CN110751570A - A method and system for identifying attacks on power service packets based on business logic - Google Patents

Abstract

The invention discloses a method and a system for identifying electric power service message attack based on service logic, wherein the method comprises the following steps: determining a current state sequence of the power service; respectively determining a dangerous state sequence set and a safe state sequence set corresponding to a current state sequence according to a multipoint signal address sequence of the current state sequence; determining the threat degree of the current state sequence according to the current state sequence, the dangerous state sequence set and the safe state sequence set; and when the threat degree of the current state sequence is greater than or equal to a preset safety risk threshold value, determining that the power grid is attacked by the power service message. According to the method, the risk state sequence set and the safety state sequence set of the power service logic are defined, the misuse detection and the abnormity detection method are combined, the threat degree of the power service is evaluated, whether the power grid is attacked by the power service message is determined according to the threat degree, the effective identification of the power service message attack is realized, and the safe and reliable operation of the power service control system is guaranteed.

Description

A method and system for identifying attacks on power service packets based on business logic

technical field

The present invention relates to the technical field of smart grid security, and more particularly, to a method and system for identifying attacks on power service packets based on service logic.

Background technique

With the deepening of the coupling between the information space and the physical space of the smart grid, in recent years, the failure of the power grid physical system caused by network attacks has become more and more common, which seriously affects the normal operation of the power system. For example, at the end of 2015, attackers performed malicious switch-off operations by obtaining the operating authority of the substation monitoring system server, causing power outages to 80,000 users of the Ukrainian power grid. In the power grid, all kinds of intelligent terminals and devices used for the measurement and control of primary system or equipment parameters (collectively referred to as measurement and control terminals in this article) serve as a bridge for communication between information systems and physical systems. The attack carried out by this article will directly affect the normal operation of primary power equipment, such as abnormal opening of circuit breakers, modification of fixed values, etc., thus causing power accidents. Therefore, how to effectively identify the power service packet attacks that the power grid monitoring and control terminal may suffer has become an urgent problem to be solved.

At present, the research on network attack identification of power grid monitoring and control terminals is mainly divided into the following two categories: 1) The network attack identification system of traditional information network is directly applied to the network attack identification of power grid monitoring and control terminals. Anomaly identification and protocol whitelisting are used to identify attacks. Some researches propose unknown attack identification methods based on self-learning communication mode; 2) The power grid monitoring and control terminal is realized by means of power-specific protocol traffic characteristics, rules, or the correlation of different fields of packets. Network attack identification. For example, some studies propose to use the network traffic characteristics of GOOSE packets to identify attacks, and some studies propose attack identification methods based on IEC 60870-5-104 protocol traffic pattern inspection, and the validity and correlation inspection of each field. Some studies use this method to identify network attacks implemented using the IEC 61850 protocol. The above research can effectively identify ARP spoofing, ICMP Flood and SYN Flood and other network attacks that utilize the vulnerability of general network protocols, as well as some network attacks that use the vulnerabilities of power-specific protocols such as IEC60870-5-104 and IEC 61850, such as GOOSE. Malformed packet attacks, etc., but cannot effectively identify power service packet attacks. Power service packet attack refers to an attack in which an attacker tampers, forges, and re-distributes the service packets transmitted by the network measurement and control terminal, causing the primary power equipment to malfunction. This type of attack usually changes the normal service logic.

SUMMARY OF THE INVENTION

The present invention proposes a method and system for identifying an attack on a power service message based on business logic, so as to solve the problem of how to effectively identify the attack on a power service message to determine the security state of the power grid.

In order to solve the above problems, according to an aspect of the present invention, a method for identifying attacks on power service packets based on service logic is provided, and the method includes:

Obtain a multipoint signal value sequence and a multipoint signal address sequence of a current state node from a power service message, determine a control block corresponding to the current state node according to the multipoint signal address sequence, and assign the multipoint signal address sequence to the multipoint signal address sequence. The signal value sequence is added to the state sequence of the control block to obtain the current state sequence;

Determine the dangerous state sequence set and the safe state sequence set corresponding to the current state sequence respectively according to the multi-point signal address sequence of the current state sequence;

Determine the threat degree of the current state sequence according to the current state sequence, the dangerous state sequence set and the safe state sequence set;

The threat degree of the current state sequence is compared with a preset security risk threshold, and when the threat degree of the current state sequence is greater than or equal to the preset security risk threshold, it is determined that the power grid has suffered a power service message attack.

Preferably, the threat degree of the current state sequence is determined according to the current state sequence, the dangerous state sequence set and the safe state sequence set, including:

Matching the current state sequence with the dangerous state sequence set, and if the current state sequence and the dangerous state sequence set are successfully matched, determine that the threat degree of the current state sequence is 1;

If the current state sequence is unsuccessfully matched with the dangerous state sequence set, the current state sequence is matched with the safe state sequence set, and if the current state sequence is successfully matched with the safe state sequence set, Then it is determined that the threat degree of the current state sequence is 0.

Preferably, the threat degree of the current state sequence is determined according to the current state sequence, the dangerous state sequence set and the safe state sequence set, including:

respectively calculating the first minimum distance between the current state sequence and the dangerous state sequence set, and the second minimum distance between the current state sequence and the safe state sequence set;

The threat degree of the current state sequence is calculated according to the first minimum distance and the second minimum distance.

Preferably, calculating the threat degree of the current state sequence according to the first minimum distance and the second minimum distance includes:

Among them, P _threaten is the threat degree of the current state sequence; d _black is the first minimum distance; d _white is the second minimum distance.

Preferably, wherein the matching of the current state sequence with the set of dangerous state sequences includes:

中，其中，n1的初始值为0，添加后

Step 11 _{: Add the latest multi-point signal value sequence status n of S ′} =(status ₁ , status ₂ , .

, where the initial value of n1 is 0, after adding

中的所有规则，

若满足n2＞n-n1and i≠t，则继续遍历；若满足n2＞n-n1 and i＝t，则表示匹配结束，遍历结束，继续执行安全状态序列集匹配模式；若满足n2＜n-n1，则进入步骤13；否则，进入步骤14；Step 12, traverse the dangerous state sequence set sequentially

all the rules in

If n2>n-n1and i≠t, continue to traverse; if n2>n-n1 and i=t, it means the matching is over, the traversal is over, and continue to execute the security state sequence set matching mode; if n2<n- n1, then go to step 13; otherwise, go to step 14;

的后n2项保留，则

并将n1置为n-n2，则

Step 13, will

The last n2 items are reserved, then

and set n1 to n-n2, then

是否与Bi相同；其中，若相同，则将

只保留最后一项，则

同时将n1置为n-1，并确定所述当前状态序列与所述危险状态序列集匹配成功，直接确定所述当前状态序列的威胁度为1；否则，返回步骤12继续遍历。Step 14, judge

Is it the same as Bi; where, if it is the same, then

keep only the last item, then

At the same time, n1 is set to n-1, and it is determined that the current state sequence is successfully matched with the dangerous state sequence set, and the threat degree of the current state sequence is directly determined to be 1; otherwise, return to step 12 to continue traversing.

