and security situation.

[0092] Collaboration module with honeypot system:

[0093] Deploy honeypots that simulate power devices in the network, such as virtual IEDs, RTUs, and SCADA servers.

[0094] Tripwire traffic is directed to the honeypot, diverting attackers away from the real assets.

[0095] The tripwire generator works together with the honeypot to simulate the real communication process and enhance the deception effect.

[0096] Capture the interaction between attackers and honeypots to provide early warning and tracing support for security personnel.

[0097] Management and control module:

[0098] Provides an API interface to support remote on / off control of the tripwire generation system.

[0099] Supports configuration files, allowing users to adjust tripwire parameters such as generation interval, traffic type, etc.

[0100] Monitor tripwire traffic effects in real time and optimize generation strategies regularly.

[0101] Passive monitoring and protocol analysis

[0102] Passive monitoring and protocol parsing are core steps in a tripwire generation system based on light-load data simulation in power system networks. This system aims to capture and analyze real-time network traffic to provide data support for the subsequent generation of realistic deceptive traffic (tripwires). Key steps include:

[0103] Determine monitoring locations. Based on network topology and traffic analysis, identify critical nodes in the network with high traffic density and security-sensitive features. Select nodes that cover major communication paths. Typical locations include substation switches, SCADA system boundaries, control and monitoring network interfaces, and transmission and distribution line nodes.

[0104] Select monitoring technology. Based on the high real-time and reliability requirements of the power system, choose appropriate traffic capture technology. Examples include: network TAP, which replicates network traffic through a fiber or copper splitter; SPAN, which configures a mirror port on a switch; and sniffing tools such as Wireshark and TCPdump.

[0105] A protocol parsing module was developed to analyze traffic and extract device identification, communication modes, and traffic characteristics. Reference was made to standard documents and open-source implementations, such as the IEC 61850 standard and the libIEC61850 open-source library. GOOSE PDU decoding was used to extract fields such as dataset, time, and stNum; SV ASDU decoding was used to extract fields such as sampling value and sampling frequency. Device identification was extracted, including IP address, MAC address, and logical ID. For example, the identification of an IED might be "IP:192.168.1.100, MAC:00:1A:2B:3C:4D:5E, Logical ID:Substation1_IED1." Communication modes were extracted, including periodic transmission, event-triggered transmission, and request-response. Traffic characteristics were extracted, including packet size (bytes), transmission frequency (times per second), and transmission direction (single / dual). To optimize performance, multithreading or asynchronous I / O was used to handle high-throughput traffic, and caching of common message templates was employed to reduce repeated parsing overhead.

[0106] Save parsed data to an efficient storage system, using InfluxDB or TimescaleDB for time series data, PostgreSQL for structured data, and MongoDB for unstructured data. Use a message queue such as Kafka to buffer high-throughput parsed data.

[0107] The technical benefits achieved through these measures include: Low interference: Passive monitoring ensures zero latency, meeting the real-time requirements of the power system. High accuracy: Protocol parsing extracts detailed device and traffic information, providing reliable data for tripwire generation. Real-time: A dynamic update mechanism maintains data up-to-date. Scalability: A modular design supports the addition of new protocols or devices.

[0108] Tripwire Packet Construction

[0109] Based on virtual address network interaction technology and a personalized fingerprint engine, deceptive data packets are constructed that are highly similar to legitimate traffic. The core idea of virtual address network interaction technology is to use virtual addresses as a medium for network interaction. Through the flexible allocation and management of virtual addresses, originally dispersed network traffic is centralized and directed to specific monitoring hosts. The core of the personalized fingerprint engine's multi-service simulation technology is to simulate the characteristics of different operating systems and network services. By accurately replicating these characteristics, the network environment is made more deceptive, which can induce attackers to attack the honeypot system. Key steps include:

[0110] Design deceptive data packets and construct them according to protocol standards (such as IEC 61850's GOOSE for event data, SV for sampled values, and DNP3 for control commands), ensuring that the structure is compatible with legitimate traffic while embedding forged content.

[0111] Content disguise: Based on the device identification and communication mode extracted in step 1) "protocol parsing", credible power data (such as voltage readings and switch status) are forged to enhance the deception effect.

