Substation network firewall rule optimization method and electronic equipment

Abstract

The invention relates to the technical field of power system network security, and discloses a substation network firewall rule optimization method, which comprises the following steps of: acquiring historical network flow data in a substation production network, and preprocessing the historical network flow data to obtain a standardized flow data set; in an offline simulation environment, performing a first simulation test on the standardized traffic data set and a current firewall rule set to generate a first simulation log; performing optimization processing on the current firewall rule set to generate a candidate optimization rule set; and performing a second simulation test on the standardized traffic data set and the candidate optimization rule set to generate a second simulation log. The method aims to solve the problem that operation and maintenance personnel are afraid to optimize old rules due to the fact that an existing method cannot accurately quantify and evaluate the security risk of rule change on specific business communication of a transformer substation before optimization and are prone to mistakenly blocking key businesses or introducing vulnerabilities.

Description

Technical Field

[0001] This invention relates to the field of power system network security technology, specifically to a method and electronic device for optimizing rules of a substation network firewall. Background Technology

[0002] With the deepening of smart grid and digital transformation, substation systems increasingly rely on network communication based on the IEC 61850 standard to realize functions such as protection, measurement, and control. To ensure the security of the production control area, deploying network firewalls and configuring fine-grained access control rules has become standard practice. However, after long-term operation and maintenance, firewall rule sets usually become bloated and complex, with a large number of redundant, conflicting, and invalid rules. This not only reduces policy execution efficiency but also expands the network attack surface. Currently, the industry usually adopts two types of methods for rule optimization: one is to rely on the experience of network administrators for manual review and adjustment, and the other is to use general network policy optimization tools for automated simplification. These existing technologies can simplify rule sets and improve performance to varying degrees.

[0003] However, these existing methods cannot accurately and quantitatively assess the security risks that rule changes may pose to specific business communications in substations before implementing optimization. Optimization operations are essentially modifications to security policies, which may lead to two serious consequences: First, overly aggressive optimization may mistakenly block critical production business messages such as GOOSE tripping and SV sampling, resulting in serious operational accidents; second, overly lenient optimization may introduce new security vulnerabilities and improperly allow malicious traffic. Due to the lack of an effective risk assessment mechanism, maintenance personnel, out of concern for causing system outages or security incidents, often tend to maintain the status quo, resulting in outdated rule sets not being effectively optimized. Summary of the Invention

[0004] The purpose of this invention is to address the problems that existing methods cannot accurately quantify and assess the security risks of rule changes to specific business communications in substations before optimization, easily leading to the accidental blocking of critical services or the introduction of vulnerabilities, and causing maintenance personnel to be hesitant to optimize outdated rules. Therefore, this invention proposes a substation network firewall rule optimization method and electronic device.

[0005] The technical solution of the present invention to solve the above-mentioned technical problems is as follows:

[0006] A method for optimizing firewall rules in a substation network includes the following steps:

[0007] S1: Collect historical network traffic data in the substation production network, and preprocess the historical network traffic data to obtain a standardized traffic dataset;

[0008] S2: In an offline simulation environment, perform a first simulation test on the standardized traffic dataset and the current firewall rule set to generate a first simulation log;

[0009] S3: Optimize the current firewall rule set to generate a candidate optimized rule set; perform a second simulation test on the standardized traffic dataset and the candidate optimized rule set to generate a second simulation log;

[0010] S4: Compare and analyze the first simulation log and the second simulation log to identify the differences in communication behavior introduced by the candidate optimization rule set, and assess potential risks based on the differences in communication behavior;

[0011] S5: Output an optimization evaluation report containing the performance metrics, security metrics, and risk warning information of the candidate optimization rule set.

[0012] Based on the above technical solution, the present invention can be further improved as follows.

[0013] Furthermore, the preprocessing in S1 includes protocol parsing and business semantic association of the historical network traffic data. The protocol parsing is used to identify IEC 61850 standard protocol messages, and the business semantic association is used to map the parsed messages to the corresponding substation business functions.

[0014] The IEC 61850 standard protocol includes the Manufacturing Message Specification (MMS), the General Object-Oriented Substation Event (GOOSE), and the Sampled Value (SV) protocol.

[0015] The business functions include protection tripping, interlocking, measurement and metering, setting modification, status monitoring, and file transfer.