Preferably, the matching of the current state sequence with the security state sequence set includes:

Step 21: Add the latest multipoint signal value sequence status _n of S′=(status ₁ , status ₂ , . . . , status _n ) in the current status sequence status_sequence _now = (S′, pos_sequence _now ) to the cache state , where the initial value of n3 is 0, after adding

若满足n4＞n-n3 and i≠e，则进入步骤26；若满足n4＞n-n3 and i＝e，则表示匹配失败，遍历结束；若满足n4＜n-n3，则进入步骤23；否则，进入步骤24；Step 22, traverse the security state sequence set sequentially all the rules in

If n4>n-n3 and i≠e are satisfied, go to step 26; if n4>n-n3 and i=e are satisfied, it means that the matching fails, and the traversal ends; if n4<n-n3 is satisfied, then go to step 23; Otherwise, go to step 24;

的后n4项保留，则

并将n3置为n-n4，则

Step 23, will

The last n4 items are reserved, then

and set n3 to n-n4, then

是否与W_i相同，若不相同，则返回步骤22，继续遍历；否则，进入步骤25；Step 24, judge

Whether it is the same as _Wi , if not, return to step 22 and continue to traverse; otherwise, enter step 25;

同时将n3置为n-1，将init_status置为1，确定所述当前状态序列与所述安全状态序列集匹配成功，直接确定所述当前状态序列的威胁度为0；其中init_status的初始值为0，用于标识是否进行一次安全状态序列完全匹配；Step 25, will keep only the last item, then

At the same time, set n3 to n-1, set init_status to 1, determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; the initial value of init_status is 0, used to identify whether to perform a complete match of the security state sequence;

Step 26, if init_status is 0, go to step 27, otherwise go to step 28;

是否为W_i的子集，若是，则确定所述当前状态序列与所述安全状态序列集匹配成功，直接确定所述当前状态序列的威胁度为0；否则，继续遍历安全状态序列集中的其他规则，返回步骤22；Step 27, init_status is 0, judge

Whether it is a _subset of Wi, if yes, then determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; otherwise, continue to traverse other security state sequence sets rule, return to step 22;

是否与W_i的前n-n1项相同，若是，则确定所述当前状态序列与所述安全状态序列集匹配成功，直接确定所述当前状态序列的威胁度为0；否则，继续遍历安全状态序列集中的其他规则，返回步骤22。Step 28, judge

Whether it is the same as the first _n -n1 items of Wi, if yes, then determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; otherwise, continue to traverse the security state Other rules in the sequence set, return to step 22.

Preferably, wherein the method further comprises:

If the threat degree of the current state sequence is less than the preset security risk threshold, it is determined that the power grid is not attacked by the power service message.

According to another aspect of the present invention, a service logic-based power service packet attack identification system is provided, the system comprising:

The current state sequence determination unit is configured to obtain a multipoint signal value sequence and a multipoint signal address sequence of a current state node from the power service message, and determine the control corresponding to the current state node according to the multipoint signal address sequence block, and add the multi-point signal value sequence to the state sequence of the control block to obtain the current state sequence;

a dangerous state sequence set and a safe state sequence set determining unit, configured to respectively determine a dangerous state sequence set and a safe state sequence set corresponding to the current state sequence according to the multipoint signal address sequence of the current state sequence;

a threat degree determination unit, configured to determine the threat degree of the current state sequence according to the current state sequence, the dangerous state sequence set and the safe state sequence set;

A power service message attack identification unit, configured to compare the threat degree of the current state sequence with a preset security risk threshold, and determine when the threat degree of the current state sequence is greater than or equal to the preset security risk threshold The power grid was attacked by power service packets.

Preferably, wherein the threat degree determination unit determines the threat degree of the current state sequence according to the current state sequence, the dangerous state sequence set and the safety state sequence set, including:

A dangerous state sequence set matching module, configured to match the current state sequence with the dangerous state sequence set, and if the current state sequence and the dangerous state sequence set are successfully matched, determine the threat of the current state sequence degree is 1;

The safety state sequence set matching module is configured to match the current state sequence with the safety state sequence set if the current state sequence is unsuccessfully matched with the dangerous state sequence set, and if the current state sequence matches the safety state sequence set If the security state sequence set matches successfully, it is determined that the threat degree of the current state sequence is 0.

Preferably, wherein the threat degree determination unit determines the threat degree of the current state sequence according to the current state sequence, the dangerous state sequence set and the safety state sequence set, including:

A first minimum distance and a second minimum distance determination module, configured to respectively calculate the first minimum distance between the current state sequence and the dangerous state sequence set, and the second minimum distance between the current state sequence and the safe state sequence set shortest distance;

A threat level determination module, configured to calculate the threat level of the current state sequence according to the first minimum distance and the second minimum distance.

Preferably, wherein the threat degree determination module calculates the threat degree of the current state sequence according to the first minimum distance and the second minimum distance, including:

Among them, P _threaten is the threat degree of the current state sequence; d _black is the first minimum distance; d _white is the second minimum distance.

Preferably, the dangerous state sequence set matching module matches the current state sequence with the dangerous state sequence set, including:

中，其中，n1的初始值为0，添加后

Step 11 _{: Add the latest multi-point signal value sequence status n of S ′} =(status ₁ , status ₂ , .

, where the initial value of n1 is 0, after adding

中的所有规则，

若满足n2＞n-n1andi≠t，则继续遍历；若满足n2＞n-n1 and i＝t，则表示匹配结束，遍历结束，继续执行安全状态序列集匹配模式；若满足n2＜n-n1，则进入步骤13；否则，进入步骤14；Step 12, traverse the dangerous state sequence set sequentially

all the rules in

If n2>n-n1andi≠t, continue to traverse; if n2>n-n1 and i=t are satisfied, it means that the matching is over, the traversal is over, and continue to execute the security state sequence set matching mode; if n2<n-n1 is satisfied , then go to step 13; otherwise, go to step 14;

的后n2项保留，则

并将n1置为n-n2，则

Step 13, will

The last n2 items are reserved, then

and set n1 to n-n2, then

是否与Bi相同；其中，若相同，则将

只保留最后一项，则

同时将n1置为n-1，并确定所述当前状态序列与所述危险状态序列集匹配成功，直接确定所述当前状态序列的威胁度为1；否则，返回步骤12继续遍历。Step 14, judge

Is it the same as Bi; where, if it is the same, then

keep only the last item, then

At the same time, n1 is set to n-1, and it is determined that the current state sequence is successfully matched with the dangerous state sequence set, and the threat degree of the current state sequence is directly determined to be 1; otherwise, return to step 12 to continue traversing.

