A network security protection method for a power monitoring system

Abstract

The application discloses a network security protection method for a power monitoring system and belongs to the technical field of network security of the power monitoring system. The method comprises the following steps: collecting network data packets transmitted between a dispatching master station and a transformer substation; performing deep packet analysis on the network data packets, and extracting a source Internet protocol address, a destination Internet protocol address and data load; inputting the data load into a pre-constructed power monitoring communication behavior baseline model, calculating a behavior deviation degree between the data load and a pre-stored legal communication behavior mode based on the source and destination Internet protocol addresses by the model; and when the behavior deviation degree exceeds a preset deviation threshold, marking the network data packet as an abnormal data packet and generating an alarm log. Through behavior baseline model and multi-dimensional deviation quantification, accurate detection and alarm of abnormal communication behaviors of the power monitoring system are realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology for power monitoring systems, specifically a network security protection method for power monitoring systems. Background Technology

[0002] The communication between the dispatch master station and substations in the power monitoring system carries critical services such as remote control, telemetry, and remote signaling. Its network security is directly related to the stable operation of the power system. Existing network security protection measures generally employ intrusion detection systems based on known attack signatures and boundary filtering mechanisms based on access control lists. These methods block or alert on data packets that match known malicious characteristics by matching pre-written rule bases or blacklists. These traditional detection methods heavily rely on prior knowledge, and their protective capabilities have significant limitations. Power monitoring communication follows industry protocols such as IEC61850 and DNP3, and its communication process is characterized by high repetition and regular field structures. Attackers can use unknown exploit methods to inject abnormal data packets into the network that fully conform to the protocol format but lack malicious software signatures. For example, they can insert a small number of operations into a legitimate command sequence, fine-tune a control field within a message, or inject false measurement values ​​near the boundary of the normal operating range. Since such abnormal data packets do not match any existing rules, signature-based systems will directly allow them to pass. Meanwhile, access control mechanisms based solely on IP addresses cannot detect communication behaviors that deviate from the original business logic at the message content level from malicious processes within authorized nodes.

[0003] Therefore, power monitoring scenarios urgently need anomaly detection capabilities based on communication behavior itself, rather than external characteristics. The core issue is how to establish a normal behavioral profile for power monitoring communication without prior knowledge of attack characteristics, and accurately quantify the differences between real-time data packets and normal behavior. A further challenge is that attack behavior may only manifest in one aspect of command operations, message structure, or data values. A single-dimensional comparison can easily misjudge normal business fluctuations with only slight deviations in one aspect as attacks, or regard malicious behavior with small deviations across multiple dimensions as normal. Therefore, it is also necessary to solve the problem of how to perform multi-dimensional fusion analysis of operation sequences, data formats, and numerical ranges in communication behavior to obtain comprehensive deviation assessment results. Summary of the Invention

[0004] This invention provides a network security protection method for power monitoring systems, aiming to solve the problems that existing power monitoring network security protection methods cannot detect abnormal communication behavior in the absence of attack characteristics, and cannot integrate and quantify the degree of deviation of communication behavior from multiple dimensions such as operation instructions, data structures and numerical ranges.

[0005] To achieve the above objectives, the present invention provides the following technical solution: The present invention provides a network security protection method for a power monitoring system. The method includes: collecting network data packets transmitted between the dispatch master station and substations in the power monitoring system; performing deep packet inspection on the network data packets to extract the source Internet Protocol (IP) address, destination IP address, and data payload carried in the network data packets; inputting the data payload into a pre-constructed power monitoring communication behavior baseline model, whereby the power monitoring communication behavior baseline model calculates the behavioral deviation between the data payload and pre-stored legitimate communication behavior patterns based on the source IP address and the destination IP address; when the behavioral deviation exceeds a preset deviation threshold, marking the network data packet as an abnormal data packet, and generating an alarm log based on the source IP address and the destination IP address. This method, through deep packet inspection and behavioral deviation calculation of network data packets, can accurately identify abnormal data packets that deviate from the normal communication behavior of the power monitoring system, improving the detection capability against covert attacks and illegal operations.

[0006] As a preferred embodiment of the present invention, the process of collecting network data packets specifically involves: deploying a traffic mirroring probe in the dispatch data network between the dispatch master station and the substation; replicating the real-time communication traffic transmitted in the dispatch data network through the traffic mirroring probe; and capturing the original data packets encapsulated based on Transmission Control Protocol or User Datagram Protocol from the real-time communication traffic as the network data packets. This method achieves non-intrusive and complete acquisition of dispatch data network traffic, ensuring the integrity and real-time performance of the original data packets.

[0007] When calculating the behavioral deviation, the following method is preferred: The service type of the current communication is determined based on the source and destination Internet Protocol (IP) addresses. A legitimate communication behavior pattern corresponding to the service type is retrieved from the power monitoring communication behavior baseline model. This legitimate communication behavior pattern includes a legitimate command sequence, a legitimate data format, and a legitimate data range. The data payload is decomposed into a command sequence to be tested, a data format to be tested, and a data value to be tested. The command sequence to be tested is compared with the legitimate command sequence to obtain a command deviation component. The data format to be tested is structurally compared with the legitimate data format to obtain a structural deviation component. The data value to be tested is interval-compared with the legitimate data range to obtain a numerical deviation component. The command deviation component, the structural deviation component, and the numerical deviation component are weighted and summed to obtain the behavioral deviation. This comprehensive quantification of the difference between network data packets and legitimate communication behavior patterns from three dimensions—command, format, and value—can more comprehensively reflect the degree of abnormality in the communication content and reduce false alarms and missed alarms.

[0008] Furthermore, the weighting coefficients used in the weighted summation are dynamically adjusted according to the business type. Different business types correspond to different instruction deviation weights, structural deviation weights, and numerical deviation weights. Through differentiated weight configuration, the deviation calculation can be made more consistent with the security sensitivity characteristics of various business scenarios, thereby improving detection accuracy.

[0009] When calculating the instruction deviation component, it is preferable to convert the instruction sequence to be tested and the legal instruction sequence into opcode vectors respectively, and calculate the edit distance between the opcode vectors. This edit distance represents the minimum number of single-character edit operations required to convert the instruction sequence to be tested into the legal instruction sequence. The ratio between the edit distance and the total length of the legal instruction sequence is then used as the instruction deviation component. More preferably, during the edit distance calculation process, different values ​​are assigned to insertion, deletion, and replacement operations, so that the instruction deviation can more realistically reflect the degree of instruction tampering.

[0010] When calculating the structural deviation component, it is preferable to parse the data format to be tested into a sequence of field names and a sequence of field types, and to parse the valid data format into a sequence of valid field names and a sequence of valid field types. The sequence of field names to be tested is then compared with the sequence of valid field names, and the positions of fields with mismatched names are marked. Similarly, the sequence of field types to be tested is then compared with the sequence of valid field types, and the positions of fields with mismatched types are marked. The sum of the number of field positions with mismatched names and the number of field positions with mismatched types is calculated, and the ratio of this sum to the total length of the valid field name sequence is taken as the structural deviation component. In this process, case sensitivity and predefined synonym mappings can be ignored to avoid misjudgments caused by differences in naming conventions, thus improving the robustness of the structural comparison.

[0011] When calculating the numerical deviation component, it is preferable to extract key parameter values, including at least voltage, current, and power values, from the measured data values. This allows for the acquisition of legal voltage, current, and power ranges corresponding to the key parameter values ​​within the legal data range. It then determines whether the voltage value falls within the legal voltage range, the current value within the legal current range, and the power value within the legal power range. The number of key parameter values ​​that do not fall within their corresponding legal ranges is counted, and the ratio of this count to the total number of key parameter values ​​is taken as the numerical deviation component. This detection method based on the range of key operating parameters of the power system can effectively detect tampered telemetry data and prevent malicious data injection from harming the power monitoring system.