[0016] Furthermore, the specific steps of performing business semantic association on IEC 61850 standard protocol messages include:

[0017] Parse the service request information in the MMS message and associate it with the monitoring, setpoint modification or file transfer services of the station control layer;

[0018] Parse the control block references and status number information in the GOOSE message and associate them with the protection tripping or interlocking services at the bay level or process level;

[0019] Parse the sampled value sequence information in the SV message and associate it with the current or voltage sampling and metering service at the process layer.

[0020] Furthermore, the first simulation test and the second simulation test are performed using a rule matching algorithm based on decision trees;

[0021] The decision tree-based rule matching algorithm is as follows: the firewall rule set is compiled into a tree data structure, the nodes of the tree are composed of rule matching conditions, and the leaf nodes correspond to the allow or deny actions of the rules. When matching data packets, the query is performed along the tree structure until a leaf node is matched and the action instruction is output.

[0022] Furthermore, the optimization process for the current firewall rule set described in S3 includes: detecting and deleting redundant rules, detecting and correcting conflicting rules, and detecting and deleting zombie rules;

[0023] The redundant rule refers to a rule whose matching conditions are completely covered by a rule with higher priority.

[0024] The conflict rule refers to a rule where there is an intersection of rule conditions but opposite action instructions;

[0025] The zombie rule refers to the rule that was not matched by the historical network traffic data within a preset historical time window.

[0026] Furthermore, the comparison analysis in S4 is performed based on the flow key, which is composed of a quintuple of data packets;

[0027] The specific details of identifying differences in communication behavior described in S4 are as follows:

[0028] Compare whether the final action instructions for the same flow key are consistent in the first simulation log and the second simulation log;

[0029] If the action command changes from allow to deny, it is determined that there is a risk of false blocking;

[0030] If the action instruction changes from deny to allow, it is determined that there is a risk of policy relaxation.

[0031] Furthermore, the assessment of potential risks in S4 specifically includes calculating the overall risk level value. The calculation formula is as follows:

[0032]

[0033] in, The total number of identified risk flow keys, For stream key The importance weighting coefficient of the associated business functions As an indicator of risk severity, for the risk of false blocking, Regarding the risks of relaxing the strategy, The importance weight coefficient The value is determined based on the importance of the business function. The flow key weight associated with protection tripping business is higher than that associated with measurement and metering business, and the flow key weight associated with measurement and metering business is higher than that associated with station control layer monitoring business.

[0034] Furthermore, the performance metrics in S5 include the rule reduction rate. And the improvement rate of average matching time The calculation formulas are as follows:

[0035]

[0036]

[0037] in, and These represent the number of entries in the firewall rule set before and after optimization. and These represent the average matching time for all data packets in the simulation tests before and after optimization.

[0038] Furthermore, the security metric mentioned in S5 is the attack surface reduction rate, which is calculated by statistically analyzing the ratio of the number of unnecessary network ports and protocol services closed by the candidate optimization rule set compared to the number originally open by the current firewall rule set.

[0039] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the substation network firewall rule optimization method described above.

[0040] Compared with the prior art, the technical solution of this application has the following beneficial technical effects:

[0041] This invention collects and preprocesses historical traffic data from substations to obtain a standardized dataset, accurately matching actual business characteristics such as GOOSE and SV, avoiding the traffic discrepancy problem of general tools, providing a realistic benchmark for subsequent simulations, and constructing an offline simulation comparison framework. This eliminates concerns about system interruptions for operations and maintenance personnel, and ensures that differences in communication behavior stem only from rule changes, improving comparison accuracy. By comparing logs to assess risks, it transforms fuzzy experience-based judgments into precise quantitative analysis, identifying issues such as mistakenly blocking critical packets or allowing malicious traffic, solving the pain point of being unable to predict business impacts, and outputting reports containing performance, security indicators, and risk warnings. This provides comprehensive decision-making support for operations and maintenance personnel, preventing the maintenance of the status quo due to insufficient information, promoting the optimization of outdated rules, and ultimately achieving the dual goals of controllable security risks and improved rule execution efficiency. Attached Figure Description

[0042] Figure 1This is a flowchart illustrating the overall process of the method of the present invention.

[0043] Figure 2 This is a flowchart illustrating the data preprocessing and business semantic association process of this invention.

[0044] Figure 3 This is a flowchart of the rule optimization process of the present invention;

[0045] Figure 4 This is a flowchart of the simulation testing and comparative analysis process for this invention.