Preferably, wherein the security state sequence set matching module matches the current state sequence with the security state sequence set, including:

中，其中，n3的初始值为0，添加后

Step 21: Add the latest multipoint signal value sequence status _n of S′=(status ₁ , status ₂ , . . . , status _n ) in the current status sequence status_sequence _now = (S′, pos_sequence _now ) to the cache state

, where the initial value of n3 is 0, after adding

中的所有规则，若满足n4＞n-n3 and i≠e，则进入步骤26；若满足n4＞n-n3 and i＝e，则表示匹配失败，遍历结束；若满足n4＜n-n3，则进入步骤23；否则，进入步骤24；Step 22, traverse the security state sequence set sequentially

all the rules in If n4>n-n3 and i≠e are satisfied, go to step 26; if n4>n-n3 and i=e are satisfied, it means that the matching fails, and the traversal ends; if n4<n-n3 is satisfied, then go to step 23; Otherwise, go to step 24;

的后n4项保留，则

并将n3置为n-n4，则

Step 23, will

The last n4 items are reserved, then

and set n3 to n-n4, then

是否与W_i相同，若不相同，则返回步骤22，继续遍历；否则，进入步骤25；Step 24, judge

Whether it is the same as _Wi , if not, return to step 22 and continue to traverse; otherwise, enter step 25;

同时将n3置为n-1，将init_status置为1，确定所述当前状态序列与所述安全状态序列集匹配成功，直接确定所述当前状态序列的威胁度为0；其中init_status的初始值为0，用于标识是否进行一次安全状态序列完全匹配；Step 25, will keep only the last item, then

At the same time, set n3 to n-1, set init_status to 1, determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; the initial value of init_status is 0, used to identify whether to perform a complete match of the security state sequence;

Step 26, if init_status is 0, go to step 27, otherwise go to step 28;

是否为W_i的子集，若是，则确定所述当前状态序列与所述安全状态序列集匹配成功，直接确定所述当前状态序列的威胁度为0；否则，继续遍历安全状态序列集中的其他规则，返回步骤22；Step 27, init_status is 0, judge

Whether it is a _subset of Wi, if yes, then determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; otherwise, continue to traverse other security state sequence sets rule, return to step 22;

是否与W_i的前n-n1项相同，若是，则确定所述当前状态序列与所述安全状态序列集匹配成功，直接确定所述当前状态序列的威胁度为0；否则，继续遍历安全状态序列集中的其他规则，返回步骤22。Step 28, judge

Whether it is the same as the first _n -n1 items of Wi, if yes, then determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; otherwise, continue to traverse the security state Other rules in the sequence set, return to step 22.

Preferably, wherein the power service packet attacks the identification unit, and is further used for:

If the threat degree of the current state sequence is less than the preset security risk threshold, it is determined that the power grid is not attacked by the power service message.

The present invention provides a method and system for identifying an attack on a power service message based on business logic, including: determining a current state sequence of a power grid; determine the threat degree of the current state sequence according to the current state sequence, the dangerous state sequence set and the security state sequence set; and when the threat degree of the current state sequence is greater than or equal to the predetermined When the set security risk threshold is exceeded, it is determined that the power grid has been attacked by power service packets. By defining the dangerous state sequence set and the safety state sequence set of the power business logic, the invention combines the misuse detection and the abnormal detection method, evaluates the threat degree of the power business, and determines whether the power grid suffers from the power business report according to the threat degree. It realizes the effective identification of power service packet attacks, reduces the false alarm rate, and ensures the safe and reliable operation of the power industrial control system.

Description of drawings

Exemplary embodiments of the present invention may be more fully understood by reference to the following drawings:

1 is a flowchart of a method 100 for identifying an attack on a power service packet based on a service logic according to an embodiment of the present invention:

Fig. 2 is a state chain data structure diagram according to an embodiment of the present invention;

FIG. 3 is a data structure diagram of a dangerous state sequence and a safe state sequence according to an embodiment of the present invention; and

FIG. 4 is a schematic structural diagram of a system 400 for identifying attacks on power service packets based on service logic according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present invention will now be described with reference to the accompanying drawings, however, the present invention may be embodied in many different forms and is not limited to the embodiments described herein, which are provided for the purpose of this thorough and complete disclosure invention, and fully convey the scope of the invention to those skilled in the art. The terms used in the exemplary embodiments shown in the drawings are not intended to limit the invention. In the drawings, the same elements/elements are given the same reference numerals.

Unless otherwise defined, terms (including scientific and technical terms) used herein have the commonly understood meanings to those skilled in the art. In addition, it is to be understood that terms defined in commonly used dictionaries should be construed as having meanings consistent with the context in the related art, and should not be construed as idealized or overly formal meanings.

FIG. 1 is a flowchart of a method 100 for identifying an attack on a power service packet based on a service logic according to an embodiment of the present invention. The business logic-based power service packet attack identification method provided by the embodiment of the present invention combines the misuse detection and anomaly detection methods by defining the dangerous state sequence set and the safe state sequence set of the power service logic. The threat degree is evaluated, and whether the power grid is attacked by power service packets is determined according to the threat degree, which realizes the effective identification of power service packet attacks, reduces the false alarm rate, and ensures the safe and reliable operation of the power industrial control system. The method 100 for identifying an attack on a power service message based on business logic provided by the embodiment of the present invention starts from step 101, and in step 101, a multipoint signal value sequence and a multipoint signal address of a node in a current state are obtained from the power service message. sequence, determining the control block corresponding to the current state node according to the multipoint signal address sequence, and adding the multipoint signal value sequence to the state sequence of the control block to obtain the current state sequence.

In the embodiment of the present invention, in order to evaluate the security of the current business logic state, the business logic needs to be saved. Therefore, it is proposed to use the data structure of the state chain to describe the power grid business logic, including the business state and its change process. The state chain data structure of the embodiment of the present invention is shown in FIG. 2 and includes the following seven parts.

(1) Single-point signal value: the data field in FIG. 2 is used to describe the value of a single FCDA (Functionally constrained Data Attribute) item. In the power grid, it can be understood as the knife switch signal or the voltage or current value of a node in the power grid.

(2) Signal address: the pos field in Figure 2 is used to describe the location of an FCDA item; it can be understood as the logical instance name of a switch or node in the power grid; in actual calculation, it can be understood as the name of a variable, to index the variable.

(3) Multi-point signal address sequence: the _{pos_sequence} =(pos ₁ , pos ₂ , ^. Signal address sequence.

(4) Multi-point signal value sequence: the status=(data ₁ , data ₂ , . . . , data _n ) ^T field in FIG. 2 is used to describe each single-point signal value sequence on a control block in the present invention. In the power grid, it can be understood as the position of multiple switches or the voltage and current values at multiple points.

(5) Status node: defined as Node=(status, pos_sequence). It consists of a multi-point signal address sequence and a multi-point signal value sequence, and is used to describe the state of a control block.

(6) State change: used to describe the change of single or multiple single-point signals in the state of a control block. In the power grid, it can be understood as one switch or multiple switch switches, one or more voltage and current changes, and one or more setting changes.

(7) Define status_sequence=(status_value, _{pos_sequence} ) as a status sequence, where status_value=(status ₁ , status ₂ , . The logical process of change. In the power grid, it can be understood as the operation logic relationship of a group of switches, and the logic relationship of a group of voltage and current changes.

In the embodiment of the present invention, in order to identify whether the current power grid is attacked by power service packets, it is first necessary to input the current service logic. Under the premise of the data structure based on the above state chain, the specific input process is as follows:

1.1) Extract a status node Node _now = (status _n , pos_sequence _now ) from the application layer content of the power service message, where status _n = (data ₁ , data ₂ , . . . , data _k ) ^T .

1.2) Find the corresponding control block status sequence status_sequence=(S, pos_sequence) according to pos_sequence _now in the status node Node _now , then the status sequence satisfying the condition of pos_sequence=pos_sequence _now , where S=(status ₁ , status ₂ , ..., status _{n -1} ).

1.3) Compare whether status _n-1 is equal to status _n , if they are equal, the process ends; otherwise, go to 1.4).

