A network security monitoring method and system for a substation automation system

Abstract

The present invention relates to the technical field of network security of substation automation systems, and discloses a network security monitoring method and system for substation automation systems, wherein the method comprises the following steps: performing real-time operation simulation of the substation automation system based on a substation digital twin simulation model to generate simulated operation message data, performing a logical conflict comparison on the simulated operation message data with the actual operation message data of the substation automation system, obtaining a position abnormality identification result, performing false trip signal generation condition identification based on the position abnormality identification result, obtaining an abnormal message identification result, and performing abnormal simulation analysis on each abnormal message based on the substation digital twin simulation model according to the abnormal message identification result to obtain a corresponding power grid threat analysis result. The present invention can perform real-time and accurate logical conflict detection on the real message data of the system based on digital twin technology, timely and reliably perceive system abnormalities, and ensure the accuracy and efficiency of identifying system abnormal messages and false trip signals.

Description

Technical Field

[0001] The present invention relates to the technical field of network security of a substation automation system, and in particular to a network security monitoring method and system for a substation automation system. Background Art

[0002] Substation automation systems are the core pillar of modern power grid operations, and their stability and reliability are directly linked to the security and economic benefits of power supply. With the increasing application of intelligent technologies, microcomputer-based protection devices, which enable rapid, real-time data exchange via GOOSE messages, have become a key component in ensuring the efficient operation of power systems. However, the network transmission of GOOSE messages also presents opportunities for malicious attackers to exploit the power system, posing a potential threat to the stable operation of the power grid.

[0003] Existing anomaly detection and analysis methods for GOOSE messages mainly rely on static configuration checks and traditional fault diagnosis methods. These methods have certain effects when dealing with other network message security monitoring, but they have application limitations when facing complex abnormal position change message scenarios caused by configuration errors, equipment failures, or even malicious tampering, resulting in poor application results: static checks are difficult to adapt to dynamically changing operating environments, and traditional diagnosis lacks the ability to deeply analyze logical conflicts, making it difficult to accurately identify logical conflicts between normal state position change messages and abnormal state position change messages in real time. It is also unable to reliably identify false signals such as misoperation or malicious tampering, resulting in an increased risk of misjudgment or missed judgment, and may even induce cascading failures, seriously threatening the overall stability of the power grid. Therefore, there is an urgent need to provide a substation automation system network security monitoring method that can adapt to dynamic operating environments, accurately identify logical conflicts between normal state position change messages and abnormal state position change messages in real time, and effectively identify false tripping signals. Summary of the Invention

[0004] The purpose of the present invention is to provide a network security monitoring method for a substation automation system. By constructing a substation digital twin simulation model based on digital twin technology, a substation automation system operation simulation message is generated to perform logical conflict detection on the system's real message, and combined with a power grid threat assessment mechanism that performs abnormal simulation analysis based on the abnormal message identification results, it can adaptively realize real-time, efficient and accurate abnormal state logical conflict detection and analysis, timely and reliably perceive system anomalies, and effectively improve the accuracy and efficiency of system abnormal message and false trip signal identification, thereby providing reliable protection for the safety and stability of the substation automation system operation.

[0005] In order to achieve the above objectives, a method and system for network security monitoring of a substation automation system are provided.

[0006] In a first aspect, an embodiment of the present invention provides a method for network security monitoring of a substation automation system, the method comprising the following steps:

[0007] Perform real-time operation simulation of the substation automation system based on the pre-built substation digital twin simulation model to generate simulation operation message data;

[0008] Acquiring actual operation message data of the substation automation system, and obtaining a position abnormality identification result based on a logical conflict comparison between the actual operation message data and corresponding simulation operation message data;

[0009] Identify the conditions for generating a false trip signal based on the position change abnormality identification result to obtain an abnormal message identification result; the abnormal message identification result includes the abnormal message and the corresponding abnormal source and abnormal type;

[0010] According to the abnormal message identification results, an abnormal simulation analysis is performed on each abnormal message based on the substation digital twin simulation model to obtain corresponding power grid threat analysis results; the power grid threat analysis results include abnormal propagation paths, potential threat levels of affected nodes, and key risk monitoring areas.

[0011] Furthermore, the steps of constructing the substation digital twin simulation model include:

[0012] Based on the physical topology and protection device configuration of the substation automation system, the initial structure of the substation model is constructed using digital twin technology;

[0013] Acquire a historical GOOSE message data set of a microcomputer protection device in the substation automation system, and analyze the historical GOOSE message data set to obtain a corresponding normal displacement feature set and an abnormal displacement feature set; the historical GOOSE message data set includes a normal displacement status message and an abnormal displacement status message;

[0014] According to the normal displacement feature set and the abnormal displacement feature set, based on the microcomputer protection operation rules and the initial structure of the substation model, normal displacement state and abnormal displacement state simulation are performed to generate displacement state simulation parameters;

[0015] Matching and analyzing the displacement state simulation parameters with the preset state simulation parameter thresholds, and if they match, generating a simulation data set through a preset message generation logic;

[0016] Extracting message generation rules based on the simulation data set, and performing consistency comparison analysis on the message generation rules and the preset message generation logic to obtain corresponding consistency comparison results; the message generation rules include bit shift trigger conditions and message format requirements;

[0017] The displacement state simulation parameters are optimized and adjusted according to the consistency comparison results, and the substation digital twin simulation model is generated according to the optimized and adjusted displacement state simulation parameters and the initial structure of the substation model.

[0018] Furthermore, the step of analyzing the historical GOOSE message data set to obtain the corresponding normal displacement feature set and abnormal displacement feature set includes:

[0019] Based on the extraction of the displacement state information of each message data in the historical GOOSE message data set, a corresponding displacement state information data set is obtained;

[0020] Performing normal displacement state screening on the displacement state information dataset according to a pre-built normal displacement rule library to obtain a normal displacement dataset;

[0021] Performing anomaly detection on the displacement state information in the difference set between the historical GOOSE message data set and the normal displacement data set based on a preset anomaly detection algorithm to obtain an abnormal displacement data set;

[0022] Based on a preset feature extraction method, feature extraction is performed on the normal displacement data set and the abnormal displacement data set respectively to obtain a corresponding normal displacement feature value set and abnormal displacement feature value set.

[0023] Furthermore, the position change anomaly identification result includes a configuration error anomaly and a device failure anomaly; and the step of obtaining the position change anomaly identification result based on a logical conflict comparison between the actual operation message data and the corresponding simulation operation message data includes:

[0024] Obtaining a message data difference between the actual operation message data and the simulated operation message data, and generating a corresponding initial logical conflict set according to the message data difference;

[0025] Based on a decision tree algorithm and preset conflict types, the initial logical conflict set is divided to obtain multiple conflict subsets; the preset conflict types include message type conflict, shift state conflict and message time conflict;

[0026] Statistical analysis is performed on each conflict subset to obtain the frequency of occurrence of various conflict types;

[0027] Determine whether the frequency of occurrence of various conflict types exceeds the corresponding preset frequency threshold. If so, obtain the log information and message type of the associated device, determine whether there is a device failure based on the log information, and determine whether there is a configuration error based on the matching of the message type and the corresponding conflict type, and obtain the corresponding bit abnormality identification result.