[0112] Address virtualization: Based on the network address pool information obtained from step 1 (passive listening), a source / destination address is generated that is within the legal device address range but not actually occupied. Traffic targeting the virtual address will be redirected to the honeypot system.

[0113] By mimicking statistical characteristics, based on the traffic features extracted in step 1) "protocol parsing" (such as packet size and frequency), the tripwire packet behavior is made realistic: GOOSE: small and periodic packets (about tens of bytes); SV: large and high-frequency packets.

[0114] The configuration information of the tripwire data package is entered into the relational database in a structured form for use in the next step of tripwire generation.

[0115] Technical Effect: High Concealment: Tripwire packets are highly similar to real traffic in terms of protocol, behavior, and content, making them difficult for attackers to identify. Protocol Compatibility: Support for IEC 61850 (GOOSE, SV) and DNP3 ensures applicability in power systems. Efficiency: The lightweight construction process consumes few resources and is suitable for real-time environments. Flexibility: Packet parameters can be adjusted according to network changes to adapt to different scenarios.

[0116] Tripwire generation and flow control

[0117] By generating diverse deceptive traffic and controlling its deployment, attackers can be confused and real assets can be protected while avoiding overloading the network. Key steps:

[0118] Determine the tripwire type. Based on common attack scenarios in power system networks, design the following three types of tripwires: A control command tripwire simulates the transmission of control commands, such as closing or opening a circuit breaker, disguised as commands from a SCADA system or IED. This trick tricks attackers into attempting to tamper with or intercept these commands, revealing their intentions. This typically uses the IEC 61850 GOOSE (event-driven) protocol or the DNP3 (request-response) protocol. For example, a GOOSE message is generated containing a fabricated "open breaker" command with the data set {"breaker_status":false}. A data acquisition tripwire simulates measurement data transmitted from field devices (such as IEDs or RTUs), such as analog quantities like voltage, current, and power, or digital quantities like switch status. This tricks attackers into attempting to read or tamper with this data, triggering an alarm. This typically uses the IEC 61850 SV (high-frequency sampled value) protocol or the DNP3 (analog input) protocol. For example, an SV message is generated containing a fabricated voltage value {"phase_A_voltage":220.5}. Alarm tripwires: Forged system anomaly information, such as device overload, communication interruption, or protection action alarms, is used to trick attackers into further probing or exploiting these anomalies, exposing their actions. These use the GOOSE protocol (for event alarms) or DNP3 protocol (for status reporting). For example, a GOOSE message containing a forged "overcurrent protection triggered" alarm is generated.

[0119] Using spoofed packets, utilizing "tripwire data construction", the generated spoofed packets serve as the basis for tripwire traffic, as dynamic filler content, such as randomized voltage values.

[0120] Dynamically generate strategies to intelligently adjust the type and frequency of tripwire traffic based on real-time threat intelligence and network status: If "passive monitoring and protocol analysis" detects an attempt to tamper with control commands, priority is given to generating control command tripwires (such as GOOSE messages); combined with the attack behavior feedback from the next step of "collaborating with honeypots", the tripwire strategy is adjusted. For example, if port scanning or abnormal traffic is detected, the generation frequency of data collection tripwires (such as SV messages) is increased.

[0121] Deploy tripwire generators at strategic locations on the network to maximize coverage of potential attack paths and protect critical assets.

[0122] Traffic flow control: Set a bandwidth cap for tripwire traffic based on protocol characteristics and network capacity, and configure rate limiting parameters in the generator. Dynamically adjust tripwire traffic based on real-time network load data from passive monitoring and protocol analysis. Traffic control algorithms use either a "token bucket" algorithm, which generates tokens at a fixed rate and consumes tokens when sending packets, or a "leaky bucket" algorithm, which leaks packets at a fixed rate and discards any excess packets.

[0123] Delay guarantee: Use high-precision timers to ensure that tripwire flow meets the delay requirements of the power system.

[0124] Technical Effect: In addition to low resource usage, protocol compatibility, and flexibility, it also provides early warning. That is, by generating diverse tripwire traffic, potential threats can be detected during the attacker's reconnaissance phase.