1.4) Chain status _n into the status sequence status_sequence=(S, pos_sequence) to obtain the current status sequence status_sequence _now =(S′, pos_sequence _now ), where S′=(status ₁ , status ₂ , . . . , status _n ).

In step 102, a dangerous state sequence set and a safe state sequence set corresponding to the current state sequence are respectively determined according to the multi-point signal address sequence of the current state sequence.

为所有满足pos_sequence＝pos_sequence₁条件的不合法状态序列集合。危险状态序列集定义为

其中，

为所有满足pos_sequence＝pos_sequence₁条件的合法状态序列集合。In the embodiment of the present invention, in order to evaluate the security of the current business logic state, it is necessary to compare the current business logic state with a known sequence of dangerous states or a sequence of safe states, and by comparing the current state sequence with the sequence of dangerous states and the safety state By comparing the status sequence, the attack of power service packets can be quickly and effectively identified. The data structures in the dangerous state sequence and the safe state sequence of the embodiment of the present invention are shown in FIG. 3 . Different rules represented by the structure of the state sequence are entered in the dangerous state sequence set and the safe state sequence set. The dangerous state sequence set is defined as in,

It is the set of all illegal state sequences that satisfy the condition of pos_sequence=pos_sequence ₁ . The dangerous state sequence set is defined as

in,

is the set of all legal state sequences that satisfy the condition of pos_sequence=pos_sequence ₁ .

In step 103, the threat degree of the current state sequence is determined according to the current state sequence, the dangerous state sequence set and the safe state sequence set.

Preferably, the threat degree of the current state sequence is determined according to the current state sequence, the dangerous state sequence set and the safe state sequence set, including:

Matching the current state sequence with the dangerous state sequence set, and if the current state sequence and the dangerous state sequence set are successfully matched, determine that the threat degree of the current state sequence is 1;

If the current state sequence is unsuccessfully matched with the dangerous state sequence set, the current state sequence is matched with the safe state sequence set, and if the current state sequence is successfully matched with the safe state sequence set, Then it is determined that the threat degree of the current state sequence is 0.

Preferably, the threat degree of the current state sequence is determined according to the current state sequence, the dangerous state sequence set and the safe state sequence set, including:

respectively calculating the first minimum distance between the current state sequence and the dangerous state sequence set, and the second minimum distance between the current state sequence and the safe state sequence set;

The threat degree of the current state sequence is calculated according to the first minimum distance and the second minimum distance.

Preferably, wherein the calculating the first minimum distance between the current state sequence and the set of dangerous state sequences includes:

对于

如果

则

否则

column_s′表示矩阵S′的列数，B_i(status_value)表示B_i状态序列中status_value值，B_i(status_value)[0，…，column_S′-1]表示B_i(status_value)矩阵的第0列到column_S′-1列；

表示

矩阵的第i列，函数d(A，B)表示求行向量A＝(x₁，x₂，…，x_n)与B＝(y₁，y₂，…，y_n)的欧几里得距离，则 Among them, d _black is the first minimum distance; the current state sequence is status_sequence _now = (S'pos_sequence _now ), S'=(status ₁ , status ₂ , ..., status _n ); the dangerous state sequence set is

for

if

but

otherwise

column _s' represents the number of columns of the matrix S', B _i (status_value) represents the status_value value in the B _i state sequence, B _i (status_value)[0,...,column _S' -1] represents the first row of the B _i (status_value) matrix Column 0 to column _S' -1 column;

express

In the i-th column of the matrix, the function d(A, B) represents the Euclidean calculation of the row vector A=(x ₁ , x ₂ ,..., x _n ) and B=(y ₁ , y ₂ ,..., y _n ) distance, then

Preferably, the calculating the second minimum distance between the current state sequence and the security state sequence set includes:

如果

则

否则

column_s′表示矩阵S′的列数，W_i(status_value)表示W_i状态序列中status_value值，则W_i(status_value)[0，…，column_S′-1]表示W_i(status_value)矩阵的第0列到column_S′-1列；表示

矩阵的第i列，函数d(A，B)表示求行向量A＝(x₁，x₂，…，x_n)与B＝(y₁，y₂，…，y_n)的欧几里得距离，则

Among them, d _white is the second minimum distance; the current state sequence is status_sequence _now =(S'pos_sequence _now ), S'=(status ₁ , status ₂ , . . . , status _n ); the security state sequence set for

if

but

otherwise

column _s' represents the number of columns of the matrix S', Wi ( _{status_value} ) represents the _{status_value} value in the Wi state sequence, then Wi ( _{status_value} )[0,...,column _S' -1] represents the value of the Wi ( _{status_value} ) matrix Column 0 to column _S' -1 column; express

In the i-th column of the matrix, the function d(A, B) represents the Euclidean calculation of the row vector A=(x ₁ , x ₂ ,..., x _n ) and B=(y ₁ , y ₂ ,..., y _n ) distance, then

Preferably, calculating the threat degree of the current state sequence according to the first minimum distance and the second minimum distance includes:

Among them, P _threaten is the threat degree of the current state sequence; d _black is the first minimum distance; d _white is the second minimum distance.

Preferably, wherein the matching of the current state sequence with the set of dangerous state sequences includes:

中，其中，n1的初始值为0，添加后

Step 11 _{: Add the latest multi-point signal value sequence status n of S ′} =(status ₁ , status ₂ , .

, where the initial value of n1 is 0, after adding

中的所有规则，若满足n2＞n-n1and i≠t，则继续遍历；若满足n2＞n-n1 and i＝t，则表示匹配结束，遍历结束，继续执行安全状态序列集匹配模式；若满足n2＜n-n1，则进入步骤13；否则，进入步骤14；Step 12, traverse the dangerous state sequence set sequentially

all the rules in If n2>n-n1and i≠t, continue to traverse; if n2>n-n1 and i=t, it means the matching is over, the traversal is over, and continue to execute the security state sequence set matching mode; if n2<n- n1, then go to step 13; otherwise, go to step 14;

的后n2项保留，则

并将n1置为n-n2，则

Step 13, will

The last n2 items are reserved, then

and set n1 to n-n2, then

是否与Bi相同；其中，若相同，则将

只保留最后一项，则同时将n1置为n-1，并确定所述当前状态序列与所述危险状态序列集匹配成功，直接确定所述当前状态序列的威胁度为1；否则，返回步骤12继续遍历。Step 14, judge

Is it the same as Bi; where, if it is the same, then

keep only the last item, then At the same time, n1 is set to n-1, and it is determined that the current state sequence is successfully matched with the dangerous state sequence set, and the threat degree of the current state sequence is directly determined to be 1; otherwise, return to step 12 to continue traversing.