[0028] Furthermore, the step of identifying a false trip signal generation condition based on the position change abnormality identification result to obtain an abnormal message identification result includes:

[0029] When the position change abnormality identification result is a configuration abnormality or a position change abnormality, the state change time sequence data of the corresponding message data is obtained; the state change time sequence data includes the time of each state change and the corresponding state ID;

[0030] Comparing the state change timing data with the preset operation timing data, and if they are inconsistent, determining that there is an abnormal message that meets the conditions for generating a false trip signal;

[0031] Obtaining the address information of each abnormal message and performing cluster analysis on the address information to obtain abnormal source classification results;

[0032] The abnormal messages of the same abnormal source classification are respectively subjected to message structure feature extraction and analysis to determine the abnormal type corresponding to the abnormal source classification.

[0033] Furthermore, the step of performing abnormal simulation analysis on each abnormal message based on the substation digital twin simulation model according to the abnormal message identification result to obtain the corresponding power grid threat analysis result includes:

[0034] According to the abnormal source and abnormal type of each abnormal message in the abnormal message identification result, a simulation is performed through the substation digital twin simulation model to obtain a corresponding abnormal propagation path; the abnormal propagation path includes an affected power grid node;

[0035] According to the preset false tripping trigger conditions of each affected grid node, the corresponding false tripping probability is obtained;

[0036] Based on the false tripping probability and operating status data of all affected grid nodes, the grid stability is evaluated based on the support vector machine algorithm to obtain the corresponding grid stability changes;

[0037] When the grid stability change indicates an increased risk, a corresponding potential threat level is obtained based on the random forest algorithm according to the topological location and historical fault frequency of each affected grid node;

[0038] Based on the ranking results of the threat levels of each affected power grid node, key risk monitoring areas are determined.

[0039] Furthermore, the method further comprises:

[0040] Collecting system abnormal operation data for performing abnormal simulation analysis on each abnormal message based on the substation digital twin simulation model;

[0041] Comparing and analyzing the abnormal system operation data with historical normal system operation data to generate logic verification rules;

[0042] According to the logic verification rules, each abnormal message in the abnormal message identification result is secondary verified to determine the cause of the corresponding suspected false signal generation;

[0043] Generate corresponding abnormal protection strategies based on the suspected false signal generation cause of each abnormal message.

[0044] Furthermore, the step of performing secondary verification on each abnormal message in the abnormal message identification result according to the logic verification rule, and the corresponding step of generating the suspected false signal includes:

[0045] Obtain the sending characteristics of each abnormal message, and match and analyze the sending characteristics with the preset error operation pattern. When matching, perform correlation analysis on the basic information of the corresponding abnormal message and the operation record to obtain the corresponding correlation score; the sending characteristics include the message sending interval and repetition frequency; the basic information includes the timestamp, sender identifier and data length;

[0046] If the correlation score is greater than a preset correlation threshold, it is determined that the cause of the corresponding suspected false signal is a misconfiguration operation; otherwise, the consistency check data of the abnormal message is obtained; the consistency check data includes a message header check code, a data field, and a timestamp;

[0047] Perform a comprehensive analysis based on the consistency check data of the abnormal message using a decision tree algorithm to obtain a corresponding message tampering score, and compare the message tampering score with a preset score threshold;

[0048] If the message tampering score reaches the preset score threshold and the corresponding message source address information satisfies the preset false signal distribution, the corresponding suspected false signal is determined to be caused by malicious tampering; otherwise, the corresponding suspected false signal is determined to be caused by equipment failure; the preset false signal distribution characteristics are obtained based on a cluster analysis of the source addresses of all abnormal messages.

[0049] Furthermore, the step of generating a corresponding abnormality protection strategy according to the suspected false signal generation cause of each abnormal message includes:

[0050] When the suspected false signal is generated due to misconfiguration or device failure, the source address information and sending device identifier of the corresponding abnormal message are obtained, and a corresponding abnormal prompt alarm is generated according to the source address information and the sending device identifier;

[0051] When the suspected false signal is generated due to malicious tampering, the abnormal propagation path of the corresponding abnormal message is obtained, and the false signal is isolated according to the abnormal propagation path.

[0052] In a second aspect, an embodiment of the present invention provides a network security monitoring system for a substation automation system, the system comprising:

[0053] The message simulation module is used to simulate the real-time operation of the substation automation system based on the pre-built substation digital twin simulation model and generate simulation operation message data;

[0054] A message comparison and analysis module is used to obtain actual operation message data of the substation automation system, and obtain a position abnormality identification result based on a logical conflict comparison between the actual operation message data and the corresponding simulated operation message data;

[0055] An abnormal message identification module is used to identify the conditions for generating a false trip signal based on the abnormal position change identification result to obtain an abnormal message identification result; the abnormal message identification result includes the abnormal message and the corresponding abnormal source and abnormal type;

[0056] The power grid threat analysis module is used to perform abnormal simulation analysis on each abnormal message based on the substation digital twin simulation model according to the abnormal message identification results to obtain corresponding power grid threat analysis results; the power grid threat analysis results include abnormal propagation paths, potential threat levels of affected nodes, and key risk monitoring areas.

[0057] The above-mentioned present invention provides a network security monitoring method and system for a substation automation system. The method realizes real-time operation simulation of the substation automation system according to a pre-built substation digital twin simulation model, generates simulated operation message data, obtains actual operation message data of the substation automation system, and compares the logical conflicts between the actual operation message data and the corresponding simulated operation message data. After obtaining the position abnormality identification result, the false tripping signal generation condition is identified according to the position abnormality identification result, and the abnormal message identification result including the abnormal message and the corresponding abnormal source and abnormal type is obtained. According to the abnormal message identification result, the abnormal simulation analysis of each abnormal message is performed based on the substation digital twin simulation model to obtain the corresponding power grid threat analysis result including the abnormal propagation path, the potential threat level of the affected node and the key risk monitoring area. Technical solution. Compared with the existing technology, this substation automation system network security monitoring method uses an abnormal message analysis mechanism to detect logical conflicts between the substation automation system operation simulation messages generated by the substation digital twin simulation model based on digital twin technology and the system's real messages. Combined with the power grid threat assessment mechanism that performs abnormal simulation analysis based on the abnormal message identification results, it can adaptively realize real-time, efficient and accurate abnormal state logical conflict detection and analysis, timely and reliably perceive system anomalies, and effectively improve the accuracy and efficiency of system abnormal message and false trip signal identification, thereby providing reliable protection for the safety and stability of substation automation system operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 1 is a flow chart of a method for network security monitoring of a substation automation system according to an embodiment of the present invention;

[0059] Figure 2 It is a structural diagram of a network security monitoring system for a substation automation system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solutions and beneficial effects of the present invention more clear, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. Obviously, the embodiments described below are part of the embodiments of the present invention and are only used to illustrate the present invention, but are not used to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0061] In one embodiment, Figure 1 As shown, a substation automation system network security monitoring method is provided, comprising the following steps:

[0062] S11. Perform real-time operation simulation of the substation automation system based on the pre-built substation digital twin simulation model to generate simulation operation message data; wherein, the substation digital twin simulation model can be understood as a substation automation system simulation model that is constructed based on the digital twin technology with the actual substation automation system as the physical entity, and can interact with the actual substation automation system and can perform digital twin simulation of the substation automation system based on the operation data of the actual substation automation system.

