Intelligent substation network intrusion detection system and detection method based on deep learning

Abstract

The invention belongs to the technical field of transformer substation network intrusion detection, and particularly relates to an intelligent transformer substation network intrusion detection systemand method based on deep learning. The system is used for intrusion detection aiming at network attacks of an IEC61850 communication protocol of an intelligent substation. The system comprises a datacollection module, a feature extraction module, a behavior analysis module and a defense behavior trigger module which are sequentially connected, wherein the data collection module is connected to an intelligent substation network to collect data, the defense behavior trigger module is connected to the intelligent substation network, the network information flow based on the IEC61850 protocol inthe intelligent substation is collected and analyzed in real time, and abnormal communication behaviors are detected and alarmed in real time.

Description

Technical field [0001] The invention belongs to the technical field of substation network intrusion detection, and in particular relates to a deep learning-based intelligent substation network intrusion detection system and detection method. Background technique [0002] The smart substation system is a network with a multi-layer structure. The domestic smart substation generally adopts a three-layer and two-network (three-device layer, two-network layer) system structure. The three device layers include the station control layer and the bay Layer and process layer. Station control layer equipment mainly includes monitoring and dispatching equipment such as monitoring host, communication gateway, server, and workstation. The process layer equipment mainly includes relay protection devices, stability control devices, measurement and control devices, etc.The two network layers include a station control layer network connecting bay layer equipment and station control layer equipmen...

AI Technical Summary

Problems solved by technology

[0006] Since the IEC61850 communication in the smart substation is based on the Ethernet protocol commonly used in the Internet at the link layer, most of the network attacks against the Ethernet in the Internet can be utilized and transformed, and then attack the Ethernet network of the smart substation

[0007] 2. Network attacks against GOOSE and SV packets

The main disadvantages of these traditional methods are as follows: 1) the protection area is not comprehensive enough, and it is impossible to carry out any effective defense against attackers who have infiltrated into the LAN and the internal personnel of the LAN; 2) the isolation and encryption methods rely on passive information hiding. Abnormal behavior cannot be actively identified and defended; 3) Existing intrusion detection systems are based on the description of currently known attacks (such as anti-virus systems), and cannot effectively identify new attacks and variant attacks; 4) Isolation Methods such as encryption and data encryption are intrusive defense methods, which may lead to delays in communication information of the substation system, complicating the network topology structure, and increasing equipment purchase costs

Images