A method and system for intelligent substation intrusion scene restoration based on spatio-temporal similarity matching

Abstract

The invention discloses an intelligent substation intrusion scene restoration method and system based on spatio-temporal similarity matching. The method comprises the following steps: obtaining alarminformation of each alarm device of the intelligent substation; classification of alarm information; determining the alarm correlation relationship between alarm devices, and establishing the alarm similarity matrix between alarm devices; the causality matrix between alarm devices is established. Calculating the attack propagation probability between any two alarm devices, and determining the final attack propagation path between the alarm devices; according to the pre-established attack characteristics database of known attack types, the attack characteristics of known attack types are obtained. The alert information of each node in the attack scenario recovered from the final attack propagation path between the alert devices and the attack characteristics of the known attack types are analyzed for attack support respectively. The attack type with the most alarm devices in each node in the attack scenario is determined as the attack type of the current attack scenario.

Description

technical field [0001] The present invention relates to the technical field of intelligent substation intrusion attack recovery, and more specifically, to a method and system for intelligent substation intrusion scene recovery based on spatio-temporal similarity matching. Background technique [0002] Smart substation is an important link in the construction of smart grid. With the wide application of information and communication technology in smart substations, various loopholes in the information network have also brought more serious cyber attack threats to smart substations. In response to these security threats, experts and scholars at home and abroad have carried out a lot of research in the field of information security of smart substations. The main content of existing technology research includes attack detection technology and attack protection technology. However, some advanced network attacks (such as APT attacks) often use intrusion evasion techniques to avoid ...

AI Technical Summary

Problems solved by technology

[0006] The technical solution of the present invention provides a method and system for restoring intrusion scenes of smart substations based on spatio-temporal similarity matching, so as to solve the problem of how to restore intrusion scenes of smart substations based on spatio-temporal similarity matching

Images