[0063] Specifically, the steps of constructing the substation digital twin simulation model include:

[0064] According to the physical topology and protection device configuration of the substation automation system, the initial structure of the substation model is constructed based on the digital twin technology; among them, the initial structure of the substation model can be understood as the model architecture of the substation digital twin simulation model, which does not contain the relevant configuration data of the displacement state simulation parameters and cannot be directly used for simulation message generation. Correspondingly, the physical topology can be understood as the physical wiring relationship between the various distribution equipment in the substation automation system, such as the connection relationship between the main transformer and the circuit breaker. The specific physical topology structure varies depending on the actual substation automation system; the protection device configuration can be understood as the actual operation configuration data of the microcomputer protection device in the substation automation system, which also varies according to the actual application scenario and is not specifically limited here. After determining the physical topology and protection device configuration of the substation automation system, the initial structure of the substation model can be constructed based on the existing digital twin technology according to the physical topology and protection device configuration.

[0065] Obtain a historical GOOSE message data set of the microcomputer protection device in the substation automation system, and analyze the historical GOOSE message data set to obtain a corresponding normal position change feature set and abnormal position change feature set; wherein, the historical GOOSE message data set can be understood as the historical GOOSE message time series data sent by the microcomputer protection device collected according to the preset time requirement, and each GOOSE message includes data information such as switch status and current anomaly. It should be noted that in order to ensure the construction of a substation digital twin simulation model that meets the actual application scenario, the historical GOOSE message data set also includes normal position change status messages (such as switch actions triggered by scheduled inspections, etc.) and abnormal position change status messages (such as unexpected tripping, etc.), which facilitates the reasonable selection of the position change state simulation parameters of the substation digital twin simulation model by analyzing the normal state position change characteristics and the abnormal state position change characteristics, so that the substation digital twin simulation model can reflect the real operating rules of the system and ensure the accuracy of its application.

[0066] Specifically, the step of analyzing the historical GOOSE message data set to obtain the corresponding normal displacement feature set and abnormal displacement feature set includes:

[0067] Based on the extraction of the displacement state information of each message data in the historical GOOSE message data set, a corresponding displacement state information data set is obtained; wherein, the displacement state information data set can be understood as a set composed of displacement state information extracted from each GOOSE message based on the existing relevant GOOSE message parsing tool, and the displacement state information can be understood as the state change information of the device, which may include information in the message data packet such as the device switch state data, current value and voltage value.

[0068] The displacement state information dataset is screened for normal displacement states based on a pre-constructed normal displacement rule library to obtain a normal displacement dataset. The normal displacement rule library can be understood as a database of various normal displacement patterns constructed based on experience or expert knowledge. If the database contains normal displacement pattern a: "The switch opening and closing time interval is within 1 second and the current is normal," and if a certain displacement state information shows "The switch recovers 0.5 seconds after opening and there is no abnormal current," then the displacement state information is considered to conform to normal displacement pattern a and can be included in the normal displacement dataset. The method of constructing a normal displacement dataset based on the normal displacement rule library in this embodiment can ensure rapid identification of normal operating modes and help reduce the complexity of subsequent analysis.

[0069] Based on a preset anomaly detection algorithm, anomaly detection is performed on the displacement state information in the difference set between the historical GOOSE message dataset and the normal displacement dataset to obtain an abnormal displacement dataset. In principle, the difference set between the historical GOOSE message dataset and the normal displacement dataset should be abnormal displacement information. Considering that the actual system operating environment is dynamically changing, the normal displacement rule library may not exhaust all normal displacement patterns. In order to ensure the reliability of subsequent abnormal displacement feature analysis, this embodiment preferably uses anomaly detection on the difference set to screen and confirm abnormal displacement information. For example, a displacement display current abnormality threshold (a preset integer multiple of the normal current value) can be set, and when the displacement display current suddenly increases to the threshold, the corresponding displacement state information is included in the abnormal displacement dataset. This difference-based anomaly detection and analysis method can effectively ensure the comprehensiveness and reliability of anomaly analysis, making it easier for the subsequent substation digital twin simulation model constructed based on the abnormal displacement dataset to effectively locate potential faults and improve system reliability.

[0070] Based on a preset feature extraction method, feature extraction is performed on the normal displacement data set and the abnormal displacement data set respectively to obtain corresponding normal displacement feature value sets and abnormal displacement feature value sets; wherein, the preset feature extraction method can perform feature analysis on the displacement data set based on a statistical analysis method. In this embodiment, a K-means clustering algorithm is preferably used to perform cluster analysis on the normal displacement data set and the abnormal displacement data set respectively to obtain the distribution laws of various types of data in the normal displacement state information and the distribution laws of various types of data in the abnormal displacement state information, and then generate corresponding normal displacement feature value sets and abnormal displacement feature value sets according to the obtained distribution laws. In practical applications, cluster analysis can be performed on data such as the duration of displacement, current fluctuation, and voltage fluctuation in normal and abnormal displacement datasets. If it is found that the displacement duration in the normal displacement dataset is concentrated at 0.5 seconds and the current fluctuation is around 10%, the normal displacement feature value set can include features such as "displacement duration: 0.5 seconds" and "current fluctuation: 10%." Similarly, if it is found that the displacement duration in the abnormal displacement dataset is concentrated at 2 seconds and the current fluctuation is around 50%, the normal displacement feature value set can include features such as "displacement duration: 2 seconds" and "current fluctuation: 50%." A comparison reveals that normal displacements are concentrated in low-fluctuation areas, while abnormal displacements are dispersed in high-fluctuation areas. In other words, the resulting normal and abnormal displacement feature value sets can intuitively reflect the difference between normal and abnormal operating states, facilitating subsequent analysis and configuration of displacement state simulation parameters for the substation digital twin simulation model.

[0071] According to the normal displacement feature set and the abnormal displacement feature set, the normal displacement state and the abnormal displacement state are simulated based on the microcomputer protection operation rules and the initial structure of the substation model to generate displacement state simulation parameters; wherein, the microcomputer protection operation rules can be set based on the operation rules of the microcomputer protection device in the actual application scenario, and the IEC61850 standard can be referred to to ensure that the simulation is close to reality; the corresponding displacement state simulation parameters can be understood as the operation response parameters of the microcomputer protection device in normal and abnormal states, such as the switch action response time configured when simulating the normal state and the fault action response time under the simulated abnormal state, etc. The specific parameter content can be determined based on the actual microcomputer protection device operation rules.