[0012] As another preferred embodiment of the present invention, the preset deviation threshold is dynamically adjusted, with different threshold levels dynamically set according to the current time period or load level of the power monitoring system. Automatically raising or lowering the threshold during peak system operation or under special operating conditions allows the safety strategy to adapt to the actual operating state of the power grid, balancing safety and availability.

[0013] In a further embodiment, after marking network packets as anomalous packets and generating alarm logs, the data payload of the anomalous packets and the corresponding legitimate communication behavior patterns are input into a pre-trained risk tracing model. The risk tracing model then segments the data payload into multiple payload fragments, compares each fragment byte-by-byte with the legitimate communication behavior pattern, and marks the byte positions where anomalies occur. Based on the anomaly byte positions, the attack injection point of the anomalous packet is determined, and the attack injection point is associated with the source Internet Protocol (IP) address and stored in the alarm log. By accurately locating the anomalous byte positions and attack injection points, security personnel can be provided with more direct tracing evidence, shortening emergency response time.

[0014] In specific implementation, the risk tracing model divides the data payload into multiple payload fragments according to the fixed field length of the protocol, with each payload fragment corresponding to a protocol field. The legitimate communication behavior pattern is then divided into multiple pattern fragments according to the same fixed field length. Each payload fragment is aligned byte-by-byte with the pattern fragment corresponding to the same field position, and the binary values ​​of each byte are compared byte-by-byte to see if they match. The offset address of bytes with inconsistent binary values ​​within the data payload is recorded, and this offset address is used as the location of the byte where the anomaly occurred. This allows for accurate pinpointing of the attacker's modifications to the protocol fields, enabling fine-grained tracing of attack behavior.

[0015] As a further security reinforcement measure, after marking the network data packets as abnormal data packets, the historical abnormal frequency corresponding to the source Internet Protocol address is extracted from the abnormal data packets. This historical abnormal frequency is determined by the ratio of the number of abnormal data packets received from the source Internet Protocol address within a preset time period to the total number of data packets. When the historical abnormal frequency exceeds a preset frequency threshold, the source Internet Protocol address is added to a dynamic blacklist. Based on the dynamic blacklist, an access control list update is performed on the routing equipment between the dispatch master station and the substation, rejecting data packets from Internet Protocol addresses in the dynamic blacklist. This establishes a dynamic blocking mechanism based on historical abnormal frequencies, which can continuously block high-frequency abnormal sources and reduce the risk of persistent attacks.

[0016] In another preferred aspect of the invention, after generating an alarm log based on the source Internet Protocol (IP) address and the destination IP address, the source IP address and the destination IP address are further extracted from the alarm log. Based on the source IP address and the destination IP address, a first node corresponding to the source IP address and a second node corresponding to the destination IP address are located in a preset network topology map. The shortest communication path between the first node and the second node is calculated, and all network devices along the shortest communication path are marked as affected devices in the network topology map. The device identifiers of the affected devices are added to the alarm log. This allows the alarm log to reflect the network scope affected by abnormal communication, helping maintenance personnel quickly assess the impact of the event and take isolation measures.

[0017] The technical effects and advantages provided by the present invention in the above technical solution are as follows:

[0018] By constructing a baseline model of power monitoring communication behavior and calculating the behavioral deviation between the data payload and pre-stored legitimate communication behavior patterns using the source and destination Internet Protocol (IP) addresses, an anomaly detection mechanism based on normal communication behavior is achieved. This scheme does not rely on known attack signatures; it directly captures the behavioral deviation of actual communication data packets relative to normal patterns. Any operation that disrupts the established communication flow of the power monitoring system—whether inserting abnormal commands, tampering with message structure, or sending out-of-range data—will generate a high deviation result and be marked as an anomaly, as long as it is inconsistent with the legitimate behavior pattern. This changes the passive situation of traditional methods that can only identify known attacks, enabling the timely detection of unknown and covert attacks at the behavioral level. The data payload is decomposed into a sequence of commands to be tested, a data format to be tested, and a data value to be tested. These are compared with legitimate command sequences, legitimate data formats, and legitimate data ranges, respectively, generating command deviation components, structural deviation components, and numerical deviation components. A weighted summation is then used to obtain the comprehensive behavioral deviation. This multi-dimensional deviation assessment method can refine the characterization of abnormal behavior from different angles, such as opcode changes, field structure tampering, and process quantity exceeding limits. Command sequence comparison quantifies differences in operation sequences by calculating edit distance, making it detectable even if attackers only slightly adjust the command order or replace individual opcodes. Structural comparison, by comparing field name and type sequences and ignoring case differences and synonym mappings, accurately detects malicious tampering such as missing fields or incorrect types, while avoiding false alarms caused by normal expression differences. Numerical comparison verifies whether key parameters such as voltage, current, and power fall within legal ranges, effectively detecting malicious data injection disguised as normal numerical ranges. The comprehensive deviation degree, obtained by weighted summation of multidimensional deviations, eliminates the possibility of alarms triggered by slight fluctuations in a single dimension, significantly reducing the frequency of false alarms. The weighting coefficients are dynamically adjusted according to the service type, distinguishing the importance of each deviation component between telecontrol services that emphasize command accuracy and measurement services that emphasize numerical range, significantly improving the accuracy of anomaly detection. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0020] Figure 1 This is a flowchart of network security protection methods for power monitoring systems;

[0021] Figure 2 This is a schematic diagram illustrating the deployment of traffic mirroring probes and network packet collection in the scheduling data network;

[0022] Figure 3 This is a flowchart for calculating the deviation of power monitoring communication behavior;

[0023] Figure 4 This is a flowchart of the dynamic adjustment method for the deviation threshold;

[0024] Figure 5 This is a flowchart for risk tracing and attack injection point location;

[0025] Figure 6 It is the cumulative probability distribution curve of the data packet payload length of the transmission control protocol and the user datagram protocol in the power monitoring system;

[0026] Figure 7 These are the probability density distribution curves of behavioral deviation under different business types;

[0027] Figure 8 This is a diagram illustrating the prediction of injection points for abnormal data packet attacks.

[0028] Figure 9 This is a curve showing the historical abnormal frequency changes of the source Internet Protocol (IP) address. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] See Figure 1 This invention provides a network security protection method for a power monitoring system. The method includes: collecting network data packets transmitted between the dispatch master station and the substation in the power monitoring system; performing deep packet inspection on the network data packets to extract the source Internet Protocol address, destination Internet Protocol address, and data payload carried in the network data packets; inputting the data payload into a pre-constructed power monitoring communication behavior baseline model, which calculates the behavioral deviation between the data payload and a pre-stored legitimate communication behavior pattern based on the source Internet Protocol address and the destination Internet Protocol address; when the behavioral deviation exceeds a preset deviation threshold, marking the network data packet as an abnormal data packet and generating an alarm log based on the source Internet Protocol address and the destination Internet Protocol address.

[0031] Example 1:

[0032] In specific implementation, please refer to Figure 2The dispatch master station and the substation communicate via the dispatch data network, which carries real-time control commands and status monitoring data from the power monitoring system. Traffic mirroring probes are deployed within the dispatch data network, implemented using network splitters or switches with port mirroring capabilities. These probes are positioned between the aggregation router and the core switch on the dispatch master station side, or between the gateway device and the station control layer switch on the substation side, enabling the traffic mirroring probes to capture all bidirectional communication traffic passing through the dispatch data network.