[0125] Collaboration with honeypots

[0126] By deploying honeypots in the power system network and working with tripwire traffic, attackers are guided into a simulated environment and their behavior is captured, thereby improving the deception effect and threat detection capabilities of network security defenses. Key steps:

[0127] Select the device type to simulate, including virtual IEDs (Intelligent Electronic Devices), virtual RTUs (Remote Terminal Units), virtual SCADA servers, and other virtual devices to enhance realism. Refer to the device identification data in step 1, "Passive Monitoring and Protocol Analysis," to ensure the honeypot type closely resembles the real network.

[0128] Choose the appropriate honeypot deployment method. Low-interaction honeypots simulate basic protocol responses and use fewer resources, while high-interaction honeypots run full device simulators and support complex interactions. A hybrid deployment of the two methods is possible.

[0129] Configure a honeypot environment, configure IEC 61850 to respond to forged events, support SCADA query and control, configure DNP3 supported object groups and response function codes, etc.

[0130] Behavioral simulation, simulate device operating status, and forge device alarm information.

[0131] By using the tripwire traffic generated by "tripwire generation and flow control" and the network interaction technology of virtual addresses, attackers are lured into the honeypot system, and the captured attack behavior is recorded in the NoSQL type database in Json format to provide feedback for the next step of dynamically adjusting the tripwire strategy.

[0132] Technical Effect: In addition to high deception and flexibility, it also has low risk: the isolated honeypot environment protects real assets and prevents the spread of attacks.

[0133] Dynamic management and adjustment

[0134] By providing a flexible control interface, dynamically adjusting tripwire generation strategies, and continuously monitoring and optimizing, we ensure the real-time and adaptability of the tripwire system in the power system network, maximize its deception effect and threat detection capabilities, while avoiding negative impacts on network performance. Key steps:

[0135] Provide APIs and configuration files, develop RESTful or gRPC-based APIs, support remote control of the core functions of the tripwire system; use YAML or Json format configuration files to support runtime configuration updates, reducing the need to restart the system.

[0136] Management interface, visualized tripwire status, real-time display of network security situation, graphical system environment configuration and operation.

[0137] Dynamic adjustment: Using attack behavior data captured by "collaboration with honeypots" to dynamically optimize tripwire generation strategies, for example, adjusting the priority of different types of tripwires to ensure that critical traffic is generated first. The algorithm can use a decision-making algorithm based on support vector machines (SVM):

[0138]

[0139] Among them, α i is the Lagrange multiplier, y i is the label of the training sample, K is the kernel function, and b is the bias term.

[0140] Technical Effects: Flexibility: APIs and configuration files enable rapid adjustments to adapt to different scenarios. Real-time: Dynamic adjustment mechanisms ensure the tripwire system is synchronized with network status. Adaptability: Intelligent adjustments based on attack behavior enhance defense effectiveness. Scalability: Modular design supports the addition of new features and protocols.

[0141] According to a specific implementation of an embodiment of the present invention, the environment perception step includes:

[0142] Based on network topology and traffic analysis, identify key nodes in the network with dense traffic and security-sensitive features, and select nodes covering the main communication paths, including substation switches, SCADA system boundaries, control network and monitoring network interfaces, and transmission and distribution line nodes;

[0143] According to the high real-time and reliability requirements of the power system, network TAP, SPAN or sniffing tool software wireshark, tcpdump traffic capture technology is selected;

[0144] Analyze traffic to extract device identification, communication patterns, and traffic characteristics, refer to standard documentation and open source implementations, and use multithreading or asynchronous I / O to handle high-throughput traffic;

[0145] The parsing results are saved in an efficient storage system. The time series data in the parsing results uses InfluxDB or TimescaleDB, the structured data in the parsing results uses PostgreSQL, and the unstructured data in the parsing results uses MongoDB.

[0146] According to a specific implementation of an embodiment of the present invention, the tripwire data packet construction step includes:

[0147] Constructing data packets according to protocol standards to ensure that the structure is compatible with legitimate traffic while embedding forged content;

[0148] Forge credible power data based on the device identification and communication mode extracted by protocol analysis;

[0149] Based on the network address pool information obtained by passive monitoring, a source / destination address that is within the legal device address range but not actually occupied is generated. Traffic targeting the virtual address will be redirected to the honeypot system.

