A safe operation method and system of a smart grid

Abstract

The application relates to the technical field of power grid safety monitoring, in particular to a safe operation method and system of a smart power grid, which comprises the following steps: collecting original flow data in the operation process of the smart power grid, extracting five-tuple data, storing the extracted five-tuple data into a ring buffer, performing feature expansion on the five-tuple data to generate multidimensional flow data, performing abnormality judgment on the multidimensional flow data, extracting corresponding abnormal flow data and associated packets associated with the abnormal flow data from the ring buffer to form an associated communication data group when an abnormality is detected, drawing a communication path of the abnormal flow based on the associated communication data group, performing dynamic sandbox analysis on the associated communication data group to obtain malicious behavior features, and matching in a strategy knowledge base based on geographical position features and the malicious behavior features to generate a response strategy, so as to realize the safe operation of the smart power grid. The application improves the correlation of multi-source data, and is more convenient for traceability analysis of safety events and dynamic response of decision-making.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power grid safety monitoring, and particularly relates to a safe operation method of a smart power grid and a safe operation system of a smart power grid. BACKGROUND

[0002] With the development of economy and technology and the improvement of people's living standards, electric energy has become an essential energy in people's production and life, bringing a lot of convenience to people's production and life. Therefore, guaranteeing the stable and reliable supply of electric energy has become one of the most important tasks in the power system.

[0003] With the continuous development of industrial informatization, the power industry has achieved deep integration with advanced information communication and computing technology, and the smart power grid can realize the collection and transmission of massive data. The increase in data volume brings challenges to data management and network optimization. At present, operation and maintenance personnel cannot realize business analysis through manual methods, and need to use safety detection technology to abstract business interaction features, such as rule-based static detection or statistical-based anomaly detection.

[0004] However, the above methods can cope with some known threats, but it is difficult to realize the deep correlation of network traffic, device account and other multi-source data, the detection of metamorphic attacks lags behind, and the analysis of power special protocols is insufficient, which cannot meet the current demand of power grid safety operation. SUMMARY

[0005] (I) Technical problems to be solved

[0006] In view of the above shortcomings and deficiencies of the prior art, the present application provides a safe operation method and system of a smart power grid, which solves the technical problems of insufficient multi-source data fusion capability and dynamic response lag of the current safety detection technology.

[0007] (II) Technical solutions

[0008] In order to achieve the above purpose, the main technical scheme adopted by the present application comprises:

[0009] In the first aspect, the present application provides a safe operation method of a smart power grid, comprising:

[0010] Real-time collection of original flow data in the operation process of the smart power grid, and preprocessing of the original flow data;

[0011] Extraction of five-tuple data of the preprocessed original flow data, and storage of the extracted five-tuple data in a ring buffer and sorting according to time stamp;

[0012] Feature extension of the five-tuple data, generation of multi-dimensional flow data, and input of the multi-dimensional flow data into an anomaly detection model for anomaly determination;

[0013] When the anomaly is detected, the original traffic data corresponding to the anomaly quintuple data is extracted from the ring buffer as anomaly traffic data, and the associated packets associated with the anomaly traffic data are screened from the ring buffer according to the anomaly traffic data to form an associated communication data group;

[0014] Based on the associated communication data group, a communication path of the anomaly traffic is drawn to mark the geographical location characteristics of each node, and a dynamic sandbox analysis is performed on the associated communication data group to obtain corresponding malicious behavior characteristics;

[0015] Based on the geographical location characteristics and the malicious behavior characteristics, a matching is performed in a predefined policy knowledge base, and a corresponding response strategy is generated based on the matching result to realize the safe operation of the smart grid.

[0016] Optionally, in a specific embodiment, before the original traffic data in the operation of the smart grid is collected in real time and the original traffic data is preprocessed, the method further comprises:

[0017] Real-time collection of original physical state data in the operation of the smart grid, and judgment of whether an operation state anomaly occurs in the operation of the smart grid based on a judgment threshold;

[0018] When the operation state anomaly occurs, the corresponding anomaly physical state data is obtained;

[0019] Then, the five-dimensional data group is expanded to generate multi-dimensional traffic data, and the multi-dimensional traffic data is input into an anomaly detection model for anomaly determination, including:

[0020] The five-dimensional data group is expanded to generate multi-dimensional traffic data, and the multi-dimensional traffic data and the anomaly physical state data are input into an anomaly detection model for anomaly determination;

[0021] When no anomaly is detected, it is determined that the anomaly is caused by physical device damage, and an alarm is processed;

[0022] The multi-dimensional traffic data includes traffic rate, continuous duration, packet size entropy, same IP concurrent connection number, and port rarity.

[0023] Optionally, in a specific embodiment, inputting the multi-dimensional traffic data and the anomaly physical state data into an anomaly detection model for anomaly determination comprises:

[0024] The multi-dimensional traffic data and the anomaly physical state data are respectively preliminarily feature extracted to obtain corresponding multi-dimensional traffic feature parameters and anomaly state feature parameters;

[0025] Based on a preset deep feature extraction network, multi-dimensional traffic feature parameters and abnormal state feature parameters are extracted respectively, and corresponding multi-dimensional traffic features and abnormal state features are obtained;

[0026] According to a preset fusion attention mechanism, the multi-dimensional traffic features and the abnormal state features are fused to obtain a corresponding fusion feature matrix;

[0027] According to the fusion feature matrix, the multi-dimensional traffic features and the abnormal state features, an abnormality is determined;

[0028] The fusion attention mechanism is:

[0029] ;

[0030] Wherein, L(A,B) is a fusion feature matrix, Q a , K a and V a are query vector, key vector and value vector of multi-dimensional traffic features respectively, Q b , K b and V b are query vector, key vector and value vector of abnormal state features respectively, and T is transposition.