[0033] Traffic mirroring probes, by configuring mirroring policies, copy all data frames flowing through a target port or target VLAN in the scheduling data network, forming a mirror copy of the real-time communication traffic. Real-time communication traffic contains data packets of various protocol types. From the mirror copy of the real-time communication traffic, the traffic mirroring probe uses deep packet inspection technology to parse the data link layer, Internet Protocol layer, and transport layer headers, filtering out packets with a protocol type field value of Transmission Control Protocol (protocol number 6) or User Datagram Protocol (protocol number 17). For the selected raw data packets encapsulated by Transmission Control Protocol or User Datagram Protocol, the traffic mirroring probe maintains the integrity of the original data packets, including the Internet Protocol header, Transmission Control Protocol header or User Datagram Protocol header, and data payload, and directly outputs these raw data packets as the network data packets required for the network security protection methods of the power monitoring system.

[0034] When capturing raw data packets encapsulated using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP), the traffic mirroring probe indiscriminately copies the mirrored real-time communication traffic without modifying or cropping the original data packet content, ensuring that the collected network data packets are consistent byte-by-byte with the data packets actually transmitted in the scheduling data network. The traffic mirroring probe sends the collected network data packets to the data processing server through a dedicated out-of-band management channel, avoiding interference with the bandwidth and performance of the scheduling data network itself.

[0035] See Figure 6 In the graph, the horizontal axis represents the packet payload length in bytes, ranging from 0 to approximately 1600 bytes, and the vertical axis represents the cumulative distribution probability, ranging from 0 to 1. The graph contains two curves: the solid line represents the cumulative distribution of the payload length of Transmission Control Protocol (TCP) packets, and the dashed line represents the cumulative distribution of the payload length of User Datagram Protocol (UDP) packets.

[0036] As can be seen from the dashed curve, the UDP protocol packet payload length is relatively short. The cumulative distribution curve rises rapidly at about 200 bytes, and about 90% of UDP packet payload lengths do not exceed 300 bytes. After that, the growth slows down, and the cumulative probability close to 1 is reached around 400 bytes, indicating that the UDP packet payload length is generally concentrated in a relatively short range.

[0037] The solid curve shows that the TCP protocol packet payload length distribution is relatively dispersed. The cumulative distribution is slow below 100 bytes, reaching a cumulative probability of about 20% at around 400 bytes. Subsequently, the curve shows a significant upward trend, with the 500-900 byte range being the main distribution range for TCP payload length, accounting for approximately 80% of TCP packet payload lengths. The cumulative probability of TCP payload length gradually approaches 1 after about 1000 bytes, indicating that its maximum payload length is mostly distributed in the range above 1000 bytes.

[0038] This figure reflects the distribution characteristics of network packet load lengths based on TCP and UDP protocols in the traffic mirroring probe collection scheduling data network in Example 1. It provides foundational data support for subsequent deep packet analysis based on load length and protocol type, construction of communication behavior baseline models, and calculation of behavior deviations. Analyzing the distribution of load lengths for different protocols helps optimize traffic mirroring strategies and ensure the integrity of packet collection, ensuring that the collected data covers typical communication services while avoiding misjudgments or omissions due to abnormal load lengths.

[0039] Example 2:

[0040] In specific implementation, please refer to Figure 3 The power monitoring communication behavior baseline model pre-constructs and stores various legal communication behavior patterns corresponding to different service types. Each legal communication behavior pattern originates from statistical analysis and protocol parsing of historical communication data collected by the power monitoring system under normal operating conditions. After the data payload is input into the power monitoring communication behavior baseline model, the model calculates the deviation between the data payload and the pre-stored legal communication behavior patterns based on the source and destination Internet Protocol (IP) addresses.

[0041] The process of determining the service type of this communication based on the source Internet Protocol address and the destination Internet Protocol address is as follows: A mapping table between Internet Protocol addresses and service types is maintained in advance in the power monitoring communication behavior baseline model. This mapping table records the service types corresponding to the Internet Protocol addresses of each server on the dispatch master station side and the service types corresponding to the Internet Protocol addresses of each intelligent electronic device on the substation side. After obtaining the source Internet Protocol address and the destination Internet Protocol address, the first service type corresponding to the source Internet Protocol address and the second service type corresponding to the destination Internet Protocol address are queried in the mapping table. The intersection of the first service type and the second service type is taken to determine the service type of this communication. If there are multiple intersections, the service type with the highest priority is selected according to the preset service type priority rules.

[0042] When retrieving the legal communication behavior pattern corresponding to the service type from the power monitoring communication behavior baseline model, the power monitoring communication behavior baseline model searches the legal pattern library according to the determined service type. The legal pattern library uses the service type identifier as the primary key and stores the legal instruction sequence, legal data format, and legal data range defined by the standard communication protocol under that service type. The legal instruction sequence is a set of opcodes arranged in sequence, and each opcode corresponds to a remote operation function defined in the power monitoring communication protocol; the legal data format is a sequence of field names and field types defined using an abstract syntax description method. Field types include integer, floating-point, boolean, string, time, and compound nested types; the legal data range is the numerical range, enumerated value list, or boolean value limitation set for key parameters.

[0043] The process of decomposing the data payload into the sequence of instructions to be tested, the data format to be tested, and the data value to be tested is as follows: the data payload is decoded according to the application layer protocol of the power monitoring communication protocol, and the opcode field, data object field, and extended field are extracted from the application service data unit; the opcode field is extracted in sequence to obtain the sequence of instructions to be tested; the data object field is recursively parsed according to the type-length-value structure to obtain the data format to be tested composed of field name and field type, and the data value to be tested composed of the actual value corresponding to each field.

[0044] When comparing the instruction sequence to be tested with the valid instruction sequence to obtain the instruction deviation component, the instruction sequence to be tested is converted into an opcode vector, with the vector dimension being the number of opcodes in the instruction sequence to be tested, and the vector elements being the numerical code of each opcode. Similarly, valid instruction sequences are converted into valid opcode vectors, with the vector dimension being the number of opcodes in the valid instruction sequence, and the vector elements being the numerical code of each opcode. The edit distance between the opcode vectors is calculated. The edit distance represents the minimum number of single-character edit operations required to convert the opcode vector to the valid opcode vector. Edit operations include inserting an opcode, deleting an opcode, and replacing an opcode.

[0045] In some embodiments, during the calculation of the edit distance between opcode vectors, the cost value assigned to the insertion operation is... The cost value assigned to the deletion operation is The cost value assigned to the replacement operation is ,in The value of is determined by the context in which the insertion operation occurs. If the insertion operation occurs at the beginning or end of the instruction sequence, then... The value is 2; if the insertion operation occurs in the middle of the instruction sequence, then... The value is 3; The value of is 2. The value of is 1, which is used when the similarity between two opcodes in the predefined opcode semantic similarity matrix exceeds 0.8. The value of is reduced to 0.5. This cost assignment method makes it more sensitive to structural changes in the instruction sequence.

[0046] Dynamic programming is used to calculate the edit distance. A two-dimensional matrix is ​​constructed, and the length of the opcode vector to be tested is set to... The length of the legal opcode vector is Row index of the matrix From 0 to Column index From 0 to Matrix elements The first part of the opcode vector to be tested The first opcode is transformed into a valid opcode vector. The minimum edit cost of each opcode, after recursive calculation, is... This is the edit distance between opcode vectors. The ratio between the edit distance and the total length of the legal instruction sequence is taken as the instruction deviation component. The value of the instruction deviation component ranges from 0 to 1. When the instruction sequence under test is completely identical to the legal instruction sequence, the edit distance is 0 and the instruction deviation component is 0; when the difference between the instruction sequence under test and the legal instruction sequence is the greatest, the instruction deviation component approaches 1.

