Power grid communication network security situation awareness method

Abstract

The invention relates to the technical field of power system information security, and discloses a power grid communication network security situation awareness method, which comprises the following steps of: extracting behavior characteristics such as time periodicity, instruction frequency distribution and network flow packet length mode from historical data of an SCADA (Supervisory Control and Data Acquisition) system, a power utilization information acquisition system and a power distribution automation terminal according to equipment and service types; constructing a fine-grained normal behavior baseline based on a Gaussian mixture model; collecting the flow in real time, extracting the same feature dimension, and calculating the probability that the same feature dimension falls into the baseline confidence interval; and judging the flow attribute according to the probability score, alarming if the flow attribute is lower than a threshold value, otherwise, updating the model online. According to the method, by fusing service semantics and an adaptive learning mechanism, the false alarm rate is effectively reduced, unknown attack behaviors are detected, and cooperation of safety protection and high service availability is realized.

Description

Technical Field

[0001] This invention relates to the field of power system information security technology, specifically to a method for power grid communication network security situation awareness. Background Technology

[0002] With the deepening of smart grid construction, the security protection requirements of power grid communication networks are becoming increasingly prominent. As a key infrastructure supporting core businesses such as power dispatching, electricity consumption data collection, and distribution automation, power grid communication networks exhibit typical characteristics of high reliability, strong real-time performance, and strong business regularity. Against this backdrop, network security situation awareness systems not only need to possess the ability to accurately identify malicious attacks, but also need to fully understand the internal logic of power grid business operations to avoid misjudging normal business behaviors as security threats, thereby ensuring the continuous and stable operation of the power grid control system.

[0003] One of the core challenges in power grid communication network security situational awareness lies in effectively distinguishing between sudden traffic surges caused by business patterns and genuine network attacks. Existing systems generally employ judgment mechanisms based on network layer statistical thresholds or general intrusion detection rule bases, lacking the ability to model the specific business semantics of the power grid. For example, the concentrated initiation of a large number of short connections for meter reading by the electricity information collection system during fixed time periods, or the high-frequency sending of remote control commands by the distribution terminal during fault handling, are typical and legitimate business behaviors, yet they are highly likely to trigger the alarm mechanisms of traditional security equipment.

[0004] Existing technologies struggle to establish dynamic judgment models coupled with the power grid business context, resulting in persistently high false alarm rates for security alarms. Furthermore, their reliance on static rule bases makes them ill-suited to evolving business needs and unable to identify novel attacks lacking known characteristics. In addition, the lack of integrated analysis capabilities for multi-source business data prevents the system from characterizing the statistical patterns of normal business behavior based on time periodicity, command frequency distribution, and packet length patterns, thus hindering high-precision anomaly traffic identification in complex communication environments. Therefore, there is an urgent need for a network security situational awareness method that can deeply integrate power grid business semantics, adaptively learn normal behavior baselines, and accurately identify real threats. Summary of the Invention

[0005] This invention provides a method for power grid communication network security situation awareness, aiming to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, according to one aspect of the present invention, a method for power grid communication network security situation awareness is provided, comprising the following steps:

[0007] A method for situational awareness of power grid communication network security includes the following specific steps:

[0008] Step 1: Extract business behavior features from the historical operating data of the SCADA system, electricity information acquisition system, and distribution automation terminal according to equipment type and business type. The business behavior features include time periodicity, command frequency distribution, and network traffic packet length pattern. The time periodicity is analyzed by Fourier transform or autocorrelation function to determine the repetition pattern of business events on a daily, weekly, or monthly scale. The command frequency distribution is used to count the number of times a specific control command is sent per unit time and its dispersion. The network traffic packet length pattern records the length sequence of continuous data packets and its statistical distribution characteristics.