[0031] Optionally, in a specific embodiment, according to the abnormal traffic data, associated packets associated with the abnormal traffic data are screened out from the ring buffer to form an associated communication data group, comprising:

[0032] According to the abnormal five-tuple data group of the abnormal traffic data, all original traffic data completely matching the abnormal five-tuple data group are searched in the ring buffer to obtain a homologous data group;

[0033] According to the abnormal five-tuple data group of the abnormal traffic data, the homologous data group is expanded in the ring buffer, and the homologous IP is expanded, the time window is expanded, the protocol is associated and the load feature is matched to obtain the associated communication data group corresponding to the abnormal traffic data;

[0034] The protocol of the associated communication data group is decoded to convert the binary data packet in the associated communication data group into a readable message log.

[0035] Optionally, in a specific embodiment, based on the associated communication data group, a communication path of the abnormal traffic is drawn to mark the geographical location characteristics of each node, comprising:

[0036] According to the source IP and the destination IP of all original traffic data in the associated communication data group, an IP address set is constructed as a node candidate of the communication path;

[0037] Based on a pre-set power grid equipment ledger, all IP addresses in the IP address set are mapped and bound to the actual equipment;

[0038] Based on the source IP and destination IP of each raw traffic data in the associated communication data group, the connection direction between all nodes is determined by the direction of flow from source IP to destination IP.

[0039] By aggregating the connections between all nodes using a pre-set graph theory algorithm, redundant paths and loops are removed to generate the simplest communication path graph, i.e. the communication path of abnormal traffic.

[0040] Based on a pre-set IP geolocation database, IP addresses are mapped to latitude and longitude coordinates.

[0041] Optionally, in a specific embodiment, dynamic sandbox analysis is performed on the associated communication data group to obtain corresponding malicious behavior characteristics, including:

[0042] When an associated communication data group is received, the associated communication data group is run in a predefined virtual environment;

[0043] During this period, the operation of the associated communication data group is monitored, and all behaviors of the associated communication data are recorded to generate malicious behavior characteristics corresponding to the associated communication data group.

[0044] Optionally, in one specific embodiment, the operation of the associated communication data group is monitored, and all behaviors of the associated communication data are recorded to generate malicious behavior characteristics corresponding to the associated communication data group, including:

[0045] Identify the payload type of all raw traffic data in the received associated communication data group, load all executable file types into a pre-built power grid equipment simulation environment, and reconstruct the network protocol traffic types into function call sequences;

[0046] During file execution, function calls are monitored in real time to capture function parameters, return values, and execution context in order to generate malicious behavior characteristics corresponding to the associated communication data group.

[0047] Optionally, in one specific embodiment, during file execution, function calls are monitored in real time to capture function parameters, return values, and execution context to generate malicious behavior characteristics corresponding to the associated communication data group, including:

[0048] During file execution, function calls are monitored in real time, capturing function parameters, return values, and execution context. At the same time, parameter compliance checks, operation sequence analysis, and equipment status tracking are performed based on predefined power grid safety rules.

[0049] When an anomaly is detected, a device state rollback is performed, and a malicious behavior feature including a function call chain is generated.

[0050] Optionally, in one specific embodiment, the preprocessing includes: based on a pre-set MAC address whitelist, screening the original traffic data, and only allowing the traffic of known devices to pass; extracting IP / IPv6 header information in the Ethernet frame; and performing timestamp labeling.

[0051] In a second aspect, the embodiments of the present application provide a safe operation system of a smart grid, comprising a memory, a processor and a computer program stored in the memory, characterized in that the processor executes the computer program to implement the safe operation method of the smart grid.

[0052] (Three) beneficial effects

[0053] The safe operation method of the smart grid provided by the present application restores the attack process by extracting the associated packets of the abnormal traffic data when the anomaly detection model detects an anomaly, avoids misjudgment caused by isolated analysis of a single abnormal packet, improves the correlation of multi-source data, and is more convenient for traceability analysis of security events; and the communication path is drawn based on the associated data set, the malicious behavior feature of the associated packet is analyzed through the dynamic sandbox, the geographical location and the behavior feature are fused to construct the space-behavior dual feature, which provides more accurate input for strategy generation, and facilitates subsequent decision-making and accurate dynamic response. BRIEF DESCRIPTION OF DRAWINGS

[0054] Figure 1 A safe operation method flowchart of a smart grid provided by the embodiments of the present application;

[0055] Figure 2 An anomaly detection flowchart of an anomaly detection model provided by the embodiments of the present application;

[0056] Figure 3 An associated communication data set extraction flowchart provided by the embodiments of the present application;

[0057] Figure 4 A geographical location feature labeling flowchart provided by the embodiments of the present application;

[0058] Figure 5 A malicious behavior feature extraction flowchart provided by the embodiments of the present application. DETAILED DESCRIPTION

[0059] In order to better explain the present application and facilitate understanding, the present application is described in detail in the specific embodiments below, with reference to the accompanying drawings.