[0047] When comparing the format of the data to be tested with the format of the valid data to obtain the structural deviation components, the format of the data to be tested is parsed into a sequence of field names and a sequence of field types. Each element in the sequence of field names is a field name string, and each element in the sequence of field types is a field type identifier. Similarly, the valid data format is parsed into a sequence of valid field names and a sequence of valid field types. Each element in the sequence of valid field names is a standard field name string, and each element in the sequence of valid field types is a standard field type identifier. The sequence of field names to be tested and the sequence of valid field names are compared sequentially. Each field position in the sequence of valid field names is traversed, and it is checked whether the field name at the same position in the sequence of field names to be tested matches the field name at the corresponding position in the sequence of valid field names. If the two strings are completely identical after ignoring the difference in capitalization, or if the string of field names to be tested and the string of valid field names have a corresponding relationship in a predefined synonym field name mapping table, then the names are considered to match; otherwise, the field positions are marked as mismatched. A synonymous field name mapping table is pre-configured, establishing equivalence relationships for commonly used English abbreviations in power systems such as "Voltage" and "V", "Current" and "I", and "ActivePower" and "P". Simultaneously, the test field type sequence is compared sequentially with the valid field type sequence. Each field position in the valid field type sequence is traversed, and the field type identifier at the same position in the test field type sequence is checked against the corresponding field type identifier in the valid field type sequence. If they are different, they are marked as type mismatched field positions. The sum of the number of field position name mismatches and the number of field position type mismatches is counted, and the ratio of this sum to the total length of the valid field name sequence is used as the structural deviation component, with a value ranging from 0 to 1.

[0048] When comparing the measured data value with the valid data range to obtain the numerical deviation component, key parameter values ​​are extracted from the measured data value. These key parameter values ​​include at least voltage, current, and power values. The extraction process is as follows: traverse the sequence of field names to be measured. When a field name matches the keyword "voltage," mark the actual value of the corresponding field as a voltage value; when a field name matches the keyword "current," mark the actual value of the corresponding field as a current value; and when a field name matches the keyword "power," mark the actual value of the corresponding field as a power value. Obtain the valid voltage range, valid current range, and valid power range corresponding to the key parameter values ​​within the valid data range. The valid voltage range is […]. , The legal current range is [ ]. , The legal power range is []. , These ranges are set based on the rated parameters and allowable deviation range of the power monitoring system during stable operation. The system checks whether the voltage value falls within the legal voltage range, the current value falls within the legal current range, and the power value falls within the legal power range. The judgment criterion is: if the voltage value is greater than or equal to... and less than or equal to If the voltage value falls within the legal voltage range, then it is considered to fall outside the range; otherwise, it does not. If the current value is greater than or equal to... and less than or equal to If the current value is greater than or equal to the legal current range, then the current value is considered to fall within the legal current range; otherwise, it does not fall within the range. and less than or equal to If the power value falls within the legal power range, then it is considered to fall within the legal power range; otherwise, it does not. The number of key parameter values ​​that do not fall within the corresponding legal range is counted. The total number of key parameter values ​​is the number of types of key parameter values ​​actually extracted. The ratio of the number of key parameter values ​​that do not fall within the corresponding legal range to the total number of key parameter values ​​is taken as the numerical deviation component. The numerical deviation component ranges from 0 to 1.

[0049] The behavioral deviation is obtained by weighted summing of the instruction deviation component, structural deviation component, and numerical deviation component. The formula for calculating the behavioral deviation is:

[0050] ;

[0051] in, Indicates the degree of behavioral deviation; Indicates the instruction deviation component; Indicates structural deviation components; Indicates the numerical deviation component; Indicates the instruction deviation weight; Indicates the structural deviation weight; This represents the weight of numerical deviation. , and The values ​​are dynamically adjusted based on the service type, with different service types corresponding to different instruction deviation weights, structural deviation weights, and numerical deviation weights. The power monitoring communication behavior baseline model has a pre-defined table mapping service types to weight triples; for example, for the remote control service type, the instruction deviation weight... The value is 0.6, representing the structural deviation weight. The value is 0.2, representing the numerical deviation weight. The value is set to 0.2 because the core of remote control services lies in the correctness of the opcode sequence; for telemetry services, the command deviation weight is... The value is 0.1, representing the structural deviation weight. The value is 0.2, representing the numerical deviation weight. The value is set to 0.7 because telemetry services focus on the reasonableness of measurement values; for remote signaling services, the command deviation weight is... The value is 0.1, representing the structural deviation weight. The value is 0.4, representing the numerical deviation weight. The value is set to 0.5 to balance data format and numerical range validation. The weighting coefficient is obtained by querying the mapping table between the determined business type and the weight triplet, and directly reading the corresponding value. , and Value used for weighted summation calculation. Behavioral deviation. The final value falls between 0 and 1. The larger the value, the more serious the deviation of the current data payload from the legitimate communication behavior pattern.

[0052] See Figure 7 In the graph, the horizontal axis represents the behavioral deviation, ranging from 0 to 1, and the vertical axis represents the probability density, reflecting the frequency of occurrence of the corresponding behavioral deviation. The legend distinguishes three service types: remote control service (solid line), telemetry service (dashed line), and remote signaling service (dotted line). The curves show the probability distribution characteristics of behavioral deviation for each service type.

[0053] For remote control services, the probability density curve exhibits a right-skewed distribution, with peak values ​​between 0.15 and 0.25 for the behavior deviation, and a peak height close to 4.0. This indicates that most remote control service data payloads have low behavior deviations, communication behavior is highly consistent with legal patterns, and abnormal behavior is rare. When the behavior deviation exceeds 0.4, the probability density rapidly drops to near zero, showing that the probability of high deviations occurring is extremely low, reflecting the high accuracy requirements of this service type for command sequences.

[0054] The probability density curve for telemetry service types exhibits a relatively symmetrical single-peak distribution, with the peak value located in the behavioral deviation range of approximately 0.45 to 0.55, and the peak value approaching 3.0. This indicates that the behavioral deviation for this service type is mostly concentrated in the moderate deviation range. This trend aligns with the telemetry service's focus on the reasonableness of measurement values, allowing for a certain degree of data fluctuation, but excessive deviation significantly reduces the probability, demonstrating effective anomaly detection capabilities.

[0055] The probability density curve for remote signaling services exhibits a slightly right-leaning peak, with the peak value occurring between approximately 0.65 and 0.75 in the behavior deviation range. The peak value is close to 2.8, indicating that the overall communication behavior deviation for this service type is higher than that for remote control and telemetry services. This aligns with the characteristic of remote signaling services, which focus on both data format and numerical range, reflecting the relatively high deviation level caused by the complexity in structure and numerical verification.

[0056] The probability density of all three curves in the figure approaches zero when the behavioral deviation approaches 1, indicating that extreme deviations in communication behavior are extremely rare across all service types. The overall trend shows that remote control services have the lowest tolerance for behavioral deviation, with deviations mainly concentrated in the lower range; telemetry services have a more even distribution of deviations, favoring the middle range; and remote signaling services tend towards the higher deviation range. This distribution corresponds to the mechanism in the power monitoring communication behavior baseline model that dynamically adjusts the weights of command deviation, structural deviation, and numerical deviation for different service types, effectively supporting anomaly detection based on behavioral deviation.

[0057] Example 3:

[0058] In specific implementation, please refer to Figure 4 The preset deviation threshold is not a fixed constant, but is dynamically adjusted according to the current time period or load level of the power monitoring system. The dynamic adjustment of the deviation threshold is carried out after the behavior deviation is calculated and before the behavior deviation is compared with the deviation threshold, so that each anomaly judgment adopts a judgment standard adapted to the current system operating state.