[0046] Figure 5 This is a flowchart of the risk assessment and report generation process for this invention. Detailed Implementation

[0047] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0048] like Figure 1 As shown, the present invention provides a method and electronic device for optimizing rules of a substation network firewall, comprising the following steps:

[0049] S1: Collect historical network traffic data in the substation production network, and preprocess the historical network traffic data to obtain a standardized traffic dataset;

[0050] S2: In the offline simulation environment, perform the first simulation test on the standardized traffic dataset and the current firewall rule set, and generate the first simulation log;

[0051] S3: Optimize the current firewall rule set to generate a candidate optimized rule set; perform a second simulation test on the standardized traffic dataset and the candidate optimized rule set to generate a second simulation log;

[0052] S4: Compare and analyze the first simulation log and the second simulation log to identify the differences in communication behavior introduced by the candidate optimization rule set, and assess potential risks based on the differences in communication behavior;

[0053] S5: Output an optimization evaluation report containing performance metrics, security metrics, and risk warning information for the candidate optimization rule set.

[0054] like Figure 2As shown; the preprocessing in S1 includes protocol parsing and business semantic association of historical network traffic data. Protocol parsing is used to identify IEC 61850 standard protocol messages, and business semantic association is used to map the parsed messages to the corresponding substation business functions.

[0055] The IEC 61850 standard protocol includes the Manufacturing Message Specification (MMS), the General Object-Oriented Substation Event (GOOSE), and the Sampled Value (SV) protocol.

[0056] The business functions include protection tripping, interlocking, measurement and metering, setting modification, status monitoring, and file transfer. The protocol parsing module is designed with a dedicated parser for the IEC 61850 standard protocol, which can accurately identify and extract key field information in various protocols. For the Manufacturing Message Specification Protocol (MMS), the parser extracts core fields such as ServiceType, InvokeID, and ConfirmedServiceRequest to identify service types such as read / write operations, reporting services, and file transfers. For the General Object-Oriented Substation Event Protocol (GOOSE), the parser specifically parses key fields such as GoID, DatSet, ConfRev, StNum, and SqNum to identify equipment status changes and protection tripping signals. For the Sampled Value Protocol (SV), the parser extracts field information such as SmpCnt, SmpSynch, and SmpRate to identify current and voltage sampling data and synchronization timing information.

[0057] Business semantic association is achieved by establishing a mapping relationship table, which associates protocol fields with business functions. The intelligent classification algorithm based on the rule engine makes a comprehensive judgment based on information such as protocol type, field value, and time series characteristics. When a mutation of the StNum field in the GOOSE protocol is detected, it is associated with the protection tripping service and given high priority. When the Write service request of the MMS protocol is identified, it is associated with the set value modification service and the value change is recorded.

[0058] The specific steps for performing business semantic association on IEC 61850 standard protocol messages include:

[0059] Parse the service request information in the MMS message and associate it with the monitoring, setpoint modification or file transfer services of the station control layer;

[0060] Parse the control block references and status number information in the GOOSE message and associate them with the protection tripping or interlocking services at the bay level or process level;

[0061] The sampling value sequence information in SV messages is parsed and associated with current or voltage sampling metering services at the process layer. This involves deep processing of IEC 61850 standard protocol messages, including MMS, GOOSE, and SV messages, based on their semantic association. In MMS message processing, when a Read service request is detected with the object identifier MeasuredValues, it is associated with station control layer monitoring services. For Write service requests, when the object identifier matches the SettingGroup pattern, it is associated with setting modification services, recording the numerical differences before and after modification, and using a formula... Calculate the change, where, This represents the change in a setpoint, indicating the numerical difference between the new and old setpoints. The new value after modification is usually a digital or analog value. The original set value before modification serves as a benchmark for comparison and is used to monitor the magnitude of the set value modification operation. When a preset security threshold is exceeded, the system generates an alarm message to prevent accidental operation or malicious modification. The file transfer service is identified by detecting the FileOpen, FileRead, and FileWrite service sequences.

[0062] GOOSE message processing focuses on parsing control block references and status number information. When GoID contains Trip and StNum changes abruptly, it is associated with protection tripping services, using a formula...