[0060] With the continuous development of industrial informatization, the power industry has achieved deep integration with advanced information communication and computing technology, and the smart grid can realize the collection and transmission of massive data. The increase in data volume poses challenges to data management and network optimization. Currently, operation and maintenance personnel cannot realize business analysis through manual methods, and need to use security detection technology to abstract business interaction features, such as rule-based static detection or statistical-based anomaly detection.

[0061] However, the above method is difficult to realize the deep correlation of network traffic, device account and other multi-source data, lags behind in detecting metamorphic attacks, and lacks analysis of power special protocols, which cannot meet the current demand for safe operation of the power grid.

[0062] The safety operation method of the smart grid provided by the embodiments of the present application extracts the associated packets of abnormal traffic data when the anomaly detection model detects an anomaly, restores the attack process, avoids misjudgment caused by isolated analysis of a single abnormal packet, improves the correlation of multi-source data, and is more convenient for traceability analysis of security incidents; and based on the associated data set, the communication path is drawn, the malicious behavior characteristics of the associated packets are analyzed through a dynamic sandbox, the geographical location and behavior characteristics are fused, the space-behavior dual characteristics are constructed, more accurate input is provided for strategy generation, and subsequent decision-making is facilitated for dynamic response.

[0063] In order to better understand the above technical solutions, the exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided to enable a clearer, more thorough understanding of the present application and to convey the complete scope of the present application to those skilled in the art.

[0064] The safety operation method of the smart grid provided by the embodiments of the present application, as shown in Figure 1 , includes:

[0065] S1, collecting raw traffic data in the operation process of the smart grid in real time, and preprocessing the raw traffic data;

[0066] S2, extracting five-tuple data of the preprocessed raw traffic data, and storing the extracted five-tuple data in a ring buffer and sorting by timestamp; wherein the five-tuple data uniquely identifies a network connection, facilitating tracking of abnormal traffic communication and target, and in general, the five-tuple data usually includes source IP, destination IP, source port, destination port and protocol.

[0067] S3, performing feature extension on the five-tuple data set to generate multi-dimensional traffic data, and inputting the multi-dimensional traffic data into an anomaly detection model for anomaly determination;

[0068] When an anomaly is detected, the original traffic data corresponding to the anomaly quintuple data is extracted from the ring buffer as anomaly traffic data, and the associated packets associated with the anomaly traffic data are screened from the ring buffer according to the anomaly traffic data to form an associated communication data group;

[0069] S4, a communication path of the anomaly traffic is drawn based on the associated communication data group to mark the geographical location features of each node, and a dynamic sandbox analysis is performed on the associated communication data group to obtain corresponding malicious behavior features;

[0070] S5, based on the geographical location features and the malicious behavior features, a matching is performed in a pre-defined strategy knowledge base, and a corresponding response strategy is generated based on a matching result to realize safe operation of the smart grid.

[0071] The smart grid safe operation method of the embodiment of the application breaks through the limitation of the traditional quintuple, combines traffic statistical features (including byte number, packet frequency, etc.) and protocol analysis features (such as Modbus protocol field value, etc.), analyzes the power special protocol, provides detection capability for metamorphic attacks, and replaces manual analysis. Through model automatic learning of normal business mode, unknown threats are dynamically detected, and the defect of lag of static detection based on rules on unknown attacks is made up. Further, when the anomaly detection model detects an anomaly, the associated packets of the anomaly traffic data are extracted to restore the attack process, avoid misjudgment caused by isolated analysis of a single anomaly packet, improve the correlation of multi-source data, and facilitate traceability analysis of security events. In addition, a communication path is drawn based on the associated data group, a malicious behavior feature of the associated packet is analyzed through a dynamic sandbox, geographical location and behavior features are fused, a space-behavior dual feature is constructed, more accurate input is provided for strategy generation, and subsequent decision-making is accurately performed for dynamic response.

[0072] Optionally, in a specific embodiment, the embodiment of the application deploys a traffic collection probe at each level (dispatching center, transformer substation, terminal device, etc.) of the smart grid, and obtains original traffic data through a mirror port or a splitter to form a collection network covering the whole network.

[0073] Usually, DPDK (Data Plane Development Kit) is used to accelerate packet capture, and line-speed collection is realized in a 10Gbps network environment to avoid traffic packet loss.

[0074] Further, the nodes are synchronized in nanosecond level through PTP (Precision Time Protocol) or NTP to ensure time sequence consistency of cross-node traffic and provide a time reference for subsequent anomaly traceability.

[0075] Optionally, in one specific embodiment, the original traffic data is pre-processed, including:

[0076] Data filtering: filtering invalid data based on five-tuple and / or power service rules (e.g. only collecting traffic of production control area), i.e. filtering traffic of 502 port which is not Modbus protocol, reducing irrelevant data interference. That is, based on pre-set MAC address whitelist, screening the original traffic data, only allowing the traffic of known devices to pass.

[0077] Format standardization: unifying the traffic logs output by different devices into JSON format (e.g. containing timestamp, src_ip, data_payload, etc.), facilitating subsequent feature extraction; and decoding the power protocol fields such as IEC61850 ASN.1 encoding into structured format.