[0009] Step 2: Based on the business behavior characteristics, construct the normal behavior probability density function of each business flow using a Gaussian mixture model: perform clustering modeling on the dataset of each type of equipment and business combination, set the number of Gaussian components to a predetermined number, iteratively optimize the model parameters through the expectation-maximization algorithm, and finally form a power grid business behavior baseline model covering a pre-set information interval.

[0010] Step 3: Collect network traffic metadata in real time and extract the same feature dimensions as in Step 1: Capture communication data packets by network traffic probes deployed at the boundary of the security partition, parse the source IP address, destination IP address, transport layer port, protocol type, packet length sequence and packet arrival time interval, and reconstruct the time periodicity indicators, instruction frequency vector and packet length statistical features consistent with the historical training phase.

[0011] Step 4: Input the real-time features into the baseline model to calculate the probability that they fall into the corresponding service preset confidence interval: For the device type and service category to which the current traffic belongs, call the corresponding Gaussian mixture model to calculate the log-likelihood value of the real-time feature vector and map it into a probability score.

[0012] Step 5: Determine the traffic attributes based on the probability score and perform corresponding operations: If the probability score is lower than the preset threshold, it is determined to be abnormal traffic and a security status alarm is generated; otherwise, it is determined to be normal business, and the sample is used as new observation data to update the parameters of the baseline model online, so as to realize the continuous adaptive evolution of the model.

[0013] Preferably, the device types in step 1 include smart meters, feeder terminal units, remote terminal units, and concentrators, and the service types include remote control operation, telemetry uploading, timed meter reading, and event reporting. Each combination is modeled independently to ensure that the baseline granularity is strictly aligned with the service semantics.

[0014] Preferably, in the process of extracting the time periodic features, a sliding window autocorrelation analysis is used for the meter reading behavior of the electricity information collection system, with the window length set to a predetermined time period and the step size set to a specific time interval, to identify the peak flow pattern of fixed time periods each day; and for the remote control commands of the distribution automation terminal, event trigger interval statistics are used to record the duration and frequency limit of command bursts during fault isolation.

[0015] Preferably, the frequency distribution features of the instructions are fitted with their occurrence intensity through a Poisson process, and the chi-square distance between the actual observed frequency and the theoretical expected value is calculated and incorporated into the feature vector as an auxiliary discrimination dimension.

[0016] Preferably, the network traffic packet length mode not only records the length of a single packet, but also calculates the standard deviation, mean, and entropy of the packet lengths of N consecutive packets (N takes the value within a predetermined range) to characterize the degree of structure of business communication. Among them, the packet length sequence of meter reading business shows low entropy and high repetition, while attack traffic shows high entropy and irregular distribution.

[0017] Preferably, in step 2, the initial parameters of the Gaussian mixture model are preset using K-means clustering, the covariance matrix is ​​constrained to a diagonal form to reduce computational complexity, and the model convergence condition is set to the log-likelihood value changing less than a preset threshold for a number of consecutive iterations.

[0018] Preferably, in step 3, the network traffic probe is deployed at the bypass port of the vertical encryption authentication device between the production control area and the management information area, and the full communication data is obtained by using a bypass mirroring method to ensure that the real-time performance of the original business is not affected.

[0019] Preferably, in step 4, the probability calculation uses logarithmic space operations to avoid floating-point underflow. The log-likelihood value is normalized and then compared with a dynamic threshold. The dynamic threshold is automatically fine-tuned based on the historical false alarm rate of the service type, and the initial value corresponds to a preset confidence interval.

[0020] Preferably, in step 5, the online update of the baseline model adopts an incremental learning mechanism. New samples participate in the correction of model parameters with a predetermined learning rate, while an aging factor is set to gradually decay the weight of old samples that have not appeared for more than a preset time to zero, so as to prevent the model from becoming outdated.

[0021] Preferably, the security status alarm includes the device identifier, service type, feature deviation dimension, and confidence score of the abnormal traffic, and is pushed to the dispatch and monitoring center through the security information and event management platform, supporting manual review and policy adjustment.