[0150] Traffic features extracted based on protocol parsing are used to make tripwire packet behavior realistic, including GOOSE as small and periodic packets and SV as large and high-frequency packets;

[0151] The configuration information of the tripwire data package is entered into the relational database in a structured form for use in the next step of tripwire generation.

[0152] According to a specific implementation of an embodiment of the present invention, the tripwire generation and deployment steps include:

[0153] Based on common attack scenarios in power system networks, three types of tripwires are designed: control command tripwire, data acquisition tripwire, and alarm tripwire.

[0154] Utilize tripwire data to construct spoofed packets as the basis for tripwire traffic and dynamically populate the content;

[0155] Adjust the type and frequency of tripwire traffic based on real-time threat intelligence and network status;

[0156] Deploy tripwire generators at strategic locations across the network to maximize coverage of potential attack paths and protect critical assets;

[0157] According to the protocol characteristics and network capacity, the bandwidth upper limit of the tripwire traffic is set, the rate limit parameters are configured in the generator, and the tripwire traffic is dynamically adjusted according to the real-time network load data. The "token bucket algorithm" or "leaky bucket algorithm" is used for flow control.

[0158] Use high-precision timers to ensure that tripwire flow meets the time delay requirements of the power system.

[0159] According to a specific implementation of an embodiment of the present invention, the step of coordinating with the honeypot system includes:

[0160] Select virtual IED, virtual RTU, and virtual SCADA server, referencing the device identification data in the environment perception step, to make the honeypot type close to the real network;

[0161] A mixed deployment of low-interaction honeypots simulating basic protocol responses and high-interaction honeypots running full device simulators;

[0162] Configure IEC61850 response to forged events, support SCADA query and control, and configure DNP3 support object groups and response function codes;

[0163] Simulate equipment operating status and forge equipment alarm information;

[0164] By utilizing the network interaction technology of tripwire generation and flow control to generate tripwire traffic and virtual addresses, attackers are lured into the honeypot system, and the captured attack behavior is recorded in the NoSQL database in Json format to provide feedback for dynamic adjustment of the tripwire strategy.

[0165] According to a specific implementation of an embodiment of the present invention, the management and control step includes:

[0166] Develop a RESTful or gRPC-based API to implement the core functionality of the remote tripwire system. Use YAML or JSON configuration files to update the configuration at runtime, reducing the need to restart the system.

[0167] Visualize tripwire status, display network security situation in real time, and graphically display system environment configuration and operation;

[0168] By utilizing the attack behavior data captured in collaboration with the honeypot, the tripwire generation strategy is dynamically optimized, and a decision algorithm based on support vector machine (SVM) is used to adjust the priorities of different types of tripwires.

[0169] See also Figure 2 The present invention also provides a tripwire generation system based on light-load data simulation in a power system network, comprising:

[0170] Environmental perception module: This module uses traffic monitoring devices deployed at key network nodes to capture communication data through passive monitoring. It then parses the IEC61850 and DNP3 power-specific protocols to obtain analysis results, including device identification, communication mode, and traffic characteristics. The analysis results are then stored in a local database.

[0171] Tripwire Data Packet Construction Module: This module is used to construct fake data packets based on power protocol standards, simulating the characteristics of real business traffic, including packet size, transmission frequency, and transmission direction. It uses fake source and destination addresses to ensure that the addresses are within the range of real device addresses, disguises the data content, and generates power parameters, control instructions, or alarm information similar to real business.

[0172] Tripwire Generation and Deployment Module: This module is used to design various tripwire types, including control command tripwires, data collection tripwires, and alarm information tripwires. Tripwire generators are deployed in key network areas. Traffic control mechanisms are used to ensure that tripwire traffic does not occupy excessive bandwidth. Dynamic adjustment strategies for tripwire generation are optimized based on network load and security status.