[0078] Missing value completion: using Kalman filtering or forward filling method to complete the missing traffic data caused by sensor failure (e.g. when a device has no traffic reported for 5 minutes, generating virtual data based on historical mean); and for protocol field missing (e.g. Modbus packet with CRC check failure), inferring possible legal values through protocol specification.

[0079] Noise removal: removing outliers based on statistical threshold method (e.g. single packet size exceeding 99% quantile of MTU 1500 bytes is considered as noise); using wavelet transform to filter high-frequency noise caused by electromagnetic interference, retaining real traffic characteristics.

[0080] In addition, IP / IPv6 header information in Ethernet frame is extracted and time stamp is marked.

[0081] Optionally, in one specific embodiment, the collection node uses electromagnetic shielding hardware to ensure the stability of traffic collection in the strong electromagnetic environment of the substation.

[0082] Optionally, in one specific embodiment, the collected encrypted traffic (e.g. HTTPS, SSL) is decrypted for pre-processing (which needs to comply with power grid security compliance requirements), ensuring that the anomaly detection model can analyze malicious behaviors (e.g. encrypted ransomware communication) in encrypted traffic; for traffic that cannot be decrypted, extracting encrypted layer features (e.g. traffic pattern, packet length distribution) as auxiliary basis for anomaly detection.

[0083] Optionally, in one specific embodiment, the collection protocol of the present embodiment supports mixed collection of power dedicated protocols and general network protocols, ensuring complete capture of traffic data of SCADA systems, relay protection devices and other devices.

[0084] Optionally, in one specific embodiment, the protocol type is identified (e.g., distinguishing SCADA system traffic from general TCP / IP traffic, etc.) while extracting the quintuple data, providing a basis for subsequent feature expansion to support power-specific protocol parsing (e.g., Modbus, IEC61850, etc.). This embodiment uniquely identifies each network through the quintuple, and when an anomaly is detected, the source device and target device of the abnormal traffic (e.g., abnormal communication between a certain substation PLC and an external server) can be quickly located through the quintuple, solving the problem of tracing difficulties caused by "many devices and complex topology" in the power grid.

[0085] Optionally, in one specific embodiment, this embodiment uses an array or a linked list to implement the ring structure of the ring buffer, and controls the data overwrite logic through a read / write pointer, avoiding frequent memory allocation and release and reducing overhead.

[0086] Optionally, in one specific embodiment, the timestamp sorting adopts an incremental insertion algorithm (e.g., insertion sort), and new data is directly positioned to the corresponding position in the time series when written, ensuring the continuity of the data.

[0087] The ring buffer of this embodiment automatically discards outdated data, adapts to the continuous collection of massive traffic in the power grid (e.g., tens of thousands of data packets per second), and avoids memory overflow; the timestamp sorting provides a structured data basis for time series pattern analysis (e.g., traffic mutation detection, periodic anomaly identification) in subsequent anomaly detection, such as identifying unexpected traffic surges during the early morning period.

[0088] Optionally, before collecting the original traffic data in the operation process of the smart grid in real time and pre-processing the original traffic data, the method further comprises:

[0089] Collecting original physical state data in the operation process of the smart grid in real time, and judging whether an operation state abnormality occurs in the operation process of the smart grid based on a judgment threshold;

[0090] When the operation state abnormality occurs, obtaining corresponding abnormal physical state data;

[0091] Then, performing feature expansion on the quintuple data set to generate multi-dimensional traffic data, and inputting the multi-dimensional traffic data into an anomaly detection model for anomaly determination, including:

[0092] Performing feature expansion on the quintuple data set to generate multi-dimensional traffic data, and inputting the multi-dimensional traffic data and the abnormal physical state data into an anomaly detection model for anomaly determination;

[0093] When no anomaly is detected, it is determined that the anomaly is caused by a damaged physical device, and an alarm is processed;

[0094] The multi-dimensional traffic data includes traffic rate, continuous duration, packet size entropy, concurrent connection number with the same IP, and port rarity.

[0095] The embodiment adds physical state collection and abnormality determination. In general, the collected objects usually include device operation parameters (transformer oil temperature, circuit breaker opening and closing state, line current and voltage, etc.), environmental parameters (substation temperature and humidity, device vibration amplitude, etc.), and sensor data (combined unit sampling value, intelligent terminal state quantity, etc.).

[0096] Specifically, the embodiment calculates the health degree of the device by comprehensively considering the physical state and network behavior, and the health degree = α·physical state score + β·network behavior score.

[0097] Specifically, the time window is associated with

[0098] Specifically, the multi-dimensional traffic data and the abnormal physical state data are input into an anomaly detection model for abnormality determination, including: the physical abnormality duration > 10 minutes and the network detection is normal, which is determined as a physical failure;

[0099] The physical abnormality disappears instantaneously and the network traffic is normal, which is determined as a sensor false alarm.

[0100] The embodiment fuses the physical state and the network traffic, and identifies the scenes of physical failure caused by network attacks or physical abnormality covering network attacks that cannot be detected by traditional methods.

[0101] Further, the timestamps of the physical abnormality and the network behavior are aligned, and the fault positioning is accurately improved from the substation level to the device level.

[0102] Further, the embodiment can adjust the physical parameter threshold value based on the external environment (power grid operation mode).