[0022] Preferably, this method also includes a business context verification mechanism: before determining an anomaly, it additionally verifies whether the target IP of the traffic belongs to the legitimate terminal whitelist of this business type. If the target IP is not in the whitelist, a high-level alarm is triggered directly without relying on a probability model.

[0023] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0024] By deeply integrating power grid business semantics, a fine-grained behavioral baseline model based on equipment type and business type is constructed, which can accurately identify sudden traffic caused by legitimate businesses such as meter reading and remote control, significantly reducing the false alarm rate. Traditional methods based on fixed thresholds or general rule bases cannot distinguish such business patterns and often misjudge concentrated meter reading in the early morning as DDoS attacks. However, this method achieves accurate exemption through dual verification of time periodicity and packet length pattern.

[0025] An online incremental update mechanism is adopted, enabling the baseline model to automatically adjust as new services are launched or terminal capacity is expanded, avoiding continuous false alarms caused by service changes. Existing systems rely on static rules, requiring frequent manual maintenance, while this method achieves long-term adaptability while ensuring model stability through the gradual fusion of new samples, making it suitable for the rapidly iterating operating environment of smart grids.

[0026] This method can identify unknown threats without relying on known attack signature databases, simply by determining the probability of deviations from normal business behavior. Attack traffic typically exhibits randomness and disorder in its temporal distribution, command frequency, and packet length structure, which differs significantly from the high regularity of power grid operations. This method can effectively capture such abnormal patterns and has early warning capabilities for new scanning, detection, or covert penetration behaviors.

[0027] While ensuring high security, it minimizes interference with normal control commands, meeting the dual requirements of high availability and strong real-time performance of the power grid communication network. Through the joint determination of business context whitelists and probabilistic models, it prevents the underreporting of real threats and avoids the false blocking of critical services, achieving deep coupling between security policies and business logic. Attached Figure Description

[0028] Figure 1 This is a flowchart of the situational awareness method proposed in this invention; Figure 2 This is a schematic diagram of the core principle framework of fine-grained behavior baseline modeling and anomaly probability determination based on device type and service type in this invention; Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this invention clearer and more complete, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention in any way.

[0030] Example 1

[0031] In the aforementioned power grid communication network security situational awareness method, step S1 involves extracting business behavior features from the historical operating data of the SCADA system, the electricity consumption information collection system, and the distribution automation terminal, categorized by equipment type and business type. Specifically, step S1 includes the following sub-operations: First, historical operating log data is synchronously acquired through data acquisition agents deployed in each business subsystem. The data acquisition agents access the OPCUA interface of the SCADA front-end machine, the MQTT Broker logs of the concentrator in the electricity consumption information collection system, and the IEC 60870-5-104 communication records of distribution automation terminals (such as feeder terminal units (FTUs) and remote terminal units (RTUs)) in a non-intrusive manner. All raw log data is timestamped and then stored in a historical business database, which adopts a distributed time-series database architecture.

[0032] Secondly, the collected historical data is categorized into two dimensions: device type and service type. Device types include smart meters, feeder terminal units, remote terminal units, and concentrators; service types include remote control operation, telemetry uploading, scheduled meter reading, and event reporting. Each device-service combination constitutes an independent data group, such as "smart meter-scheduled meter reading" or "RTU-remote control operation," forming a total of M×N groups, where M is the number of device types and N is the number of service types. The data stream within each group is processed separately to ensure that the granularity of the subsequently constructed baseline model is strictly aligned with the service semantics.

[0033] Subsequently, three types of core business behavior characteristics were extracted within each group: time periodicity, instruction frequency distribution, and network traffic packet length pattern.