[0173] Honeypot system collaboration module: This module is used to deploy honeypots that simulate power equipment on the network. Tripwire traffic is directed to the honeypots, diverting attackers away from real assets. The tripwire generator and honeypot work together to simulate real communication processes and capture the attacker's interaction with the honeypot.

[0174] Management and control module: Used to achieve remote on / off control of the tripwire generation system through the API interface, adjust tripwire parameters through configuration files, including generation interval and traffic type, monitor tripwire traffic effects in real time, and regularly optimize generation strategies.

[0175] According to a specific implementation of an embodiment of the present invention, the environment perception module further includes:

[0176] Listening location determination unit: used to identify key nodes with dense traffic and security-sensitive in the network based on network topology and traffic analysis, and select nodes covering the main communication paths;

[0177] Monitoring technology selection unit: used to select network TAP, SPAN or sniffing tool software wireshark, tcpdump traffic capture technology according to the high real-time and reliability requirements of the power system;

[0178] Protocol parsing unit: This unit analyzes traffic to extract device identification, communication patterns, and traffic characteristics. It references standard documentation and open-source implementations, uses multi-threading or asynchronous I / O to handle high-throughput traffic, and caches common message templates to reduce repeated parsing overhead.

[0179] Data storage unit: used to save parsed data to an efficient storage system. Time series data uses InfluxDB or TimescaleDB, structured data uses PostgreSQL, and unstructured data uses MongoDB. Message queues including Kafka are used to buffer high-throughput parsed data.

[0180] According to a specific implementation of an embodiment of the present invention, the tripwire data packet construction module further includes:

[0181] Data packet design unit: used to construct data packets according to protocol standards, ensure the structure is compatible with legitimate traffic, and embed forged content;

[0182] Content camouflage unit: used to forge credible power data based on the device identification and communication mode extracted by protocol parsing;

[0183] Address virtual unit: used to generate source / destination addresses that are within the legal device address range but not actually occupied based on the network address pool information obtained through passive monitoring. Traffic targeting the virtual addresses will be redirected to the honeypot system.

[0184] Statistical feature simulation unit: used to make tripwire data packets behave realistically based on traffic features extracted by protocol analysis;

[0185] Data storage unit: used to enter the configuration information of the tripwire data package into the relational database in a structured form for use in the next step of tripwire generation.

[0186] According to a specific implementation of the embodiment of the present invention, the management and control module further includes:

[0187] Interface and Configuration File Management Unit: This unit is used to develop RESTful or gRPC-based APIs to support remote control of the core functions of the tripwire system. It uses YAML or JSON format configuration files to support runtime configuration updates, reducing the need to restart the system.

[0188] Management interface display unit: used to visualize tripwire status, display network security situation in real time, and graphically configure and operate the system environment;

[0189] Strategy Adjustment Unit: This unit is used to dynamically optimize the tripwire generation strategy by utilizing the attack behavior data captured in collaboration with the honeypot, and to adjust the priority of different types of tripwires using a decision algorithm based on a support vector machine (SVM).

[0190] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A tripwire generation method based on light-load data simulation in a power system network, characterized in that: The following steps are involved: Environmental sensing step S1: Through passive monitoring, traffic monitoring devices deployed at key network nodes capture communication data, parse it according to the IEC61850 and DNP3 power-specific protocols, and obtain analysis results including device identification, communication mode, and traffic characteristics. The analysis results are stored in a local database. Step S2 of tripwire data packet construction: constructing a fake data packet according to the power protocol standard, simulating the characteristics of real business traffic, including packet size, transmission frequency, and transmission direction, using fake source and destination addresses so that the addresses are within the range of real device addresses, disguising the data content, and generating power parameters, control instructions, or alarm information similar to real business; Tripwire generation and deployment step S3: Design multiple tripwire types, including control command tripwires, data collection tripwires, and alarm information tripwires. Deploy tripwire generators in key network areas. Use flow control mechanisms to ensure that tripwire traffic does not occupy excessive bandwidth. Optimize the dynamic adjustment strategy for tripwire generation based on network load and security status. Step S4: Deploy a honeypot simulating power equipment in the network. The tripwire traffic is directed to the honeypot to guide the attacker away from the real assets. The tripwire generator and the honeypot work together to simulate the real communication process and capture the interaction between the attacker and the honeypot. Management and control step S5: Through the API interface, remote on / off control of the tripwire generation system is realized, and tripwire parameters, including generation interval and traffic type, are adjusted through the configuration file. The tripwire traffic effect is monitored in real time, and the generation strategy is optimized regularly.