[0103] Specifically, as Figure 2 shown, the multi-dimensional traffic data and the abnormal physical state data are input into an anomaly detection model for abnormality determination, including:

[0104] S311, respectively, preliminary feature extraction is performed on the multi-dimensional traffic data and the abnormal physical state data, and corresponding multi-dimensional traffic feature parameters and abnormal state feature parameters are obtained;

[0105] S312, based on a pre-set deep feature extraction network, the multi-dimensional traffic feature parameters and the abnormal state feature parameters are extracted, and corresponding multi-dimensional traffic features and abnormal state features are obtained.

[0106] S313, according to a pre-set fusion attention mechanism, the multi-dimensional traffic features and the abnormal state features are fused to obtain a corresponding fusion feature matrix.

[0107] S314, according to the fusion feature matrix, the multi-dimensional traffic feature and the abnormal state feature, performing abnormality determination.

[0108] The embodiment simultaneously captures network behavior abnormality and physical state abnormality, identifies composite attacks, and effectively solves the deficiencies of traditional methods in power grid special protocol analysis and physical network correlation analysis, and is especially suitable for early warning of network attacks and device failures in smart grids, thereby providing more comprehensive protection for safe operation of power grids.

[0109] Further, the embodiment extracts basic statistical features (such as traffic rate, packet size distribution, connection frequency, etc.), time sequence features (such as traffic mutation rate, periodicity, etc.) and protocol features (such as Modbus function code frequency, IEC61850 message structure, etc.) from the multi-dimensional traffic data expanded from the five-tuple data. From the physical state data, device operating parameters (such as temperature, voltage, vibration, etc.), alarm logs (such as device automatic code, sensor abnormal signal, etc.) and environmental parameters (such as humidity, air pressure, etc.) are extracted.

[0110] Deep extraction of traffic features uses CNN to capture traffic patterns and combines LSTM to learn time sequence dependence; deep extraction of state features uses attention mechanism to weight physical parameters and uses auto-encoder to learn the latent representation of normal state.

[0111] The traffic features and the state features are deeply fused through the fusion attention mechanism for abnormality determination.

[0112] The fusion attention mechanism is as follows:

[0113] ;

[0114] Wherein, L(A,B) is the fusion feature matrix, Q a , K a and V a are the query vector, the key vector and the value vector of the multi-dimensional traffic feature respectively, Q b , K b and V b are the query vector, the key vector and the value vector of the abnormal state feature respectively, and T is the transpose.

[0115] The embodiment simultaneously captures network behavior abnormality (such as traffic surge) and physical state abnormality (such as device temperature exceeding threshold), identifies composite attacks (such as tampering with PLC parameters through network to cause device overheating), automatically assigns feature weights (such as strengthening attention to current parameters during high load period), and improves the detection accuracy of abnormality during business peak period.

[0116] Further, the prediction uncertainty is calculated by using Monte Carlo Dropout, and the monitoring density is increased in high-risk areas (such as hub substations); and an abnormal confidence score is output, and a risk value is calculated by combining the equipment asset value (such as risk value = abnormal confidence x equipment importance x repair cost).

[0117] Optionally, in a specific embodiment, the associated packets associated with the abnormal traffic data are screened from the ring buffer according to the abnormal traffic data, and an associated communication data group is formed, that is, the associated communication data group extraction process is as shown in Figure 3 as shown, comprising:

[0118] S321, according to the abnormal five-tuple data group of the abnormal traffic data, all original traffic data completely matching the abnormal five-tuple data group are retrieved in the ring buffer, and a homologous data group is obtained;

[0119] S322, according to the abnormal five-tuple data group of the abnormal traffic data, the homologous data group is subjected to homologous IP expansion, homologous destination IP expansion, time window expansion, protocol association and load feature matching in the ring buffer, and an associated communication data group corresponding to the abnormal traffic data is obtained;

[0120] S323, the associated communication data group is subjected to protocol decoding to convert the binary data packets in the associated communication data group into readable message logs.

[0121] The screening and protocol decoding scheme of the associated packets of the embodiment realizes the leap from "single abnormality detection" to "complete supply chain analysis" through multi-dimensional expansion and deep decoding, and provides key technical support for the rapid response and accurate tracing of smart grid security incidents.

[0122] Specifically, the HGETALL command of Redis is used for retrieval according to the five-tuple hash key, accurate matching is performed in the ring buffer based on the abnormal five-tuple, all data packets of the same session are obtained, and the time complexity is O (1).

[0123] Specifically, homologous / homologous destination IP expansion: other five-tuple data packets with the same source IP or destination IP are included to identify attack diffusion paths (such as scanning behavior of the same IP to multiple devices).

[0124] Time window expansion: all data packets within ±10 seconds centered on the abnormal packet timestamp are expanded to capture interactions before and after the attack (such as probe packets before the attack and command echo after the attack).

[0125] Protocol association expansion: according to the protocol state machine, upstream and downstream data packets are associated (such as SYN, SYN-ACK and ACK packets of TCP three-way handshake), and the session context is completed.

[0126] Load feature matching: extract feature strings in abnormal packet load (such as malicious URL, encryption key), match packets with the same features in the buffer, and identify the same type of attack.

[0127] Further, the FPGA is used to accelerate the power protocol decoding, and the IEC61850 message decoding delay is reduced from 5ms of CPU processing to 200μs.