[0034] Regarding the extraction of time-periodic features: For meter reading behavior in the electricity information collection system, a sliding window autocorrelation analysis method is adopted. The sliding window length is set to 24 hours, with a step size of 1 hour. The autocorrelation coefficient is calculated for the flow event sequence during the same time period each day. If a significant peak occurs for 7 consecutive days in a certain time period (e.g., 02:00 to 03:00), this time period is determined to be a fixed meter reading window, and its periodic intensity value is recorded. For remote control commands from distribution automation terminals, the periodicity assumption is not relied upon; instead, event trigger interval statistics are used: the time span T from the issuance of the first remote control command to the completion of the last command is recorded for each fault isolation event, as well as the maximum command frequency F_max per unit time. The time span T and F_max, as non-periodic but burst-limited feature parameters, are incorporated into the time dimension modeling.

[0035] Extraction of command frequency distribution characteristics: Statistically count the number of times a specific control command (e.g., "circuit breaker tripping," "read voltage value") is sent within a unit time window (e.g., 1 second, 5 seconds, 60 seconds). For each device-service combination, collect historical frequency sequences for at least 30 days, fit a Poisson process model, and obtain the theoretical expected occurrence intensity. ( (where k is a constant). Then, the chi-square distance between the actual observation frequency k and the theoretical expected value is calculated: Where n is the number of observation time windows, Let i be the frequency of actual observation commands in the i-th time window. The theoretical expected strength is obtained by fitting a Poisson process to historical data.

[0036] Regarding the extraction of network traffic packet length pattern features: In addition to recording the length L (in bytes) of a single data packet, the statistical characteristics of the packet length sequence {L1, L2, ..., L_N} consisting of N consecutive packets (N being an integer between 5 and 20, preferably N=10) are calculated, including the mean μ_L, standard deviation σ_L, and Shannon entropy H_L. in For the length of the package Frequency of occurrence in the sequence This is the set of all unique packet length values ​​in the sequence. Meter reading services use fixed-format MQTT PUBLISH messages, resulting in low entropy (H_L < 1.5 bits) and high repetition (σ_L < 5 bytes) in their packet length sequences. In contrast, attack traffic, due to random padding or protocol obfuscation, typically exhibits high entropy (H_L > 4.0 bits) and irregular distribution. The aforementioned μ_L, σ_L, and H_L together constitute a quantitative indicator of the packet length's structural degree.

[0037] After completing the above feature extraction, each device-service combination corresponds to a high-dimensional feature vector X ∈ ℝ^d, where d is the total number of feature dimensions (valued=9, including: periodic intensity, autocorrelation peak time, burst duration T, maximum frequency F_max, chi-square distance χ², mean packet length μ_L, standard deviation σ_L, entropy H_L, and protocol type encoding). All historical samples {X1, X2, ..., X_T} constitute the training dataset for this combination, used for subsequent modeling.

[0038] In the aforementioned power grid communication network security situation awareness method, step S2 involves constructing the normal behavior probability density function of each service flow based on the service behavior characteristics using a Gaussian Mixture Model (GMM), thus forming a power grid service behavior baseline model. Specifically, step S2 executes the following process:

[0039] First, for the training dataset {X1, ..., X_T} of each device-service combination, a Gaussian mixture model is initialized. The number of Gaussian components, K, is set to a predetermined number, ranging from 3 to 8, and dynamically adjusted according to the size and complexity of the dataset. Initial cluster centers are obtained using the K-means algorithm, and the covariance matrix is ​​constrained to a diagonal form (i.e., assuming that each feature dimension is independent) to reduce the number of parameters and improve computational efficiency. Model parameters include the weights of each Gaussian component. Mean vector and the diagonal covariance matrix ,in Let be the covariance matrix of the k-th Gaussian component. Let d represent the variance of the k-th Gaussian component in the j-th feature dimension, where j = 1, 2, ..., d. The dimension of the feature vector. This indicates the number of Gaussian components.

[0040] Secondly, the Expectation-Maximization (EM) algorithm is used to iteratively optimize the model parameters. In the E-step, the posterior probability γ_{tk} of each sample X_t belonging to the k-th Gaussian component is calculated; in the M-step, π_k, μ_k, and Σ_k are updated. Iteration continues until the model converges. The convergence condition is set as follows: the change in the log-likelihood value is less than a preset threshold over 5 consecutive iterations. The final Gaussian mixture model can be expressed as: in, It is a multivariate Gaussian probability density function. .