2. The tripwire generation method based on light-load data simulation in a power system network according to claim 1, characterized in that: The environment perception step includes: Based on network topology and traffic analysis, identify key nodes in the network with dense traffic and security-sensitive features, and select nodes covering the main communication paths, including substation switches, SCADA system boundaries, control network and monitoring network interfaces, and transmission and distribution line nodes; According to the high real-time and reliability requirements of the power system, network TAP, SPAN or sniffing tool software wireshark, tcpdump traffic capture technology is selected; Analyze traffic to extract device identification, communication patterns, and traffic characteristics, refer to standard documentation and open source implementations, and use multithreading or asynchronous I / O to handle high-throughput traffic; The parsing results are saved in an efficient storage system. The time series data in the parsing results uses InfluxDB or TimescaleDB, the structured data in the parsing results uses PostgreSQL, and the unstructured data in the parsing results uses MongoDB.

3. The tripwire generation method based on light-load data simulation in a power system network according to claim 1, characterized in that: The tripwire data packet construction step comprises: Constructing data packets according to protocol standards to ensure that the structure is compatible with legitimate traffic while embedding forged content; Forge credible power data based on the device identification and communication mode extracted by protocol analysis; Based on the network address pool information obtained by passive monitoring, a source / destination address that is within the legal device address range but not actually occupied is generated. Traffic targeting the virtual address will be redirected to the honeypot system. Traffic features extracted based on protocol parsing are used to make tripwire packet behavior realistic, including GOOSE as small and periodic packets and SV as large and high-frequency packets; The configuration information of the tripwire data package is entered into the relational database in a structured form for use in the next step of tripwire generation.

4. The tripwire generation method based on light-load data simulation in a power system network according to claim 3, characterized in that: The tripwire generation and deployment steps include: Based on common attack scenarios in power system networks, three types of tripwires are designed: control command tripwire, data acquisition tripwire, and alarm tripwire. Utilize tripwire data to construct spoofed packets as the basis for tripwire traffic and dynamically populate the content; Adjust the type and frequency of tripwire traffic based on real-time threat intelligence and network status; Deploy tripwire generators at strategic locations across the network to maximize coverage of potential attack paths and protect critical assets; Set the bandwidth cap for tripwire traffic based on protocol characteristics and network capacity. Configure rate limiting parameters in the generator. Dynamically adjust tripwire traffic based on real-time network load data, using either the "token bucket algorithm" or the "leaky bucket algorithm" for flow control. Use high-precision timers to ensure that tripwire flow meets the time delay requirements of the power system.

5. The tripwire generation method based on light-load data simulation in a power system network according to claim 4, characterized in that: The steps of coordinating with the honeypot system include: Select virtual IED, virtual RTU, and virtual SCADA server, referencing the device identification data in the environment perception step, to make the honeypot type close to the real network; A mixed deployment of low-interaction honeypots simulating basic protocol responses and high-interaction honeypots running full device simulators; Configure IEC61850 response to forged events, support SCADA query and control, and configure DNP3 support object groups and response function codes; Simulate equipment operating status and forge equipment alarm information; By utilizing the network interaction technology of tripwire generation and flow control to generate tripwire traffic and virtual addresses, attackers are lured into the honeypot system, and the captured attack behavior is recorded in the NoSQL database in Json format to provide feedback for dynamic adjustment of the tripwire strategy.

6. The tripwire generation method based on light-load data simulation in a power system network according to claim 5, characterized in that: The management and control steps include: Develop a RESTful or gRPC-based API to implement the core functionality of the remote tripwire system. Use YAML or JSON configuration files to update the configuration at runtime, reducing the need to restart the system. Visualize tripwire status, display network security situation in real time, and graphically display system environment configuration and operation; By utilizing the attack behavior data captured in collaboration with the honeypot, the tripwire generation strategy is dynamically optimized, and a decision algorithm based on support vector machine (SVM) is used to adjust the priorities of different types of tripwires.