[0128] Further, the associated packets are sorted by timestamp to generate an attack chain timing diagram.

[0129] Further, based on the protocol decoding, business semantic analysis is added, such as Modbus write register command analysis to "modify the main cooler start threshold".

[0130] The embodiment shortens the attack tracing time from the traditional 30 minutes to 5 minutes through associated packet analysis; combined with the protocol decoding log, the abnormality is positioned from the network layer to the abnormality of business operation.

[0131] Optionally, in a specific embodiment, as shown in Figure 4 , the communication path of abnormal traffic is drawn based on the associated communication data set, and the geographical location characteristics of each node are marked, including:

[0132] S411, according to the source IP and destination IP of all original traffic data in the associated communication data set, an IP address set is constructed as a node candidate of the communication path;

[0133] S412, based on the pre-set power grid equipment account, all IP addresses in the IP address set are mapped and bound to the actual device;

[0134] S413, according to the source IP and destination IP of each original traffic data in the associated communication data set, in the direction of the source IP flowing to the destination IP, the connection direction between all nodes is determined;

[0135] S414, through the pre-set graph theory algorithm, the connection between all nodes is aggregated, the redundant path and loop are removed, and the simplest communication path graph is generated, that is, the communication path of abnormal traffic;

[0136] S415, based on the pre-set IP home database, the IP address is mapped to the latitude and longitude coordinates.

[0137] Specifically, all source IPs and destination IPs are extracted from the associated packets, and after deduplication, an IP address set is formed as a candidate node of the communication path.

[0138] Based on the power grid equipment account database (containing the mapping relationship of IP-device), the IP address is associated to the actual device.

[0139] Build directed edges according to data packet flow (source IP -> destination IP), for example, data packet 1, source IP 192.168.1.100 -> destination IP 10.0.0.1, data packet 2, source IP 10.0.0.1 -> destination IP 172.16.0.5.

[0140] Aggregate directed edges using graph theory algorithms (such as Dijkstra's shortest path, Floyd-Warshall algorithm), remove redundant paths (such as unified repeated connections between IPs) and loops (such as A -> B -> A), and generate the simplest directed graph.

[0141] Convert IP addresses to latitude and longitude through IP attribution databases (such as MaxMind GeoIP2), for example, 192.168.1.100 -> latitude 39.9°, longitude 116.4° (assuming a certain substation).

[0142] Further, in this embodiment, static mapping in limited matching device account (such as protection device IP fixed binding), if static mapping is indeed, through MAC address + switch port mapping table dynamic association. For temporary equipment, through ARP cache and DHCP log trace IP allocation record.

[0143] Further, introduce power grid physical topology rules to prune paths, such as prohibiting direct connection across security zones (such as production control area IP and information management area IP need to pass through firewall); filter impossible paths based on substation wiring diagram (such as single bus, double bus wiring).

[0144] Further, combined with power grid GIS system to improve positioning accuracy, get accurate coordinates directly from GIS for substation IP, and associate wide area network IP to specific power transmission line tower location through operator special line information.

[0145] Further, perform geographic information visualization processing: macro layer, national power grid topology map, mark cross-regional impact of abnormal paths; intermediate layer, provincial power grid wiring diagram, display abnormal path through substations and lines; micro layer, device connection diagram in substation, accurately locate the specific device affected by attack.

[0146] This embodiment converts abstract network traffic into intuitive geographic topology map through IP-device mapping, path optimization and geographic coordinate labeling, realizes "network attack -> physical device -> geographic location" three-dimensional tracing, and provides visual decision support for intelligent power grid security event rapid response and topology reinforcement.

[0147] Optionally, in a specific embodiment, dynamic sandbox analysis is performed on the associated communication data set to obtain corresponding malicious behavior characteristics, including:

[0148] S42, when receiving the associated communication data group, running the associated communication data group in a pre-defined virtual environment;

[0149] During the running of the associated communication data group, all behaviors of the associated communication data are monitored and recorded to generate the corresponding malicious behavior characteristics of the associated communication data group.

[0150] Further, the running of the associated communication data group is monitored, and all behaviors of the associated communication data are recorded to generate the corresponding malicious behavior characteristics of the associated communication data group, as shown in Figure 5 , including:

[0151] S421, identifying the load type of all original traffic data in the received associated communication data group, and loading all executable file types therein into a pre-constructed power grid equipment simulation environment for running, and reconstructing the network protocol traffic type therein as a function call sequence;

[0152] S422, during the file running process, real-time monitoring of function calls, capturing function parameters, return values and execution context to generate the corresponding malicious behavior characteristics of the associated communication data group.

[0153] Specifically, executable files (such as.exe,.elf), script files (such as.sh,.py) and power protocol payloads (such as Modbus, IEC61850) are identified based on file magic number, file extension and byte characteristics. For example, ELF format Linux executable files are identified by magic number 0x7F454C46.

[0154] Based on QEMU / KVM, a power dedicated device virtual machine is built, and device specific firmware and business logic are implanted. The device hardware interface is simulated to ensure that the executable file running environment is consistent with the real device.

[0155] Tracking is performed through pre-set rules, such as using Ptrace to track critical system calls such as execve() in Linux environment, and capturing parameter context.

[0156] Further, the protection logic of the power equipment is implemented in the simulation environment to ensure that the business behavior of the executable file is consistent with the real device.