[0041] Based on the multivariate Gaussian probability density function, a probability threshold P_th corresponding to the 95% confidence interval is determined. Specifically, the log-likelihood value log p(X_t) is calculated for all samples in the training set, and the lower 5th quantile is used as the threshold benchmark. This threshold ensures that 95% of normal business samples fall within the acceptance region, thereby statistically controlling the false alarm rate.

[0042] Ultimately, each device-service combination corresponds to an independent Gaussian mixture baseline model, which, together with its P_th threshold, constitutes the power grid service behavior baseline model library. This model library is stored in the memory cache of the service behavior baseline engine and periodically persisted to solid-state storage devices, supporting fast loading and version rollback.

[0043] In the aforementioned power grid communication network security situational awareness method, step S3 involves real-time collection of network traffic metadata, extracting the same feature dimensions as in step S1. Specifically, step S3 is performed by a network traffic probe deployed at the boundary of a security partition. This network traffic probe is physically connected to the bypass mirror port of the vertical encryption authentication device between the production control zone and the management information zone. It non-intrusively captures all communication data packets using SPAN (Switched Port Analyzer) or TAP (Test Access Point) methods, ensuring that the real-time performance and determinism of existing services are not affected.

[0044] The captured data packets are processed by a high-speed parsing engine to extract the following metadata fields: source IP address, destination IP address, transport layer protocol (TCP / UDP), source port, destination port, packet length, and packet arrival timestamp (with an accuracy of at least microseconds). Based on this metadata, a feature vector that is completely consistent with the one used in the training phase is reconstructed.

[0045] The reconstruction process includes: First, based on the destination IP address and port number, a predefined service context mapping table is matched to determine the device type and service type of the current traffic. For example, if the destination IP belongs to the smart meter asset list and the port is 1883, it is determined to be "Smart Meter - Scheduled Meter Reading"; if the destination IP is an RTU and the port is 2404, and the protocol is IEC 104, it is determined to be "RTU - Remote Control Operation". The service context mapping table is automatically generated by the asset management system and synchronized periodically. Its entries include: device IP address range, MAC address prefix, transport layer port, application layer protocol identifier (such as MQTT Topic prefix, IEC 104 ASDU type code), and the corresponding device type and service type. When a new IP address not in the mapping table is detected, the system initiates passive listening on the management information zone side: recording the source / destination port, transport layer protocol, and application layer protocol identifier of its first communication; if the destination port is 1883 and the protocol is MQTT, the system queries the device type corresponding to the IP in the asset management system. If it is a smart meter, the service type is determined to be 'timed meter reading' or 'event reporting', further distinguished based on whether the MQTT Topic contains the keyword 'event'; if the destination port is 2404 and the protocol is IEC 60870-5-104, the device type is determined to be RTU or FTU, and the service type is determined to be 'remote operation' or 'telemetry upload', determined based on the ASDU type identifier code M_BO_NA_1 or C_SC_NA_1; after the above determination results are confirmed by the security audit module, they are automatically written into the service context mapping table.

[0046] Secondly, real-time features are calculated based on continuous data packet streams. For time-periodic indicators, the same sliding window mechanism (24-hour window, 1-hour step) as in the training phase is used to update the autocorrelation coefficient in real time. For command frequency, the number of control commands in the most recent 1 second, 5 seconds, and 60 seconds is counted (identified by parsing the operation type codes of application layer protocols such as DNP3 and IEC 104). For packet length patterns, μ_L, σ_L, and H_L are calculated for the most recent N=10 packets. All calculation results are encapsulated into a d-dimensional vector X_realtime, which is completely consistent with the dimensions of the training features.