[0072] The displacement state simulation parameters are matched and analyzed with the preset state simulation parameter thresholds. If they match, a simulation data set is generated through the preset message generation logic; wherein, the preset state simulation parameter thresholds can be understood as the rationality detection thresholds for the various parameters involved in the displacement state simulation parameters, for example, the normal switch action response time shall not exceed 0.3 seconds, the abnormal state response time shall not exceed 0.2 seconds, etc. When the displacement state simulation parameters completely match the preset state simulation parameter thresholds, it is considered that the obtained displacement state simulation parameters can be applied to the substation digital twin simulation model to generate simulation message data that is close to the actual operation of the substation system. It should be noted that the preset message generation logic can be understood as the message grouping fields and field sorting rules pre-set based on the communication message protocol, and the corresponding generated simulation message data may include timestamps and status data, etc.

[0073] Message generation rules are extracted based on the simulation data set, and the message generation rules are compared and analyzed for consistency with the preset message generation logic to obtain corresponding consistency comparison results; wherein, the message generation rules include position change trigger conditions and message format requirements, for example, normal position change messages must include a "status confirmation" field, while abnormal position changes must be accompanied by an "alarm" identifier. Taking into account that in actual applications, the simulation message data generated by the substation digital twin simulation model may deviate from actual expectations due to unreasonable settings of preset state simulation parameter thresholds, in order to ensure the reliability of simulation message generation as much as possible, this embodiment preferably extracts message generation rules from simulation message data and compares them with preset message generation logic. If the two are completely consistent, it is considered that the position change state simulation parameters are the optimal parameters that can be used directly. Otherwise, it is considered that there is still room for optimization and adjustment of the position change state simulation parameters.

[0074] The displacement state simulation parameters are optimized and adjusted according to the consistency comparison results, and the substation digital twin simulation model is generated according to the optimized and adjusted displacement state simulation parameters and the initial structure of the substation model; wherein, the optimization and adjustment of the displacement state simulation parameters according to the consistency comparison results can be understood as an inconsistency item based on the message generation rule and the preset message generation logic, and the displacement state simulation parameters related thereto are found according to the association analysis algorithm, and then the related displacement state simulation parameters are tuned and set according to the needs. For example, if it is found that an abnormal displacement message lacks an alarm mark, it is considered that the consistency judgment has failed. After the association analysis, it is determined that the alarm mark is related to the abnormal state response time. The abnormal state response time can be adjusted to 0.15 seconds to ensure the integrity of the field, so that the message simulation data generated based on the optimized displacement state simulation parameters can more realistically reflect the device behavior, so as to ensure the reliability and simulation accuracy of the digital twin model application.

[0075] S12. Obtain the actual operation message data of the substation automation system, and obtain the displacement abnormality identification result based on the logical conflict comparison between the actual operation message data and the corresponding simulated operation message data; wherein, the actual operation message data can be understood as the message data generated during the system operation process for a period of time to facilitate periodic monitoring of network abnormalities; the corresponding logical conflict comparison can be understood as the difference analysis of the message trigger generation logic reflected by the message data difference between the real message data and the corresponding simulated operation message data.

[0076] Specifically, the position change anomaly identification result includes a configuration error anomaly and a device failure anomaly; and the step of obtaining the position change anomaly identification result based on a logical conflict comparison between the actual operation message data and the corresponding simulation operation message data includes:

[0077] Obtain the message data difference between the actual operation message data and the simulated operation message data, and generate a corresponding initial logical conflict set based on the message data difference; wherein, considering that the actual operation message data and the simulated operation message data are both message timing data of a certain length, the difference between the message data corresponding to the position in the two sets of data can be analyzed to obtain the initial logical conflict set. In actual applications, the difference analysis between the two sets of data is not limited to the state value deviation. In order to ensure the comprehensiveness of the difference analysis, it can also include message type deviation, time deviation and deviation of other data contents; for example, the displacement state of a device in the actual message is displayed as "closed", while the displacement state in the simulated message is displayed as "disconnected", then this difference can be included in the logical conflict set. Similarly, if the timestamp of the actual message data is 5 milliseconds later than that of the simulated message data, it can be included in the logical conflict set as a time deviation.

[0078] Based on the decision tree algorithm and the preset conflict types, the initial logical conflict set is divided to obtain multiple conflict subsets; the preset conflict types include message type conflicts, position change state conflicts and message time conflicts; wherein, the conflict subsets can be understood as data sets corresponding to different preset conflict types obtained based on the decision tree algorithm classification; the specific classification process of obtaining multiple conflict subsets using the decision tree algorithm can refer to the relevant existing technology implementation based on the decision tree algorithm to achieve multi-category division, which will not be described in detail here.

[0079] Statistical analysis is performed on each conflict subset to obtain the occurrence frequency of various conflict types; among them, the occurrence frequency of various conflict types can be understood as the frequency of occurrence of various conflict types within the abnormal monitoring period, which can be obtained based on existing statistical analysis methods and will not be repeated here.

[0080] Determine whether the frequency of occurrence of various conflict types exceeds the corresponding preset frequency threshold. If so, obtain the log information and message type of the associated device, determine whether there is a device failure based on the log information, and determine whether there is a configuration error based on the matching of the message type and the corresponding conflict type, and obtain the corresponding bit-wise abnormality identification result; among which, the preset frequency threshold can be set according to actual application requirements. If the frequency of occurrence of a certain conflict type exceeds the preset frequency threshold, it is considered that there are high instability factors in the system operation, and the frequency distribution law can intuitively reflect the concentration of the problem, which can provide a basis for troubleshooting. After determining that the frequency of occurrence of the conflict type exceeds the corresponding preset frequency threshold, the devices and corresponding message types associated with the frequency exceeding the standard anomaly can be further obtained to identify whether there is a configuration anomaly or a displacement anomaly; for example, if a switch state anomaly with a frequency exceeding the standard is related to a circuit breaker, it can be inferred that its sensor may be damaged. At the same time, if relevant fault alarm information can be found in the operation log of the relevant equipment, it can be preliminarily confirmed that the displacement anomaly is related to a hardware failure. On the contrary, if no relevant fault alarm is found in the operation log information of the corresponding equipment, it can be preliminarily determined that the anomaly is not related to the hardware failure, but may be related to a configuration anomaly. Then, combined with the matching of the message type and the corresponding conflict type, it is further confirmed whether there is a configuration error; for example, if the message type sent by the associated device should be GOOSE, but an IEC104 message is actually received, it can be confirmed that the anomaly is caused by an incorrect device protocol configuration.

[0081] S13. Identify the conditions for generating a false tripping signal based on the position abnormality identification result to obtain an abnormal message identification result; the abnormal message identification result includes the abnormal message and the corresponding abnormal source and abnormal type; wherein, the abnormal message can be understood as the message data that may trigger a tripping signal obtained by further screening and confirming the suspected abnormal message data with configuration abnormality and position abnormality.

