Steam turbine network security real-time online monitoring system and method

Abstract

The invention belongs to the technical field of steam turbine network security protection, and particularly relates to a steam turbine network security real-time online monitoring method and system. The system comprises a comprehensive analysis module, a control unit monitoring module and a network flow monitoring module, real-time and analog data are synchronously collected based on an active monitoring algorithm through mirror data collection, and the steam turbine network security real-time online monitoring is realized through a network data acquisition step, a network data anomaly analysis step, a system operation result monitoring step, a correlation analysis step and a comprehensive analysis step in combination with combined analysis of network data anomaly and system data anomaly.

Description

technical field [0001] The invention belongs to the technical field of steam turbine network security protection, and in particular relates to a real-time online monitoring method and system for steam turbine network security. Background technique [0002] In the thermal power generation process, the steam turbine is one of the main control objects. The steam turbine control and protection system realizes the control and protection functions of the steam turbine, which mainly includes two parts: the steam turbine control system and the steam turbine protection system. The steam turbine control system specifically refers to the steam turbine control unit of the power plant distributed control system (DCS), the steam turbine digital electro-hydraulic control system (DEH), and the steam turbine protection system specifically refers to the steam turbine emergency tripping system (ETS) and the steam turbine safety monitoring system (TSI). [0003] Among them, the main function o...

AI Technical Summary

Problems solved by technology

[0008] 1. The method based on network traffic analysis lacks the analysis of the state of the control system itself, and cannot effectively prove whether the control and protection system is really out of control under a network attack. At the same time, there are false alarms, which mislead the on-site staff to implement inappropriate emergency response plans. Therefore, It is difficult to apply in practical engineering;

[0009] 2. Although the method of implanting monitoring software can make up for the shortcomings of the network traffic analysis method, it needs to add new software to the control system and modify the original configuration. If the control system manufacturer does not cooperate, this method is almost useless in project implementation. possible

In addition, the method of using embedded monitoring software alone cannot effectively distinguish

Images