[0059] To achieve dynamic adjustment of the deviation threshold, a first mapping relationship between time periods and threshold levels, and a second mapping relationship between load levels and threshold levels are pre-established in the configuration module of the power monitoring communication behavior baseline model. The first mapping relationship divides a 24-hour day into multiple time periods and assigns a corresponding threshold level to each period. The time period division is based on the time distribution pattern of the power monitoring system's dispatching services: 00:00 to 06:00 is classified as a low-activity period, corresponding to the first threshold level; 06:00 to 08:00 is classified as a ramp-up active period, corresponding to the second threshold level; 08:00 to 18:00 is classified as a high-activity period, corresponding to the third threshold level; 18:00 to 22:00 is classified as a slightly higher active period, corresponding to the second threshold level; and 22:00 to 24:00 is classified as a low-activity period, corresponding to the first threshold level. The deviation threshold for the first level is 0.35, the second level is 0.25, and the third level is 0.15. The above values ​​are based on the following: during high-activity periods, scheduling operations are frequent and communication modes are switched frequently, so a stricter deviation threshold is required to improve the sensitivity of detecting abnormal behavior; during low-activity periods, operations are sparse, and a more lenient deviation threshold can effectively reduce false alarms caused by occasional communication jitter.

[0060] The second mapping relationship divides the load levels of the power monitoring system into four levels and assigns a corresponding threshold level to each load level. The load level division is based on the ratio between the total active power of the entire network monitored in real time by the power monitoring system and the rated capacity of the system. When the ratio of the total active power of the entire network to the rated capacity of the system is less than or equal to 40%, the load level is light load, corresponding to the first threshold level, with a deviation threshold of 0.35. When the ratio of the total active power of the entire network to the rated capacity of the system is greater than 40% and less than or equal to 70%, the load level is normal, corresponding to the second threshold level, with a deviation threshold of 0.25. When the ratio of the total active power of the entire network to the rated capacity of the system is greater than 70% and less than or equal to 90%, the load level is heavy load, corresponding to the third threshold level, with a deviation threshold of 0.15. When the ratio of the total active power of the entire network to the rated capacity of the system is greater than 90%, the load level is overload, corresponding to the fourth threshold level, with a deviation threshold of 0.10. The above values ​​are based on the following: the higher the load level, the closer the power monitoring system is to its limit operation. At this time, the tolerance for abnormal communication behavior should be lower, and a stricter deviation threshold can more sensitively detect malicious data packets or abnormal commands that may endanger the stability of the system. When the load level is low, the system margin is sufficient, and the deviation threshold can be appropriately increased to balance security protection and business continuity.

[0061] In practical implementation, when it is necessary to obtain the currently effective deviation threshold, the power monitoring communication behavior baseline model synchronously obtains the current system time and real-time load level of the power monitoring system. The system time is obtained by calling the clock interface of the data processing server's operating system to read the hour and minute values ​​corresponding to the current moment. The load level is obtained by using the real-time data service interface provided by the dispatch automation system to obtain the current total active power of the entire network and the system's rated capacity, calculating the ratio between the total active power of the entire network and the system's rated capacity, and then determining the corresponding load level based on the second mapping relationship.

[0062] The power monitoring communication behavior baseline model queries the first mapping relationship based on system time and the second mapping relationship based on load level to obtain a first candidate deviation threshold based on time period and a second candidate deviation threshold based on load level. The first and second candidate deviation thresholds are compared, and the smaller value is selected as the currently effective deviation threshold for determining whether the behavior deviation exceeds the limit. The reason for selecting a smaller value is that when one dimension suggests a lenient threshold while another suggests a strict threshold, the stricter judgment principle should be followed to maximize the security of the power monitoring system.

[0063] Once the current effective deviation threshold is determined, it is compared with the behavior deviation. If the behavior deviation is greater than the current effective deviation threshold, it is determined that the behavior deviation exceeds the preset deviation threshold, triggering the abnormal data packet marking and alarm log generation process; if the behavior deviation is less than or equal to the current effective deviation threshold, the network data packet is determined to be a normal data packet, and no alarm is triggered.

[0064] In some embodiments, both the first mapping relationship and the second mapping relationship can be customized and adjusted by the security administrator through the configuration management interface. The configuration management interface provides time period editing function, load level interval editing function, and deviation threshold value editing function for each threshold level. The modified mapping relationship and threshold value take effect in real time after confirmation, replace the original configuration and write it into the configuration storage area of ​​the power monitoring communication behavior baseline model.

[0065] In some embodiments, the dynamic adjustment of the deviation threshold also considers the current operating condition type of the power monitoring system, which includes normal operation, maintenance operation, and emergency operation. The power monitoring communication behavior baseline model obtains the current operating condition type by reading the status identifier in the dispatch operation ticket system or maintenance management system. When the operating condition type is maintenance operation, the currently effective deviation threshold is automatically lowered by one level. For example, if the original second-level deviation threshold value of 0.25 is lowered to the third-level deviation threshold value of 0.15, and the original fourth-level deviation threshold value of 0.10 remains unchanged. When the operating condition type is emergency operation, the currently effective deviation threshold is automatically set to the fourth-level deviation threshold value of 0.10. The introduction of operating condition types allows the dynamic adjustment of the deviation threshold to cover changes in communication behavior patterns caused by planned operations or emergencies.

[0066] Optionally, the dynamic adjustment output of the deviation threshold is saved through logging. The log records include the adjustment trigger time, system time, load level, ratio between the total active power of the entire network and the rated capacity of the system, operating condition type, query results of the first mapping relationship, query results of the second mapping relationship, and the final effective deviation threshold value, for use in security auditing and strategy optimization analysis.

[0067] Example 4:

[0068] In specific implementation, please refer to Figure 5When the deviation from the target behavior exceeds a preset deviation threshold, the network data packet is marked as an abnormal packet, and an alarm log is generated based on the source and destination Internet Protocol (IP) addresses. This then triggers the risk tracing process. The purpose of risk tracing is to pinpoint the specific injection location from within the abnormal data packet to determine the attacker's malicious intent, providing precise evidence for subsequent threat analysis and security hardening. The core processing module of the risk tracing process is a pre-trained risk tracing model.

[0069] The input data of the risk tracing model consists of two parts: the first part is the data payload of the abnormal data packet, which is the data payload extracted from the network data packet in the aforementioned steps and determined to be abnormal by the behavior deviation calculation; the second part is the legitimate communication behavior pattern corresponding to the abnormal data packet, which is the legitimate communication behavior pattern corresponding to this communication retrieved from the power monitoring communication behavior baseline model based on the service type determined by the source Internet Protocol address and destination Internet Protocol address of the abnormal data packet during the aforementioned behavior deviation calculation process.

[0070] The risk attribution model employs a deep neural network architecture combining convolutional neural networks and attention mechanisms. The core architecture of the risk attribution model consists of an input layer, a multi-scale one-dimensional convolutional layer, a bidirectional long short-term memory network layer, a multi-head self-attention layer, a fully connected classification layer, and an output layer connected sequentially. The input layer receives the data payload of abnormal data packets and the byte sequence of legitimate communication behavior patterns, converting both into numerical vectors of fixed-length bytes. Each element in the numerical vector represents the normalized binary value of the corresponding byte, achieved by dividing the byte's binary value by 255. The multi-scale one-dimensional convolutional layer contains three parallel convolutional branches: the first branch has a kernel size of 3, a stride of 1, uniform padding, and 64 output channels; the second branch has a kernel size of 5, a stride of 1, uniform padding, and 64 output channels; and the third branch has a kernel size of 7, a stride of 1, uniform padding, and 64 output channels. The outputs of the three convolutional branches are concatenated along the channel dimension to form a feature map with 192 channels. The concatenated feature map is then fused across channels using a convolutional layer with a kernel size of 1, compressing the number of channels to 128.