[0063]

[0064] : Status number change, indicating the change in the value of the StNum field within a specific time period;

[0065] Time window: The length of the observation period, usually measured in milliseconds, used to calculate the rate of change;

[0066] Data quality: Data integrity index, with a value range of 0-1, calculated based on message loss rate, verification error rate, etc.

[0067] The reliability of protection trip signals is quantified; high confidence indicates a genuine and reliable trip signal, while low confidence may indicate a false alarm or interference. Interlocking services are identified through status number changes and the inclusion of "Interlock" in the DatSet field. SV message processing focuses on sampled value sequence analysis; when the configuration description includes "Current," it is associated with current sampling and metering services, and the effective value is calculated using the following formula; when it includes "Voltage," it is associated with voltage sampling and metering services.

[0068]

[0069] in, : Root Mean Square (RMS) represents the equivalent DC value of alternating current;

[0070] Number of sampling points: the number of samples taken within one period;

[0071] : No. The instantaneous current value at each sampling point;

[0072] Sum the squares of the current values ​​at all sampling points;

[0073] It is used to calculate the effective value of alternating current and is an important basic calculation for power system measurement and protection.

[0074] like Figure 4 As shown; the first and second simulation tests were performed using a rule matching algorithm based on decision trees;

[0075] The decision tree-based rule matching algorithm works as follows: the firewall rule set is compiled into a tree data structure, where each node consists of a rule matching condition, and each leaf node corresponds to a rule's allow or deny action. During packet matching, the algorithm searches along the tree structure until a leaf node is matched and an action command is output. The first and second simulation tests use the decision tree-based rule matching algorithm, including decision tree construction, matching query, and performance optimization. In the decision tree construction phase, the rules are... Transform into a multidimensional space supercube: The HiCuts algorithm is used for space partitioning, and the cost function is applied. ,in The rule lists in the leaf nodes are sorted by priority.

[0076] During a matching query, extract the feature vector of the data packet. Starting from the root node, the system traverses to the leaf node, using a linear search to find matching rules. Performance optimizations include multi-threaded parallel processing of traffic data sharding, stream key caching to reduce redundant calculations, and maintaining a virtual state table. Simulate TCP state transitions.

[0077] In the regular space representation formula

[0078]

[0079] : The geometric representation of the i-th firewall rule in multidimensional space;

[0080] : Source IP address range, indicating the source address matching conditions of the rule;

[0081] : Destination IP address range, indicating the destination address matching condition of the rule;

[0082] Cartesian product operation: representing a combination of multiple dimensions;

[0083] Firewall rules are converted into hypercubes in multidimensional space, which facilitates rule matching and optimization using geometric algorithms.

[0084] In the decision tree cost function formula

[0085]

[0086] : Memory overhead weighting coefficient, with a value range of 0-1;

[0087] Matching time weight coefficient, with a value range of 0-1, and satisfying the following conditions: ;

[0088] Memory overhead: The amount of memory space occupied by the decision tree;

[0089] Matching time: The average matching time for a single data packet;

[0090] This function is used to balance the memory usage and matching performance of decision trees by adjusting the values ​​of α and β to suit different performance requirements.

[0091] In the formula for data packet feature vector

[0092]

[0093] Data packet feature vector

[0094] : Source IP address;

[0095] Destination IP address;

[0096] Protocol type (TCP, UDP, ICMP, etc.);

[0097] : Source port number;

[0098] Destination port number;

[0099] This vector fully describes the characteristics of a network data stream and is the basis for rule matching.

[0100] In the mathematical representation of the state table

[0101]

[0102] : Mapping relationship, representing the correspondence between stream keys and states.

[0103] state: TCP connection state (such as SYN_SENT, ESTABLISHED, FIN_WAIT, etc.)

[0104] The notation describes the data structure for flow state tracking in a stateful firewall.

[0105] like Figure 3 As shown; S3 optimizes the current firewall rule set, including: detecting and deleting redundant rules, detecting and correcting conflicting rules, and detecting and deleting zombie rules;

[0106] Redundant rules are those whose matching conditions are completely covered by rules with higher priority.

[0107] Conflicting rules refer to rules whose conditions overlap but whose action instructions are opposite.