[0157] Hardware interface simulation is performed, virtual sampling value input is performed, and the normal business processing flow of the device is triggered.

[0158] Further, protocol semantic level feature extraction is performed, for the Modbus protocol, the write register operation with function_code=0x06 is mapped to the function call of write_register (register_addr, value), and the business meaning corresponding to the register address is parsed.

[0159] Further, a whitelist is set for the known normal behavior to reduce invalid feature collection.

[0160] Further, an eBPF accelerator call monitoring is used to reduce the overhead.

[0161] The embodiment realizes the deep behavior analysis of the associated communication data group through the "executable file simulation running and protocol traffic function reconstruction", and is especially suitable for the advanced threat detection of the power special equipment in the smart grid, and provides a basis for the accurate traceability of security events and the generation of response strategies.

[0162] On this basis, the function call is monitored in real time during the file running, the function parameters, return values and execution context are captured to generate the malicious behavior features corresponding to the associated communication data group, including:

[0163] During the file running, the function call is monitored in real time, the function parameters, return values and execution context are captured, and the parameter compliance check, operation sequence analysis and device state tracking are performed based on the pre-defined power grid security rules;

[0164] When the anomaly is detected, the device state rollback is performed, and the malicious behavior features including the function call chain are generated.

[0165] The sandbox analysis at the function level greatly improves the detection speed and ensures the timeliness of the anomaly detection, and the device state rollback facilitates the subsequent use.

[0166] In addition, the embodiment of the application further provides a safe operation system of a smart grid, which comprises a memory, a processor and a computer program stored in the memory, and the processor executes the computer program to realize the safe operation method of the smart grid in the embodiment.

[0167] In summary, the safe operation method of the smart grid provided by the embodiment of the application extracts the associated packets of the abnormal traffic data when the anomaly detection model detects the anomaly, restores the attack process, avoids the misjudgment caused by the isolated analysis of a single abnormal packet, improves the correlation of the multi-source data, and is more convenient for the traceability analysis of security events; the communication path is drawn based on the associated data group, the malicious behavior features of the associated packets are analyzed through the dynamic sandbox, the geographical position and the behavior features are fused, the spatial-behavior dual features are constructed, more accurate inputs are provided for the strategy generation, and the subsequent decision-making is facilitated to perform the dynamic response accurately.

[0168] In the description of the application, it should be understood that the terms "first", "second" are used only for descriptive purposes, and cannot be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first", "second" can be explicitly or implicitly included one or more of the features. In the description of the application, the meaning of "a plurality of" is two or more, unless otherwise explicitly specified and limited.

[0169] In this application, unless otherwise explicitly specified and limited, the terms "mounting", "connecting", "connecting", "fixing" and the like should be understood broadly, for example, it can be fixed connection, or detachable connection, or integrated; it can be mechanical connection, or electrical connection; it can be directly connected, or indirectly connected through intermediate medium; it can be the internal communication of two elements or the interaction relationship between two elements. For those skilled in the art, the specific meaning of the above terms in this application can be understood according to the specific circumstances.

[0170] In this application, unless otherwise explicitly specified and limited, the first feature is "on" or "under" the second feature, which can be direct contact between the first and second features, or indirect contact between the first and second features through intermediate medium. Moreover, the first feature is "on", "above" and "on" the second feature, which can be directly above or obliquely above the first feature, or only indicates that the horizontal height of the first feature is higher than that of the second feature. The first feature is "under", "below" and "under" the second feature, which can be directly below or obliquely below the first feature, or only indicates that the horizontal height of the first feature is lower than that of the second feature.

[0171] In the description of the specification, the description of the terms "one embodiment", "some embodiments", "embodiment", "example", "specific example" or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the application. In this specification, the illustrative description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine the different embodiments or examples described in the specification and the features of the different embodiments or examples, without contradiction.

[0172] Although the embodiments of the application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be construed as limiting the application, and those skilled in the art can modify, modify, replace and modify the above embodiments within the scope of the application.

Claims

1. A method for safe operation of a smart grid, characterized in that The method comprises the following steps: Real-time acquisition of original flow data in the operation process of the smart grid, and preprocessing of the original flow data; Extract the five-tuple data of the preprocessed original flow data, and store the extracted five-tuple data in a ring buffer and sort them by timestamp; Feature expansion of the five-tuple data set to generate multi-dimensional flow data, and inputting the multi-dimensional flow data into an anomaly detection model for anomaly determination; When an anomaly is detected, extract the original flow data corresponding to the abnormal five-tuple data associated with the abnormal flow data from the ring buffer as abnormal flow data, and filter out the associated packets associated with the abnormal flow data from the ring buffer based on the abnormal flow data to form an associated communication data set; Based on the associated communication data set, draw the communication path of the abnormal flow to mark the geographical location characteristics of each node, and perform dynamic sandbox analysis on the associated communication data set to obtain the corresponding malicious behavior characteristics; Based on the geographical location characteristics and the malicious behavior characteristics, match in a pre-defined strategy knowledge base, and generate a corresponding response strategy based on the matching result to realize the safe operation of the smart grid.