[0082] In order to ensure the efficiency and reliability of abnormal message identification, this embodiment preferably performs a comprehensive analysis based on the message change timing and data content; specifically, the step of identifying the false trip signal generation condition based on the change abnormality identification result to obtain the abnormal message identification result includes:

[0083] When the position change abnormality identification result is a configuration abnormality or a position change abnormality, the state change timing data of the corresponding message data is obtained; the state change timing data includes the time of each state change and the corresponding state ID; for example, a message shows that it changes from "open" to "closed" at 10:02, and the corresponding previous message obtained is from "closed" to "open" at 10:00, then the state change timing data corresponding to the message is a sequence data including the corresponding state IDs at different times, which can be expressed as "closed-opened-closed", and the time interval of adjacent state switching can be obtained; it should be noted that the number of state IDs in the specific state change timing data increases according to actual needs, but in view of improving the efficiency of data analysis while ensuring the reliability of the position change timing analysis, this embodiment preferably generates state change timing data based on the position change information of the message data with configuration abnormality or position change abnormality and its previous message data.

[0084] The state change timing data is compared with the preset operation timing data. If there is any inconsistency, it is determined that an abnormal message exists that meets the conditions for generating a false trip signal. The preset operation timing data can be understood as valid state change timing data ("close-open-close" or "open-close-open") constructed based on the principles that adjacent change states do not repeat and the duration between different change states is not less than the preset operation duration interval. If, when comparing the state change timing data with the preset operation timing data, the state ID sorting rules or the set duration interval between adjacent state IDs do not match the preset operation timing data, it is considered that this may trigger a false trip signal judgment, and the corresponding message data is determined to be an abnormal message.

[0085] The address information of each abnormal message is obtained, and the address information is clustered and analyzed to obtain abnormal source classification results; wherein the address information may include the source and destination IP addresses and source and destination port numbers of the message, etc., which can locate the source of the message.

[0086] The message structure features of the abnormal messages classified under the same abnormal source are extracted and analyzed respectively to determine the abnormal type of the corresponding abnormal source classification; the message structure features can be understood as the message content fields that can reflect the type of device sending the message, the difference in communication protocols and the cause of the abnormality. The specific feature content can be determined based on the actual analysis needs and is not specifically limited here; for example, assuming that the redundant field "spare bit = 1" of the abnormal message should be "0" under normal circumstances, it is considered that there is a device collection error, that is, the abnormal type corresponding to the abnormal messages corresponding to the same abnormal source can be marked as the "collection error" type; for example, if the abnormal messages from the same abnormal source all have a reporting time deviation, it can be considered that there is a "network transmission failure" and so on.

[0087] Considering that the identification of false tripping signals not only improves system stability but also reduces economic losses caused by misoperation, this embodiment uses timing verification to further confirm abnormal messages, and provides abnormal message source classification and abnormal type marking to provide accurate basis for subsequent system equipment operation and maintenance, avoid blind troubleshooting, and improve positioning efficiency.

[0088] S14. According to the abnormal message identification result, each abnormal message is subjected to abnormal simulation analysis based on the substation digital twin simulation model to obtain a corresponding power grid threat analysis result; the power grid threat analysis result includes the abnormal propagation path, the potential threat level of the affected node and the key risk monitoring area; wherein, the process of performing abnormal simulation analysis on each abnormal message based on the substation digital twin simulation model can be understood as a process of simulating and setting the corresponding equipment in the substation digital twin simulation model based on the source and abnormal type of each abnormal message, and using the substation digital twin simulation model to perform system operation simulation based on the abnormal setting; specifically, the step of performing abnormal simulation analysis on each abnormal message based on the substation digital twin simulation model to obtain the corresponding power grid threat analysis result according to the abnormal message identification result includes:

[0089] According to the abnormal source and abnormal type of each abnormal message in the abnormal message identification result, the substation digital twin simulation model is used to perform simulation to obtain the corresponding abnormal propagation path; the abnormal propagation path includes the affected power grid nodes; wherein, the abnormal propagation path can be understood as the abnormal message input into the substation digital twin simulation model, and the abnormal message obtained by performing system operation simulation based on the normal operation mechanism of the substation automation system to pass through each device node and the path sequence of each device node in the system; for example, assuming that a switch message shows abnormal closure, but the actual device is not operated, the corresponding message sample data has a timestamp of 09:05:23 and a current value of 0A. After the message sample is input into the substation digital twin simulation model for real-time simulation, the simulation system tracks the message transmission from the main control unit to the protection device, which takes about 50 milliseconds, and obtains the propagation path of "main control-bus-protection unit". Based on the obtained abnormal propagation path, the impact range of the abnormal message on the power grid can be determined.

[0090] The corresponding false trip probability is obtained based on the preset false trip trigger conditions for each affected grid node. The preset false trip trigger conditions for the affected grid nodes can be obtained based on analysis of relevant historical data. For example, if a node has experienced four similar anomalies in the past 30 days, and the corresponding trigger condition is that the timestamp in the message lags behind the actual operation by 2 seconds three times, then if the abnormal cause of the abnormal message is also time deviation, then the probability of the message causing a false trip for this node is approximately 75%. It should be noted that the preset false trip trigger conditions for the affected grid nodes may vary in actual applications and can be determined based on the actual application scenario, and are not specifically limited here.

[0091] Based on the false tripping probabilities and operating status data of all affected grid nodes, the grid stability is evaluated using the support vector machine algorithm to obtain the corresponding grid stability changes. The operating status data of the affected grid nodes can be selected according to actual application requirements, such as the node's voltage fluctuation rate, current fluctuation rate, and tripping frequency, which will affect grid stability. Correspondingly, the grid stability changes can be understood as a comprehensive analysis of the false tripping probabilities and operating status data of all affected grid nodes using the support vector machine algorithm to obtain the corresponding grid stability assessment value. This is then compared with the historical grid stability assessment value obtained based on the historical false tripping probabilities and historical operating status data of the relevant affected grid nodes before the input of the abnormal message to obtain the grid stability change results.

[0092] When the change in the grid stability is a risk increase, the corresponding potential threat level is obtained based on the random forest algorithm according to the topological position and historical fault frequency of each affected grid node; wherein, the topological position can be understood as the network position of the affected grid node in the substation automation system; the historical fault frequency can be understood as the fault frequency obtained based on the relevant historical operation and maintenance ledger data statistics of the affected grid node. Taking into account the fact that in actual applications, the closer the affected node is to the load center or the greater the number of historical faults, the greater its impact on the grid power supply stability, this embodiment preferably performs corresponding threat level sorting based on the topological position and historical fault frequency of the affected grid node, so as to effectively identify risk points as the focus of subsequent system operation and maintenance, so as to improve the reliability of grid operation. It should be noted that the specific analysis process of using the random forest algorithm to analyze the topological position and historical fault frequency of the affected grid node to obtain the potential threat level can refer to the existing relevant implementation process of level evaluation or classification based on the random forest algorithm, which will not be described in detail here.