[0108] Zombie rules refer to rules that have not been matched by historical network traffic data within a preset historical time window. Step S3's optimization of the current firewall rule set includes redundancy, conflict, and zombie rule detection. Redundancy rule detection is achieved through rule coverage analysis, checking the rules... Whether it is subject to higher priority rules Full coverage: and The completely overlapping region was detected using multi-dimensional spatial projection technology, in which... Rule Rj is completely covered by rule Ri, meaning that the matching condition of Rj is a subset of Ri; : The action (allow or deny) of rule Rj; : Actions of rule Ri; Conflict rule detection identifies rule pairs where conditions overlap but actions contradict each other: and The rules for implementation are determined based on priority, and users are prompted to modify lower-priority rules. The matching conditions of rules Ri and Rj have overlap; Two rules have contradictory actions; this defines the mathematical conditions for rule conflict. A rule conflict occurs when two rules have overlapping matching conditions but opposite actions.

[0109] Zombie rule detection is based on historical traffic data statistics, within a time window. Internal statistics hit count ,when And the rule's lifespan is greater than The rule is marked as a zombie rule. The invalidity confidence of the rule is calculated as follows: To avoid accidental deletion. Among them, : Confidence level for invalid rules, ranging from 0 to 1; Actual collected traffic: The amount of network traffic data actually collected; Total traffic: The total amount of traffic data that should theoretically exist; : The number of times the rule is hit in the actual collected traffic; Expected hit count: The expected number of rule hits predicted based on historical patterns. It is used to assess the confidence level of whether a rule is a zombie rule by comprehensively considering the completeness of traffic collection and the activity level of the rule.

[0110] In S4, the comparative analysis is performed based on the flow key, which consists of the five-tuple of the data packet: {source IP address, destination IP address, protocol number, source port number, destination port number}.

[0111] The specific methods for identifying differences in communication behavior in S4 are as follows:

[0112] Compare whether the final action commands for the same flow key are consistent in the first and second simulation logs;

[0113] If the action command changes from allow to deny, it is determined that there is a risk of false blocking;

[0114] If the action instruction changes from deny to allow, it is determined that there is a risk of policy relaxation. The comparative analysis in step S4 is based on the flow key, which is defined as the packet quintuple: A unique stream key is generated for each data packet, and action instructions are recorded. A stream key uniquely identifies a network data stream; differences in communication behavior are identified through stream key association. ,in, : Stream key-based association operations; : Benchmark simulation log; Candidate simulation logs; This involves associating records with the same flow key from two simulation logs for easier comparison and analysis, and processing each flow key... Calculate the difference in actions: (Allow = 1, Deny = 0), according to Risk classification by value: 1 represents false blocking risk, -1 represents policy relaxation risk, and 0 represents no risk change. : Action difference value of the i-th stream key; : The action of this flow key in the benchmark simulation (allow=1, deny=0); The action of the flow key in the candidate simulation; the difference in the processing results of the same flow key by two rule sets is quantified.

[0115] Combined with DPI information, business interpretation is provided, application layer information is extracted by tracing back the original message, and interpretation statements such as "flow key K12345 is blocked, corresponding station control layer host (A1) provides setting query service for protection device (B2)" are generated.

[0116] S4 assesses potential risks, specifically by calculating the overall risk rating. The calculation formula is as follows:

[0117]

[0118] in, The total number of identified risk flow keys, For stream key The importance weighting coefficient of the associated business functions As an indicator of risk severity, for the risk of false blocking, Regarding the risks of relaxing the strategy, Importance weight coefficient The value is determined based on the importance of the business function. The flow key weight associated with protection tripping business is higher than that associated with measurement and metering business, and the flow key weight associated with measurement and metering business is higher than that associated with station control layer monitoring business. In step S4, the potential risks are assessed and the overall risk level value is calculated using a quantitative model.

[0119]

[0120] Weighting coefficient Based on business importance: protection tripping 1.0, interlocking operation 0.9, setting modification 0.8, measurement and metering 0.6, file transfer 0.4, status monitoring 0.5.

[0121] Risk severity factor Values: False blocking risk 1.0, strategy relaxation risk 0.5. Risk levels are determined by R value: R<5 is low risk and can be implemented directly; 5≤R<20 is medium risk and requires manual review; R≥20 is high risk and requires re-optimization or abandonment.