Preferably, the matching of the current state sequence with the security state sequence set includes:

中，其中，n3的初始值为0，添加后

Step 21: Add the latest multipoint signal value sequence status _n of S′=(status ₁ , status ₂ , . . . , status _n ) in the current status sequence status_sequence _now = (S′, pos_sequence _now ) to the cache state

, where the initial value of n3 is 0, after adding

中的所有规则，

若满足n4＞n-n3 and i≠e，则进入步骤26；若满足n4＞n-n3 and i＝e，则表示匹配失败，遍历结束；若满足n4＜n-n3，则进入步骤23；否则，进入步骤24；Step 22, traverse the security state sequence set sequentially

all the rules in

If n4>n-n3 and i≠e are satisfied, go to step 26; if n4>n-n3 and i=e are satisfied, it means that the matching fails, and the traversal ends; if n4<n-n3 is satisfied, then go to step 23; Otherwise, go to step 24;

并将n3置为n-n4，则

Step 23, will The last n4 items are reserved, then

and set n3 to n-n4, then

Step 24, judge Whether it is the same as _Wi , if not, return to step 22 and continue to traverse; otherwise, enter step 25;

只保留最后一项，则

同时将n3置为n-1，将init_status置为1，确定所述当前状态序列与所述安全状态序列集匹配成功，直接确定所述当前状态序列的威胁度为0；其中init_status的初始值为0，用于标识是否进行一次安全状态序列完全匹配；Step 25, will

keep only the last item, then

At the same time, set n3 to n-1, set init_status to 1, determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; the initial value of init_status is 0, used to identify whether to perform a complete match of the security state sequence;

Step 26, if init_status is 0, go to step 27, otherwise go to step 28;

Step 27, init_status is 0, judge Whether it is a _subset of Wi, if yes, then determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; otherwise, continue to traverse other security state sequence sets rule, return to step 22;

是否与W_i的前n-n1项相同，若是，则确定所述当前状态序列与所述安全状态序列集匹配成功，直接确定所述当前状态序列的威胁度为0；否则，继续遍历安全状态序列集中的其他规则，返回步骤22。Step 28, judge

Whether it is the same as the first _n -n1 items of Wi, if yes, then determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; otherwise, continue to traverse the security state Other rules in the sequence set, return to step 22.

In an embodiment of the present invention, after the dangerous safety state sequence set and the safety state sequence set are determined, the step of determining the threat degree includes:

S1, carry out the matching of the dangerous state sequence set, if the matching is successful, the threat degree of the current state sequence is determined to be 1; otherwise, enter S2:

S2, match the security state sequence set, if the match is successful, determine that the threat degree of the current state sequence is 0; otherwise, enter S3:

S3: Determine the first minimum distance and the second minimum distance, and determine the threat degree of the safety state sequence according to the first minimum distance and the second minimum distance.

In step 104, the threat degree of the current state sequence is compared with a preset security risk threshold, and when the threat degree of the current state sequence is greater than or equal to the preset security risk threshold, it is determined that the power grid has suffered from a power service report. text attack.

Preferably, wherein the method further comprises:

If the threat degree of the current state sequence is less than the preset security risk threshold, it is determined that the power grid is not attacked by the power service message.

In the embodiment of the present invention, it is determined whether the current power grid is under attack based on the threat degree P _threaten of the current state sequence. In order to reduce the false alarm rate of the present invention, a safety risk threshold X _safe is defined, where X _safe is set to 0.25 by default. The value of the safety risk threshold X _safe can be set according to actual needs, and is not limited to 0.25 mentioned in this application. When P _threaten >X _safe , it is considered that the power grid corresponding to the value of pos_sequence _now in the current state sequence status_sequence _now = (S', pos_sequence _now ) has suffered an attack by a power service packet; otherwise, it is considered that the power grid is not subject to a power service packet attack , in a safe state.

The following specific examples illustrate the embodiments of the present invention

Assuming that the state block attacked by the attacker has three FCDAs, the address information of each FCDA is as follows:

pos ₁ = "(APPID=0x0001)-(dataset=DeviceF001/LLN0$GOOSE1)-(alldata.1)",

pos ₂ = "(APPID=0x0001)-(dataset=DeviceF001/LLN0$GOOSE1)-(alldata.2)",

pos ₃ = "(APPID=0x0001)-(dataset=DeviceF001/LLN0$GOOSE1)-(alldata.3)",

The corresponding control block states are: status ₁ =(0, 0, 0) ^T , status ₂ =(0, 0, 1) ^T , . . . , status ₈ =(1, 1, 1) ^T . The security risk threshold X _safe of the intrusion detection method is set to 0.25.

When it is determined that the power grid is attacked by power service packets, the specific implementation is as follows:

Step (1), state chain entry: assume that the entered state sequence is status_sequence ₁ =(S ₁ , pos_sequence), where S ₁ =(status ₁ , status ₂ ), pos_sequence=(pos ₁ , pos ₂ , pos ₃ ) ^T , now extract a status node Node _now = (status ₅ , pos_sequence) from the application layer message, add the extracted status node to the entered status sequence, then the status sequence changes from status_sequence ₁ to status_sequence ₂ =(S ₂ , pos_sequence), where S ₂ =(status ₁ , status ₂ , status ₅ ).

Step (2), determine the dangerous state sequence set U _{blacklist/pos_sequence} ={B ₁ } of the current state sequence, where B ₁ ={status ₁ , status ₃ , status ₇ } and the safe state sequence set U _{whitelist/pos_sequence} ={W ₁ , W ₂ }.

In step (3), the current state sequence is matched with the dangerous state sequence set. If it matches, the threat degree is determined to be 1; Specific steps are as follows:

3.1 _{) Add the latest status status 5 in} S2 in status_sequence ₂ to the cached status S″ _{blacklist/pos_sequence} = (status ₁ , status ₂ ), after adding S″ _{blacklist/pos_sequence} = (status ₁ , status ₂ , status ₅ ) .

3.2) Sequentially traverse the rules with the same pos_sequence in the dangerous state sequence set, then traverse U _{blacklist/pos_sequence} = {B ₁ }, where B ₁ has 3 states, S″ _{blacklist/pos_sequence} has 3 states, go to 3.3).

3.3) Compare B ₁ with S ₂ , and find that they do not match, continue to traverse, and go to 3.4).

3.4) U _{blacklist/pos_sequence} traversal ends, go to step (4).

In step (4), the current state sequence is subjected to the sequence matching mode of the critical and safe state, and if it matches, the threat degree is determined to be 0; if it does not match, it goes to step (5). The specific process is as follows:

4.1) Add the latest status status ₅ in S ₂ in the current status sequence status_sequence ₂ to the cache status S″ _{whitelist/pos_sequence} = (status ₁ , status ₂ ), and the cache status sequence after adding is S″ _{whitelist/pos_sequence} = (status ₁ , status ₂ , status ₅ ).

具有3种状态，转4.3)。4.2) Traverse the rules with the same pos_sequence in the dangerous state sequence set, then U _{whitelist/pos_sequence} = {W ₁ , W ₂ }, first traverse W ₁ ={status ₁ , status ₂ , status ₈ }, where W ₁ has 3 states ,

With 3 states, go to 4.3).

4.3) S" _{whitelist/pos_sequence} and W ₁ perform rule comparison, S" _{whitelist/pos_sequence} does not match with W ₁ , and continue to traverse.

4.4) Traverse W ₂ , where W ₂ = {status ₁ , status ₂ , status ₄ , status ₅ } has 4 states, S″ _{whitelist/pos_sequence} = (status ₁ , status ₂ , status ₅ ) has 3 states, turn 4.5).

4.5) If init_status is 0 (assuming 0), go to 4.6).

4.6) S" _{whitelist/pos_sequence} is compared with W ₂ for rules, W ₂ is not a subset of S" _{whitelist/pos_sequence} , the traversal is over, and go to step (5).