[0093] Based on the threat level ranking results of each affected grid node, a key risk monitoring area is determined. A key risk monitoring area can be understood as a monitoring area centered on the physical location of one or more affected grid nodes with a higher threat level, as determined by the ranking results, and defined by a preset radius. For example, if node A is rated the highest priority due to its proximity to the load center and its high number of historical faults, the 2-kilometer radius around node A could be designated as a key risk monitoring area requiring increased inspections.

[0094] The present embodiment provides an abnormal message analysis mechanism for detecting logical conflicts between the substation automation system operation simulation messages generated by the substation digital twin simulation model based on digital twin technology and the system's real messages. The mechanism can accurately identify the logical conflicts between normal state position change messages and abnormal position change messages caused by configuration errors or equipment failures in real time, thereby ensuring the efficient and accurate identification of abnormal messages with abnormal position changes that may cause false tripping signals, reducing the risk of misjudgment or missed judgment, and facilitating the improvement of abnormal response efficiency in complex substation communication scenarios, effectively avoiding the risk of chain failures caused by untimely analysis and processing of abnormal messages, and providing reliable protection for power grid stability.

[0095] Considering that in actual applications, the generation of abnormal position change messages may be caused by factors such as manual configuration errors and equipment failures, as well as malicious tampering of communication messages by malicious attackers, in order to ensure the comprehensiveness of power grid security protection, this embodiment preferably conducts a comprehensive analysis of the system abnormal operation data and historical system normal operation data collected during the abnormal simulation analysis based on the accurate logical conflict comparison analysis of the actual operation message data based on the substation digital twin simulation model to identify abnormal position change messages, so as to achieve reliable identification of false trip signals caused by malicious tampering and timely perception of network attack risks. Specifically, the method also includes:

[0096] Collect system abnormal operation data based on the abnormal simulation analysis of each abnormal message based on the digital twin simulation model of the substation; wherein, the system abnormal operation data can be understood as the system simulation operation data collected during the abnormal simulation analysis performed according to the abnormal message identification result analysis to obtain the corresponding power grid threat analysis result in the above embodiment, and can obtain data such as the message repetition ratio and message sending time interval of various types of messages in the system abnormal simulation operation based on the actual application scenario requirements.

[0097] The system abnormal operation data and the historical system normal operation data are compared and analyzed to generate logic verification rules; wherein the logic verification rules may include system operation indicators and corresponding indicator thresholds determined based on the comparison and analysis of each data in the system abnormal operation data and the historical system normal operation data, where the abnormal operation state changes more significantly than the normal operation state; for example, the message repetition ratio of the corresponding message type exceeds the repetition ratio threshold, and / or the message sending time interval is lower than the preset time interval, etc.

[0098] According to the logic check rule, each abnormal message in the abnormal message identification result is secondary verified to determine the corresponding suspected false signal generation cause; wherein the suspected false signal generation cause may include misconfiguration operation, malicious tampering and equipment failure; specifically, according to the logic check rule, each abnormal message in the abnormal message identification result is secondary verified to determine the corresponding suspected false signal generation cause, including:

[0099] The transmission characteristics of each abnormal message are obtained and matched with a preset misoperation pattern. When matching, a correlation analysis is performed between the basic information of the corresponding abnormal message and the operation record to obtain a corresponding correlation score. The transmission characteristics can be understood as being obtained based on a statistical analysis of message data of the same message type within the monitoring period corresponding to the abnormal message, including the message transmission interval and repetition frequency, corresponding to the aforementioned logical verification rules. The preset misoperation pattern can be understood as the transmission characteristics of abnormal messages generated due to misoperation, determined based on experience or expert knowledge. For example, if a trip signal message contains three consecutive repeated switching commands, while normal operation only requires one, the transmission characteristics of the message are considered inconsistent with the preset misoperation pattern (e.g., only transmitted once within a preset operation duration), and the initial judgment is that it may be a misoperation. To ensure the accuracy of the misoperation analysis, after the preset misoperation pattern is successfully matched, a further correlation analysis is performed based on the basic information of the abnormal message and the operation record to determine whether it is truly a misoperation.

[0100] The operation records in this embodiment may include the time when the user manually performs the operation and the relevant device operation log, etc. The corresponding basic information can be understood as data that is convenient for efficient comparison and analysis with the device operation record, and may include the sending timestamp, sender identifier and data length of the message, etc.; the corresponding correlation score can be understood as extracting the operation log that matches the sending timestamp in the basic information of the message from the operation record, and then comparing and analyzing the sending device identifier and sending data length involved in the operation log matching the timestamp with the sender identifier and data length in the basic information to generate the corresponding correlation score, or the timestamp ("2025-03-2010:00:05"), sender identifier ("device A") and data length ("128 bytes") into a feature vector for similarity analysis; if the matching degree is high, the corresponding correlation score is high.

[0101] If the correlation score is greater than the preset correlation threshold, it is determined that the cause of the corresponding suspected false signal is a misconfiguration operation. Otherwise, the consistency verification data of the abnormal message is obtained; wherein, the preset correlation threshold can also be determined according to actual application requirements; when the correlation score is greater than the preset correlation threshold, it can be determined that the suspected false signal is generated due to a misconfiguration operation, and the misconfigured device can be located based on the sender identifier in the corresponding message. When the misconfiguration operation judgment condition is not met, that is, the message characteristics deviate from the misoperation mode, it is necessary to further combine the consistency verification data of the message for judgment and analysis. Preferably, the consistency verification data includes the message header check code, data field and timestamp.

[0102] According to the consistency verification data of the abnormal message, a comprehensive analysis is performed based on the decision tree algorithm to obtain the corresponding message tampering score, and the message tampering score is compared with the preset score threshold; wherein, the process of generating the message tampering score based on the decision tree algorithm can also refer to the existing implementation process of classification scoring based on the decision tree algorithm, which will not be described in detail here; the corresponding preset score threshold can also be set based on actual application requirements.

[0103] If the message tampering score reaches the preset score threshold and the corresponding message source address information meets the preset false signal distribution, it is determined that the corresponding suspected false signal is caused by malicious tampering. Otherwise, it is determined that the corresponding suspected false signal is caused by equipment failure. The preset false signal distribution characteristics can be understood to be obtained by clustering analysis of the message source address information (source IP address and source port number) of the abnormal message data collected during the historical operation of the system, or by clustering analysis of the source addresses of all abnormal messages identified during the monitoring period. For example, the clustering results show that 80% of the abnormal messages come from For packets in the same IP address segment "192.168.1.x", the IP address segment is used as a false signal distribution feature to identify malicious tampering messages. Abnormal messages whose message tampering score reaches the preset score threshold and whose message source address information is the IP address "192.168.1.10" and port number "8080" are determined to meet the preset false signal distribution and are further determined to be suspected false signals generated by malicious tampering. If only the message tampering score reaches the preset score threshold, but the message source address information does not meet the preset false signal distribution, it is considered to be a signal generated by a normal device failure trigger.