[0047] In the above-mentioned power grid communication network security situation awareness method, step S4 involves inputting real-time features into the baseline model and calculating the probability that they fall within the corresponding service's pre-set information interval (95%). Specifically, step S4 performs the following operations:

[0048] First, based on the device-service category determined in step S3, the corresponding Gaussian mixture model is retrieved from the service behavior baseline model library. and its threshold .

[0049] Next, the log-likelihood value log p(X_realtime) of the real-time feature vector X_realtime is calculated. To avoid floating-point underflow, all probability operations are performed in logarithmic space. The specific calculation formula is as follows: Where C is the normalization constant. This value, after normalization (e.g., subtracting the maximum log-likelihood value of the training set), is mapped to the probability score. .

[0050] In addition, a dynamic threshold mechanism is introduced: the initial threshold P_th corresponds to a pre-set confidence interval (95%), but the system continuously monitors the historical false alarm rate of this service category. If the false alarm rate is below 0.5% for 7 consecutive days, the threshold is slightly tightened (e.g., increased to a 96% confidence level); if the false alarm rate exceeds 2%, it is moderately relaxed (e.g., reduced to 94%). The dynamic threshold adjustment follows these rules: the historical false alarm rate FR for a specific service is calculated every 24 hours; if FR is consistently below the target lower limit, the probability threshold P_th is increased by a fixed step size Δ, where Δ is 0.01 units of the probability score; the target false alarm rate lower limit is 0.5%, and the upper limit is 2%; if FR is consistently above the target upper limit, P_th is decreased by a step size Δ.

[0051] In the aforementioned power grid communication network security situation awareness method, in step S5, if the probability is lower than a threshold, it is determined to be abnormal traffic, and a security situation alarm is generated; otherwise, it is determined to be normal service, and the sample is used to update the baseline model online. Specifically, step S5 includes the following logical branches:

[0052] When probability score When the current traffic is determined to be normal business, the system initiates an online update mechanism: using X_realtime as a new observation sample, it participates in the baseline model parameter correction through incremental learning. Specifically, a weighted EM update strategy is adopted; in the E-step, the new sample is calculated. Posterior probabilities belonging to each Gaussian component In the M-step, when updating the model parameters, sample weights are introduced: new sample weights... The weights are the learning rate α, which is a constant between 0.01 and 0.1, preferably 0.05; historical samples The current effective weight is ,in Its timestamp, aging factor satisfy Its value is set according to the business stability requirements: for high-stability businesses (such as remote control operations). For volatile business processes (such as event reporting). The model parameter update formula is in weighted form. For example, the mean vector of the k-th Gaussian component is updated as follows: in, For the sample The current effective weights are determined. In this way, new samples are incorporated into the model at a controlled rate, while the influence of old samples decays exponentially. After several updates, if old patterns do not appear for a long time, their contribution to the model will approach zero, thus enabling the model to adapt to business evolution.

[0053] When probability score In such cases, the system does not immediately issue an alarm. Instead, it initiates a business context verification mechanism: verifying whether the destination IP address of the traffic belongs to the legitimate terminal whitelist for that business type. This whitelist is maintained synchronously by the asset management system and includes the IP address and MAC address binding relationships of all registered smart meters, RTUs, concentrators, and other devices. If the destination IP is not in the whitelist, a high-level security alarm is triggered directly without relying on a probability model; if it is in the whitelist, a medium-level alarm is generated based on feature deviation dimensions (such as a sudden increase in packet entropy or an excessive command frequency).

[0054] The generated security posture alert includes the following structured information: abnormal device identifier (IP+MAC), service type, feature deviation dimension (e.g., "packet entropy H_L=4.8, exceeding the baseline mean by 3.2 standard deviations"), confidence score (1-S), timestamp, and original traffic quintuple. This alert is pushed to the Security Information and Event Management (SIEM) platform via Syslog or SNMP Trap protocol and highlighted in the human-machine interface of the dispatch monitoring center, supporting one-click review and policy adjustment by operations and maintenance personnel.