In step (5), similarity matching is performed on the state sequence to obtain the threat degree P _threaten . Specific steps are as follows:

5.1) Find the dangerous state sequence set U _{blacklist/pos_seauence} ={B ₁ } and the safe state sequence set U _{whitelist/pos_sequence} ={W ₁ , W ₂ } of the corresponding control block according to pos_sequence.

则

5.2) For B ₁ ∈ U _{blacklist/pos_sequence} , where

but

5.3) Calculate the minimum distance between the current state sequence status_sequence ₂ and the dangerous state sequence set U _{blacklist/pos_sequence} as d _black =1.

则对于W₂∈U_{whitelist/pos_sequence}，其中则

5.4) For W ₁ ∈ U _{whitelist/pos_sequence} , where

but For W ₂ ∈ U _{whitelist/pos_sequence} , where but

5.5) Calculate the minimum distance between the current state sequence status_sequence and the safe state sequence set U _{whitelist/pos_sequence} as d _white =2.

转步骤(6)。5.6) Calculate the threat level

Go to step (6).

In step (6), the calculated threat degree is compared with the preset security risk threshold, and if P _threaten > X _safe , it is determined that the power grid corresponding to the pos_sequence value in the current state sequence status_sequence is under attack by the power service message.

FIG. 4 is a schematic structural diagram of a system 400 for identifying attacks on power service packets based on service logic according to an embodiment of the present invention. As shown in FIG. 4 , the system 400 for identifying a power service message attack based on business logic provided by an embodiment of the present invention includes: a current state sequence determination unit 401 , a dangerous state sequence set and a safety state sequence set determination unit 402 , a threat level The determination unit 403 and the power service packet attack identification unit 404 are determined.

Preferably, the current state sequence determination unit 401 is configured to obtain a multipoint signal value sequence and a multipoint signal address sequence of a node in a current state from an electric power service message, and determine, according to the multipoint signal address sequence, which is the same as the multipoint signal address sequence. The control block corresponding to the current state node, and the multi-point signal value sequence is added to the state sequence of the control block to obtain the current state sequence.

Preferably, the dangerous state sequence set and the safe state sequence set determining unit 402 is configured to respectively determine the dangerous state sequence set and the safe state sequence corresponding to the current state sequence according to the multipoint signal address sequence of the current state sequence set.

Preferably, the threat degree determination unit 403 is configured to determine the threat degree of the current state sequence according to the current state sequence, the dangerous state sequence set and the safety state sequence set.

Preferably, the threat determination unit 403 includes: a dangerous state sequence set matching module and a safety state sequence set matching module.

The dangerous state sequence set matching module is used to match the current state sequence with the dangerous state sequence set, and if the current state sequence and the dangerous state sequence set are successfully matched, determine the current state sequence The threat level is 1.

The safety state sequence set matching module is configured to match the current state sequence with the safety state sequence set if the current state sequence is unsuccessfully matched with the dangerous state sequence set, and if the current state sequence is unsuccessful If the sequence matches the security state sequence set successfully, it is determined that the threat degree of the current state sequence is 0.

Preferably, the dangerous state sequence set matching module matches the current state sequence with the dangerous state sequence set, including:

中，其中，n1的初始值为0，添加后

Step 11 _{: Add the latest multi-point signal value sequence status n of S ′} =(status ₁ , status ₂ , .

, where the initial value of n1 is 0, after adding

中的所有规则，

若满足n2＞n-n1and i≠t，则继续遍历；若满足n2＞n-n1 and i＝t，则表示匹配结束，遍历结束，继续执行安全状态序列集匹配模式；若满足n2＜n-n1，则进入步骤13；否则，进入步骤14；Step 12, traverse the dangerous state sequence set sequentially

all the rules in

If n2>n-n1and i≠t, continue to traverse; if n2>n-n1 and i=t, it means the matching is over, the traversal is over, and continue to execute the security state sequence set matching mode; if n2<n- n1, then go to step 13; otherwise, go to step 14;

的后n2项保留，则

并将n1置为n-n2，则

Step 13, will

The last n2 items are reserved, then

and set n1 to n-n2, then

是否与Bi相同；其中，若相同，则将

只保留最后一项，则同时将n1置为n-1，并确定所述当前状态序列与所述危险状态序列集匹配成功，直接确定所述当前状态序列的威胁度为1；否则，返回步骤12继续遍历。Step 14, judge

Is it the same as Bi; where, if it is the same, then

keep only the last item, then At the same time, n1 is set to n-1, and it is determined that the current state sequence is successfully matched with the dangerous state sequence set, and the threat degree of the current state sequence is directly determined to be 1; otherwise, return to step 12 to continue traversing.

Preferably, wherein the security state sequence set matching module matches the current state sequence with the security state sequence set, including:

中，其中，n3的初始值为0，添加后 Step 21: Add the latest multipoint signal value sequence status _n of S′=(status ₁ , status ₂ , . . . , status _n ) in the current status sequence status_sequence _now = (S′, pos_sequence _now ) to the cache state

, where the initial value of n3 is 0, after adding

中的所有规则，若满足n4＞n-n3 and i≠e，则进入步骤26；若满足n4＞n-n3 and i＝e，则表示匹配失败，遍历结束；若满足n4＜n-n3，则进入步骤23；否则，进入步骤24；Step 22, traverse the security state sequence set sequentially

all the rules in If n4>n-n3 and i≠e are satisfied, go to step 26; if n4>n-n3 and i=e are satisfied, it means that the matching fails, and the traversal ends; if n4<n-n3 is satisfied, then go to step 23; Otherwise, go to step 24;

的后n4项保留，则

并将n3置为n-n4，则

Step 23, will

The last n4 items are reserved, then

and set n3 to n-n4, then

是否与W_i相同，若不相同，则返回步骤22，继续遍历；否则，进入步骤25；Step 24, judge

Whether it is the same as _Wi , if not, return to step 22 and continue to traverse; otherwise, enter step 25;

同时将n3置为n-1，将init_status置为1，确定所述当前状态序列与所述安全状态序列集匹配成功，直接确定所述当前状态序列的威胁度为0；其中init_status的初始值为0，用于标识是否进行一次安全状态序列完全匹配；Step 25, will keep only the last item, then

At the same time, set n3 to n-1, set init_status to 1, determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; the initial value of init_status is 0, used to identify whether to perform a complete match of the security state sequence;

Step 26, if init_status is 0, go to step 27, otherwise go to step 28;

是否为W_i的子集，若是，则确定所述当前状态序列与所述安全状态序列集匹配成功，直接确定所述当前状态序列的威胁度为0；否则，继续遍历安全状态序列集中的其他规则，返回步骤22；Step 27, init_status is 0, judge

Whether it is a _subset of Wi, if yes, then determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; otherwise, continue to traverse other security state sequence sets rule, return to step 22;

是否与W_i的前n-n1项相同，若是，则确定所述当前状态序列与所述安全状态序列集匹配成功，直接确定所述当前状态序列的威胁度为0；否则，继续遍历安全状态序列集中的其他规则，返回步骤22。Step 28, judge

Whether it is the same as the first _n -n1 items of Wi, if yes, then determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; otherwise, continue to traverse the security state Other rules in the sequence set, return to step 22.

Preferably, the threat degree determination unit 403 further includes: a first minimum distance and a second minimum distance determination module and a threat degree determination module.