[0104] Generate a corresponding abnormal protection strategy based on the suspected false signal generation cause of each abnormal message; wherein the abnormal protection strategy can be understood as a protection mechanism preset for different suspected false signal generation causes in order to avoid the risk of cascading failures induced by abnormal messages. Specifically, the steps of generating a corresponding abnormal protection strategy based on the suspected false signal generation cause of each abnormal message include:

[0105] When the suspected false signal is generated due to misconfiguration or device failure, the source address information and sending device identifier of the corresponding abnormal message are obtained, and a corresponding abnormal prompt alarm is generated according to the source address information and the sending device identifier;

[0106] When the suspected false signal is generated due to malicious tampering, the abnormal propagation path of the corresponding abnormal message is obtained, and the false signal is isolated according to the abnormal propagation path; wherein, false signal isolation can be understood as isolating the communication channel for the abnormal message to be transmitted to the next network node based on the abnormal propagation path obtained by abnormal simulation analysis. For example, if a false signal is sent from the sensor of substation A, passes through relay node B, and finally affects the control center, the path analysis will clarify this link, and the isolation range will be locked to the communication channel from A to B, effectively preventing false signals from interfering with normal operation and avoiding more serious threats to power grid operation.

[0107] The embodiment of the present invention uses a substation digital twin simulation model based on digital twin technology to generate a substation automation system operation simulation message to perform logical conflict detection on the system's real message, combined with a power grid threat assessment mechanism that performs abnormal simulation analysis based on the abnormal message identification results. It can adaptively realize real-time, efficient and accurate abnormal state logical conflict detection and analysis, timely and reliably perceive system anomalies, effectively improve the accuracy and efficiency of system abnormal message and false trip signal identification, and at the same time, can accurately perceive network attack risks in real time, and perform targeted system security protection based on different abnormal causes of displacement, effectively improving the safety and stability of substation automation system operation.

[0108] It should be noted that although the steps in the above flowchart are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders.

[0109] In one embodiment, Figure 2 As shown, a network security monitoring system for a substation automation system is provided, the system comprising:

[0110] Message simulation module 1, used to simulate the real-time operation of the substation automation system based on the pre-built substation digital twin simulation model and generate simulation operation message data;

[0111] The message comparison and analysis module 2 is used to obtain the actual operation message data of the substation automation system, and obtain the position abnormality identification result based on the logical conflict comparison between the actual operation message data and the corresponding simulation operation message data;

[0112] The abnormal message identification module 3 is used to identify the conditions for generating a false trip signal according to the abnormal position change identification result, and obtain an abnormal message identification result; the abnormal message identification result includes the abnormal message and the corresponding abnormal source and abnormal type;

[0113] The power grid threat analysis module 4 is used to perform abnormal simulation analysis on each abnormal message based on the substation digital twin simulation model according to the abnormal message identification results to obtain corresponding power grid threat analysis results; the power grid threat analysis results include abnormal propagation paths, potential threat levels of affected nodes and key risk monitoring areas.

[0114] For the specific definition of the network security monitoring system for the substation automation system, please refer to the definition of the network security monitoring method for the substation automation system above. The corresponding technical effects can also be obtained equivalently, so they will not be repeated here. Each module in the above-mentioned network security monitoring system for the substation automation system can be implemented in whole or in part through software, hardware, and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0115] In summary, the embodiment of the present invention provides a network security monitoring method and system for a substation automation system. The network security monitoring method for a substation automation system realizes real-time operation simulation of the substation automation system according to a pre-built substation digital twin simulation model, generates simulated operation message data, obtains actual operation message data of the substation automation system, and compares the logical conflicts between the actual operation message data and the corresponding simulated operation message data to obtain the position abnormality identification result. Then, according to the position abnormality identification result, the false tripping signal generation condition is identified to obtain the abnormal message identification result including the abnormal message and the corresponding abnormal source and abnormal type. According to the abnormal message identification result, each abnormal message is identified based on the substation digital twin simulation model. This paper conducts abnormal simulation analysis to obtain a technical solution for the power grid threat analysis results including abnormal propagation paths, potential threat levels of affected nodes and key risk monitoring areas. This method uses the digital twin technology to build a substation digital twin simulation model to generate substation automation system operation simulation messages to perform logical conflict detection on the system's real messages. Combined with the power grid threat assessment mechanism that performs abnormal simulation analysis based on the abnormal message identification results, it can adaptively realize real-time, efficient and accurate abnormal state logical conflict detection and analysis, timely and reliably perceive system abnormalities, and effectively improve the accuracy and efficiency of system abnormal message and false trip signal identification, thereby providing reliable protection for the safety and stability of substation automation system operation.

[0116] Each embodiment in this specification is described in a progressive manner, and the same or similar parts of each embodiment can be directly referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. It should be noted that the various technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the various technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0117] The above-described embodiments merely represent several preferred implementations of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the patent. It should be noted that a person skilled in the art can make several improvements and substitutions without departing from the technical principles of the present invention, and such improvements and substitutions should also be considered within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be based on the scope of protection of the claims.

Claims

1. A network security monitoring method for a substation automation system, characterized in that: The method comprises the following steps: Perform real-time operation simulation of the substation automation system based on the pre-built substation digital twin simulation model to generate simulation operation message data; Acquiring actual operation message data of the substation automation system, and obtaining a position abnormality identification result based on a logical conflict comparison between the actual operation message data and corresponding simulation operation message data; Identify the conditions for generating a false trip signal based on the position change abnormality identification result to obtain an abnormal message identification result; the abnormal message identification result includes the abnormal message and the corresponding abnormal source and abnormal type; According to the abnormal message identification results, an abnormal simulation analysis is performed on each abnormal message based on the substation digital twin simulation model to obtain corresponding power grid threat analysis results; the power grid threat analysis results include abnormal propagation paths, potential threat levels of affected nodes, and key risk monitoring areas.

2. The substation automation system network security monitoring method according to claim 1, characterized in that: The steps of constructing the substation digital twin simulation model include: Based on the physical topology and protection device configuration of the substation automation system, the initial structure of the substation model is constructed using digital twin technology; Acquire a historical GOOSE message data set of a microcomputer protection device in the substation automation system, and analyze the historical GOOSE message data set to obtain a corresponding normal displacement feature set and an abnormal displacement feature set; the historical GOOSE message data set includes a normal displacement status message and an abnormal displacement status message; According to the normal displacement feature set and the abnormal displacement feature set, based on the microcomputer protection operation rules and the initial structure of the substation model, normal displacement state and abnormal displacement state simulation are performed to generate displacement state simulation parameters; Matching and analyzing the displacement state simulation parameters with the preset state simulation parameter thresholds, and if they match, generating a simulation data set through a preset message generation logic; Extracting message generation rules based on the simulation data set, and performing consistency comparison analysis on the message generation rules and the preset message generation logic to obtain corresponding consistency comparison results; the message generation rules include bit shift trigger conditions and message format requirements; The displacement state simulation parameters are optimized and adjusted according to the consistency comparison results, and the substation digital twin simulation model is generated according to the optimized and adjusted displacement state simulation parameters and the initial structure of the substation model.