2. The method for secure operation of a smart grid of claim 1, wherein, Before real-time acquisition of original flow data in the operation process of the smart grid, and preprocessing of the original flow data, the method further comprises: Real-time acquisition of original physical state data in the operation process of the smart grid, and based on a judgment threshold, judging whether an abnormal running state occurs in the operation process of the smart grid; When an abnormal running state occurs, obtain the corresponding abnormal physical state data; Then, feature expansion of the five-tuple data set to generate multi-dimensional flow data, and inputting the multi-dimensional flow data and the abnormal physical state data into an anomaly detection model for anomaly determination, comprising: Feature expansion of the five-tuple data set to generate multi-dimensional flow data, and inputting the multi-dimensional flow data and the abnormal physical state data into an anomaly detection model for anomaly determination; When no anomaly is detected, it is determined that the anomaly is caused by physical equipment damage, and an alarm is processed; The multi-dimensional flow data includes flow rate, continuous duration, packet size entropy, same IP concurrent connection number and port rarity.

3. The method for secure operation of a smart grid of claim 2, wherein, Inputting the multi-dimensional flow data and the abnormal physical state data into an anomaly detection model for anomaly determination, comprising: Respectively performing preliminary feature extraction on the multi-dimensional flow data and the abnormal physical state data to obtain corresponding multi-dimensional flow feature parameters and abnormal state feature parameters; Based on a pre-set deep feature extraction network, respectively extracting the multi-dimensional flow feature parameters and the abnormal state feature parameters, corresponding multi-dimensional flow features and abnormal state features; According to a pre-set fusion attention mechanism, feature fusion is performed on the multi-dimensional flow features and the abnormal state features to obtain a corresponding fusion feature matrix; Based on the fusion feature matrix, the multi-dimensional flow features and the abnormal state features, anomaly determination is performed; The fusion attention mechanism is: ； wherein L(A, B) is the fusion feature matrix, Q a , K a and V a are the query vector, key vector and value vector of the multi-dimensional flow feature respectively, Q b , K b and V b are the query vector, key vector and value vector of the abnormal state feature respectively, and T is the transpose.

4. The method for secure operation of a smart grid of claim 1, wherein, According to the abnormal five-tuple data set of the abnormal flow data, searching for all original flow data in the ring buffer that completely match the abnormal five-tuple data set to obtain a homologous data set; ​ According to the abnormal five-tuple data group of the abnormal traffic data, homologous IP extension, destination IP extension, time window extension, protocol association and load feature matching are performed on the homologous data group in the ring buffer to obtain the associated communication data group corresponding to the abnormal traffic data; Protocol decoding is performed on the associated communication data group to convert binary data packets in the associated communication data group into readable message logs.

5. The method for secure operation of a smart grid of claim 1, wherein, Based on the associated communication data group, a communication path of the abnormal traffic is drawn to mark the geographical location features of each node, including: According to the source IP and destination IP of all original traffic data in the associated communication data group, an IP address set is constructed as a node candidate of the communication path; Based on the pre-set power grid equipment account, all IP addresses in the IP address set are mapped and bound to actual devices; According to the source IP and destination IP of each original traffic data in the associated communication data group, the connection direction between all nodes is determined in the direction from the source IP to the destination IP; Through a pre-set graph theory algorithm, all connections between nodes are aggregated, redundant paths and loops are removed, and a simplest communication path graph, i.e. the communication path of the abnormal traffic, is generated; Based on a pre-set IP attribution database, IP addresses are mapped to latitude and longitude coordinates.

6. The method for secure operation of a smart grid of claim 1, wherein, Dynamic sandbox analysis is performed on the associated communication data group to obtain corresponding malicious behavior features, including: When the associated communication data group is received, the associated communication data group is run in a pre-defined virtual environment; During the running, the running of the associated communication data group is monitored, and all behaviors of the associated communication data are recorded to generate the malicious behavior features corresponding to the associated communication data group.

7. The method for secure operation of a smart grid of claim 6, wherein, The running of the associated communication data group is monitored, and all behaviors of the associated communication data are recorded to generate the malicious behavior features corresponding to the associated communication data group, including: The load types of all original traffic data in the received associated communication data group are identified, and all executable file types therein are loaded into a pre-constructed power grid device simulation environment for running, and network protocol traffic types therein are reconstructed into function call sequences; During the file running, the function calls are monitored in real time, and function parameters, return values and execution contexts are captured to generate the malicious behavior features corresponding to the associated communication data group.

8. The method for secure operation of a smart grid of claim 7, wherein, During the file running, the function calls are monitored in real time, and function parameters, return values and execution contexts are captured to generate the malicious behavior features corresponding to the associated communication data group, including: During the file running, the function calls are monitored in real time, and function parameters, return values and execution contexts are captured, and parameter compliance checks, operation sequence analysis and device state tracking are performed based on pre-defined power grid security rules; When an anomaly is detected, device state rollback is performed, and malicious behavior features including function call chains are generated.

9. The method for secure operation of a smart grid of claim 1, wherein, The preprocessing includes: based on a pre-set MAC address whitelist, the original traffic data is screened to allow only the traffic of known devices to pass; IP / IPv6 header information in the Ethernet frame is extracted; and a timestamp is marked.

10. A secure operation system of a smart grid, comprising a memory, a processor and a computer program stored on the memory, characterized in that, The processor executes the computer program to implement the method for safe operation of a smart grid according to any one of claims 1 to 9. The processor executes the computer program to implement the method for safe operation of a smart grid according to any one of claims 1 to 9.

Images