7. A tripwire generation system based on light load data simulation in a power system network, characterized in that: include: Environmental perception module: This module uses traffic monitoring devices deployed at key network nodes to capture communication data through passive monitoring. It then parses the IEC61850 and DNP3 power-specific protocols to obtain analysis results, including device identification, communication mode, and traffic characteristics. The analysis results are then stored in a local database. Tripwire Data Packet Construction Module: This module is used to construct fake data packets based on power protocol standards, simulating the characteristics of real business traffic, including packet size, transmission frequency, and transmission direction. It uses fake source and destination addresses to ensure that the addresses are within the range of real device addresses, disguises the data content, and generates power parameters, control instructions, or alarm information similar to real business. Tripwire Generation and Deployment Module: This module is used to design various tripwire types, including control command tripwires, data collection tripwires, and alarm information tripwires. Tripwire generators are deployed in key network areas. Traffic control mechanisms are used to ensure that tripwire traffic does not occupy excessive bandwidth. Dynamic adjustment strategies for tripwire generation are optimized based on network load and security status. Honeypot system collaboration module: This module is used to deploy honeypots that simulate power equipment on the network. Tripwire traffic is directed to the honeypots, diverting attackers away from real assets. The tripwire generator and honeypot work together to simulate real communication processes and capture the attacker's interaction with the honeypot. Management and control module: Used to achieve remote on / off control of the tripwire generation system through the API interface, adjust tripwire parameters through configuration files, including generation interval and traffic type, monitor tripwire traffic effects in real time, and regularly optimize generation strategies.

8. The tripwire generation system based on light-load data simulation in a power system network according to claim 7, characterized in that: The environment perception module also includes: Listening location determination unit: used to identify key nodes with dense traffic and security-sensitive in the network based on network topology and traffic analysis, and select nodes covering the main communication paths; Monitoring technology selection unit: used to select network TAP, SPAN or sniffing tool software wireshark, tcpdump traffic capture technology according to the high real-time and reliability requirements of the power system; Protocol parsing unit: This unit analyzes traffic to extract device identification, communication patterns, and traffic characteristics. It references standard documentation and open-source implementations, uses multi-threading or asynchronous I / O to handle high-throughput traffic, and caches common message templates to reduce repeated parsing overhead. Data storage unit: used to save parsed data to an efficient storage system. Time series data uses InfluxDB or TimescaleDB, structured data uses PostgreSQL, and unstructured data uses MongoDB. Message queues including Kafka are used to buffer high-throughput parsed data.

9. The tripwire generation system based on light-load data simulation in a power system network according to claim 8, characterized in that: The tripwire data packet construction module also includes: Data packet design unit: used to construct data packets according to protocol standards, ensure the structure is compatible with legitimate traffic, and embed forged content; Content camouflage unit: used to forge credible power data based on the device identification and communication mode extracted by protocol parsing; Address virtual unit: used to generate source / destination addresses that are within the legal device address range but not actually occupied based on the network address pool information obtained through passive monitoring. Traffic targeting the virtual addresses will be redirected to the honeypot system. Statistical feature simulation unit: used to make tripwire data packets behave realistically based on traffic features extracted by protocol analysis; Data storage unit: used to enter the configuration information of the tripwire data package into the relational database in a structured form for use in the next step of tripwire generation.

10. The tripwire generation system based on light-load data simulation in the power system network according to claim 9, characterized in that: The management and control module also includes: Interface and Configuration File Management Unit: This unit is used to develop RESTful or gRPC-based APIs to support remote control of the core functions of the tripwire system. It uses YAML or JSON format configuration files to support runtime configuration updates, reducing the need to restart the system. Management interface display unit: used to visualize tripwire status, display network security situation in real time, and graphically configure and operate the system environment; Strategy Adjustment Unit: This unit is used to dynamically optimize the tripwire generation strategy by utilizing the attack behavior data captured in collaboration with the honeypot, and to adjust the priority of different types of tripwires using a decision algorithm based on a support vector machine (SVM).

Images