[0122] Performance metrics in S5 include the rule reduction rate. And the improvement rate of average matching time The calculation formulas are as follows:

[0123]

[0124]

[0125] in, and These represent the number of entries in the firewall rule set before and after optimization. and The average matching time for all data packets in the simulation tests before and after optimization is given, and the total matching time for all data packets is calculated. Calculate the average matching time .in, Average matching time; Total time for matching all data packets; Number of data packets: Total number of test data packets; Implement standardized benchmark testing, use a unified traffic dataset, run in a dedicated environment, and take the average of multiple tests to ensure accuracy.

[0126] like Figure 5 As shown; in step S5, the security metric is the attack surface reduction rate, which is calculated by statistically analyzing the ratio of the number of unnecessary network ports and protocol services closed by the candidate optimization rule set compared to the current firewall rule set, to the original number of open ports and protocol services. The attack surface in step S5 includes network ports, protocol services, and access paths. The reduction rate calculation formula is: The metrics include: ASR (Attack Surface Reduction); Number of closed port services: the number of network ports and services closed after optimization; Number of originally open port services: the number of ports and services open before optimization. This metric quantifies the improvement in network security, with a positive value indicating a reduction in the attack surface. Implementation steps include analyzing the open port services of the original and optimized rule sets, comparing differences to identify closed items, and calculating the reduction rate. Risk assessment integration: High-value service ports should be closed cautiously and with confirmation; unknown or suspicious ports should be closed first and monitored more closely; management and maintenance ports should be retained according to the principle of least privilege.

[0127] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor executes the program to implement the substation network firewall rule optimization method described above.

[0128] By preprocessing the collected historical network traffic data, deep message inspection technology is used to perform fine analysis on the IEC 61850 standard protocol series specific to substations. This accurately identifies various key field information in the manufacturing message specification protocol, the general object-oriented substation event protocol, and the sampled value protocol. By analyzing these protocol fields, the system can establish a mapping relationship between protocol characteristics and business functions, mapping network communication behavior to specific substation business scenarios, such as protection tripping, setting modification, measurement and metering, and other important business functions.

[0129] Based on the completion of business semantic association, the method verifies the rule optimization effect through two simulation tests. The first simulation uses the current rule set to perform matching tests on standardized traffic data and establish a baseline behavior log. The second simulation uses the optimized rule set to perform the same test and generate candidate behavior logs. Both simulations adopt an efficient matching algorithm based on decision trees, which converts the rule set into a tree structure to improve matching performance. At the same time, parallel processing, cache optimization and other techniques are used to ensure simulation efficiency.

[0130] The rule optimization process focuses on identifying and resolving three types of problems in the rule set: redundant rules, conflicting rules, and zombie rules. Through multi-dimensional spatial analysis and priority ranking, it detects and eliminates completely covered redundant rules; through intersection detection and action analysis, it discovers and resolves conflicting rules; and based on historical traffic statistics and time window analysis, it identifies zombie rules that have not been used for a long time. This optimization process significantly simplifies the rule set structure and improves rule management efficiency.

[0131] The risk assessment phase identifies potential changes in communication behavior due to optimization by comparing and analyzing the results of two simulations. Using the flow key as a benchmark, it compares in detail the differences in the processing of each network flow, accurately identifies the risks of false blocking and policy relaxation, and provides business-level explanations for each risk flow by combining business semantic information, making the risk assessment results more practical. By establishing a quantitative risk level model, it comprehensively considers the importance and severity of risks of different business functions, providing a scientific basis for optimization decisions.

[0132] The performance evaluation phase quantifies the optimization effect from two dimensions: reduction in the number of rules and improvement in matching speed. Standardized testing ensures the accuracy and comparability of the evaluation results. The security evaluation focuses on the reduction of the attack surface and analyzes the impact of rule optimization on network open ports and services. The final optimization scheme considers both the performance improvement requirements and the security risks, ensuring that the optimized rule set can provide more efficient packet processing performance while protecting the network security of the substation.

[0133] Through systematic architecture design and multiple performance optimization measures, we ensure the efficiency and reliability of the processing. At the same time, we adopt strict security mechanisms, including test environment isolation, data encryption, and access control, to ensure that the optimization process will not pose any security risks to the production system.

