IEC61850-based detection method and system for detecting power industrial control network intrusions

Abstract

The invention discloses an IEC61850-based detection method and system for detecting power industrial control network intrusions; the method comprises access control detection, protocol white list detection, model-based detection and multiple-parameter-based detection, wherein through the access control detection, it is possible to prevent malware intending to communicate with a control server from acting and attacking, and the effect is particularly good in the initial infection stage; through the protocol white list detection, it is possible to detect abnormal protocol traffic in station control layer and process layer network of a substation and give a warning; the model-based anomaly detection has the potential to discover hostile attack or untended anomalies in the station control layer and process layer network; in the multiple-parameter-based detection, possible threats to an industrial control system due to internal untended misuse or external hostile attack can be recognized by monitoring the most sensitive parameters of an intelligent substation. Validation on a network physical test platform for simulating actual 500 kV intelligent substations shows that the method is timely and practical.

Description

Technical field [0001] The invention belongs to the technical field of industrial control system network information security, and in particular relates to an IEC61850-based power industry control network intrusion detection method and system. Background technique [0002] The industrial control system is a computer-based production process control and scheduling automation system. It can monitor and control on-site operating equipment and play an important role in the industrial control system of key infrastructure such as power, petroleum, and chemical industries. As the complexity and interconnectivity of industrial control systems continue to increase, the possibility of malicious network attacks has also increased significantly. Industrial control networks that follow traditional communication protocols often have insufficient consideration of network security threats at the beginning of their design. The continuously evolving industrial control system may be regarded by ma...

AI Technical Summary

Problems solved by technology

Due to the lack of control instruction authentication mechanism in the traditional power industry system, malicious attackers may access the industrial control system without authorization, destroy the integrity and availability of information, launch spoofing attacks, replay attacks and man-in-the-middle attacks, which may cause catastrophic damage and endanger safe operation of the system

Existing intrusion detection systems based on IEC 61850 have the following deficiencies: (1) cannot effectively prevent "zero-day attacks" (unknown threats or undiscovered vulnerabilities); The impact on the substation event (GOOSE) message of the general object makes most statistical analysis and detection methods produce false negatives and miss the real attack; (3) the detection accuracy needs to be improved and cannot adapt to the actual substation

Images