3. The substation automation system network security monitoring method according to claim 2, characterized in that: The step of analyzing the historical GOOSE message data set to obtain the corresponding normal displacement feature set and abnormal displacement feature set includes: Based on the extraction of the displacement state information of each message data in the historical GOOSE message data set, a corresponding displacement state information data set is obtained; Performing normal displacement state screening on the displacement state information dataset according to a pre-built normal displacement rule library to obtain a normal displacement dataset; Performing anomaly detection on the displacement state information in the difference set between the historical GOOSE message data set and the normal displacement data set based on a preset anomaly detection algorithm to obtain an abnormal displacement data set; Based on a preset feature extraction method, feature extraction is performed on the normal displacement data set and the abnormal displacement data set respectively to obtain a corresponding normal displacement feature value set and abnormal displacement feature value set.

4. The substation automation system network security monitoring method according to claim 1, characterized in that: The position change anomaly identification result includes a configuration error anomaly and a device failure anomaly; and the step of obtaining the position change anomaly identification result based on a logical conflict comparison between the actual operation message data and the corresponding simulation operation message data includes: Obtaining a message data difference between the actual operation message data and the simulated operation message data, and generating a corresponding initial logical conflict set according to the message data difference; Based on a decision tree algorithm and preset conflict types, the initial logical conflict set is divided to obtain multiple conflict subsets; the preset conflict types include message type conflict, shift state conflict and message time conflict; Statistical analysis is performed on each conflict subset to obtain the frequency of occurrence of various conflict types; Determine whether the frequency of occurrence of various conflict types exceeds the corresponding preset frequency threshold. If so, obtain the log information and message type of the associated device, determine whether there is a device failure based on the log information, and determine whether there is a configuration error based on the matching of the message type and the corresponding conflict type, and obtain the corresponding bit abnormality identification result.

5. The substation automation system network security monitoring method according to claim 1, characterized in that: The step of identifying a false trip signal generation condition based on the position change abnormality identification result to obtain an abnormal message identification result includes: When the position change abnormality identification result is a configuration abnormality or a position change abnormality, the state change time sequence data of the corresponding message data is obtained; the state change time sequence data includes the time of each state change and the corresponding state ID; Comparing the state change timing data with the preset operation timing data, and if they are inconsistent, determining that there is an abnormal message that meets the conditions for generating a false trip signal; Obtaining the address information of each abnormal message and performing cluster analysis on the address information to obtain abnormal source classification results; The abnormal messages of the same abnormal source classification are respectively subjected to message structure feature extraction and analysis to determine the abnormal type corresponding to the abnormal source classification.

6. The substation automation system network security monitoring method according to claim 1, characterized in that: The step of performing abnormal simulation analysis on each abnormal message based on the substation digital twin simulation model according to the abnormal message identification result to obtain the corresponding power grid threat analysis result includes: According to the abnormal source and abnormal type of each abnormal message in the abnormal message identification result, a simulation is performed through the substation digital twin simulation model to obtain a corresponding abnormal propagation path; the abnormal propagation path includes an affected power grid node; According to the preset false tripping trigger conditions of each affected grid node, the corresponding false tripping probability is obtained; Based on the false tripping probability and operating status data of all affected grid nodes, the grid stability is evaluated based on the support vector machine algorithm to obtain the corresponding grid stability changes; When the grid stability change indicates an increased risk, a corresponding potential threat level is obtained based on the random forest algorithm according to the topological location and historical fault frequency of each affected grid node; Based on the ranking results of the threat levels of each affected power grid node, key risk monitoring areas are determined.

7. The substation automation system network security monitoring method according to claim 1, characterized in that: The method further comprises: Collecting system abnormal operation data for performing abnormal simulation analysis on each abnormal message based on the substation digital twin simulation model; Comparing and analyzing the abnormal system operation data with historical normal system operation data to generate logic verification rules; According to the logic verification rules, each abnormal message in the abnormal message identification result is secondary verified to determine the cause of the corresponding suspected false signal generation; Generate corresponding abnormal protection strategies based on the suspected false signal generation cause of each abnormal message.

8. The substation automation system network security monitoring method according to claim 7, characterized in that: The step of performing secondary verification on each abnormal message in the abnormal message identification result according to the logic verification rule, and correspondingly verifying the cause of the suspected false signal generation includes: Obtain the sending characteristics of each abnormal message, and match and analyze the sending characteristics with the preset error operation pattern. When matching, perform correlation analysis on the basic information of the corresponding abnormal message and the operation record to obtain the corresponding correlation score; the sending characteristics include the message sending interval and repetition frequency; the basic information includes the timestamp, sender identifier and data length; If the correlation score is greater than a preset correlation threshold, it is determined that the cause of the corresponding suspected false signal is a misconfiguration operation; otherwise, the consistency check data of the abnormal message is obtained; the consistency check data includes a message header check code, a data field, and a timestamp; Perform a comprehensive analysis based on the consistency check data of the abnormal message using a decision tree algorithm to obtain a corresponding message tampering score, and compare the message tampering score with a preset score threshold; If the message tampering score reaches the preset score threshold and the corresponding message source address information satisfies the preset false signal distribution, the corresponding suspected false signal is determined to be caused by malicious tampering; otherwise, the corresponding suspected false signal is determined to be caused by equipment failure; the preset false signal distribution characteristics are obtained based on a cluster analysis of the source addresses of all abnormal messages.

9. The substation automation system network security monitoring method according to claim 7, characterized in that: The step of generating a corresponding abnormality protection strategy according to the suspected false signal generation cause of each abnormal message includes: When the suspected false signal is generated due to misconfiguration or device failure, the source address information and sending device identifier of the corresponding abnormal message are obtained, and a corresponding abnormal prompt alarm is generated according to the source address information and the sending device identifier; When the suspected false signal is generated due to malicious tampering, the abnormal propagation path of the corresponding abnormal message is obtained, and the false signal is isolated according to the abnormal propagation path.

10. A network security monitoring system for a substation automation system, characterized in that: The system comprises: The message simulation module is used to simulate the real-time operation of the substation automation system based on the pre-built substation digital twin simulation model and generate simulation operation message data; A message comparison and analysis module is used to obtain actual operation message data of the substation automation system, and obtain a position abnormality identification result based on a logical conflict comparison between the actual operation message data and the corresponding simulated operation message data; An abnormal message identification module is used to identify the conditions for generating a false trip signal based on the abnormal position change identification result to obtain an abnormal message identification result; the abnormal message identification result includes the abnormal message and the corresponding abnormal source and abnormal type; The power grid threat analysis module is used to perform abnormal simulation analysis on each abnormal message based on the substation digital twin simulation model according to the abnormal message identification results to obtain corresponding power grid threat analysis results; the power grid threat analysis results include abnormal propagation paths, potential threat levels of affected nodes, and key risk monitoring areas.

Images