[0071] The bidirectional Long Short-Term Memory (LSTM) network layer comprises a forward LSM network and a backward LSM network, both with 128 hidden units. The forward LSM network processes the feature map from the first time step to the last time step, while the backward LSM network processes it from the last time step to the first time step. The hidden state of the last time step of the forward LSM network is concatenated with the hidden state of the first time step of the backward LSM network to obtain a context vector of dimension 256. The multi-head self-attention layer has 8 attention heads, each with a query, key, and value dimension of 32. The multi-head self-attention layer performs self-attention calculation on the features output by the bidirectional LSM network layer at each time step, outputting a weighted feature sequence. The fully connected classification layer comprises two fully connected sub-layers. The input dimension of the first fully connected sub-layer is the flattened vector dimension of the feature sequence output from the attention layer, and its output dimension is 512. The activation function is the rectified linear unit function. The input dimension of the second fully connected sub-layer is 512, and its output dimension is equal to the total number of bytes in the data payload. The activation function is a sigmoid function. Each output neuron in the second fully connected sub-layer corresponds to a byte position in the data payload, and the output value represents the probability that the corresponding byte position is an anomalous byte. The output layer determines the byte positions in the fully connected classification layer whose output probability is greater than a preset anomaly threshold as the byte positions where anomalies have occurred. The preset anomaly threshold is set to 0.5, which is selected based on the empirically optimal cutoff point for balancing recall and precision in anomaly detection.

[0072] The training process of the risk tracing model is as follows: Anomaly data packet samples with attack injection point annotations generated by the power monitoring system during historical operation are collected to form a training sample set. Each training sample contains an anomalous data payload, a corresponding legitimate communication behavior pattern, and a binary label vector of the same length as the data payload. Positions with a value of 1 in the binary label vector indicate the actual offset address of the attack injection byte, while positions with a value of 0 represent normal bytes. The attack injection types in the training sample set cover four types: malicious instruction injection, data tampering, denial-of-service attack payload padding, and protocol field malformation construction. The number of samples for each attack injection type is evenly distributed in the training sample set. During training, the anomalous data payload and the corresponding legitimate communication behavior pattern are concatenated and input into the risk tracing model. The risk tracing model outputs the predicted probability that each byte position is an anomalous byte. The loss function adopts a byte-by-byte binary cross-entropy loss function. The loss function is calculated as follows: for each byte position, the binary cross-entropy between the true label and the predicted probability is calculated, and the average of the binary cross-entropy for all byte positions is calculated. The optimizer uses an adaptive moment estimation optimizer, with an initial learning rate of 0.001. The learning rate decay strategy involves multiplying the learning rate by a decay factor of 0.9 every 10 training epochs. The batch size is 32, and the total number of training epochs is 100. After training, the model parameters with the highest F1 score on the validation set are selected and saved as the final risk tracing model parameters. The validation set consists of 20% of the samples randomly selected from the training set.

[0073] When the risk tracing model segments the data payload of anomaly data packets into multiple payload fragments, it does so according to the fixed field lengths of the protocol. The fixed field lengths are the lengths of the fixed structure fields of the application service data unit defined in the power monitoring communication protocol. For example, in the IEC 60870-5-104 protocol, the type identifier field occupies 1 byte, the variable structure qualifier occupies 1 byte, the transmission reason occupies 2 bytes, the application service data unit common address occupies 2 bytes, and the information object address occupies 3 bytes. Information object elements have different fixed lengths depending on their type identifiers. These field length values ​​are pre-configured in the protocol fixed field length configuration table. Starting from the first byte, the data payload is segmented sequentially according to the lengths of each protocol field recorded in the protocol fixed field length configuration table. Each payload fragment corresponds to one protocol field. After all protocol fields have been segmented, the remaining bytes of the data payload are divided into a payload fragment. The same fixed field lengths are also applied to the segmentation of legitimate communication behavior patterns, dividing legitimate communication behavior patterns into multiple pattern fragments. Each pattern fragment has a structural correspondence with the payload fragment corresponding to the same field position.

[0074] Each payload fragment is aligned byte-by-byte with the corresponding pattern fragment at the same field position, and then compared byte-by-byte. The byte-by-byte comparison process is as follows: starting from the first byte of both the payload fragment and the pattern fragment, the offset address in the payload fragment is read synchronously. The binary value of the byte and the offset address in the pattern fragment are The binary value of the bytes, where Incrementing from 0 to the payload segment length minus 1, perform a bitwise XOR operation on the two binary values. If the result of the bitwise XOR operation is 0, it means the two bytes have the same binary value; if the result of the bitwise XOR operation is not 0, it means the two bytes have different binary values, and in this case, record the global offset address of that byte in the data payload. The global offset address is calculated by adding the starting offset address of the current payload segment in the data payload to the offset address within the segment. The starting offset address is obtained by summing the lengths of all load segments preceding this load segment.

[0075] The risk tracing model aggregates the global offset addresses of bytes with inconsistent binary values ​​marked in all payload segments, forming a set of byte locations where anomalies occurred. When determining the attack injection point of an abnormal data packet based on the abnormal byte locations, the risk tracing model sorts the offset addresses in the abnormal byte location set in ascending order of value, identifies continuous offset address intervals, and uses the start and end offset addresses corresponding to each continuous offset address interval as the span of an attack injection point. The span of each attack injection point and the names of the protocol fields involved within that span are extracted. The protocol field names are extracted by querying the protocol fixed field length configuration table based on the start and end offset addresses of the attack injection point. If an attack injection point spans multiple protocol fields, all involved protocol field names are listed. The start and end offset addresses of the attack injection point and the names of the involved protocol fields are used as attack injection point information and associated with the source Internet Protocol address of the abnormal data packet. The associated data is then appended to the alarm log. The newly added attack injection point field in the alarm log is stored in a structured data format, including the attack injection point number, starting offset address, ending offset address, a list of related protocol field names, and the associated source Internet Protocol address.

[0076] See Figure 8In the graph, the horizontal axis represents the byte offset address in the data payload, ranging from 0 to 600, and the vertical axis represents the anomaly probability of the corresponding byte position, ranging from 0 to 1. The curve is drawn as a continuous broken line, representing the predicted probability of each byte in the abnormal data packet being abnormal by the risk tracing model; the graph uses "×" to indicate the specific byte position of the identified attack injection point; the dashed line represents the preset anomaly judgment threshold, with a threshold value of 0.5.

[0077] As shown in the graph, the predicted probability remains generally low, with fluctuations less than 0.3, indicating that most bytes were not identified as abnormal. The anomaly probability curve exhibits three distinct peak intervals, with peak heights approaching or reaching 1. The byte offset addresses corresponding to these peaks are concentrated between approximately 110 and 130, 310 and 340, and 470 and 500, respectively. Within these three peak intervals, the predicted probability significantly exceeds the preset anomaly detection threshold of 0.5, indicating that the risk tracing model detected abnormal bytes at these byte offset addresses with a high degree of confidence.

[0078] The dense distribution of "×" marks across each peak interval, highly overlapping with the peak areas of the curve, indicates that the risk tracing model has successfully located the attack injection point in the abnormal data packet. The byte offset address range spanned by the attack injection point is clearly defined, facilitating the subsequent extraction of the corresponding protocol field names from the protocol fixed field length configuration table, thus achieving precise location and description of the attack injection point.