[0055] To further illustrate the effectiveness of this invention, the following specific application examples are provided:

[0056] Taking the scheduled meter reading service of smart meters as an example: At 02:00 AM, the communication gateway of a 220kV substation detected 200 TCP connection requests per second, all destined for port 1883. Traditional systems would classify this as a SYNFlood attack due to the connection rate exceeding a threshold. However, in this embodiment, the system first identifies that the target IPs of this traffic all belong to the substation's smart meter asset list, and determines the service type as "smart meter - scheduled meter reading". After calling the corresponding Gaussian mixture model, the system calculates the time periodicity characteristics matching the 02:00 meter reading window (autocorrelation coefficient > 0.85), with a mean packet length of 128 bytes, a standard deviation < 3 bytes, and an entropy of... The instruction frequency follows a Poisson distribution (χ²=2.1 < threshold 5.99). Overall probability score. Therefore, it was determined to be a normal business transaction, and the sample was included in the model update to strengthen the representation of the early morning meter reading mode.

[0057] Taking remote control operation of a distribution automation terminal as an example: A ground fault occurs on a distribution line, and the FTU sends 15 remote control commands (opening, blocking) to the master station within 3 seconds. The system identifies the service type as "FTU-remote control operation" and calls the corresponding non-periodic model. Historical data recorded by the model shows that the upper limit of command frequency for this type of event is 20 commands / 5 seconds, and the burst duration T ≤ 5 seconds. The current flow rate T = 3 seconds, F = 15, both within the normal range, and the packet length is fixed at 86 bytes (IEC 104 ASDU format). Probability score. (Due to the large fluctuations in the remote control service itself, the threshold is slightly low), which is determined to be a normal fault handling procedure.

[0058] The examples above demonstrate that this method, through deep integration of business context, fine-grained modeling, and multi-layered verification mechanisms, achieves accurate exemption from normal burst traffic and effective capture of real threats.

[0059] Example 2

[0060] In another embodiment, the Gaussian mixture model is constructed using the Bayesian Information Criterion (BIC) to automatically determine the optimal number of Gaussian components K. Specifically, in step S2, for each device-service combination's training dataset, Gaussian mixture models with K=1 to K=10 are fitted sequentially, and the BIC value of each model is calculated: Where L is the maximum likelihood value of the model, k is the total number of model parameters, and n is the number of samples. The K value with the smallest BIC is selected as the final number of components. This method avoids the subjectivity of manually setting the K value and is especially suitable for scenarios with complex business behavior patterns, such as "concentrator-event reporting", whose traffic may contain multiple sub-patterns (such as pressure loss alarm, cover opening alarm, communication interruption), which require multiple Gaussian components to characterize them separately.

[0061] Furthermore, a concept drift detection module is introduced into the online update mechanism in step S5. This module continuously monitors the log-likelihood sequence of new samples. If the average likelihood value of 100 consecutive samples decreases by more than 2 standard deviations, it determines that a structural change has occurred in the business behavior (such as the deployment of a new batch of smart meters), automatically triggering a full retraining process: freezing the current model, enabling a backup training thread, reconstructing the Gaussian mixture model using data from the last 30 days, and switching the model after confirming performance improvement on the validation set. This mechanism ensures that the system can maintain high accuracy even when facing large-scale business changes.

[0062] At the feature extraction level, the semantic feature dimension of the protocol is added. For example, for the MQTT protocol, the Topic name (such as "meter / 00123 / voltage") is parsed, and the Topic level depth and keyword matching degree (whether it contains "alarm" or "event") are extracted; for IEC 104, the ASDU type identifier (such as M_SP_NA_1 indicating single-point remote signaling) is parsed, and the proportion distribution of different types of ASDUs is statistically analyzed. These semantic features are encoded into one-hot vectors or embedding vectors, which are then added to the original feature vector to further improve the model's ability to understand business intent.