The first minimum distance and the second minimum distance determination module are used to respectively calculate the first minimum distance between the current state sequence and the dangerous state sequence set, and the difference between the current state sequence and the safe state sequence set. Second minimum distance.

The threat degree determination module is configured to calculate the threat degree of the current state sequence according to the first minimum distance and the second minimum distance.

Preferably, the first minimum distance and the second minimum distance determination module calculate the first minimum distance between the current state sequence and the set of dangerous state sequences in the following manner, including:

对于

如果

则

否则

column_s′表示矩阵S′的列数，Bi(status_value)表示B_i状态序列中status_value值，B_i(status_value)[0，…，column_s′-1]表示B_i(status_value)矩阵的第0列到column_s′-1列；

表示

矩阵的第i列，函数d(A，B)表示求行向量A＝(x₁，x₂，…，x_n)与B＝(y₁，y₂，…，y_n)的欧几里得距离，则

Among them, d _black is the first minimum distance; the current state sequence is status_sequence _now = (S'pos_sequence _now ), S'=(status ₁ , status ₂ , ..., status _n ); the dangerous state sequence set is

for

if

but

otherwise

column _s' represents the number of columns of the matrix S', Bi(status_value) represents the _{status_value} value in the Bi state sequence, Bi ( _{status_value} )[0,...,column _s' -1] represents the 0th of the Bi ( _{status_value} ) matrix column to column _s' -1 column;

express

In the i-th column of the matrix, the function d(A, B) represents the Euclidean calculation of the row vector A=(x ₁ , x ₂ ,..., x _n ) and B=(y ₁ , y ₂ ,..., y _n ) distance, then

Preferably, wherein the first minimum distance and the second minimum distance determination module calculate the second minimum distance between the current state sequence and the safety state sequence set in the following manner, including:

对于

如果

则

否则

column_S′表示矩阵S′的列数，W_i(status_value)表示W_i状态序列中status_value值，则W_i(status_value)[0，…，column_s′-1]表示W_i(status_value)矩阵的第0列到column_s′-1列；

表示

矩阵的第i列，函数d(A，B)表示求行向量A＝(x₁，x₂，…，x_n)与B＝(y₁，y₂，…，y_n)的欧几里得距离，则

Among them, d _white is the second minimum distance. The current state sequence is status_sequence _now = (S', pos_sequence _now ), S' = (status ₁ , status ₂ , ..., status _n );; security state sequence set

for

if

but

otherwise

column _S' represents the number of columns of the matrix S', Wi ( _{status_value} ) represents the _{status_value} value in the Wi state sequence, then Wi ( _{status_value} )[0,...,column _s' -1] represents the value of the Wi ( _{status_value} ) matrix Column 0 to column _s' -1 column;

express

In the i-th column of the matrix, the function d(A, B) represents the Euclidean calculation of the row vector A=(x ₁ , x ₂ ,..., x _n ) and B=(y ₁ , y ₂ ,..., y _n ) distance, then

Preferably, wherein the threat degree determination module calculates the threat degree of the current state sequence according to the first minimum distance and the second minimum distance, including:

Among them, P _threaten is the threat degree of the current state sequence; d _black is the first minimum distance; d _white is the second minimum distance.

Preferably, the power service packet attack identification unit 404 is configured to compare the threat degree of the current state sequence with a preset security risk threshold, and when the threat degree of the current state sequence is greater than or equal to a preset When the security risk threshold is reached, it is determined that the power grid has been attacked by power service packets.

Preferably, the power service packet attack identification unit 404 is further configured to: if the threat degree of the current state sequence is less than a preset security risk threshold, determine that the power grid is not attacked by the power service packet.

The service logic-based power service packet attack identification system 400 of the embodiment of the present invention corresponds to the business logic-based power service packet attack identification method 100 of another embodiment of the present invention, and details are not described herein again.

The present invention has been described with reference to a few embodiments. However, as is known to those skilled in the art, other embodiments than the above disclosed invention are equally within the scope of the invention, as defined by the appended patent claims.

Generally, all terms used in the claims are to be interpreted according to their ordinary meaning in the technical field, unless explicitly defined otherwise herein. All references to "a/the/the [means, component, etc.]" are open to interpretation as at least one instance of said means, component, etc., unless expressly stated otherwise. The steps of any method disclosed herein do not have to be performed in the exact order disclosed, unless explicitly stated.

As will be appreciated by those skilled in the art, the embodiments of the present application may be provided as a method, a system, or a computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block in the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce Means for implementing the functions specified in a flow or flow of a flowchart and/or a block or blocks of a block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory result in an article of manufacture comprising instruction means, the instructions The apparatus implements the functions specified in the flow or flow of the flowcharts and/or the block or blocks of the block diagrams.

These computer program instructions can also be loaded on a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process such that The instructions provide steps for implementing the functions specified in the flow or blocks of the flowcharts and/or the block or blocks of the block diagrams.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit them. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: the present invention can still be Modifications or equivalent replacements are made to the specific embodiments of the present invention, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention shall be included within the protection scope of the claims of the present invention.

Claims (14)

1. a power service message attack identification method based on business logic, is characterized in that, described method comprises: Obtain a multipoint signal value sequence and a multipoint signal address sequence of a current state node from a power service message, determine a control block corresponding to the current state node according to the multipoint signal address sequence, and assign the multipoint signal address sequence to the multipoint signal address sequence. The signal value sequence is added to the state sequence of the control block to obtain the current state sequence; Determine the dangerous state sequence set and the safe state sequence set corresponding to the current state sequence respectively according to the multi-point signal address sequence of the current state sequence; Determine the threat degree of the current state sequence according to the current state sequence, the dangerous state sequence set and the safe state sequence set; The threat degree of the current state sequence is compared with a preset security risk threshold, and when the threat degree of the current state sequence is greater than or equal to the preset security risk threshold, it is determined that the power grid has suffered a power service message attack. 2. The method according to claim 1, wherein determining the threat degree of the current state sequence according to the current state sequence, the dangerous state sequence set and the safety state sequence set, comprising: Matching the current state sequence with the dangerous state sequence set, and if the current state sequence and the dangerous state sequence set are successfully matched, determine that the threat degree of the current state sequence is 1; If the current state sequence is unsuccessfully matched with the dangerous state sequence set, the current state sequence is matched with the safe state sequence set, and if the current state sequence is successfully matched with the safe state sequence set, Then it is determined that the threat degree of the current state sequence is 0. 3. The method according to claim 1 or 2, wherein determining the threat degree of the current state sequence according to the current state sequence, the dangerous state sequence set and the safe state sequence set, comprising: respectively calculating the first minimum distance between the current state sequence and the dangerous state sequence set, and the second minimum distance between the current state sequence and the safe state sequence set; The threat degree of the current state sequence is calculated according to the first minimum distance and the second minimum distance. 4. The method according to claim 3, wherein calculating the threat degree of the current state sequence according to the first minimum distance and the second minimum distance, comprising: Among them, P _threaten is the threat degree of the current state sequence; d _black is the first minimum distance; d _white is the second minimum distance. 5. The method according to claim 2, wherein matching the current state sequence with the set of dangerous state sequences comprises: Step 11 _{: Add the latest multi-point signal value sequence status n of S ′} =(status ₁ , status ₂ , .