[0079] The entire anomaly probability change process exhibits distinct phase characteristics: the low-probability fluctuation phase corresponds to the normal byte region, and the three high-probability peak phases correspond to the attack injection region. The probability changes before and after the peaks are relatively steep, indicating that the model has a strong ability to distinguish between abnormal and normal bytes and a low false detection rate. This feature aligns with the design goal of the risk tracing model in Example 4, which utilizes multi-scale convolutional layers and attention mechanisms to deeply mine anomalous payload features.

[0080] In summary, this figure vividly illustrates the prediction results of the risk tracing model for attack injection points in the payload of abnormal data packets, clearly marking the byte positions of multiple attack injection points. This helps to accurately locate abnormal data packets and structure the subsequent alarm logs, demonstrating the key technical effects of the risk tracing process in Example 4.

[0081] Example 5:

[0082] In practice, when a network data packet is marked as an abnormal data packet, the security protection processing module of the power monitoring system extracts the source Internet Protocol (IP) address from the abnormal data packet. The extraction method involves reading the source IP address field value from the IP header field of the abnormal data packet and converting this value into a dotted decimal string format for storage.

[0083] The security protection processing module maintains a communication statistics database based on source Internet Protocol (IP) addresses. This database records the data packet transmission and reception status of each source IP address that has communicated with the power monitoring system within a preset time period. The data entries stored in the communication statistics database include a source IP address field, a timestamp sequence field, an anomaly marker sequence field, and a total count cache field. Whenever a network data packet is marked as an anomaly, the communication statistics database finds the corresponding data entry based on the source IP address of the anomaly, appends the current system timestamp to the timestamp sequence of that data entry, appends a Boolean value of "true" to the anomaly marker sequence, and increments the total count cache field by one. Conversely, whenever a network data packet is determined to be a normal data packet, the communication statistics database also finds the corresponding data entry based on the source IP address, appends the current system timestamp to the timestamp sequence, appends a Boolean value of "false" to the anomaly marker sequence, and increments the total count cache field by one. The communication statistics database periodically cleans the timestamp sequence, removing timestamp entries with timestamps earlier than the current system time minus a preset duration, along with their corresponding anomaly marker entries, from the beginning of the sequence. Simultaneously, the total count cache field value is reduced accordingly to ensure the database retains only communication records from the past preset duration. The preset duration is set to 24 hours, or 86,400 seconds. This setting is based on the following: 24 hours covers a complete daily operating cycle of the power monitoring system, effectively reflecting the different communication characteristics during peak and off-peak periods; and the window length is sufficient to ensure statistical stability in anomaly frequency statistics, avoiding misjudgments caused by occasional fluctuations due to excessively short windows.

[0084] When extracting the historical anomaly frequency corresponding to the source Internet Protocol address from abnormal data packets, the security protection processing module queries the communication statistics database based on the source Internet Protocol address to obtain the number of data packets marked as abnormal by that source Internet Protocol address within the past preset time period and the total number of data packets received by that source Internet Protocol address within the past preset time period. The number of abnormal data packets is obtained by counting the number of elements with a true value in the anomaly marker sequence of the corresponding data entry in the communication statistics database. The total number of data packets is obtained by directly reading the total count cache field value of the corresponding data entry, or by counting the total number of elements in the anomaly marker sequence. The formula for calculating the historical anomaly frequency is:

[0085] ;

[0086] in, Indicates the source Internet Protocol address The corresponding historical anomaly frequency ranges from 0 to 1. A value of 0 indicates that the source Internet Protocol address has never sent any abnormal data packets in the past preset time period, while a value of 1 indicates that all data packets sent by the source Internet Protocol address in the past preset time period were abnormal data packets. Indicates the source Internet Protocol address In the past preset duration The number of packets marked as abnormal within the data. Indicates the source Internet Protocol address In the past preset duration The total number of data packets received. The preset duration is 86400 seconds.

[0087] The security protection processing module compares the calculated historical anomaly frequency with a preset frequency threshold. The preset frequency threshold is set to 0.3. This value is based on the following: when the historical anomaly frequency exceeds 0.3, it indicates that more than 30% of the communications from the source Internet Protocol address have been identified as abnormal recently, representing a high-risk source of continuous malicious behavior. If the frequency threshold is set too low, it may lead to frequent blocking of legitimate nodes due to normal communication fluctuations; if the frequency threshold is set too high, it may fail to block attacks in a timely manner. 0.3 is a balance point between the timeliness of security protection processing and reducing the false positive rate.

[0088] When the historical anomaly frequency exceeds a preset frequency threshold, the security protection module adds the source Internet Protocol (IP) address to a dynamic blacklist. The dynamic blacklist is a memory-based hash set, where the key is the dotted-decimal string of the source IP address and the value is the system timestamp at the time of addition. The dynamic blacklist supports dynamic additions and deletions. When the historical anomaly frequency of a source IP address falls below the preset frequency threshold again in a subsequent statistical period, the security protection module removes that source IP address from the dynamic blacklist.

[0089] Based on the dynamic blacklist, the security protection processing module updates the access control list on the routing equipment between the dispatch master station and the substation. The security protection processing module remotely logs into the core router or aggregation layer switch in the dispatch data network via the Secure Enclosure Protocol (SEIP), and issues access control list update commands through the configuration terminal of the routing equipment or through the network configuration protocol interface. For each source Internet Protocol (IP) address in the dynamic blacklist, the access control list update command generates a denial statement. The format of the denial statement is as follows: a filter rule is appended to the end of the inbound rules of the access control list, with the action field set to "deny," the source IP address field being the corresponding source IP address in the dynamic blacklist, the destination IP address field being arbitrary, the protocol field being Transmission Control Protocol (TCP) or User Datagram Protocol (UDP), and the transport layer port field being the range of all ports used by power monitoring services in the dispatch data network. After receiving the access control list update command, the routing equipment immediately applies the updated access control list to the inbound WAN interfaces on both the dispatch master station side and the substation side, denying all subsequent data packets from IP addresses in the dynamic blacklist. When a source Internet Protocol address is removed from the dynamic blacklist, the security protection processing module also issues an access control list update command to delete the corresponding denial statement and restore normal communication reception for that source Internet Protocol address.

[0090] After generating alarm logs based on the source and destination Internet Protocol (IP) addresses, the security protection processing module also performs communication path impact analysis. The source and destination IP addresses are extracted from the alarm logs by parsing the predefined source and destination IP address labels from the structured data fields of the alarm logs.

[0091] The security protection processing module preloads and maintains a preset network topology graph. The network topology graph is stored using a directed or undirected graph data structure. Nodes in the graph represent network devices in the power monitoring system, including dispatch master station servers, switches, routers, firewalls, substation-side station control layer switches, and bay-level intelligent electronic devices. Each node contains at least a device identifier field and a list of device Internet Protocol (IP) addresses. Edges in the graph represent physical or logical communication links between network devices. Each edge contains the identifiers of the two nodes connected by the link and a link weight field. The link weight field is assigned a value based on the link's transmission delay or hop count; initially, all edges have a weight of 1 by default.

[0092] Based on the source and destination Internet Protocol (IP) addresses, the security protection processing module locates the first node corresponding to the source IP address and the second node corresponding to the destination IP address in the network topology diagram. The location process is as follows: traverse the list of device IP addresses for all nodes in the network topology diagram, searching for nodes containing the source IP address as the first node, and searching for nodes containing the destination IP address as the second node. If no node is matched for either the source or destination IP address, the routing information from the alarm log generation point to the source and destination IP addresses is obtained through a routing tracing protocol. Newly discovered IP addresses and corresponding devices along the way are dynamically added to the network topology diagram, and the node location is re-executed.