[0134] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0135] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method and electronic device for optimizing rules of a substation network firewall, characterized in that, Includes the following steps: S1: Collect historical network traffic data in the substation production network, and preprocess the historical network traffic data to obtain a standardized traffic dataset; S2: In an offline simulation environment, perform a first simulation test on the standardized traffic dataset and the current firewall rule set to generate a first simulation log; S3: Optimize the current firewall rule set to generate a candidate optimized rule set; perform a second simulation test on the standardized traffic dataset and the candidate optimized rule set to generate a second simulation log; S4: Compare and analyze the first simulation log and the second simulation log to identify the differences in communication behavior introduced by the candidate optimization rule set, and assess potential risks based on the differences in communication behavior; S5: Output an optimization evaluation report containing the performance metrics, security metrics, and risk warning information of the candidate optimization rule set.

2. The method for optimizing rules of a substation network firewall according to claim 1, characterized in that, The preprocessing in S1 includes protocol parsing and business semantic association of the historical network traffic data. The protocol parsing is used to identify IEC 61850 standard protocol messages, and the business semantic association is used to map the parsed messages to the corresponding substation business functions. The IEC 61850 standard protocol includes the Manufacturing Message Specification (MMS), the General Object-Oriented Substation Event (GOOSE), and the Sampled Value (SV) protocol. The business functions include protection tripping, interlocking, measurement and metering, setting modification, status monitoring, and file transfer.

3. The method for optimizing rules of a substation network firewall according to claim 2, characterized in that, The specific steps of performing business semantic association on IEC 61850 standard protocol messages include: Parse the service request information in the MMS message and associate it with the monitoring, setpoint modification or file transfer services of the station control layer; Parse the control block references and status number information in the GOOSE message and associate them with the protection tripping or interlocking services at the bay level or process level; Parse the sampled value sequence information in the SV message and associate it with the current or voltage sampling and metering service at the process layer.

4. The method for optimizing rules of a substation network firewall according to claim 1, characterized in that, The first simulation test and the second simulation test are performed using a rule matching algorithm based on decision trees; The decision tree-based rule matching algorithm is as follows: the firewall rule set is compiled into a tree data structure, the nodes of the tree are composed of rule matching conditions, and the leaf nodes correspond to the allow or deny actions of the rules. When matching data packets, the query is performed along the tree structure until a leaf node is matched and the action instruction is output.

5. The method for optimizing rules of a substation network firewall according to claim 1, characterized in that, The optimization process for the current firewall rule set described in S3 includes: detecting and deleting redundant rules, detecting and correcting conflicting rules, and detecting and deleting zombie rules. The redundant rule refers to a rule whose matching conditions are completely covered by a rule with higher priority. The conflict rule refers to a rule where there is an intersection of rule conditions but opposite action instructions; The zombie rule refers to the rule that was not matched by the historical network traffic data within a preset historical time window.

6. The method for optimizing rules of a substation network firewall according to claim 1, characterized in that, The comparison analysis in S4 is performed based on the flow key, which is composed of a quintuple of data packets; The specific details of identifying differences in communication behavior described in S4 are as follows: Compare whether the final action instructions for the same flow key are consistent in the first simulation log and the second simulation log; If the action command changes from allow to deny, it is determined that there is a risk of false blocking; If the action instruction changes from deny to allow, it is determined that there is a risk of policy relaxation.

7. A method for optimizing rules of a substation network firewall according to claim 6, characterized in that, The assessment of potential risks described in S4 specifically includes calculating the overall risk level value. The calculation formula is as follows: ； in, The total number of identified risk flow keys, For stream key The importance weighting coefficient of the associated business functions As an indicator of risk severity, for the risk of false blocking, Regarding the risks of relaxing the strategy, The importance weight coefficient The value is determined based on the importance of the business function. The flow key weight associated with protection tripping business is higher than that associated with measurement and metering business, and the flow key weight associated with measurement and metering business is higher than that associated with station control layer monitoring business.

8. The method for optimizing rules of a substation network firewall according to claim 1, characterized in that, The performance metrics mentioned in S5 include the rule reduction rate. And the improvement rate of average matching time The calculation formulas are as follows: ； ； in, and These represent the number of entries in the firewall rule set before and after optimization. and These represent the average matching time for all data packets in the simulation tests before and after optimization.

9. A method for optimizing rules of a substation network firewall according to claim 8, characterized in that, The security metric mentioned in S5 is the attack surface reduction rate, which is calculated by statistically analyzing the ratio of the number of unnecessary network ports and protocol services closed by the candidate optimization rule set compared to the number originally open by the current firewall rule set.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the substation network firewall rule optimization method as described in any one of claims 1 to 9.

Images