, where the initial value of n1 is 0, after adding

Step 12, traverse the dangerous state sequence set sequentially

all the rules in If n2>n-n1 andi≠t, continue to traverse; if n2>n-n1 and i=t are satisfied, it means the matching is over, the traversal is over, and continue to execute the security state sequence set matching mode; if n2<n- n1, then go to step 13; otherwise, go to step 14; Step 13, will

The last n2 items are reserved, then

and set n1 to n-n2, then

Step 14, judge

Is it the same as B _i ; where, if it is the same, then

keep only the last item, then

At the same time, n1 is set to n-1, and it is determined that the current state sequence is successfully matched with the dangerous state sequence set, and the threat degree of the current state sequence is directly determined to be 1; otherwise, return to step 12 to continue traversing. 6. The method according to claim 2, wherein the matching the current state sequence with the security state sequence set comprises: Step 21: Add the latest multi _{-point signal value sequence status n of} S′=( _status1 , _status2 , .

, where the initial value of n3 is 0, after adding

Step 22, traverse the security state sequence set sequentially

all the rules in

If n4>n-n3 and i≠e are satisfied, go to step 26; if n4>n-n3 and i=e are satisfied, it means that the matching fails, and the traversal ends; if n4<n-n3 is satisfied, then go to step 23; Otherwise, go to step 24; Step 23, will The last n4 items are reserved, then

and set n3 to n-n4, then

Step 24, judge

Whether it is the same as _Wi , if not, return to step 22 and continue to traverse; otherwise, enter step 25; Step 25, will

keep only the last item, then

At the same time, set n3 to n-1, set init_status to 1, determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; the initial value of init_status is 0, used to identify whether to perform a complete match of the security state sequence; Step 26, if init_status is 0, go to step 27, otherwise go to step 28; Step 27, init_status is 0, judge

Whether it is a _subset of Wi, if yes, then determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; otherwise, continue to traverse other security state sequence sets rule, return to step 22; Step 28, judge

Whether it is the same as the first _n -n1 items of Wi, if yes, then determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; otherwise, continue to traverse the security state Other rules in the sequence set, return to step 22. 7. The method of claim 1, wherein the method further comprises: If the threat degree of the current state sequence is less than the preset security risk threshold, it is determined that the power grid is not attacked by the power service message. 8. A power service message attack identification system based on business logic, wherein the system comprises: The current state sequence determination unit is configured to obtain a multipoint signal value sequence and a multipoint signal address sequence of a current state node from a power service message, and determine the control corresponding to the current state node according to the multipoint signal address sequence block, and add the multi-point signal value sequence to the state sequence of the control block to obtain the current state sequence; a dangerous state sequence set and a safe state sequence set determining unit, configured to respectively determine a dangerous state sequence set and a safe state sequence set corresponding to the current state sequence according to the multipoint signal address sequence of the current state sequence; a threat degree determination unit, configured to determine the threat degree of the current state sequence according to the current state sequence, the dangerous state sequence set and the safe state sequence set; A power service message attack identification unit, configured to compare the threat degree of the current state sequence with a preset security risk threshold, and determine when the threat degree of the current state sequence is greater than or equal to the preset security risk threshold The power grid was attacked by power service packets. 9. The system according to claim 8, wherein the threat degree determination unit determines the threat degree of the current state sequence according to the current state sequence, the dangerous state sequence set and the safety state sequence set, comprising: A dangerous state sequence set matching module, configured to match the current state sequence with the dangerous state sequence set, and if the current state sequence and the dangerous state sequence set are successfully matched, determine the threat of the current state sequence degree is 1; The safety state sequence set matching module is configured to match the current state sequence with the safety state sequence set if the current state sequence is unsuccessful in matching with the dangerous state sequence set, and if the current state sequence matches the safety state sequence set If the security state sequence set matches successfully, it is determined that the threat degree of the current state sequence is 0. 10. The system according to claim 8 or 9, wherein the threat degree determination unit determines the threat degree of the current state sequence according to the current state sequence, the dangerous state sequence set and the safe state sequence set, include: A first minimum distance and a second minimum distance determination module, configured to respectively calculate the first minimum distance between the current state sequence and the dangerous state sequence set, and the second minimum distance between the current state sequence and the safe state sequence set shortest distance; A threat level determination module, configured to calculate the threat level of the current state sequence according to the first minimum distance and the second minimum distance. 11. The system according to claim 10, wherein the threat degree determination module calculates the threat degree of the current state sequence according to the first minimum distance and the second minimum distance, comprising:

Among them, P _threaten is the threat degree of the current state sequence; d _black is the first minimum distance; d _white is the second minimum distance. 12 . The system according to claim 10 , wherein the dangerous state sequence set matching module matches the current state sequence with the dangerous state sequence set, comprising: 12 . Step 11 _{: Add the latest multi-point signal value sequence status n of S ′} =(status ₁ , status ₂ , .

, where the initial value of n1 is 0, after adding

Step 12, traverse the dangerous state sequence set sequentially

all the rules in

If n2>n-n1 andi≠t, continue to traverse; if n2>n-n1 and i=t are satisfied, it means the matching is over, the traversal is over, and continue to execute the security state sequence set matching mode; if n2<n- n1, then go to step 13; otherwise, go to step 14; Step 13, will The last n2 items are reserved, then

and set n1 to n-n2, then

Step 14, judge

Is it the same as B _i ; where, if it is the same, then

keep only the last item, then

At the same time, n1 is set to n-1, and it is determined that the current state sequence is successfully matched with the dangerous state sequence set, and the threat degree of the current state sequence is directly determined to be 1; otherwise, return to step 12 to continue traversing. 13. The system according to claim 10, wherein the security state sequence set matching module, which matches the current state sequence with the security state sequence set, comprises: Step 21: Add the latest multipoint signal value sequence status _n of S′=(status ₁ , status ₂ , . . . , status _n ) in the current status sequence status_sequence _now = (S′, pos_sequence _now ) to the cache state

, where the initial value of n3 is 0, after adding Step 22, traverse the security state sequence set sequentially all the rules in

If n4>n-n3 and i≠e are satisfied, go to step 26; if n4>n-n3 and i=e are satisfied, it means that the matching fails, and the traversal ends; if n4<n-n3 is satisfied, then go to step 23; Otherwise, go to step 24; Step 23, will

The last n4 items are reserved, then

and set n3 to n-n4, then

Step 24, judge

Whether it is the same as _Wi , if not, return to step 22 and continue to traverse; otherwise, enter step 25; Step 25, will

keep only the last item, then

At the same time, set n3 to n-1, set init_status to 1, determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; the initial value of init_status is 0, used to identify whether to perform a complete match of the security state sequence; Step 26, if init_status is 0, go to step 27, otherwise go to step 28; Step 27, init_status is 0, judge

Whether it is a _subset of Wi, if yes, then determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; otherwise, continue to traverse other security state sequence sets rule, return to step 22; Step 28, judge

Whether it is the same as the first _n -n1 items of Wi, if yes, then determine that the current state sequence is successfully matched with the security state sequence set, and directly determine that the threat degree of the current state sequence is 0; otherwise, continue to traverse the security state Other rules in the sequence set, return to step 22. 14. The system according to claim 8, wherein the power service message attacks the identification unit, further used for: If the threat degree of the current state sequence is less than the preset security risk threshold, it is determined that the power grid is not attacked by the power service message.

Images