[0093] When calculating the shortest communication path between the first and second nodes, the security protection processing module uses Dijkstra's algorithm on the network topology graph. Dijkstra's algorithm uses the first node as the source node and the second node as the target node, searching for the shortest path based on the link weight field values ​​of each edge in the network topology graph, and outputs a shortest communication path containing a sequence of nodes and edges. If multiple paths with equal weights exist, the path with the fewest network device nodes is selected as the shortest communication path.

[0094] After determining the shortest communication path, the security protection module marks all network devices along the shortest communication path as affected devices in the network topology diagram. The marking method is as follows: for each node in the shortest communication path node sequence, the affected status of that node is set to true in the affected marking table of the network topology diagram, and the device identifier corresponding to the affected device is added to the affected device field of the alarm log. The device identifier is a string format combining the device name and the device's Internet Protocol address, with multiple affected device identifiers separated by semicolons. After the alarm log is updated, the security administrator can quickly grasp the range of network devices that may be affected by an abnormal communication event by viewing the list of affected devices in the alarm log.

[0095] See Figure 9 In the graph, the horizontal axis represents time in hours, covering the complete 24-hour daily cycle; the vertical axis represents the historical abnormal frequency corresponding to the source Internet Protocol address, with a value range of 0 to 0.6. The solid curve in the graph depicts the trend of historical abnormal frequency changes of a certain source Internet Protocol address over the past 24 hours, while the dashed horizontal line represents the preset frequency threshold of 0.3.

[0096] From 0 hours to approximately 10 hours, the historical anomaly frequency remained stable between 0.05 and 0.2, far below the preset frequency threshold, reflecting that there were few communication anomalies at this source address during this period, indicating a low risk. Between approximately 10 and 14 hours, the historical anomaly frequency increased significantly, reaching a peak of 0.35 to 0.6, exceeding the preset threshold of 0.3, indicating that this source address generated a large number of abnormal data packets during this period, exhibiting high-risk characteristics of continuous malicious behavior. The anomaly frequency curve showed multiple fluctuations during this period, reflecting that the transmission of abnormal data packets had certain temporal characteristics and stages.

[0097] The gray vertical bars in the graph mark multiple abnormally active phases, corresponding to the peaks of the curve. These indicate that during these phases, the system security protection module may frequently trigger dynamic blacklist updates and access control list adjustments based on frequency thresholds. After 14 hours, the historical abnormal frequency rapidly drops to 0.1 to 0.15, below the threshold, indicating that the abnormal activity has ended or the source of risk has been effectively contained.

[0098] This figure visually illustrates the actual operational effect of the security protection processing module in Example 5, which uses historical abnormal frequency statistics based on source Internet Protocol (IP) addresses. By continuously monitoring and calculating frequencies, the system can identify periods of high incidence of abnormal communication and then dynamically adjust the blacklist according to preset frequency thresholds to promptly block high-risk source addresses, ensuring the communication security and stable operation of the power monitoring system.

[0099] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A network security protection method for a power monitoring system, characterized in that, The method includes: Collect network data packets transmitted between the dispatch master station and substations in the power monitoring system; Perform deep packet inspection on the network data packets to extract the source Internet Protocol address, destination Internet Protocol address, and data payload carried in the network data packets; The data payload is input into a pre-built baseline model of power monitoring communication behavior, and the baseline model of power monitoring communication behavior calculates the deviation between the data payload and the pre-stored legitimate communication behavior pattern based on the source Internet Protocol address and the destination Internet Protocol address. When the deviation of the behavior exceeds a preset deviation threshold, the network data packet is marked as an abnormal data packet, and an alarm log is generated based on the source Internet Protocol address and the destination Internet Protocol address.

2. The network security protection method for a power monitoring system according to claim 1, characterized in that, The network data packets transmitted between the dispatch master station and the substation in the power monitoring system are specifically collected, including: Deploy traffic mirroring probes in the dispatch data network between the dispatch master station and the substation; The traffic mirroring probe replicates the real-time communication traffic transmitted in the scheduling data network, and captures the original data packets encapsulated based on Transmission Control Protocol or User Datagram Protocol from the real-time communication traffic as the network data packets.

3. A network security protection method for a power monitoring system according to claim 1, characterized in that, The data payload is input into a pre-built baseline model of power monitoring communication behavior. The baseline model calculates the behavioral deviation between the data payload and a pre-stored legitimate communication behavior pattern based on the source and destination Internet Protocol (IP) addresses. Specifically, this includes: The service type of this communication is determined based on the source Internet Protocol address and the destination Internet Protocol address; The legal communication behavior pattern corresponding to the service type is retrieved from the power monitoring communication behavior baseline model. The legal communication behavior pattern includes a legal instruction sequence, a legal data format, and a legal data range. The data payload is decomposed into a sequence of instructions to be tested, a data format to be tested, and a data value to be tested. The instruction sequence to be tested is compared with the legal instruction sequence to obtain the instruction deviation component; The structure of the data format to be tested is compared with that of the legal data format to obtain the structural deviation component. The value of the data to be tested is compared with the range of legal data to obtain the numerical deviation component. The behavioral deviation is obtained by weighted summation of the instruction deviation component, the structural deviation component, and the numerical deviation component.

4. A network security protection method for a power monitoring system according to claim 3, characterized in that, The weighting coefficients used in the weighted summation are dynamically adjusted according to the business type. Different business types correspond to different instruction deviation weights, structural deviation weights, and numerical deviation weights.

5. A network security protection method for a power monitoring system according to claim 3, characterized in that, The instruction sequence to be tested is compared with the legal instruction sequence to obtain the instruction deviation component, which specifically includes: The sequence of instructions to be tested and the sequence of valid instructions are respectively converted into opcode vectors; Calculate the edit distance between the opcode vectors, where the edit distance represents the minimum number of single-character edit operations required to transform the instruction sequence under test into the legal instruction sequence; The ratio between the edit distance and the total length of the legal instruction sequence is used as the instruction deviation component.

6. A network security protection method for a power monitoring system according to claim 5, characterized in that, In the process of calculating the edit distance between the opcode vectors, different values ​​are assigned to the insertion, deletion and replacement operations.

7. A network security protection method for a power monitoring system according to claim 3, characterized in that, The test data format is structurally compared with the valid data format to obtain structural deviation components, specifically including: The data format to be tested is parsed into a sequence of field names and a sequence of field types. The valid data format is parsed into a sequence of valid field names and a sequence of valid field types; The sequence of field names to be tested is compared with the sequence of valid field names in turn, and the positions of the fields whose names do not match are marked. The test field type sequence is compared sequentially with the valid field type sequence, and the positions of fields with mismatched types are marked. The sum of the number of field positions with mismatched names and the number of field positions with mismatched types is used as the ratio of this sum to the total length of the valid field name sequence as the structural deviation component.

8. A network security protection method for a power monitoring system according to claim 7, characterized in that, When comparing the sequence of field names to be tested with the sequence of valid field names, case differences and predefined synonym field name mappings are ignored.

9. A network security protection method for a power monitoring system according to claim 3, characterized in that, The measured data value is compared with the valid data range to obtain the numerical deviation component, which specifically includes: Key parameter values ​​are extracted from the measured data values, and the key parameter values ​​include at least voltage values, current values, and power values; Obtain the valid voltage range, valid current range, and valid power range corresponding to the key parameter values ​​within the valid data range; Determine whether the voltage value falls within the legal voltage range, the current value falls within the legal current range, and the power value falls within the legal power range, respectively. The number of key parameter values ​​that do not fall into the corresponding valid interval is counted, and the ratio of the count to the total number of key parameter values ​​is taken as the numerical deviation component.

10. A network security protection method for a power monitoring system according to claim 1, characterized in that, The preset deviation threshold is dynamically adjusted, with different threshold levels set dynamically according to the current time period or load level of the power monitoring system.

Images