[0063] With the above enhancements, the false alarm rate of meter reading flow for new narrowband Internet of Things (NB-IoT) meters was reduced from 12% to 0.8% in a provincial power grid pilot project. At the same time, an APT attack that used forged telemetry data to cover up electricity theft was successfully detected, verifying the robustness and scalability of the method.

[0064] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for situational awareness of power grid communication network security, characterized in that, Includes the following steps: From the historical operating data of SCADA system, electricity information collection system and distribution automation terminal, business behavior features are extracted according to equipment type and business type. The business behavior features include time periodicity, command frequency distribution and network traffic packet length pattern. Based on the business behavior features, a Gaussian mixture model is used to construct the normal behavior probability density function corresponding to each combination of equipment type and business type, forming a power grid business behavior baseline model covering a pre-set information interval. Real-time collection of network traffic metadata, and extraction of time-periodic indicators, instruction frequency vectors and packet length statistical features consistent with historical training phases; Real-time features are input into the baseline model corresponding to the device type and service type, and the probability score of falling into the preset confidence interval is calculated. The traffic attribute is determined according to the probability score. If the probability score is lower than the preset threshold, it is determined as abnormal traffic and a security status alarm is generated. Otherwise, it is determined as normal service, and the sample is used as new observation data to update the parameters of the baseline model online, so as to realize the continuous adaptive evolution of the model.

2. The power grid communication network security situation awareness method according to claim 1, characterized in that, The equipment types include smart meters, feeder terminal units, remote terminal units, and concentrators. The service types include remote control operation, telemetry uploading, timed meter reading, and event reporting. Each combination of equipment type and service type independently constructs a baseline model.

3. The power grid communication network security situation awareness method according to claim 1, characterized in that, The extraction of the time periodic features includes: using sliding window autocorrelation analysis on the meter reading behavior of the electricity information collection system to identify the peak flow pattern during fixed time periods each day; and using event trigger interval statistics on the remote control commands of the distribution automation terminal to record the duration and frequency limit of command bursts during fault isolation.

4. The power grid communication network security situation awareness method according to claim 1, characterized in that, The frequency distribution characteristics of the commands are fitted with their occurrence intensity using a Poisson process, and the chi-square distance between the actual observed frequency and the theoretical expected value is calculated. The chi-square distance is then used as a component of the feature vector.

5. The power grid communication network security situation awareness method according to claim 1, characterized in that, The network traffic packet length pattern includes calculating the mean, standard deviation, and Shannon entropy of a sequence of N consecutive data packets, where N is an integer between 5 and 20, and the Shannon entropy is used to characterize the degree of structure of business communication.

6. The power grid communication network security situation awareness method according to claim 1, characterized in that, The initial parameters of the Gaussian mixture model are preset using K-means clustering, the covariance matrix is ​​constrained in diagonal form, and the model convergence condition is set to the log-likelihood value changing less than a preset threshold for a number of consecutive iterations.

7. The power grid communication network security situation awareness method according to claim 1, characterized in that, The network traffic metadata is obtained via a bypass mirroring method through a network traffic probe deployed at the bypass port of the vertical encryption authentication device between the production control area and the management information area.

8. The power grid communication network security situation awareness method according to claim 1, characterized in that, The probability score is calculated in logarithmic space to avoid floating-point underflow, and the preset threshold is a dynamic threshold that is automatically fine-tuned based on the historical false alarm rate feedback of the business type.

9. The power grid communication network security situation awareness method according to claim 1, characterized in that, The online baseline model update adopts an incremental learning mechanism, in which new samples participate in the model parameter correction at a predetermined learning rate, and an aging factor is set to gradually decay the weight of old samples that have not appeared for a preset period of time to zero.

10. The power grid communication network security situation awareness method according to claim 1, characterized in that, Before determining abnormal traffic, verify whether the target IP address of the traffic belongs to the legitimate terminal whitelist for this service type. If the target IP is not in the whitelist, a high-level alarm is triggered directly.

Images